Privacy Policy

Introduction and Overview

We have written this privacy policy (version 17.04.2025-122974758) in order to explain to you, in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (data for short) we as the controller – and the processors commissioned by us (e.g. providers) – process, will process in the future and what legal options you have. The terms used are to be considered gender-neutral.
In short: We provide you with comprehensive information about any of your personal data we process.

Privacy policies usually sound very technical and use legal terminology. However, this privacy policy is intended to describe the most important things to you as simply and transparently as possible. So long as it aids transparency, technical terms are explained in a reader-friendly manner, links to further information are provided and graphics are used. We are thus informing in clear and simple language that we only process personal data in the context of our business activities if there is a legal basis for it. This is certainly not possible with brief, unclear and legal-technical statements, as is often standard on the internet when it comes to data protection. I hope you find the following explanations interesting and informative. Maybe you will also find some information that you have not been familiar with.
If you still have questions, we kindly ask you to contact the responsible body named below or in the imprint, follow the existing links and look at further information on third-party sites. You can of course also find our contact details in the imprint.

Scope

This privacy policy applies to all personal data processed by our company and to all personal data processed by companies commissioned by us (processors). With the term personal data, we refer to information within the meaning of Article 4 No. 1 GDPR, such as the name, email address and postal address of a person. The processing of personal data ensures that we can offer and invoice our services and products, be it online or offline. The scope of this privacy policy includes:

• all online presences (websites, online shops) that we operate
• Social media presences and email communication
• mobile apps for smartphones and other devices

In short: This privacy policy applies to all areas in which personal data is processed in a structured manner by the company via the channels mentioned. Should we enter into legal relations with you outside of these channels, we will inform you separately if necessary.

Legal bases

In the following privacy policy, we provide you with transparent information on the legal principles and regulations, i.e. the legal bases of the General Data Protection Regulation, which enable us to process personal data.
Whenever EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016. You can of course access the General Data Protection Regulation of the EU online at EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679.

We only process your data if at least one of the following conditions applies:

1. Consent (Article 6 Paragraph 1 lit. a GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of data you entered into a contact form.
2. Contract (Article 6 Paragraph 1 lit. b GDPR): We process your data in order to fulfill a contract or pre-contractual obligations with you. For example, if we conclude a sales contract with you, we need personal information in advance.
3. Legal obligation (Article 6 Paragraph 1 lit. c GDPR): If we are subject to a legal obligation, we will process your data. For example, we are legally required to keep invoices for our bookkeeping. These usually contain personal data.
4. Legitimate interests (Article 6 Paragraph 1 lit. f GDPR): In the case of legitimate interests that do not restrict your basic rights, we reserve the right to process personal data. For example, we have to process certain data in order to be able to operate our website securely and economically. Therefore, the processing is a legitimate interest.

Other conditions such as making recordings in the interest of the public, the exercise of official authority as well as the protection of vital interests do not usually occur with us. Should such a legal basis be relevant, it will be disclosed in the appropriate place.

In addition to the EU regulation, national laws also apply:

• In Austria this is the Austrian Data Protection Act (Datenschutzgesetz), in short DSG.
• In Germany this is the Federal Data Protection Act (Bundesdatenschutzgesetz), in short BDSG.

Should other regional or national laws apply, we will inform you about them in the following sections.

Contact details of the data protection controller

If you have any questions about data protection or the processing of personal data, you will find below the contact details of the controller in accordance with Article 4(7) of the EU General Data Protection Regulation (GDPR):
Turn-Motion FlexCo
Marktgasse 8-10/EG/01, 1090 Wien,
Österreich

E-Mail: hello@turn-motion.com
Phone: +436763082875
Company details: https://turn-motion.com/impressum/

Storage Period

It is a general criterion for us to store personal data only for as long as is absolutely necessary for the provision of our services and products. This means that we delete personal data as soon as any reason for the data processing no longer exists. In some cases, we are legally obliged to keep certain data stored even after the original purpose no longer exists, such as for accounting purposes.

If you want your data to be deleted or if you want to revoke your consent to data processing, the data will be deleted as soon as possible, provided there is no obligation to continue its storage.

We will inform you below about the specific duration of the respective data processing, provided we have further information.

Rights in accordance with the General Data Protection Regulation

In accordance with Articles 13, 14 of the GDPR, we inform you about the following rights you have to ensure fair and transparent processing of data:

• According to Article 15 DSGVO, you have the right to information about whether we are processing data about you. If this is the case, you have the right to receive a copy of the data and to know the following information:
  • for what purpose we are processing;
  • the categories, i.e. the types of data that are processed;
  • who receives this data and if the data is transferred to third countries, how security can be guaranteed;
  • how long the data will be stored;
  • the existence of the right to rectification, erasure or restriction of processing and the right to object to processing;
  • that you can lodge a complaint with a supervisory authority (links to these authorities can be found below);
  • the origin of the data if we have not collected it from you;
  • Whether profiling is carried out, i.e. whether data is automatically evaluated to arrive at a personal profile of you.
• You have a right to rectification of data according to Article 16 GDPR, which means that we must correct data if you find errors.
• You have the right to erasure (“right to be forgotten”) according to Article 17 GDPR, which specifically means that you may request the deletion of your data.
• According to Article 18 of the GDPR, you have the right to restriction of processing, which means that we may only store the data but not use it further.
• According to Article 20 of the GDPR, you have the right to data portability, which means that we will provide you with your data in a standard format upon request.
• According to Article 21 DSGVO, you have the right to object, which entails a change in processing after enforcement.
  • If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you may object to the processing. We will then check as soon as possible whether we can legally comply with this objection.
  • If data is used to conduct direct advertising, you may object to this type of data processing at any time. We may then no longer use your data for direct marketing.
  • If data is used to conduct profiling, you may object to this type of data processing at any time. We may no longer use your data for profiling thereafter.
• According to Article 22 of the GDPR, you may have the right not to be subject to a decision based solely on automated processing (for example, profiling).
• You have the right to lodge a complaint under Article 77 of the GDPR. This means that you can complain to the data protection authority at any time if you believe that the data processing of personal data violates the GDPR.

In short: you have rights – do not hesitate to contact the responsible party listed above with us!

If you believe that the processing of your data violates data protection law or your data protection rights have been violated in any other way, you can complain to the supervisory authority. For Austria, this is the data protection authority, whose website can be found at https://www.dsb.gv.at/. In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:

Austria Data protection authority

Manager:Dr. Matthias Schmidl
Address: Barichgasse 40-42, 1030 Wien
Phone number.: +43 1 52 152-0
E-mail address: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

Data transfer to third countries

We only transfer or process data to countries outside the scope of the GDPR (third countries) if you consent to this processing or if there is another legal permission. This is particularly true when processing is legally required or necessary for the performance of a contractual relationship, and in any case, only to the extent permitted by law. Your consent is in most cases the primary reason for us to process data in third countries. Processing of personal data in third countries such as the USA, where many software providers offer services and have their server locations, may mean that personal data is processed and stored in unexpected ways.

We explicitly point out that, according to the opinion of the European Court of Justice, there is currently only an adequate level of protection for data transfers to the USA if a US company processing personal data of EU citizens in the USA is an active participant in the EU-US Data Privacy Framework. More information can be found at: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

Data processing by US services that are not active participants in the EU-US Data Privacy Framework may result in data not being anonymized and processed, if applicable. Additionally, US government authorities may potentially have access to individual data. Furthermore, it may occur that collected data is linked with data from other services of the same provider, if you have a corresponding user account. Where possible, we try to use server locations within the EU, if offered.

We will inform you in the appropriate sections of this privacy policy in more detail about data transfers to third countries, if applicable.

Security of data processing operations

In order to protect personal data, we have implemented both technical and organisational measures. We encrypt or pseudonymise personal data wherever this is possible. Thus, we make it as difficult as we can for third parties to extract personal information from our data.

Article 25 of the GDPR refers to “data protection by technical design and by data protection-friendly default” which means that both software (e.g. forms) and hardware (e.g. access to server rooms) appropriate safeguards and security measures shall always be placed. If applicable, we will outline the specific measures below.

TLS encryption with https

The terms TLS, encryption and https sound very technical, which they are indeed. We use HTTPS (Hypertext Transfer Protocol Secure) to securely transfer data on the Internet.
This means that the entire transmission of all data from your browser to our web server is secured – nobody can “listen in”.

We have thus introduced an additional layer of security and meet privacy requirements through technology design Article 25 Section 1 GDPR). With the use of TLS (Transport Layer Security), which is an encryption protocol for safe data transfer on the internet, we can ensure the protection of confidential information.
You can recognise the use of this safeguarding tool by the little lock-symbol , which is situated in your browser’s top left corner in the left of the internet address (e.g. examplepage.uk), as well as by the display of the letters https (instead of http) as a part of our web address.
If you want to know more about encryption, we recommend you to do a Google search for “Hypertext Transfer Protocol Secure wiki” to find good links to further information.

Data Processing Agreement (DPA)

In this section, we would like to explain what a Data Processing Agreement is and why it is needed. As the term “Data Processing Agreement” is quite lengthy, we will often only use the acronym DPA here in this text. Like most companies, we do not work alone, but also use the services of other companies or individuals. By involving different companies or service providers, we may pass on personal data for processing. These partners then act as processors with whom we conclude a contract, the so-called Data Processing Agreement (DPA). Most importantly for you to know is that any processing of your personal data takes place exclusively according to our instructions and must be regulated by the DPA.

Who are the processors?

As a company and website owner, we are responsible for any of your data that is processed by us. In addition to the controller, there may also be so-called processors involved. This includes any company or person who processes your personal data. More precisely and according to the GDPR’s definition, this means: Any natural or legal person, authority, institution or other entity that processes your personal data is considered a processor. Processors can therefore be service providers such as hosting or cloud providers, payment or newsletter providers or large companies such as Google or Microsoft.

To make the terminology easier to comprehend, here is an overview of the GDPR’s three roles:

Data subject (you as a customer or interested party) → Controller (we as a company and contracting entity) → Processors (service providers such as web hosts or cloud providers)

Contents of a Data Processing Agreement

As mentioned above, we have concluded a DPA with our partners who act as processors. First and foremost, it states that the processor processes the data exclusively in accordance with the GDPR. The contract must be concluded in writing, although an electronic contract completion is also considered a “written contract”. Any processing of personal data only takes place after this contract is concluded. The contract must contain the following:

• indication to us as the controller
• obligations and rights of the controller
• categories of data subjects
• type of personal data
• type and purpose of data processing
• subject and duration of data processing
• location of data processing

Furthermore, the contract contains all obligations of the processor. The most important obligations are:

• ensuring data security measures
• taking possible technical and organisational measures to protect the rights of the data subject
• maintaining a data processing record
• cooperation with the data protection authority upon request
• performing a risk analysis for any received personal data
• subprocessors may only be appointed with the written consent of the controller

You can see an example of what a DPA looks like at https://gdpr.eu/data-processing-agreement/. This link shows a sample contract.

Cookies

Cookies Overview 👥 Affected parties: visitors to the website 🤝 Purpose: depending on the respective cookie. You can find out more details below or from the software manufacturer that sets the cookie. 📓 Processed data: depends on the cookie used. More details can be found below or from the manufacturer of the software that sets the cookie. 📅 Storage duration: can vary from hours to years, depending on the respective cookie ⚖️ Legal basis: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What are cookies?

Our website uses HTTP-cookies to store user-specific data.
In the following we explain what cookies are and why they are used, so that you can better understand the following privacy policy.

Whenever you surf the Internet, you are using a browser. Common browsers are for example, Chrome, Safari, Firefox, Internet Explorer and Microsoft Edge. Most websites store small text-files in your browser. These files are called cookies.

It is important to note that cookies are very useful little helpers. Almost every website uses cookies. More precisely, these are HTTP cookies, as there are also other cookies for other uses. HTTP cookies are small files that our website stores on your computer. These cookie files are automatically placed into the cookie-folder, which is the “brain” of your browser. A cookie consists of a name and a value. Moreover, to define a cookie, one or multiple attributes must be specified.

Cookies store certain user data about you, such as language or personal page settings. When you re-open our website to visit again, your browser submits these “user-related” information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are familiar to. In some browsers, each cookie has its own file, while in others, such as Firefox, all cookies are stored in one single file.

The following graphic shows a possible interaction between a web browser such as Chrome and the web server. The web browser requests a website and receives a cookie back from the server. The browser then uses this again as soon as another page is requested.

There are both first-party cookies and third-party cookies. First-party cookies are created directly by our site, while third-party cookies are created by partner-websites (e.g. Google Analytics). Each cookie must be evaluated individually, as each cookie stores different data. The expiry time of a cookie also varies from a few minutes to a few years. Cookies are not software programs and do not contain viruses, trojans or other malware. Cookies also cannot access your PC’s information.

This is an example of how cookie-files can look:

Name: _ga
Value: GA1.2.1326744211.152122974758-9
Purpose: Differentiation between website visitors
Expiry date: after 2 years

A browser should support these minimum sizes:

• At least 4096 bytes per cookie
• At least 50 cookies per domain
• At least 3000 cookies in total

Which types of cookies are there?

The exact cookies that we use, depend on the used services, which will be outlined in the following sections of this privacy policy. Firstly, we will briefly focus on the different types of HTTP-cookies.

There are 4 different types of cookies:

Essential cookies
These cookies are necessary to ensure the basic functions of a website. They are needed when a user for example puts a product into their shopping cart, then continues surfing on different websites and comes back later in order to proceed to the checkout. These cookies ensure the shopping cart does not get deleted, even if the user closes their browser window.

Purposive cookies
These cookies collect information about user behaviour and whether the user receives any error messages. Furthermore, these cookies record the website’s loading time as well as its behaviour in different browsers.

Target-orientated cookies
These cookies ensure better user-friendliness. Thus, information such as previously entered locations, fonts sizes or data in forms stay stored.

Advertising cookies
These cookies are also known as targeting cookies. They serve the purpose of delivering customised advertisements to the user. This can be very practical, but also rather annoying.

Upon your first visit to a website you are usually asked which of these cookie-types you want to accept. Furthermore, this decision will of course also be stored in a cookie.

If you want to learn more about cookies and do not mind technical documentation, we recommend https://tools.ietf.org/html/rfc6265, the Request for Comments of the Internet Engineering Task Force (IETF) called “HTTP State Management Mechanism”.

Purpose of processing via cookies

The purpose ultimately depends on the respective cookie. You can find out more details below or from the software manufacturer that sets the cookie.

Which data are processed?

Cookies are little helpers for a wide variety of tasks. Unfortunately, it is not possible to tell which data is generally stored in cookies, but in the privacy policy below we will inform you on what data is processed or stored.

Storage period of cookies

The storage period depends on the respective cookie and is further specified below. Some cookies are erased after less than an hour, while others can remain on a computer for several years.

You can also influence the storage duration yourself. You can manually erase all cookies at any time in your browser (also see “Right of objection” below). Furthermore, the latest instance cookies based on consent will be erased is after you withdraw your consent. The legality of storage will remain unaffected until then.

Right of objection – how can I erase cookies?

You can decide for yourself how and whether you want to use cookies. Regardless of which service or website the cookies originate from, you always have the option of erasing, deactivating or only partially accepting cookies. You can for example block third-party cookies but allow all other cookies.

If you want to find out which cookies have been stored in your browser, or if you want to change or erase cookie settings, you can find this option in your browser settings:

Chrome: Clear, enable and manage cookies in Chrome

Safari: Manage cookies and website data in Safari

Firefox: Clear cookies and site data in Firefox

Internet Explorer: Delete and manage cookies

Microsoft Edge: Delete cookies in Microsoft Edge

If you generally do not want cookies, you can set up your browser in a way to notify you whenever a cookie is about to be set. This gives you the opportunity to manually decide to either permit or deny the placement of every single cookie. This procedure varies depending on the browser. Therefore, it might be best for you to search for the instructions in Google. If you are using Chrome, you could for example put the search term “delete cookies Chrome” or “deactivate cookies Chrome” into Google.

Legal basis

The so-called “cookie directive” has existed since 2009. It states that the storage of cookies requires your consent (Article 6 Paragraph 1 lit. a GDPR). Within countries of the EU, however, the reactions to these guidelines still vary greatly. In Austria, however, this directive was implemented in Section 165 (3) of the Telecommunications Act (2021). In Germany, the cookie guidelines have not been implemented as national law. Instead, this guideline was largely implemented in Section 15 (3) of the Telemedia Act (TMG), which has been replaced by the Digital Services Act (DSA) since May 2024.

For absolutely necessary cookies, even if no consent has been given, there are legitimate interests (Article 6 (1) (f) GDPR), which in most cases are of an economic nature. We want to offer our visitors a pleasant user experience on our website. For this, certain cookies often are absolutely necessary.

This is exclusively done with your consent, unless absolutely necessary cookies are used. The legal basis for this is Article 6 (1) (a) of the GDPR.

In the following sections you will find more detail on the use of cookies, provided the used software does use cookies.

Application Data

Application Data Summary 👥 Affected Parties: Users applying for a job position with us 🤝 Purpose: Processing a job application procedure 📓 Processed Data: Name, address, contact details, email address, phone number, proof of qualifications (certificates), potentially data of special categories. 📅 Retention Period: For successful applications, data will be retained until the end of the employment relationship. Otherwise, the data will be deleted after the application process or stored for a certain period with your consent. ⚖️ Legal Basis: Art. 6(1)(a) GDPR (consent), legitimate interest (Art. 6(1)(f) GDPR), Art. 6(1)(b) GDPR (contract), Art. 9(2)(a) GDPR (processing special categories of data)

What is application data?

You can apply for a job at our company via email, online form, or a recruiting tool. All data we receive and process as part of an application is considered application data. This includes personal data such as name, date of birth, address, and phone number.

Why do we process application data?

We process your data to carry out a proper selection process for the advertised position. Additionally, we may retain your application documents in our applicant archive. Often, we are impressed by a candidate and their application but cannot proceed with collaboration for various reasons. With your consent, we archive your documents so we can easily contact you for future opportunities in our company.

We assure you that we handle your data with the utmost care and always process it within the legal framework. Within our company, your data is only shared with individuals directly involved in your application process. In short: Your data is safe with us!

What data is processed?

For example, when you apply via email, we naturally receive personal data as mentioned above. Even the email address itself is considered personal data. During the application process, only data relevant to deciding whether we would like to welcome you to our team is processed.

The specific data processed depends primarily on the job listing. However, it usually includes your name, date of birth, contact details, and proof of qualifications. If you submit your application via an online form, the data is transmitted to us in encrypted form. If you send your application via email, this encryption does not occur, and we cannot take responsibility for the transmission method. Once the data is on our servers, we are responsible for its lawful handling.

During the application process, information about your health or ethnic origin may also be requested. This helps us comply with legal obligations related to labor law, social security, and social protection. These are considered special category data.

Here is a list of possible data we receive and process:

• Name
• Contact address
• Email address
• Phone number
• Date of birth
• Information from cover letters and resumes
• Proof of qualifications (e.g., certificates)
• Special category data (e.g., ethnic origin, health data, religious beliefs)
• Usage data (visited websites, access data, etc.)
• Metadata (IP address, device information)

How long is the data stored?

If you join our team, your data will be further processed for employment purposes and retained at least until the employment relationship ends. All application documents will then become part of your employee file.

If we do not offer you the position, you decline our offer, or withdraw your application, we may retain your data for up to 6 months after the application process ends under legitimate interest (Art. 6(1)(f) GDPR). After that, both electronic data and physical documents will be fully deleted or destroyed. We retain your data, for example, to answer follow-up questions or to provide evidence of the application in case of legal disputes. If a legal dispute arises and we need the data beyond the 6-month period, we will delete it only when there is no longer any reason to retain it. If there are statutory retention obligations, we must store the data longer than 6 months.

Furthermore, we may retain your data longer if you provide explicit consent. This might be the case if we see potential for future collaboration. In such cases, your data will be included in our applicant pool. Of course, you can withdraw your consent for extended retention at any time. If no withdrawal is made and no new consent is given, your data will be deleted after a maximum of 2 years.

Legal Basis

The legal bases for processing your data are Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract or pre-contractual measures), Art. 6(1)(f) GDPR (legitimate interests), and Art. 9(2)(a) GDPR (processing special categories of data).

If we include you in our applicant tool, it is based on your consent (Art. 6(1)(a) GDPR). We emphasize that your consent to join our applicant pool is voluntary, does not affect the application process, and can be withdrawn at any time. The legality of processing until the point of withdrawal remains unaffected.

In cases where vital interests are at stake, data processing occurs under Art. 9(2)(c) GDPR. For purposes related to healthcare, occupational medicine, medical diagnosis, provision of health or social care, or the management of systems and services in health or social care, data is processed under Art. 9(2)(h) GDPR. If you voluntarily provide special category data, processing is based on Art. 9(2)(a) GDPR.

Web hosting

Web hosting Overview 👥 Affected parties: visitors to the website 📓 Purpose: professional hosting of the website and security of operations 🤝 Processed data: IP address, time of website visit, browser used and other data. You can find more details on this below or at the respective web hosting provider. 📅 Storage period: dependent on the respective provider, but usually 2 weeks ⚖️ Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interests)

What is web hosting?

Every time you visit a website nowadays, certain information – including personal data – is automatically created and stored, including on this website. This data should be processed as sparingly as possible, and only with good reason. By website, we mean the entirety of all websites on your domain, i.e. everything from the homepage to the very last subpage (like this one here). By domain we mean example.uk or examplepage.com.

When you want to view a website on a screen, you use a program called a web browser. You probably know the names of some web browsers: Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari.

The web browser has to connect to another computer which stores the website’s code: the web server. Operating a web server is complicated and time-consuming, which is why this is usually done by professional providers. They offer web hosting and thus ensure the reliable and flawless storage of website data.

Whenever the browser on your computer establishes a connection (desktop, laptop, smartphone) and whenever data is being transferred to and from the web server, personal data may be processed. After all, your computer stores data, and the web server also has to retain the data for a period of time in order to ensure it can operate properly.

Illustration:

Why do we process personal data?

The purposes of data processing are:

1. Professional hosting of the website and operational security
2. To maintain the operational as well as IT security
3. Anonymous evaluation of access patterns to improve our offer, and if necessary, for prosecution or the pursuit of claims.li>

Which data are processed?

Even while you are visiting our website, our web server, that is the computer on which this website is saved, usually automatically saves data such as

• the full address (URL) of the accessed website (e. g. https://www.examplepage.uk/examplesubpage.html?tid=122974758)
• browser and browser version (e.g. Chrome 87)
• the operating system used (e.g. Windows 10)
• the address (URL) of the previously visited page (referrer URL) (e. g. https://www.examplepage.uk/icamefromhere.html/)
• the host name and the IP address of the device from the website is being accessed from (e.g. COMPUTERNAME and 194.23.43.121)
• date and time
• in so-called web server log files

How long is the data stored?

Generally, the data mentioned above are stored for two weeks and are then automatically deleted. We do not pass these data on to others, but we cannot rule out the possibility that this data may be viewed by the authorities in the event of illegal conduct.

In short: Your visit is logged by our provider (company that runs our website on special computers (servers)), but we do not pass on your data without your consent!

Legal basis

The lawfulness of processing personal data in the context of web hosting is justified in Art. 6 para. 1 lit. f GDPR (safeguarding of legitimate interests), as the use of professional hosting with a provider is necessary to present the company in a safe and user-friendly manner on the internet, as well as to have the ability to track any attacks and claims, if necessary.

Amazon Web Services (AWS) Privacy Policy

We use Amazon Web Services (AWS) for our website, which is a web hosting provider, among other things. The provider of this service is the American company Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA.

Amazon processes data from you, among other things, in the USA. Amazon is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. More information can be found at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Additionally, Amazon uses so-called Standard Contractual Clauses (Article 46(2) and (3) GDPR). Standard Contractual Clauses (SCC) are template clauses provided by the EU Commission and are designed to ensure that your data complies with European data protection standards, even when transferred and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Amazon commits to maintaining the European data protection level when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_2847.

The Amazon data processing terms and conditions (Data Processing Addendum), which correspond to the standard contractual clauses, can be found at https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf.

You can find out more about the data that are processed through the use of Amazon Web Services (AWS) in their Privacy Policy at https://aws.amazon.com/privacy/?nc1=h_ls.

Data Processing Agreement (DPA) Amazon Web Services (AWS)

In accordance with Article 28 of the General Data Protection Regulation (GDPR), we have entered into a Data Processing Agreement (DPA) with Amazon Web Services (AWS). What exactly a DPA is and especially what must be included in a DPA, you can read in our general section “Data Processing Agreement (DPA)”.

This contract is required by law because Amazon Web Services (AWS) processes personal data on our behalf. It clarifies that Amazon Web Services (AWS) may only process data they receive from us according to our instructions and must comply with the GDPR. You can find the link to the Data Processing Agreement (DPA) under https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf.

Website Builders Introduction

Website Builders Privacy Policy Overview 👥 Affected parties: website visitors 🤝 Purpose: service optimisation 📓 Data processed: The data that is being processed includes but is not limited to technical usage information, browser activity, clickstream activity, session heat maps, contact details, IP addresses or geographic locations. You can find more details in the Privacy Policy below as well as in the providers’ Privacy Policies. 📅 Storage duration: depends on the provider ⚖️ Legal bases: Art. 6 (1) lit. f GDPR (legitimate interests), Art. 6 (1) lit. a GDPR (consent)

What are website builders?

We use a modular website builder for our website. This is a special form of Content Management System (CMS). Website builders enable website operators to create websites very easily and without any programming knowledge. In many cases, web hosts also offer website builders. Your personal data may be collected, stored and processed if a website builder is being used. In this Privacy Policy, you will find general information about data that is processed by such modular website builder systems. You can find more information in the respective provider’s Privacy Policy.

Why do we use website builders for our website?

The greatest advantage of modular website builders is their ease of use. We want to offer you a clear, simple and nicely designed website that we can easily operate and maintain by ourselves – without needing any external support. Nowadays website builders offer many helpful functions that we can use even without having any programming knowledge. This enables us to design our website according to our wishes and therefore, to give you an informative and pleasant experience on our website.

Which data are stored by website builders?

First of all, the exact data that is stored depends on the website builder that is being used. Each provider processes and collects different data from website visitors. However, technical usage information such as users’ operating system, browser, screen resolution, language and keyboard settings, hosting provider as well as the date of the website visit are usually collected. Moreover, tracking data (e. g. browser activity, clickstream activities, session heat maps, etc.) may also be processed. The same goes for personal data, since data such as contact information e. g. email address, telephone number (if you have provided it), IP address and geographic location data may also be processed and stored. In the respective provider’s Privacy Policy you can find out exactly which of your data is getting stored.

How long and where are the data stored?

Provided that we have any further information on this, we will inform you below about the duration of the data processing associated with the website builder we use. You can find detailed information on this in the provider’s Privacy Policy. Generally, we only process personal data for as long as is absolutely necessary to provide our services and products. The provider may store your data according to their own specifications, over which we have no influence.

Right to object

You always retain the right to information, rectification and erasure of your personal data. If you have any questions, you can also contact the responsible parties at the respective website builder system at any time. You can find the corresponding contact details either in our Privacy Policy or on the website of the respective provider.

What is more, in your browser you can clear, disable or manage cookies that providers use for their functions. Depending on the browser you use, this can be done in different ways. Please note, that this may lead to not all functions working as usual anymore.

Legal Bases

We have a legitimate interest in using a website builder system to optimise our online service and present it in an efficient and user-friendly way. The corresponding legal basis for this is Article 6 (1) (f) GDPR (legitimate interests). However, we only use the website builder system if you have consented to it.

If the processing of data is not absolutely necessary for the operation of the website, your data will only be processed on the basis of your consent. This particularly applies to tracking activities. The legal basis for this is Article 6 (1) (a) GDPR.

With this Privacy Policy, we have made you more familiar with the most important general information on data processing. If you want to find out more about this, you will find further information – if available – in the following section or in the Privacy Policy of the provider.

Framer Privacy Policy

We use the website builder Framer for our website. The service provider is the Dutch company Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands.

Framer also processes data in the United States, among other locations. We would like to point out that, according to the European Court of Justice, there is currently no adequate level of data protection for data transfers to the US. This may entail various risks regarding the legality and security of data processing.

As the basis for data processing with recipients located in third countries (outside the European Union, Iceland, Liechtenstein, Norway — especially in the USA) or for data transfers to such countries, Framer uses the standard contractual clauses approved by the European Commission (pursuant to Art. 46 para. 2 and 3 GDPR). These clauses oblige Framer to comply with the EU level of data protection even when processing relevant data outside the EU. These clauses are based on an implementing decision by the European Commission. You can find the decision and the clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=en

More information about Framer’s use of standard contractual clauses can be found here: https://www.framer.com/legal/data-processing-addendum/

For more details on the data processed through the use of Framer, please refer to the privacy policy at https://www.framer.com/legal/privacy-statement/.

Web Analytics

Web Analytics Privacy Policy Overview 👥 Affected parties: visitors to the website 🤝 Purpose: Evaluation of visitor information to optimise the website. 📓 Processed data: Access statistics that contain data such as access location, device data, access duration and time, navigation behaviour, click behaviour and IP addresses. You can find more details on this from the respective web analytics tool directly. 📅 Storage period: depending on the respective web analytics tool used ⚖️ Legal basis: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What is Web Analytics?

We use software on our website, which is known as web analytics, in order to evaluate website visitor behaviour. Thus, data is collected, which the analytic tool provider (also called tracking tool) stores, manages and processes. Analyses of user behaviour on our website are created with this data, which we as the website operator receive. Most tools also offer various testing options. These enable us, to for example test which offers or content our visitors prefer. For this, we may show you two different offers for a limited period of time. After the test (a so-called A/B test) we know which product or content our website visitors find more interesting. For such testing as well as for various other analyses, user profiles are created and the respective data is stored in cookies.

Why do we run Web Analytics?

We have a clear goal in mind when it comes to our website: we want to offer our industry’s best website on the market. Therefore, we want to give you both, the best and most interesting offer as well as comfort when you visit our website. With web analysis tools, we can observe the behaviour of our website visitors, and then improve our website accordingly for you and for us. For example, we can see the average age of our visitors, where they come from, the times our website gets visited the most, and which content or products are particularly popular. All this information helps us to optimise our website and adapt it to your needs, interests and wishes.

Which data are processed?

The exact data that is stored depends on the analysis tools that are being used. But generally, data such as the content you view on our website are stored, as well as e. g. which buttons or links you click, when you open a page, which browser you use, which device (PC, tablet, smartphone, etc.) you visit the website with, or which computer system you use. If you have agreed that location data may also be collected, this data may also be processed by the provider of the web analysis tool.

Moreover, your IP address is also stored. According to the General Data Protection Regulation (GDPR), IP addresses are personal data. However, your IP address is usually stored in a pseudonymised form (i.e. in an unrecognisable and abbreviated form). No directly linkable data such as your name, age, address or email address are stored for testing purposes, web analyses and web optimisations. If this data is collected, it is retained in a pseudonymised form. Therefore, it cannot be used to identify you as a person.

The following example shows Google Analytics’ functionality as an example for client-based web tracking with JavaScript code.

The storage period of the respective data always depends on the provider. Some cookies only retain data for a few minutes or until you leave the website, while other cookies can store data for several years.

Duration of data processing

If we have any further information on the duration of data processing, you will find it below. We generally only process personal data for as long as is absolutely necessary to provide products and services. The storage period may be extended if it is required by law, such as for accounting purposes for example for accounting.

Right to object

You also have the option and the right to revoke your consent to the use of cookies or third-party providers at any time. This works either via our cookie management tool or via other opt-out functions. For example, you can also prevent data processing by cookies by managing, deactivating or erasing cookies in your browser.

Legal basis

The use of Web Analytics requires your consent, which we obtained with our cookie popup. According to Art. 6 para. 1 lit. a of the GDPR (consent), this consent represents the legal basis for the processing of personal data, such as by collection through Web Analytics tools.

In addition to consent, we have a legitimate interest in analysing the behaviour of website visitors, which enables us to technically and economically improve our offer. With Web Analytics, we can recognise website errors, identify attacks and improve profitability. The legal basis for this is Art. 6 para. 1 lit. f of the GDPR (legitimate interests). Nevertheless, we only use these tools if you have given your consent.

Since Web Analytics tools use cookies, we recommend you to read our privacy policy on cookies. If you want to find out which of your data are stored and processed, you should read the privacy policies of the respective tools.

If available, information on special Web Analytics tools can be found in the following sections.

Google Analytics Privacy Policy

Google Analytics Privacy Policy Overview 👥 Affected parties: website visitors 🤝 Purpose: Evaluation of visitor information to optimise the website. 📓 Processed data: Access statistics that contain data such as the location of access, device data, access duration and time, navigation behaviour and click behaviour. You can find more details on this in the privacy policy below. 📅 Storage period: Customizable, GA4 stores data for 14 months by default. ⚖️ Legal basis: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What is Google Analytics?

On our website, we use the analytics tracking tool Google Analytics in the Google Analytics 4 (GA4) version provided by the American company Google Inc. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. Google Analytics collects data about your actions on our website. By combining various technologies such as cookies, device IDs, and login information, you can be identified as a user across different devices. This allows your actions to be analyzed across platforms as well.

For example, when you click on a link, this event is stored in a cookie and sent to Google Analytics. With the reports we receive from Google Analytics, we can better tailor our website and service to your needs. In the following, we will provide more information about the tracking tool and specifically inform you about the data processed and how you can prevent it.

Google Analytics is a tracking tool used for website traffic analysis. The basis for these measurements and analyses is a pseudonymous user identification number. This number does not include personally identifiable information such as name or address but is used to assign events to a device. GA4 utilizes an event-based model that captures detailed information about user interactions such as page views, clicks, scrolling, and conversion events. Additionally, GA4 incorporates various machine learning features to better understand user behavior and certain trends. GA4 employs modeling through machine learning capabilities, meaning that based on the collected data, missing data can be extrapolated to optimize the analysis and provide forecasts.

In order for Google Analytics to function properly, a tracking code is embedded in the code of our website. When you visit our website, this code records various events that you perform on our website. With GA4’s event-based data model, we, as website operators, can define and track specific events to obtain analyses of user interactions. This allows us to track not only general information such as clicks or page views but also specific events that are important for our business, such as submitting a contact form or making a purchase.

Once you leave our website, this data is sent to and stored on Google Analytics servers.

Google processes the data, and we receive reports on your user behavior. These reports can include, among others, the following:

• Audience reports: Audience reports help us get to know our users better and gain a more precise understanding of who is interested in our service.
• Advertising reports: Advertising reports make it easier for us to analyze and improve our online advertising.
• Acquisition reports: Acquisition reports provide helpful information on how we can attract more people to our service.
• Behavior reports: Here, we learn about how you interact with our website. We can track the path you take on our site and which links you click on.
• Conversion reports: Conversion refers to an action you take as a result of a marketing message, such as going from being a website visitor to becoming a buyer or newsletter subscriber. Through these reports, we gain insights into how our marketing efforts resonate with you, with the aim of improving our conversion rate.
• Real-time reports: With real-time reports, we can see what is currently happening on our website. For example, we can see how many users are currently reading this text.

In addition to the above-mentioned analysis reports, Google Analytics 4 also offers the following functions:

• Event-based data model: This model captures specific events that can occur on our website, such as playing a video, making a purchase, or subscribing to our newsletter.
• Advanced analytics features: With these features, we can gain a better understanding of your behavior on our website or certain general trends. For example, we can segment user groups, conduct comparative analyses of target audiences, or track your path on our website.
• Predictive modeling: Based on the collected data, missing data can be extrapolated through machine learning to predict future events and trends. This can help us develop better marketing strategies.
• Cross-platform analysis: Data collection and analysis are possible from both websites and apps. This enables us to analyze user behavior across platforms, provided you have consented to data processing.

Why do we use Google Analytics on our website?

Our goal with this website is clear: we want to provide you with the best possible service. The statistics and data from Google Analytics help us achieve this goal.

The statistically evaluated data gives us a clear picture of the strengths and weaknesses of our website. On one hand, we can optimize our site to make it more easily found by interested people on Google. On the other hand, the data helps us better understand you as a visitor. We know exactly what we need to improve on our website in order to provide you with the best possible service. The data also helps us conduct our advertising and marketing activities in a more personalized and cost-effective manner. After all, it only makes sense to show our products and services to people who are interested in them.

What data is stored by Google Analytics?

With the help of a tracking code, Google Analytics creates a random, unique ID associated with your browser cookie. This way, Google Analytics recognizes you as a new user, and a user ID is assigned to you. When you visit our site again, you are recognized as a “returning” user. All collected data is stored together with this user ID, making it possible to evaluate pseudonymous user profiles.

To analyze our website with Google Analytics, a property ID must be inserted into the tracking code. The data is then stored in the corresponding property. For each newly created property, the default is Google Analytics 4 Property. The data storage duration varies depending on the property used.

Through identifiers such as cookies, app instance IDs, user IDs, or custom event parameters, your interactions, if you have consented, are measured across platforms. Interactions encompass all types of actions you perform on our website. If you also use other Google systems (such as a Google account), data generated through Google Analytics can be linked to third-party cookies. Google does not disclose Google Analytics data unless we, as website operators, authorize it, except when required by law.

According to Google, IP addresses are not logged or stored in Google Analytics 4. However, IP address data is used by Google for deriving location data and is immediately deleted thereafter. All IP addresses collected from users in the EU are deleted before the data is stored in a data center or on a server.

Since GA4 focuses on event-based data, the tool uses significantly fewer cookies compared to previous versions such as Google Universal Analytics. However, there are still some specific cookies used by GA4. These can include:

Name: _ga
Value: 2.1326744211.152122974758-5
Purpose: By default, analytics.js uses the _ga cookie to store the user ID. It is used to distinguish website visitors.
Expiration: After 2 years

Name: _gid
Value: 2.1687193234.152122974758-1
Purpose: This cookie is also used to distinguish website visitors.
Expiration: After 24 hours

Name: gat_gtag_UA Value: 1
Purpose: Used to reduce the request rate. If Google Analytics is deployed via Google Tag Manager, this cookie will be named dc_gtm .
Expiration: After 1 minute

Note: This list cannot claim to be exhaustive, as Google may change their choice of cookies from time to time. GA4 aims to improve data privacy and offers several options for controlling data collection. For example, we can determine the storage duration ourselves and control data.

Here we provide an overview of the main types of data collected by Google Analytics:

Heatmaps: Google creates heatmaps to show the exact areas you click on. This provides us with information about your interactions on our site.

Session Duration: Google refers to session duration as the time you spend on our site without leaving. If you are inactive for 20 minutes, the session automatically ends.

Bounce Rate: Bounce rate refers to when you view only one page on our website and then leave.

Account Creation: If you create an account or place an order on our website, Google Analytics collects this data.

Location: IP addresses are not logged or stored in Google Analytics. However, location data is derived shortly before the IP address is deleted.

Technical Information: Technical information includes your browser type, internet service provider, and screen resolution, among others.

Source of Origin: Google Analytics is interested in the website or advertisement that brought you to our site.

Additional data may include contact information, reviews, media playback (e.g., if you play a video on our site), sharing of content via social media, or adding to favorites. This list is not exhaustive and serves only as a general guide to the data storage by Google Analytics.

Where and how long are the data stored?

Google has servers distributed worldwide. You can find precise information about the locations of Google data centers at: https://www.google.com/about/datacenters/locations/?hl=en

Your data is distributed across multiple physical storage devices. This ensures faster access to data and better protection against manipulation. Each Google data center has emergency programs in place for your data. In the event of hardware failure or natural disasters, the risk of service interruption at Google remains low.

The retention period of data depends on the properties used. The storage duration is always set separately for each individual property. Google Analytics offers us four options for controlling the storage duration:

• 2 months: This is the shortest storage period.
• 14 months: By default, data is stored in GA4 for 14 months.
• 26 months: Data can also be stored for 26 months.
• Data is only deleted manually.

In addition, there is also the option for data to be deleted only if you do not visit our website within the selected time period. In this case, the retention period is reset every time you revisit our website within the defined time frame.

Once the defined period has expired, the data is deleted once a month. This retention period applies to data linked to cookies, user identification, and advertising IDs (e.g., cookies from the DoubleClick domain). Report results are based on aggregated data and are stored independently of user data. Aggregated data is a combination of individual data into larger units.

How can I delete my data or prevent data storage?

Under the data protection laws of the European Union, you have the right to access, update, delete, or restrict your data. By using the browser add-on to deactivate Google Analytics JavaScript (analytics.js, gtag.js), you can prevent Google Analytics 4 from using your data. You can download and install the browser add-on at: https://tools.google.com/dlpage/gaoptout?hl=en Please note that this add-on only disables data collection by Google Analytics.

If you want to disable, delete, or manage cookies in general, you can find the respective instructions for the most common browsers in the “Cookies” section.

Legal basis

The use of Google Analytics requires your consent, which we obtained through our cookie popup. According to Art. 6(1)(a) of the GDPR, this consent constitutes the legal basis for the processing of personal data that may occur during the collection by web analytics tools.

In addition to consent, we also have a legitimate interest in analyzing the behavior of website visitors to improve our offering technically and economically. By using Google Analytics, we can identify website errors, detect attacks, and improve efficiency. The legal basis for this is Art. 6(1)(f) of the GDPR (legitimate interests). However, we only use Google Analytics if you have given your consent.

Google processes data from you, among other things, in the USA. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. More information can be found at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Additionally, Google uses so-called Standard Contractual Clauses (Article 46(2) and (3) GDPR). Standard Contractual Clauses (SCC) are template clauses provided by the EU Commission and are designed to ensure that your data complies with European data protection standards, even when transferred and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google commits to maintaining the European data protection level when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_2847.

You can find the Google Ads Data Processing Terms, which refer to the Standard Contractual Clauses, at: https://business.safety.google/intl/en/adsprocessorterms/

We hope we have provided you with the most important information regarding the data processing by Google Analytics. If you want to learn more about the tracking service, we recommend the following links: https://marketingplatform.google.com/about/analytics/terms/en/ and https://support.google.com/analytics/answer/6004245?hl=en

If you want to learn more about data processing, you can refer to the Google Privacy Policy at: https://policies.google.com/privacy?hl=en.

Data Processing Agreement (DPA) Google Analytics

In accordance with Article 28 of the General Data Protection Regulation (GDPR), we have entered into a Data Processing Agreement (DPA) with Google Analytics. What exactly a DPA is and especially what must be included in a DPA, you can read in our general section “Data Processing Agreement (DPA)”.

This contract is required by law because Google Analytics processes personal data on our behalf. It clarifies that Google Analytics may only process data they receive from us according to our instructions and must comply with the GDPR. You can find the link to the Data Processing Terms under https://business.safety.google/intl/en/adsprocessorterms/.

Google Analytics Reports on demographic characteristics and interests

We have turned on Google Analytics’ functions for advertising reports. These reports on demographic characteristics and interests contain details about age, gender and interests. Through them we can get a better picture of our users – without being able to allocate any data to individual persons. You can learn more about advertising functions at auf https://support.google.com/analytics/answer/3450482?hl=en&amp%3Butm_id=ad.

You can terminate the use of your Google Account’s activities and information in “Ads Settings” at https://adssettings.google.com/authenticated via a checkbox.

Google Analytics in Consent Mode

Depending on your consent, Google Analytics will progress your personal data in the so-called “consent mode”. You can choose whether or not you want to accept Google Analytics cookies, and thus which of your data Google Analytics may process. The retained data is mainly used to measure user behaviour on the website, to serve targeted advertising and to provide us with web analysis reports. Usually, you would consent to Google’s data processing via a cookie consent tool. If you do not consent to data processing, only aggregated data will be collected and processed. This means that data cannot be assigned to individual users and therefore no user profile will be created for you. You also have the option to only agree to statistical measurement, meaning that none of your personal data will be processed and used for advertising or advertising measurement sequences.

Google Tag Manager Privacy Policy

Google Tag Manager Privacy Policy Overview 👥 Affected parties: website visitors 🤝 Purpose: Organisation of individual tracking tools 📓 Processed data: Google Tag Manager itself does not store any data. The data record tags of the web analytics tools used. 📅 Storage period: depending on the web analytics tool used ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What is Google Tag Manager?

We use Google Tag Manager by the company Google Inc. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA) for our website.
This Tag Manager is one of Google’s many helpful marketing products. With it, we can centrally integrate and manage code sections of various tracking tools, that we use on our website.

In this privacy statement we will explain in more detail, what Google Tag Manager does, why we use it and to what extent your data is processed.

Google Tag Manager is an organising tool with which we can integrate and manage website tags centrally and via a user interface. Tags are little code sections which e.g. track your activities on our website. For this, segments of JavaScript code are integrated to our site’s source text. The tags often come from Google’s intern products, such as Google Ads or Google Analytics, but tags from other companies can also be integrated and managed via the manager. Since the tags have different tasks, they can collect browser data, feed marketing tools with data, embed buttons, set cookies and track users across several websites.

Why do we use Google Tag Manager for our website?

Everybody knows: Being organised is important! Of course, this also applies to maintenance of our website. In order to organise and design our website as well as possible for you and anyone who is interested in our products and services, we rely on various tracking tools, such as Google Analytics.
The collected data shows us what interests you most, which of our services we should improve, and which other persons we should also display our services to. Furthermore, for this tracking to work, we must implement relevant JavaScript Codes to our website. While we could theoretically integrate every code section of every tracking tool separately into our source text, this would take too much time and we would lose overview. This is the reason why we use Google Tag Manager. We can easily integrate the necessary scripts and manage them from one place. Additionally, Google Tag Manager’s user interface is easy to operate, and requires no programming skills. Therefore, we can easily keep order in our jungle of tags.

What data is stored by Google Tag Manager?

Tag Manager itself is a domain that neither uses cookies nor stores data. It merely functions as an “administrator“ of implemented tags. Data is collected by the individual tags of the different web analysis tools. Therefore, in Google Tag Manager the data is sent to the individual tracking tools and does not get saved.

However, with the integrated tags of different web analysis tools such as Google Analytics, this is quite different. Depending on the analysis tool used, various data on your internet behaviour is collected, stored and processed with the help of cookies. Please read our texts on data protection for more information on the articular analysis and tracking tools we use on our website.

We allowed Google via the account settings for the Tag Manager to receive anonymised data from us. However, this exclusively refers to the use of our Tag Manager and not to your data, which are saved via code sections. We allow Google and others, to receive selected data in anonymous form. Therefore, we agree to the anonymised transfer of our website data. However, even after extensive research we could not find out what summarised and anonymous data it is exactly that gets transmitted. What we do know is that Google deleted any info that could identify our website. Google combines the data with hundreds of other anonymous website data and creates user trends as part of benchmarking measures. Benchmarking is a process of comparing a company’s results with the ones of competitors. As a result, processes can be optimised based on the collected information.

How long and where is the data stored?

When Google stores data, this is done on Google’s own servers. These servers are located all over the world, with most of them being in America. At https://www.google.com/about/datacenters/inside/locations/?hl=en you can read in detail where Google’s servers are.

In our individual data protection texts on the different tools you can find out how long the respective tracking tools store your data.

How can I delete my data or prevent data retention?

Google Tag Manager itself does not set any cookies but manages different tracking websites’ tags. In our data protection texts on the different tracking tools you can find detailed information on how you can delete or manage your data.

Please note that when using this tool, your data may also be stored and processed outside the EU. Most third countries (including the USA) are not considered secure under current European data protection law. Data must not be transferred, stored and processed to insecure third countries, unless there are suitable guarantees (such as EU standard contractual clauses) between us and the non-European service provider.

Legal basis

The use of the Google Tag Manager requires your consent, which we obtained via our cookie popup. According to Art. 6 para. 1 lit. a GDPR (consent), this consent is the legal basis for personal data processing, such as when it is collected by web analytics tools.

In addition to consent, we have a legitimate interest in analysing the behaviour of website visitors and thus technically and economically improving our offer. With the help of Google Tag Managers we can also improve profitability. The legal basis for this is Art. 6 para. 1 lit. f GDPR (legitimate interests). We only use Google Tag Manager if you have given us your consent.

Google processes data from you, among other things, in the USA. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. More information can be found at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Additionally, Google uses so-called Standard Contractual Clauses (Article 46(2) and (3) GDPR). Standard Contractual Clauses (SCC) are template clauses provided by the EU Commission and are designed to ensure that your data complies with European data protection standards, even when transferred and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google commits to maintaining the European data protection level when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_2847.

You can find the Google Ads Data Processing Terms, which refer to the Standard Contractual Clauses, at: https://business.safety.google/intl/en/adsprocessorterms/

If you want to learn more about Google Tag Manager, we recommend their FAQs at https://support.google.com/tagmanager/?hl=en#topic=3441530.

Blogs and Publication Media Introduction

Blogs and Publication Media Privacy Policy Overview 👥 Affected parties: website visitors 🤝 Purpose: Presentation and optimisation of our service, along with communication between website visitors, as well as security measures and administration 📓 Data processed: Data such as contact details, IP address and published content. More details can be found under the tools used. 📅 Storage duration: depending on the tools used ⚖️ Legal basis: Article 6 paragraph 1 letter a GDPR (consent), Article 6 paragraph 1 letter f GDPR (legitimate interests), Article 6 paragraph 1 sentence 1 letter b. GDPR (contract)

What are blogs and publishing media?

We use blogs or other means of communication on our website through which we can communicate with you – and through which you can communicate with us. Your data may also be stored and processed by us. This may be necessary in order for us to display content appropriately, make communication work smoothly and increase security. In this privacy policy, we will show you general information on which of your data may be processed. The exact information on data processing, however, always depends on the tools and functions used. You will find detailed information about data processing in the privacy policies of the individual providers.

Why do we use blogs and publication media?

Our greatest motivation for our website is to offer you interesting and exciting content. At the same time, your opinions and your content are important to us. That’s why we want to create a good interactive exchange between you and ourselves. With various blogs and publication options, we can achieve exactly that. You can e. g. post comments about our content, reply to others’ comments or, in some cases, make posts yourself.

Which data is processed?

Exactly which data is processed always depends on the communication functions we use. Very often IP address, username and published content are stored. This is done primarily to ensure security protection, prevent spam, and for us to be able to take action against any illegal content. What is more, cookies may also be used for data retention. They are small text files that are stored as information in your browser. You can find more details about the collected and stored data in our individual sections and in the privacy policies of the respective providers.

Duration of data processing

We will inform you below about the duration of data processing, provided we have further information on this. For example, post and comment functions store data until you revoke data storage. In general, personal data is only stored for as long as is absolutely necessary for us to provide you with our services.

Right to object

You also have the right and the option to revoke your consent to the use of cookies or third-party communication tools at any time. This can be done either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection through cookies by managing, deactivating or erasing the cookies in your browser.

Since cookies can also be used in publication media, we also recommend you read our general privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Legal Basis

We use this means of communication mainly on the basis of our legitimate interests (Art. 6 Para. 1 lit. f GDPR) in fast and good communication with you or other customers, business partners and visitors. Provided the use serves to process or initiate contractual relationships, the legal basis also extends to Article 6 Paragraph 1 Sentence 1 lit. b. GDPR.

Certain types of processing require your consent – in particular the use of cookies and comment or message functions. Provided you have consented to your data being processed and stored by integrated publication media, this consent is the legal basis for any data processing (Article 6 (1) (a) GDPR). Most communication features we use set cookies in your browser to store data. We therefore recommend you read our privacy policy on cookies carefully and consult the privacy policy or cookie policy of the relevant service provider.

Information on specific tools – if available – can be found in the following sections.

Blog Posts and Comment Functions Privacy Policy

There are various online communication tools that we may use on our website. For example, we use blog posts and comment functions. This gives you the possibility to comment on our content or to write articles. If you make use of this function, your IP address may be stored for security reasons. This is how we protect ourselves from illegal content such as insults, unauthorised advertising or prohibited political propaganda. In order to recognise whether any comments are spam, we can also store and process user information on the basis of our legitimate interests. If we start a survey, we will also store your IP address for the duration of the survey so we can be sure that everyone who takes part only votes once. Moreover, cookies may also be used for storage purposes. All data that we store about you (such as content or information about you) will be stored until you object.

Content Delivery Networks

Content Delivery Networks Privacy Policy Overview 👥 Affected parties: website visitors 🤝 Purpose: Service performance optimisation (to increase website loading speeds) 📓 Processed data: data such as your IP address You can find more details on this below as well as in the individual Privacy Policies. 📅 Storage period: most data is stored until it is no longer needed for the provision of the service. ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What is a Content Delivery Network?

On our website we use a so-called content delivery network or CDN. This helps to load our website quickly and easily, regardless of your location. Moreover, your personal data will also be stored, managed and processed on the respective CDN provider’s servers. In the following, we will go into more general detail on this service and the data processing associated with it. You can find detailed information on how your data is handled in the provider’s Privacy Policy.

Each content delivery network (CDN) is a network of regionally distributed servers that are connected to each other via the internet. Through this network, website content (especially very large files) can be delivered quickly and smoothly, even when large loading peaks occur. To make this possible, CDNs create a copy of our website on their servers. The website can be delivered quickly because these servers are distributed all around the world. Any data transfer to your browser is therefore significantly shortened by the CDN.

Why do we use a Content Delivery Network for our website?

A fast loading website is part of our service. Of course, we know how annoying it is when a website loads at a snail’s pace. Most of the time, you lose your patience and click away before the website is fully loaded. But of course we want to avoid that. Therefore, to us a fast loading website is an obligatory part of our website offer. With the use of a content delivery network, our website loads significantly faster in your browser. Furthermore, CDNs are particularly helpful when you are abroad, as the website is always delivered from a server in your area.

Which data are processed?

If you access a website or its content and it gets cached in a CDN, the CDN forwards the request to the server closest to you which then delivers the content. Content delivery networks are built in a way that JavaScript libraries can be downloaded and hosted on npm and Github servers. Alternatively, WordPress plugins can also be loaded on most CDNs, provided they are hosted on WordPress.org. Moreover, your browser can send personal data to the content delivery network we use. This includes data such as IP addresses, browser type, browser version, the accessed website or the time and date of the page visit. This data is collected and stored by the CDN. Whether cookies are used for data storage depends on the network that is being used. For more information on this, please read the Privacy Policy of the respective service.

Right to object

If you want to prevent this data transfer altogether, you can use a JavaScript blocker (see for example https://noscript.net/) on your computer. However, our website can then of course no longer offer its usual service (such as a fast loading speeds).

Legal basis

If you have consented to the use of a content delivery network, your consent represents the the legal basis for the corresponding data processing. According to Art. 6 paragraph 1 lit. a (consent) your consent represents the legal basis for the processing of personal data, as it can occur when collected by a content delivery network.

We also have a legitimate interest in using a content delivery network to optimise our online service and make it more secure. The corresponding legal basis for this is Art. 6 para. 1 lit. f GDPR (legitimate interests). Nevertheless, we only use the tool if you have consented to it.

Provided this information is available, you can find out more about the particular content delivery networks in the following sections.

Amazon CloudFront CDN Privacy Policy

Amazon CloudFront CDN Privacy Policy Overview 👥 Affected parties: website visitors 🤝 Purpose: service performance optimisation (to accelerate website loading times) 📓 Processed data: Data such as the anonymized IP address and cache metadata. You can find more details on this in the Privacy Policy below. 📅 Storage duration: most of the data is stored for less than 24 hours ⚖️ Legal basis: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What is Amazon CloudFront CDN?

To deliver all our individual web pages (subpages of our website) quickly and securely on all devices, we utilize the Content Delivery Network Amazon CloudFront CDN provided by the American company Amazon Web Services Inc., 410 Terry Avenue North, Seattle WA 98109, USA.
A Content Delivery Network (CDN) is a network of regionally distributed servers connected over the internet. This network enables the rapid delivery of content, especially very large files, even during peak loads.

Why do we use Amazon CloudFront CDN?

Our goal is to provide you with the best possible experience on our website. To achieve this, we want our web pages to be quickly accessible or loaded from anywhere. With CloudFront, we improve loading times while simultaneously reducing the load on our base servers. The use of Amazon CloudFront CDN is particularly helpful for users from abroad, as content can be delivered from a nearby server. The more efficient delivery of our content leads to an enhanced user experience, ultimately serving our business goals.

What data is stored by Amazon CloudFront CDN?

When content is delivered via CloudFront, your IP address may be stored in anonymized form for a certain period. CloudFront generally does not store personally identifiable data unless such data is part of a delivered resource. Long-term storage is not intended in any case. To optimize delivery, cache metadata may be temporarily stored, which typically consists of non-personal data, providing information about the storage duration of specific content in the cache (temporary storage).

How long and where are the data stored?

As mentioned above, it is usually only cache files that are temporarily stored by Amazon CloudFront CDN. These data are stored in the so-called Edge Locations of the CDN network, allowing requests for specific resources to be quickly fulfilled.
In general, data is stored by Amazon for as long as business purposes require, and Amazon is contractually and legally obligated. Unfortunately, we cannot specify exact retention periods at this point because they also depend on individual configurations.

How can I delete my data or prevent data storage?

You have the right and the option to access your personally identifiable data at any time and object to its use and processing. You can also file a complaint with a state supervisory authority or with us at any time.
In your browser, you also have the option to manage, delete, or disable cookies individually. Please note that disabled or deleted cookies may have potential negative effects on the functions of our website. The process of managing cookies may vary depending on the browser you use. The respective links to the instructions for the most popular browsers can be found under the “Cookies” section.

If you do not want data transmission to occur, you also have the option to install JavaScript blockers such as https://www.ghostery.com/ or noscript.net. However, if you choose to disable JavaScript code execution in your browser, the usual functions may be altered. For example, a website may not load as quickly.

Legal Basis

The use of Amazon CloudFront requires your consent, which you provided through a Consent Management Tool (Popup). According to Art. 6 (1) lit. a GDPR (Consent), this consent is the legal basis for the processing of personally identifiable data, as may occur with Amazon CloudFront.
In addition to consent, we have a legitimate interest in improving our website technically and economically. With the help of Amazon CloudFront, we can deliver content more quickly, thus enhancing our web offering. The legal basis for this is Art. 6 (1) lit. f GDPR (Legitimate Interests). However, features of Amazon CloudFront are only used to the extent that you have given consent.

Amazon processes data from you, among others, also in the USA. Amazon is an active participant in the EU-US Data Privacy Framework, regulating the correct and secure transfer of personally identifiable data from EU citizens to the USA. More information can be found at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Amazon also uses so-called Standard Contractual Clauses (= Art. 46. Abs. 2 und 3 DSGVO). Standard Contractual Clauses (SCC) are template contracts provided by the EU Commission and are intended to ensure that your data complies with European data protection standards, even when transferred and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Amazon commits to maintaining the European level of data protection when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. The decision and the corresponding Standard Contractual Clauses can be found at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Amazon Data Processing Terms (AWS GDPR DATA PROCESSING), which comply with the Standard Contractual Clauses, can be found at https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf.

To learn more about the data processed by the use of Amazon CloudFront, refer to the Privacy Policy at https://aws.amazon.com/de/privacy/.

Cookie Consent Management Platform

Cookie Consent Management Platform Overview 👥 Affected parties: Website visitors 🤝 Purpose: Obtaining and managing consent to certain cookies and thus the use of certain tools 📓 Processed data: data for managing cookie settings such as IP address, time of consent, type of consent and individual consent. You can find more details on this directly with the tool that is being used. 📅 Storage period: depends on the tool used, periods of several years can be assumed ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What is a cookie consent management platform?

We use a Consent Management Platform (CMP) software on our website that makes it easier for us and you to handle the scripts and cookies used correctly and securely. The software automatically creates a cookie pop-up, scans and controls all scripts and cookies, provides you with the cookie consent required under data protection law and helps you and us to keep track of all cookies. Most cookie consent management tools identify and categorize all existing cookies. As a website visitor, you then decide for yourself whether and which scripts and cookies you allow or not. The following graphic shows the relationship between browser, web server and CMP.

Why do we use a cookie management tool?

Our goal is to offer you the best possible transparency in the area of ​​data protection. We are also legally obliged to do so. We want to inform you as well as possible about all tools and all cookies that can save and process your data. It is also your right to decide for yourself which cookies you accept and which you do not. In order to grant you this right, we first need to know exactly which cookies actually landed on our website. Thanks to a cookie management tool, which regularly scans the website for all cookies present, we know about all cookies and can provide you with GDPR-compliant information. You can then use the consent system to accept or reject cookies.

Which data are processed?

As part of our cookie management tool, you can manage each individual cookie yourself and have complete control over the storage and processing of your data. The declaration of your consent is stored so that we do not have to ask you every time you visit our website and we can also prove your consent if required by law. This is saved either in an opt-in cookie or on a server. The storage time of your cookie consent varies depending on the provider of the cookie management tool. Usually this data (e.g. pseudonymous user ID, time of consent, detailed information on the cookie categories or tools, browser, device information) is stored for up to two years.

Duration of data processing

We will inform you below about the duration of the data processing if we have further information. In general, we only process personal data for as long as is absolutely necessary for the provision of our services and products. Data stored in cookies are stored for different lengths of time. Some cookies are deleted after you leave the website, others may be stored in your browser for a few years. The exact duration of the data processing depends on the tool used, in most cases you should be prepared for a storage period of several years. In the respective data protection declarations of the individual providers, you will usually receive precise information about the duration of the data processing.

Right of objection

You also have the right and the option to revoke your consent to the use of cookies at any time. This works either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser.

Information on special cookie management tools can be found – if available – in the following sections.

Legal basis

If you agree to cookies, your personal data will be processed and stored via these cookies. If we are allowed to use cookies with your consent (Article 6 paragraph 1 lit. a GDPR), this consent is also the legal basis for the use of cookies and the processing of your data. In order to be able to manage the consent to cookies and to enable you to give your consent, a cookie consent management platform software is used. The use of this software enables us to operate the website in an efficient and legally compliant manner, which is a legitimate interest (Article 6 paragraph 1 lit. f GDPR).

AdSimple Consent Manager Privacy Policy

AdSimple Consent Manager Privacy Policy Overview 👥 Affected parties: Website visitors 🤝 Purpose: Obtaining consent to certain cookies and thus the use of certain tools 📓 Processed data: data for managing cookie settings such as IP address, time of consent, type of consent and individual consent. You can find more details on this under in the privacy policy below. 📅 Storage period: the used cookie expires after one year ⚖️ Legal basis: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What is the AdSimple Consent Manager?

On our website we use the AdSimple Consent Manager of the software development and online marketing company AdSimple GmbH, Fabriksgasse 20, 2230 Gänserndorf, Austria. The AdSimple Consent Manager offers us, among other things, the opportunity to provide you with a cookie notice that is comprehensive and compliant with data protection laws. This gives you the opportunity to decide which cookies you want to allow or deny. By using this software, data is sent from you to AdSimple, where it is stored. In this privacy policy we inform you on why we use the AdSimple Consent Manager, which data is transferred and stored and how you can prevent this data transfer.

The AdSimple Consent Manager is a software that scans our website to identify and categorise all existing cookies. Additionally, you as the website visitor will be informed on the use of cookies via a cookie notice script. Then you can decide yourself which cookies you want to allow or deny.

Why do we use the AdSimple Consent Manager on your website?

We want to offer you maximum transparency when it comes to data protection. Before we can do so, we need to exactly determine which cookies have ended up on our website over time. Since the AdSimple consent manager regularly scans our website and locates all cookies, we have full control over these cookies and can therefore act in compliance with the GDPR. This enables us to inform you precisely on the use of cookies on our website.
Moreover, you will always receive an up-to-date cookie notice that is data-protection compliant. This enables you to decide yourself which cookies you want to allow or deny via the checkbox system.

Which data are stored by the AdSimple Consent Manager?

If you agree to cookies on our website, AdSimple Consent Manager will set the following cookie:

Name: acm_status
Value: “:true,”statistics”:true,”marketing”:true,”socialmedia”:true,”settings”:true}
Porpose: This cookie saves the status of your consent. This enables our website to read and adhere to the latest status, even during future visits.
Expiry date: after one year

How long and where are the data stored?

All data collected by the AdSimple Consent Manager is transferred and stored exclusively within the European Union. The collected data is stored on the AdSimple servers at Hetzner GmbH in Germany. Therefore, only AdSimple GmbH and Hetzner GmbH have access to the data.

How can I erase my data or prevent data retention?

You have the right to access and delete your personal data at any time. You can prevent data collection and storage by for example rejecting the use of cookies via the cookie notification script. Another option to prevent data processing or to manage it according to your wishes is your browser. Depending on the browser you use, managing cookies differs slightly. Below you will find links to the instructions for the most common browsers:

Chrome: Clear, enable and manage cookies in Chrome

Safari: Manage cookies and website data in Safari

Firefox: Clear cookies and site data in Firefox

Internet Explorer: Delete and manage cookies

Microsoft Edge: Delete cookies in Microsoft Edge

Legal basis

If you agree to cookies, your personal data will be processed and stored via these cookies. If we are allowed to use cookies with your consent (Article 6 (1) (a) GDPR), this consent is also the legal basis for the use of cookies and the processing of your data. The AdSimple Consent Manager is used to manage your consent to cookies and to enable you to give your consent. The use of this software enables us to operate the website in an efficient and legally compliant manner, which is a legitimate interest (Article 6 (1) lit.f GDPR).

We hope we were able to provide you with a good overview of data traffic and data processing by AdSimple Consent Manager. If you want to learn more about this tool, we recommend the description page at https://www.adsimple.at/consent-manager/.

ccm19 Privacy Policy

On our website we use ccm19, which is a cookie consent manager tool. The provider of this service is the German company Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany. You can find out more about the data that is processed by using ccm19 in their Privacy Policy at https://www.ccm19.de/en/privacyclarification.html.

Security & Anti-spam

Security & Anti-Spam Privacy Policy Overview 👥 Affected parties: website visitors 🤝 Purpose: for cyber security 📓 Processed data: Data such as your IP address, name or technical data such as browser version More details can be found below and in the individual privacy policies. 📅 Duration of storage: In most cases, data is stored until it is no longer required in order to provide the service ⚖️ Legal bases: Article 6 paragraph 1 lit. a GDPR (consent), Article 6 paragraph 1 lit. f GDPR (legitimate interests)

What is Security & Anti-spam software?

So-called security & Anti-spam software can protect you and us from various spam or phishing emails and other potential cyber-attacks. Spam includes advertising emails from mass mailings that you did not sign up for yourself. Such emails are also called data garbage and can also cause costs. Other spam such as phishing emails, on the other hand, are messages that aim to gain trust via fake messages or websites in order to obtain personal information. Anti-spam software usually protects against unwanted spam messages or malicious emails that could inject viruses into our system. We also use general firewall and security systems that protect our devices from unwanted network attacks.

Why do we use Security & Anti-spam software?

We put great importance on our website’s security. After all, this is not just about our safety, but also about your safety. Unfortunately, cyber threats are now part of everyday life in the world of IT and the internet. Hackers e. g. often try to steal personal data from IT systems with the help of cyber attacks. And therefore a good defence system is absolutely necessary. A security system monitors all incoming and outgoing connections to our network or computer. In order to achieve even greater security against cyber attacks, we also use other external security services on our devices in addition to standardised security systems. Unauthorised data transmissions are thus better prevented and this is how we protect ourselves from cybercrime.

Which data are processed by Security & Anti-spam software?

The data that is collected and stored of course depends on the respective service. However, we always try to only use programs that collect data very sparingly or only store data that is necessary for the fulfilment of the offered service. In general, the service may store data such as name, address, IP address, email address and technical data such as browser type or browser version. Any performance and log data may also be collected in order to identify possible incoming threats in good time. This data will be processed as part of the provided services and in compliance with applicable laws. This also includes the GDPR for US providers (via the Standard Contractual Clauses). In some cases, security services also work with third parties who may store and/or process data under instructions and in accordance with privacy policies and other security measures. Data is usually stored using cookies.

Duration of data processing

We will inform you below about the duration of data processing, provided we have further information on this. For example, security programs store data until you or we revoke data storage. In general, personal data is only stored for as long as is absolutely necessary for the provision of the services. Unfortunately, in many cases, we do not have precise information from the providers about their data storage periods.

Right to object

You also have the right and the option to revoke your consent to the use of cookies or third-party security software at any time. This can be done either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection through cookies by managing, deactivating or erasing the cookies in your browser.

Since cookies may also be used with security services, we recommend you read our privacy policy on cookies. To find out exactly which of your data is stored and processed, you should read the privacy policies of the respective tools.

Legal Basis

We use security services mainly on the basis of our legitimate interests (Art. 6 Para. 1 lit. f GDPR) in a good security system and protection against various cyber attacks.

Certain data processing requires your consent – in particular, the use of cookies and security functions. If you have agreed to the processing and storage of your data by integrated security services, your consent is the legal basis for data processing (Article 6 (1) (a) GDPR). Most of the services we use set cookies on your browser to store data. We, therefore, recommend you read our privacy policy on cookies carefully and consult the privacy policy or cookie policy of the relevant service provider.

Information on special tools – if available – can be found in the following sections.

Google reCAPTCHA Privacy Policy

Google reCAPTCHA Privacy Policy Overview 👥 Affected parties: website visitors 🤝 Purpose: Service optimisation and protection against cyber attacks 📓 Processed data: data such as IP address, browser information, operating system, limited location and usage data You can find more details on this in the Privacy Policy below. 📅 Storage duration: depending on the retained data ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What is reCAPTCHA?

Our primary goal is to provide you an experience on our website that is as secure and protected as possible. To do this, we use Google reCAPTCHA from Google Inc. (1600 Amphitheater Parkway Mountain View, CA 94043, USA). With reCAPTCHA we can determine whether you are a real person from flesh and bones, and not a robot or a spam software. By spam we mean any electronically undesirable information we receive involuntarily. Classic CAPTCHAS usually needed you to solve text or picture puzzles to check. But thanks to Google’s reCAPTCHA you usually do have to do such puzzles. Most of the times it is enough to simply tick a box and confirm you are not a bot. With the new Invisible reCAPTCHA version you don’t even have to tick a box. In this privacy policy you will find out how exactly this works, and what data is used for it.

reCAPTCHA is a free captcha service from Google that protects websites from spam software and misuse by non-human visitors. This service is used the most when you fill out forms on the Internet. A captcha service is a type of automatic Turing-test that is designed to ensure specific actions on the Internet are done by human beings and not bots. During the classic Turing-test (named after computer scientist Alan Turing), a person differentiates between bot and human. With Captchas, a computer or software program does the same. Classic captchas function with small tasks that are easy to solve for humans but provide considerable difficulties to machines. With reCAPTCHA, you no longer must actively solve puzzles. The tool uses modern risk techniques to distinguish people from bots. The only thing you must do there, is to tick the text field “I am not a robot”. However, with Invisible reCAPTCHA even that is no longer necessary. reCAPTCHA, integrates a JavaScript element into the source text, after which the tool then runs in the background and analyses your user behaviour. The software calculates a so-called captcha score from your user actions. Google uses this score to calculate the likelihood of you being a human, before entering the captcha. reCAPTCHA and Captchas in general are used every time bots could manipulate or misuse certain actions (such as registrations, surveys, etc.).

Why do we use reCAPTCHA on our website?

We only want to welcome people from flesh and bones on our side and want bots or spam software of all kinds to stay away. Therefore, we are doing everything we can to stay protected and to offer you the highest possible user friendliness. For this reason, we use Google reCAPTCHA from Google. Thus, we can be pretty sure that we will remain a “bot-free” website. Using reCAPTCHA, data is transmitted to Google to determine whether you genuinely are human. reCAPTCHA thus ensures our website’s and subsequently your security. Without reCAPTCHA it could e.g. happen that a bot would register as many email addresses as possible when registering, in order to subsequently “spam” forums or blogs with unwanted advertising content. With reCAPTCHA we can avoid such bot attacks.

What data is stored by reCAPTCHA?

reCAPTCHA collects personal user data to determine whether the actions on our website are made by people. Thus, IP addresses and other data Google needs for its reCAPTCHA service, may be sent to Google. Within member states of the European Economic Area, IP addresses are almost always compressed before the data makes its way to a server in the USA. Moreover, your IP address will not be combined with any other of Google’s data, unless you are logged into your Google account while using reCAPTCHA. Firstly, the reCAPTCHA algorithm checks whether Google cookies from other Google services (YouTube, Gmail, etc.) have already been placed in your browser. Then reCAPTCHA sets an additional cookie in your browser and takes a snapshot of your browser window.

The following list of collected browser and user data is not exhaustive. Rather, it provides examples of data, which to our knowledge, is processed by Google.

• Referrer URL (the address of the page the visitor has come from)
• IP-address (z.B. 256.123.123.1)
• Information on the operating system (the software that enables the operation of your computers. Popular operating systems are Windows, Mac OS X or Linux)
• Cookies (small text files that save data in your browser)
• Mouse and keyboard behaviour (every action you take with your mouse or keyboard is stored)
• Date and language settings (the language and date you have set on your PC is saved)
• All Javascript objects (JavaScript is a programming language that allows websites to adapt to the user. JavaScript objects can collect all kinds of data under one name)
• Screen resolution (shows how many pixels the image display consists of)

Google may use and analyse this data even before you click on the “I am not a robot” checkmark. In the Invisible reCAPTCHA version, there is no need to even tick at all, as the entire recognition process runs in the background. Moreover, Google have not given details on what information and how much data they retain.

The following cookies are used by reCAPTCHA: With the following list we are referring to Google’s reCAPTCHA demo version at https://www.google.com/recaptcha/api2/demo.
For tracking purposes, all these cookies require a unique identifier. Here is a list of cookies that Google reCAPTCHA has set in the demo version:

Name: IDE
Value: WqTUmlnmv_qXyi_DGNPLESKnRNrpgXoy1K-pAZtAkMbHI-122974758-8
Purpose: This cookie is set by DoubleClick (which is owned by Google) to register and report a user’s interactions with advertisements. With it, ad effectiveness can be measured, and appropriate optimisation measures can be taken. IDE is stored in browsers under the domain doubleclick.net.
Expiry date: after one year

Name: 1P_JAR
Value: 2019-5-14-12
Purpose: This cookie collects website usage statistics and measures conversions. A conversion e.g. takes place, when a user becomes a buyer. The cookie is also used to display relevant adverts to users. Furthermore, the cookie can prevent a user from seeing the same ad more than once.
Expiry date: after one month

Name: ANID
Value: U7j1v3dZa1229747580xgZFmiqWppRWKOr
Purpose: We could not find out much about this cookie. In Google’s privacy statement, the cookie is mentioned in connection with “advertising cookies” such as “DSID”, “FLC”, “AID” and “TAID”. ANID is stored under the domain google.com.
Expiry date: after 9 months

Name: CONSENT
Value: YES+AT.de+20150628-20-0
Purpose: This cookie stores the status of a user’s consent to the use of various Google services. CONSENT also serves to prevent fraudulent logins and to protect user data from unauthorised attacks.
Expiry date: after 19 years

Name: NID
Value: 0WmuWqy122974758zILzqV_nmt3sDXwPeM5Q
Purpose: Google uses NID to customise advertisements to your Google searches. With the help of cookies, Google “remembers” your most frequently entered search queries or your previous ad interactions. Thus, you always receive advertisements tailored to you. The cookie contains a unique ID to collect users’ personal settings for advertising purposes.
Expiry date: after 6 months

Name: DV
Value: gEAABBCjJMXcI0dSAAAANbqc122974758-4
Purpose: This cookie is set when you tick the “I am not a robot” checkmark. Google Analytics uses the cookie personalised advertising. DV collects anonymous information and is also used to distinct between users.
Expiry date: after 10 minutes

Note: We do not claim for this list to be extensive, as Google often change the choice of their cookies.

How long and where are the data stored?

Due to the integration of reCAPTCHA, your data will be transferred to the Google server. Google have not disclosed where exactly this data is stored, despite repeated inquiries. But even without confirmation from Google, it can be assumed that data such as mouse interaction, length of stay on a website or language settings are stored on the European or American Google servers. The IP address that your browser transmits to Google does generally not get merged with other Google data from the company’s other services.
However, the data will be merged if you are logged in to your Google account while using the reCAPTCHA plug-in. Google’s diverging privacy policy applies for this.

How can I erase my data or prevent data retention?

If you want to prevent any data about you and your behaviour to be transmitted to Google, you must fully log out of Google and delete all Google cookies before visiting our website or use the reCAPTCHA software. Generally, the data is automatically sent to Google as soon as you visit our website. To delete this data, you must contact Google Support at https://support.google.com/?hl=en-GB&tid=122974758.

If you use our website, you agree that Google LLC and its representatives automatically collect, edit and use data.

Please note that when using this tool, your data can also be stored and processed outside the EU. Most third countries (including the USA) are not considered secure under current European data protection law. Data to insecure third countries must not simply be transferred to, stored and processed there unless there are suitable guarantees (such as EU’s Standard Contractual Clauses) between us and the non-European service provider.

Legal basis

If you have consented to the use of Google reCAPTCHA, your consent is the legal basis for the corresponding data processing. According to Art. 6 Paragraph 1 lit. a GDPR (consent) your consent is the legal basis for the processing of personal data, as can occur when processed by Google reCAPTCHA.

We also have a legitimate interest in using Google reCAPTCHA to optimise our online service and make it more secure. The corresponding legal basis for this is Art. 6 para. 1 lit. f GDPR (legitimate interests). Nevertheless, we only use Google reCAPTCHA if you have given your consent to it.

Google processes data from you, among other things, in the USA. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. More information can be found at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Additionally, Google uses so-called Standard Contractual Clauses (Article 46(2) and (3) GDPR). Standard Contractual Clauses (SCC) are template clauses provided by the EU Commission and are designed to ensure that your data complies with European data protection standards, even when transferred and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google commits to maintaining the European data protection level when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_2847.

You can find the Google Ads Data Processing Terms, which refer to the Standard Contractual Clauses, at: https://business.safety.google/intl/en/adsprocessorterms/

You can find out a little more about reCAPTCHA on Google’s web developer page at https://developers.google.com/recaptcha/. Google goes into the technical development of the reCAPTCHA in more detail here, but you will look in vain for detailed information about data storage and data protection issues. A good overview of the basic use of data by Google can be found in the in-house data protection declaration at https://policies.google.com/privacy?hl=en-GB.

Web Design Introduction

Web Design Privacy Policy Overview 👥 Affected parties: website visitors 🤝 Purpose: improvement of user experience 📓 Processed data: depends heavily on the services used. Usually, data such as IP address, technical data, language settings, browser version, screen resolution and browser name are processed. You can find more details directly with the respective web design tools. 📅 Storage duration: depends on the tools used ⚖️ Legal bases: Article 6 paragraph 1 lit. a GDPR (consent), Article 6 paragraph 1 lit. f GDPR (legitimate interests)

What is web design?

We use various tools on our website for the purpose of our web design. Contrary to common belief, web design is not just about making our website look nice, but rather also about functionality and performance. But of course, a good-looking website is also a major goal of professional web design. Web design is a part of media design and deals with the visual as well as the structural and functional design of a website. Our aim with our web design is to improve your experience on our site. In web design jargon, this is called User Experience (UX) and usability. User Experience entails all impressions and experiences that website visitors come across on a website. What is more, usability is part of the User Experience, as it determines how user-friendly a website is. This includes the clear structuring of content, subpages or products, along with how quickly and easily the website enables you to find what you are looking for. In order to offer you the best possible experience on our website, we also use so-called third-party web design tools. Therefore, all tools and services that help improve our website’s design are classified under the category “web design”. This may, for example, include fonts, various plugins or other integrated web design functions.

Why do we use web design tools?

The way you absorb information on a website depends very much on its structure, functionality and visual perception. Therefore, good and professional web design has become increasingly important for us. We are constantly working on improving our site as a way of further extending our services for you as a website visitor. Furthermore, a beautiful and functioning website also has economic advantages for us. Needless to say, you will only visit it and take advantage of our offers if you feel completely at ease.

What data is stored by web design tools?

When you visit our website, any web design elements integrated into our pages may process your data. The exact data that is processed depends on the tools used. Below you can see exactly which tools we use for our website. For more information about data processing, we recommend you also read the respective privacy policy of the respective tools. There you can usually find out which data is processed, whether cookies are used and how long the data is stored. Moreover, fonts such as Google Fonts, for example, also automatically transmit information such as your language settings, IP address, browser version, browser screen resolution and browser name to Google’s servers.

Duration of data processing

Data processing times are very individual and depend on the web design elements used. For example, when cookies are used, the retention period can be as little as a minute, but it may also be a few years. Please make yourself familiar with this topic. You may for example read our general section on cookies as well as the Privacy Policies of the tools used. There you can likely find out exactly which cookies are used and what information is stored there. For example, Google Font files are stored for one year, in order to improve the loading speed of a website. In principle, data is only kept for as long as is necessary to provide the service. But legal requirements may require data to be stored for longer.

Right to object

You also retain the right and the option to revoke your consent to the use of cookies or third-party providers at any time. You can do this either via our cookie management tool or via other opt-out functions. You can also prevent cookies from collecting your data by managing, deactivating or deleting the cookies in your browser. However, among web design elements (typically fonts) there is also data that cannot be erased easily. This is the case whenever data is automatically collected as soon as a page is accessed and then directly transmitted to a third party (e.g. Google). In these cases, please contact the support of the respective provider. In the case of Google, you can reach support at https://support.google.com/?hl=de.

Legal Basis

If you have consented to the use of web design tools, this consent serves as the legal basis for the relevant data processing. According to Article 6 (1) (a) GDPR (consent), your consent represents the legal basis for the processing of personal data, as it may occur when it is collected by web design tools. We also have a legitimate interest in web design to improve on our website. After all, only then can we provide you with a beautiful and professional web offer. The corresponding legal basis for this is Article 6 (1) (f) GDPR (legitimate interests). However, we strongly want to emphasise once more that we only use web design tools if you have given your consent.

You can find information on different web design tools – if available – in the following sections.

Google Fonts Privacy Policy

Google Fonts Privacy Policy Overview 👥 Affected parties: website visitors 🤝 Purpose: service optimisation 📓 Processed data: data such as IP address, CSS and font requests You can find more details on this in the Privacy Policy below. 📅 Storage period: Google stores font files for one year ⚖️ Legal bases: Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. f GDPR (legitimate interests)

What are Google Fonts?

On our website we use Google Fonts, by the company Google Inc. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA).

To use Google Fonts, you must log in and set up a password. Furthermore, no cookies will be saved in your browser. The data (CSS, Fonts) will be requested via the Google domains fonts.googleapis.com and fonts.gstatic.com. According to Google, all requests for CSS and fonts are fully separated from any other Google services. If you have a Google account, you do not need to worry that your Google account details are transmitted to Google while you use Google Fonts. Google records the use of CSS (Cascading Style Sheets) as well as the utilised fonts and stores these data securely. We will have a detailed look at how exactly the data storage works.

Google Fonts (previously Google Web Fonts) is a directory with over 800 fonts that Google provides its users free of charge.

Many of these fonts have been published under the SIL Open Font License license, while others have been published under the Apache license. Both are free software licenses.

Why do we use Google Fonts on our website?

With Google Fonts we can use different fonts on our website and do not have to upload them to our own server. Google Fonts is an important element which helps to keep the quality of our website high. All Google fonts are automatically optimised for the web, which saves data volume and is an advantage especially for the use of mobile terminal devices. When you use our website, the low data size provides fast loading times. Moreover, Google Fonts are secure Web Fonts. Various image synthesis systems (rendering) can lead to errors in different browsers, operating systems and mobile terminal devices. These errors could optically distort parts of texts or entire websites. Due to the fast Content Delivery Network (CDN) there are no cross-platform issues with Google Fonts. All common browsers (Google Chrome, Mozilla Firefox, Apple Safari, Opera) are supported by Google Fonts, and it reliably operates on most modern mobile operating systems, including Android 2.2+ and iOS 4.2+ (iPhone, iPad, iPod). We also use Google Fonts for presenting our entire online service as pleasantly and as uniformly as possible.

Which data is stored by Google?

Whenever you visit our website, the fonts are reloaded by a Google server. Through this external cue, data gets transferred to Google’s servers. Therefore, this makes Google recognise that you (or your IP-address) is visiting our website. The Google Fonts API was developed to reduce the usage, storage and gathering of end user data to the minimum needed for the proper depiction of fonts. What is more, API stands for „Application Programming Interface“ and works as a software data intermediary.

Google Fonts stores CSS and font requests safely with Google, and therefore it is protected. Using its collected usage figures, Google can determine how popular the individual fonts are. Google publishes the results on internal analysis pages, such as Google Analytics. Moreover, Google also utilises data of ist own web crawler, in order to determine which websites are using Google fonts. This data is published in Google Fonts’ BigQuery database. Enterpreneurs and developers use Google’s webservice BigQuery to be able to inspect and move big volumes of data.

One more thing that should be considered, is that every request for Google Fonts automatically transmits information such as language preferences, IP address, browser version, as well as the browser’s screen resolution and name to Google’s servers. It cannot be clearly identified if this data is saved, as Google has not directly declared it.

How long and where is the data stored?

Google saves requests for CSS assets for one day in a tag on their servers, which are primarily located outside of the EU. This makes it possible for us to use the fonts by means of a Google stylesheet. With the help of a stylesheet, e.g. designs or fonts of a website can get changed swiftly and easily.

Any font related data is stored with Google for one year. This is because Google’s aim is to fundamentally boost websites’ loading times. With millions of websites referring to the same fonts, they are buffered after the first visit and instantly reappear on any other websites that are visited thereafter. Sometimes Google updates font files to either reduce the data sizes, increase the language coverage or to improve the design.

How can I erase my data or prevent it being stored?

The data Google stores for either a day or a year cannot be deleted easily. Upon opening the page this data is automatically transmitted to Google. In order to clear the data ahead of time, you have to contact Google’s support at https://support.google.com/?hl=en-GB&tid=122974758. The only way for you to prevent the retention of your data is by not visiting our website.

Unlike other web fonts, Google offers us unrestricted access to all its fonts. Thus, we have a vast sea of font types at our disposal, which helps us to get the most out of our website. You can find out more answers and information on Google Fonts at https://developers.google.com/fonts/faq?tid=122974758. While Google does address relevant elements on data protection at this link, it does not contain any detailed information on data retention.
It proofs rather difficult to receive any precise information on stored data by Google.

Legal basis

If you have consented to the use of Google Fonts, your consent is the legal basis for the corresponding data processing. According to Art. 6 Paragraph 1 lit. a GDPR (Consent) your consent is the legal basis for the processing of personal data, as can occur when it is processed by Google Fonts.

We also have a legitimate interest in using Google Font to optimise our online service. The corresponding legal basis for this is Art. 6 para. 1 lit. f GDPR (legitimate interests). Nevertheless, we only use Google Font if you have given your consent to it.

Google processes data from you, among other things, in the USA. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. More information can be found at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Additionally, Google uses so-called Standard Contractual Clauses (Article 46(2) and (3) GDPR). Standard Contractual Clauses (SCC) are template clauses provided by the EU Commission and are designed to ensure that your data complies with European data protection standards, even when transferred and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google commits to maintaining the European data protection level when processing your relevant data, even if the data is stored, processed, and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_2847.

You can find the Google Ads Data Processing Terms, which refer to the Standard Contractual Clauses, at: https://business.safety.google/intl/en/adsprocessorterms/

You can find more information on which data is generally retained by Google and what this data is used at https://policies.google.com/privacy?hl=en-GB.

Google Fonts Local Privacy Policy

On our website we use Google Fonts, by the company Google Inc. The responsible entity for the European area is Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland). We have integrated Google fonts locally, i.e. on our web server and not on Google’s servers. This means that no connection to Google’s servers and therefore no data transfer or retention take place.

What are Google Fonts?

Google Fonts was previously called Google Web Fonts. It is an interactive list with over 800 fonts which Google offer for free use. With the use of Google Fonts, it is possible to utilise fonts without uploading them to your own server. In order to prevent any transfer of information to Google’s servers, we downloaded the fonts to our own server. This way we can comply with data privacy and do not transmit any data to Google Fonts.

Explanation of the terminology used

We always strive to make our privacy policy as clear and comprehensible as possible. However, this is not always easy, especially when it comes to technical and legal matters. It is often sensible to use legal terms (such as ‘personal data)’ or certain technical terms (such as ‘cookies’ or ‘IP address’). But we don’t want to use such terms without any explanation. This is why you will find an alphabetical list of important terms used below. These are terms we may not yet have sufficiently explained in the privacy policy. In case we have adopted any of these terms from the GDPR which are definitions, we will also list the GDPR texts here and add our own further explanations if necessary.

Processor

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

“processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

Explanation: As a company and a website owner, we are responsible for all your data we process (i. e. the ‘controller’). In addition to the controller, there may also be so-called processors. This includes any company or person who processes personal data on our behalf. In addition to service providers such as tax consultants, processors can also be hosting or cloud providers, payment or newsletter providers or large companies such as Google or Microsoft.

Consent

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

“consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Explanation: With websites, such consent is usually given via a cookie consent tool. You’ve most certainly come across these. Whenever you visit a website for the first time, you will usually be asked via a banner whether you agree or consent to the data processing. You can usually also make individual settings and thus decide for yourself which level of data processing you want to allow. If you do not give your consent, no personal data may be processed. Consent can of course also be given in writing, i.e. not via a tool.

Data concerning health

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

“Data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;

Explanation: Health data includes all stored information relating to your own health. It is often data that is also noted in patient files. This includes, for example, which medication you are using, X-rays, your entire medical history or your vaccination statuses.

Personal Data

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

“personenal data” means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Explanation: Personal data is all data that can identify you as a person. This is usually data such as:

• name
• address
• email address
• postal address
• phone number
• birthday
• identification numbers such as social security number, tax identification number, ID card number or matriculation number
• banking data such as account number, credit information, account balances and more.

According to the European Court of Justice (ECJ), your IP address is also personal data. IT experts can use your IP address to determine at least the approximate location of your device and subsequently your location as the connection owner. Therefore, storing an IP address also requires a legal basis within the scope of the GDPR. There are also so-called “special categories” of personal data, which are particularly worthy of protection. These include:

• racial and ethnic origin
• political opinions
• religious or ideological beliefs
• Union membership
• genetic data such as data obtained from blood or saliva samples
• biometric data (this is information about psychological, physical or behavioural characteristics that can identify an individual).
  health Data
• Data relating to sexual orientation or sex life

Profiling

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

Explanation: Profiling collects various personal data about an individual in order to learn more about that individual. On the internet, profiling is often used for advertising purposes or for credit checks. Web and advertising analysis programs e. g. collect data about your behaviour and interests on a website. This results in a special user profile that can be used to target advertising to specific target groups.

Controller

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Explanation: In our example, we are responsible for the processing of your personal data and are therefore the “controller”. If we pass on collected data to other service providers for processing, they are considered “contract processors”. For this, a “Data Processing Agreement (DPA)” must be concluded.

Processing

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term means:

“processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Note: When we talk about processing in our Privacy Policy, we talk about any type of data processing. As mentioned above in the original GDPR declaration, this includes not only the collection but also the storage and processing of data.

Closing Remarks

Congratulations! If you are reading these lines, you have most likely familiarised yourself with our entire Privacy Policy – or at least scrolled down here. As you can see from the scope of our Privacy Policy, we do not take the protection of your personal data lightly.
We find it important to inform you about the processing of your personal data to the best of our abilities. In doing so, we not only want to tell you which data is processed but also explain to you why we use various software programs. In general, Privacy Policies have very technical and legal jargon. However, since most of you are not web developers or solicitors, we wanted to take a different approach and explain the facts in simple and clear language. Of course, this is not always possible due to the subject matter. Therefore, you can also find a more detailed explanation of the most important terms at the end of the Privacy Policy.
If you have any questions about data protection on our website, please do not hesitate to contact us or the responsible body. We wish you all the best and hope to soon welcome you to our website again.

All texts are copyrighted.

Cookies

We use cookies to personalize content and advertisements, to be able to offer functions for social media and to analyze the access to our website. We also share information about your use of our website with our social media, advertising and analytics partners. Our partners may combine this information with other data that you have provided to them or that they have collected as part of your use of the services.

Your current condition: everything accepted
Your consent ID: 3667d44a2693da9d
Date of consent: 3/9/2026, 7:30:55 AM

Change consent

Technically neccessary

Cookie Consent Manager Clickskeks

Vendor
Turn-Motion FlexCo

Description
Used to save the cookie consent – which cookies may be set. The status of the cookie settings can be set for you. The data is stored in categories.

Link to privacy policy
https://turn-motion.com/legal/privacy-policy

Local Storage:

Name	Lifetime	Description
ccm_consent	1 year	Used to store the cookie consent agreement, which specifies which cookies can be set.

Legal basis
EU: § 25 (2.2) TDDDG, Art. 6 para. 1 s. 1 lit. c GDPR
Switzerland: Art. 17 sentence 1 b.2) DSG

Place of processing
1090 Vienna/Austria

Measurement

Google Analytics

Vendor
Google Ireland Limited

Description
Google Analytics is a web analytics tool that helps website owners understand and analyze user interactions on their website. It collects data about website visits, including information about how users arrive at a website (e.g. via search engines, social media or directly), how they navigate the website, which pages they visit and how long they stay on those pages. This information is then presented in various reports that provide insights into user behavior and enable website operators to optimize their website and improve the user experience. The data is also used for personalization and effective targeting of advertisements.

Link to privacy policy
https://business.safety.google/privacy/

What data will be collected?
Browser information; Click path; Date and time of the visit; Location information; IP address; Interaction data; Usage data; Device drive system; Device information; Referrer URL; Browser type; Browser language; Screen resolution; JavaScript support; Visited pages; User behavior; Hostname; Visited URL; Downloads; App updates; Purchase activity; Widget interactions; Flash version; IP address; Location information; Devices information; Device information; App updates; JavaScript support; Purchase activities; Browser information;

Purpose of data collection
Personalization; Remarketing; Effective control of advertisements; Analysis and marketing

Cookies:

Name	Lifetime	Description
_ga	24 months	Collection of statistics on the use of the website. (reach measurement)
_gid	24 hours	ID to identify the user within 24 hours of the last activity
_gat_gtag_*	1 minute	This cookie is used to distinguish users.
_gac_*	90 days	This cookie contains information about the ad you clicked on.
_gat*	1 minute	This is used to limit the request rate.
_dc_gtm_*	1 minute	This is used to distinguish computer users.
IDE	1 year	With this ID, Google can identify users across different websites and domains and show them personalized advertising.
AMP_TOKEN	30 seconds to 1 year	Contains the token code used to read the client ID from the AMP client ID service. By matching this ID with the Google Analytics ID, users can synchronize when switching between AMP and non-AMP content. Reference: https://support.google.com/analytics/answer/7486764?hl=fr
__utma	2 years after the last activity	This cookie is one of the 4 core cookies of Google Analytics and tracks user actions on the website and measures the performance of the website. Cookies distinguish between users and sessions. It is used to calculate statistics on returning visitors and is updated every time data is sent to Google Analytics.
__utmt*	10 minutes	This cookie is used to limit the request rate of the service and thus restrict data collection on highly frequented websites.
__utmb	30 minutes after the last activity	This cookie is one of the 4 core cookies of Google Analytics and tracks user actions on the website and measures the performance of the website. A cookie identifies new sessions and visits by a user. It is updated every time data is sent to Google Analytics. Any visitor activity during the lifetime of the cookie is counted as a single visit, even if the visitor leaves the website and then returns to it. Visits after the cookie expires are counted as new visits.
__utmc	End of session (browser)	This cookie is one of the 4 core Google Analytics cookies and tracks user actions on the website and measures website performance. Most websites no longer use cookies, but are still configured to provide legacy scan code, also known as urchin. In older versions, it was used with __utmb to identify the visitor.
__utmz	6 months after the last activity	This cookie is one of the 4 main cookies set by Google Analytics to track user behavior and measure website performance. The cookie identifies the location of the visitor’s visit to the website to inform the owner of the location of the user’s visit to the website and is updated each time the data is sent to Google Analytics.
__utmv	2 years after the last activity	Used to store variable data at the individual visitor level. This cookie is created when the developer uses the _setCustomVar method with custom variables at visitor level. This cookie is also used for the deprecated _setVar method. The cookie is updated every time data is sent to Google Analytics.
__utmx	18 months	This cookie is linked to the Google Website Optimizer. It is used to distinguish between two variants of a website that can be presented to visitors as part of an A/B split test.
__utm*	18 months	Used to determine when an A/B or multivariate user participation test ends
_swag_ga_ga*	n.a.	The cookies used assign an identifier to the website visitor and determine statistical data about the website visitor’s visit to the website. This is used to personalize the advertising displayed to users.
__utmd	n.a.	This cookie name appears to be associated with the Google Analytics service, which allows website owners to track visitor behavior and measure website performance. However, Google does not currently document this.
__utmo	n.a.	This cookie activates the functionality of Google Analytics.
__gads	13 months	Is set to enable ad placement or retargeting.
_gd*	Session	Saves a timestamp of the user.
_ga_*	2 years	Is used to retrieve the session status.
_gcl_gb	1 year	The _gcl cookie value contains a version number, followed by a timestamp and campaign information in the format of the GCLID value.

Legal basis
EU: Art. 6 para. 1 s. 1 lit. a GDPR
Switzerland: Art. 45c (b) TCA, Art. 17 sentence 1 a) DSG

Place of processing
European Union

Google Analytics 4

Vendor
Google Ireland Limited

Description
Google Analytics is a web analytics tool that helps website owners understand and analyze user interactions on their website. It collects data about website visits, including information about how users arrive at a website (e.g. via search engines, social media or directly), how they navigate the website, which pages they visit and how long they stay on those pages. This information is then presented in various reports that provide insights into user behavior and enable website operators to optimize their website and improve the user experience. The data is also used for personalization and effective targeting of advertisements.

Link to privacy policy
https://business.safety.google/privacy/

What data will be collected?
Browser information; Click path; Date and time of the visit; Location information; Internet service provider; Device information; Referrer URL; Screen resolution; Mouse movements; Anonymized IP address; Visit duration; Account data; Bounce rates; Downloads; Behavioral data; App updates

Purpose of data collection
Analysis; Marketing; Personalization; Remarketing; Effective control of advertisements

Cookies:

Name	Lifetime	Description
_ga	24 months	Used to differentiate between individual users.
_gid	24 hours	Used to distinguish individual users, but only has a runtime of 24 hours.
_gac_gb_*	90 days	This cookie is only set if Google Analytics 4 is linked to Google Ads. It contains information about Google Ads campaigns.
_ga_*	2 years	Used to save the session status.
FPID	Persistent	Server-side GA identifier
FPLC	24 hours	Hash from FPID for cross-domain linking with GA

Legal basis
EU: Art. 6 para. 1 s. 1 lit. a GDPR
Switzerland: Art. 45c (b) TCA, Art. 17 sentence 1 a) DSG

Place of processing
European Union