The responsible party within the meaning of the EU General Data Protection Regulation (DSGVO) and other national data protection laws of the Federal Republic of Germany as well as other data protection regulations is:

Comet Yxlon GmbH
Essener Bogen 15
22419 Hamburg
Deutschland

Authorized representatives: Dionys van de Ven, Erik Wessel

E-mail address: yxlon@comet.tech
Phone: +49 40 52729-0.
Imprint: yxlon.comet.tech/imprint

Contact data protection officer
E-mail: dataprivacy.yxlon@comet.tech
Phone: +49 40 52729-237

Collection of general data and information about the website

Our website collects a series of general data and information with each call by a data subject or an automated system. This general data and information is stored in the so-called. Logfiles of the server. The types and versions of browsers used, the operating system used by the accessing system, the website from which an accessing system accesses our website (so-called referrer), the sub-websites that are accessed via an accessing system on our website, the date and time of access to the website, an Internet protocol address (IP address), the Internet service provider of the accessing system and other similar data and information that serve to avert danger in the event of attacks on our information technology systems can be collected.

When using these general data and information, we do not draw any conclusions about the data subject. Rather, this information is needed to correctly deliver the content of our website, to optimize the content of our website and the advertising for it, to ensure the long-term functionality of our information technology systems and the technology of our website, and to provide law enforcement authorities with the information necessary for prosecution in the event of a cyber-attack. Therefore, we statistically evaluate this anonymously collected data and information on one hand, and on the other hand, with the aim of increasing the data protection and data security of our enterprise, so as to ultimately ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from any personal data provided by a data subject

Relevant legal basis

Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Furthermore, should more specific legal bases be relevant in individual cases, we will inform you of these in the data protection declaration.

• Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO) - The data subject has given his/her consent to the processing of personal data relating to him/her for a specific purpose or purposes.
• Performance of a contract and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO) - Processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures carried out at the data subject's request.
• Legal obligation (Art. 6 (1) p. 1 lit. c. DSGVO) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 (1) p. 1 lit. f. DSGVO) - Processing is necessary for the purposes of the legitimate interests of the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
• Application procedure as a pre-contractual or contractual relationship (Art. 9 (2) lit. b DSGVO) - Insofar as special categories of personal data within the meaning of Art. 9 (1) DSGVO (e.g. Health data, such as severely disabled status or ethnic origin) are requested from applicants so that the data controller or the data subject can exercise the rights accruing to him or her under labor law and social security and social protection law and fulfill his or her obligations in this regard, their processing is carried out in accordance with Art. 9 (2) lit. b. DSGVO, in case of protection of vital interests of the applicants or other persons according to Art. 9 para. 2 lit. c. DSGVO or for the purposes of preventive health care or occupational medicine, for the assessment of the employee's ability to work, for medical diagnostics, care or treatment in the health or social sector or for the management of systems and services in the health or social sector pursuant to Art. 9 para. 2 lit. h. DSGVO. In the case of a communication of special categories of data based on voluntary consent, their processing is based on Art. 9 para. 2 lit. a. DSGVO.

If personal data is processed based on your consent, you have the right to revoke your consent at any time with effect for the future.

If we process data based on a balance of interests, you as the data subject have the right to object to the processing of personal data, considering the requirements of Art. 21 DSGVO.

National data protection regulations in Germany: In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection apply in Germany. These include the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act - BDSG). In particular, the BDSG contains special regulations on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for employment purposes (Section 26 BDSG), in particular regarding the establishment, implementation or termination of employment relationships as well as the consent of employees. Furthermore, state data protection laws of the individual federal states may apply.

Security measures

We take appropriate technical and organizational measures in accordance with the legal requirements, considering the state of the art, the implementation costs and the nature, scope, circumstances, and purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.

The measures include safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as access to, input of, disclosure of, assurance of availability of and segregation of the data. Furthermore, we have established procedures to ensure the exercise of data subjects' rights, the deletion of data, and responses to data compromise. Furthermore, we already take the protection of personal data into account during the development or selection of hardware, software as well as procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

SSL encryption (https): To protect your data transmitted via our online offer, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Transmission of personal data

During our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organizational units, or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

Data transfer within the group of companies: We may transfer personal data to other companies within our group of companies or grant them access to this data. If this transfer is for administrative purposes, the transfer of data is based on our legitimate business and business interests or is made if it is necessary for the fulfillment of our contract-related obligations or if the consent of the data subjects or legal permission exists.

Data transfer within the organization: we may transfer personal data to other entities within our organization or grant them access to this data. Where this transfer is for administrative purposes, the transfer of data is based on our legitimate business and operational interests or is made where it is necessary to fulfill our contract-related obligations or where there is consent from the data subjects or legal permission.

Data processing in third countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, entities, or companies, this will only be done in accordance with the legal requirements.

Subject to express consent or contractually or legally required transfer, we only process or have data processed in third countries with a recognized level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 DSGVO, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Deletion of data

The data processed by us will be deleted in accordance with the legal requirements as soon as their consents permitted for processing are revoked or other permissions cease to apply (e.g., if the purpose of processing this data has ceased to apply or it is not necessary for the purpose).

If the data are not deleted because they are required for other and legally permissible purposes, their processing will be limited to these purposes. That is, the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for reasons of commercial or tax law or whose storage is necessary for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person.

Within the framework of our privacy notices, we may provide users with further information regarding the deletion as well as the retention of data that is specific to the processing operation in question.

Use of cookies

Cookies are text files that contain data from visited websites or domains and are stored by a browser on the user's computer. The primary purpose of a cookie is to store information about a user during or after his or her visit within an online service. Stored information may include, for example, language settings on a website, login status, a shopping cart, or where a video was watched. We further include in the term cookies other technologies that perform the same functions as cookies (e.g., when user information is stored using pseudonymous online identifiers, also referred to as "user IDs")

The following cookie types and functions are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed his browser.
• Permanent cookies: Permanent cookies remain stored even after the browser is closed. For example, the login status can be saved, or preferred content can be displayed directly when the user visits a website again. Likewise, the interests of users used for reach measurement or marketing purposes can be stored in such a cookie.
• First-party cookies: First-party cookies are set by us.
• Third-party cookies (also: third-party cookies): Third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
• Necessary (also: essential or absolutely necessary) cookies: Cookies may be absolutely necessary for the operation of a website (e.g., to store logins or other user input or for security reasons).
• Statistical, marketing and personalization cookies: Furthermore, cookies are generally also used in the context of range measurement and when a user's interests or behavior (e.g. viewing certain content, using functions, etc.) on individual websites are stored in a user profile. Such profiles are used, for example, to show users content that matches their potential interests. This process is also referred to as "tracking", i.e., tracking the potential interests of users. Insofar as we use cookies or "tracking" technologies, we will inform you separately in our data protection declaration or in the context of obtaining consent.

Notes on legal bases: the legal basis on which we process your personal data using cookies depends on whether we ask you for consent. If this is the case and you consent to the use of cookies, the legal basis for processing your data is your declared consent. Otherwise, the data processed with the help of cookies is processed based on our legitimate interests (e.g., in the business operation of our online offer and its improvement) or, if the use of cookies is necessary to fulfill our contractual obligations.

Processing of cookie data based on consent: We use a cookie consent management procedure, in the context of which the consent of users to the use of cookies, or the processing and providers mentioned in the cookie consent management procedure can be obtained and managed and revoked by users. Here, the declaration of consent is stored in order not to have to repeat its query and to be able to prove the consent in accordance with the legal obligation. The storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or with the help of comparable technologies), to be able to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following information applies: The duration of the storage of consent can be up to two years. Here, a pseudonymous user identifier is formed and stored with the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers) as well as the browser, system and end device used.

Cookie settings/opposition

• Types of data processed: Usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses) yxlon.comet.tech/manage-consent.
• Data Subjects: Users (e.g., website visitors, users of online services).
• Legal basis: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• Cookiebot: cookie consent management; service provider: Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark; Website: https://www.cookiebot.com/de; Privacy policy: https://www.cookiebot.com/de/privacy-policy/; Stored data (on the service provider's server): The user's IP number in anonymized form (the last three digits are set to 0), Date and time of consent, Browser details, The URL from which the consent was sent, An anonymous, random and encrypted key value; The user's consent status.

Business services

We process data of our contractual and business partners, e.g., customers and prospective customers (collectively referred to as "contractual partners") in the context of contractual and comparable legal relationships as well as related measures and in the context of communication with contractual partners (or pre-contractual), e.g., to answer inquiries.

We process this data to fulfill our contractual obligations, to secure our rights and for the purposes of the administrative tasks associated with this information as well as for business organization. Within the framework of applicable law, we only disclose the data of contractual partners to third parties to the extent that this is necessary for the purposes or for the fulfillment of legal obligations or with the consent of the data subjects (e.g., to participating telecommunications, transport, and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Contractual partners will be informed about further forms of processing, e.g., for marketing purposes, within the scope of this data protection declaration.

We inform the contractual partners which data is required for the purposes before or during data collection, e.g., in online forms, by means of special marking (e.g., colors) or symbols (e.g., asterisks or similar), or in person.

We delete the data after the expiry of legal warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., if it must be kept for legal archiving reasons (e.g., for tax purposes generally 10 years). We delete data disclosed to us by the contractual partner as part of an order in accordance with the specifications of the order, generally after the end of the order.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and data protection notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

Further information on commercial services: We process the data of our customers as well as clients (hereinafter uniformly referred to as "Customers") to enable them to select, acquire or commission the selected services or works as well as related activities as well as their payment and delivery or execution or performance.

The required data is identified as such in the context of the order, purchase order or comparable contract conclusion and includes the data required for the provision of services and billing as well as contact information to be able to hold any consultations.

• Types of data processed: inventory data (e.g., names, addresses), payment data (e.g., bank details, invoices, payment history), contact data (e.g., e-mail, telephone numbers), contract data (e.g., subject matter of contract, term, customer category).
• Data subjects: Prospective customers, business, and contractual partners.
• Purposes of processing: provision of contractual services and customer services, contact requests and communication, office and organizational procedures, administration, and response to requests.
• Legal basis: Contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legal obligation (Art. 6 para. 1 p. 1 lit. c. DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Credit assessment

If we make advance payments or enter comparable economic risks (e.g., when ordering on account), we reserve the right to obtain identity and creditworthiness information for the purpose of assessing the credit risk based on mathematical-statistical procedures from specialized service providers (credit agencies) to protect our legitimate interests.

We process the information received from the credit agencies on the statistical probability of a payment default within the framework of an appropriate discretionary decision on the establishment, implementation, and termination of the contractual relationship. We reserve the right to refuse payment on account or other advance performance in the event of a negative result of the credit check.

In accordance with Art. 22 DSGVO, the decision as to whether we provide advance performance is made solely based on an automated decision in the individual case, which is made by our software based on the information from the credit agency.

If we obtain explicit consent from contractual partners, the legal basis for the credit rating information and the transmission of the customer's data to the credit agencies is the consent. If no consent is obtained, the credit information is provided based on our legitimate interests in the default security of our payment claims.

• Types of data processed: inventory data (e.g., names, addresses), payment data (e.g., bank details, invoices, payment history), contact data (e.g., e-mail, telephone numbers), contract data (e.g., subject matter of the contract, term, customer category).
• Data subjects: Customers, prospective customers.
• Purposes of processing: assessment of creditworthiness and credit standing.
• Legal basis: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).
• Automated decisions in individual cases: credit information (decision based on a credit check).

Services used and service providers:

• Dun & Bradstreet Deutschland GmbH: credit agency; service provider: Dun & Bradstreet Deutschland GmbH, Robert-Bosch-Strasse 11, 64293 Darmstadt, Germany; website: https://www.dnb.com/de-de/; privacy policy: https://www.dnb.com/de-de/datenschutz/.
• Creditreform Boniversum GmbH and Verband der Vereine Creditreform e.V.: Credit reference agency; service provider: Creditreform Boniversum GmbH, Hammfelddamm 13, 41460 Neuss, Germany; Website: https://www.boniversum.de/ ; Privacy policy: https://www.boniversum.de/datenschutzerklaerung/.

Provision of the online offer and web hosting

To provide our online offer securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security services and technical maintenance services.

The data processed as part of the provision of the hosting offer may include all information relating to the users of our online offer, which is generated as part of the use and communication. This regularly includes the IP address, which is necessary to be able to deliver the contents of online offers to browsers, and all entries made within our online offer or from websites.

E-mail sending and hosting: The web hosting services we use also include the sending, receiving, and storing of e-mails. For these purposes, the addresses of the recipients and senders as well as further information regarding the e-mail dispatch (e.g., the providers involved) and the contents of the respective e-mails are processed. The data may also be processed for SPAM detection purposes. Please note that e-mails are generally not sent encrypted on the Internet. As a rule, e-mails are encrypted in transit, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and received. Therefore, we cannot assume any responsibility for the transmission path of the e-mails between the sender and the reception on our server.

Collection of access data and log files: We ourselves (or our web hosting provider) collect data on each access to the server (so-called server log files). The server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

The server log files may be used on the one hand for security purposes, e.g., to prevent server overload (especially in the event of abusive attacks, so-called DDoS attacks) and on the other hand to ensure the utilization of the servers and their stability.

Microsoft Azure: services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacities); service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; website: https://azure.microsoft.com/de-de/; privacy policy: https://azure.microsoft.com/de-de/overview/trusted-cloud/privacy/.

• Types of data processed: Content data (e.g., entries in online forms), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: provision of our online offer and user-friendliness.
• Legal grounds: legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Blogs and publication media

We use blogs or comparable means of online communication and publication (hereinafter "publication medium"). Readers' data are processed for the purposes of the publication medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons. For the rest, we refer to the information on the processing of visitors to our publication medium within the scope of this data protection notice.

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., entries in online forms), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: provision of contractual services and customer services, feedback (e.g., collecting feedback via online form).
• Legal grounds: contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Contact and request management

When contacting us (e.g. by post, contact form, email, telephone or via social media) and in the context of existing user and business relationships, the data of the inquiring persons are processed insofar as this is necessary to answer the contact inquiries and any requested measures.

• Processed data types: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. text or image messages and contributions as well as the information relating to them, such as information on authorship or time of creation); usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and process data (e.g. IP addresses, time data, identification numbers, persons involved). Contract data (e.g. subject matter of the contract, term, customer category).
• Affected persons: Communication partners; service recipients and clients; interested parties. Business and contractual partners.
• Purposes of Processing: Communication; organizational and administrative procedures; feedback (e.g. collecting feedback via online form); Provision of our online services and usability; Conversion tracking (Measurement of the effectiveness of marketing activities). Marketing.
• Storage and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion".
• Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR). Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Further information on processing operations, procedures and services:

• Contact form: When contacting us via our contact form, by e-mail or other communication channels, we process the personal data transmitted to us to answer and process the respective request. This generally includes details such as name, contact information and any other information that is provided to us and is required for appropriate processing. We use this data exclusively for the stated purpose of establishing contact and communication; legal basis: contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Services used and service providers:

• Pardot (Salesforce Account Engagement): Marketing automation for the acquisition of contacts, their management, targeting and conversion measurement; Service provider: salesforce.com Deutschland GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.salesforce.com/de; Privacy Policy: https://www.salesforce.com/de/company/privacy; Data processing agreement: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/data-processing-addendum.pdf; Basis for third country transfers: Standard Contractual Clauses (https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/scc-amendment.pdf); Further information: Data Transfer Impact Assessment & Salesforce Services: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Privacy/dpia-and-salesforce-services.pdf.
• Salesforce Sales Cloud: Quotation and sales support as well as process management with creation of prospect and customer profiles, analysis and feedback functions; Service provider: salesforce.com Deutschland GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.salesforce.com/de; Privacy Policy: https://www.salesforce.com/de/company/privacy; Data processing agreement: https://www.salesforce.com/company/privacy/; Basis for third country transfers: Data Privacy Framework (DPF). Further information: Data Transfer Impact Assessments: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Privacy/dpia-and-salesforce-services.pdf?bc=OTH.

Video conferencing, online meetings, webinars, and screen sharing

We use platforms and applications of other providers (hereinafter referred to as "conference platforms") for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as "conference"). When selecting the Conference Platforms and their services, we comply with the legal requirements.

Data Processed by Conference Platforms: While participating in a conference, the conference platforms process the personal data of the participants mentioned below. The scope of the processing depends on the one hand, on which data is requested in the context of a specific conference (e.g., provision of access data or clear names) and which optional information is provided by the participants. In addition to processing for the purpose of conducting the conference, participants' data may also be processed by the conference platforms for security purposes or service optimization. The processed data includes personal data (first name, last name), contact information (e-mail address, telephone number), access data (access codes or passwords), profile pictures, information on professional position/function, the IP address of the Internet access, information on the participants' terminal devices, their operating system, the browser and its technical and language settings, information on the content of the communications, i.e. entries in chats and audio and video data, as well as the use of other available functions (e.g. surveys). Content of communications is encrypted to the extent technically provided by the conference providers. If participants are registered as users with the conference platforms, then further data may be processed according to the agreement with the respective conference provider.

Logging and recordings: If text entries, participation results (e.g., from surveys), and video or audio recordings are logged, this will be transparently communicated to participants in advance, and they will be asked for consent - if necessary.

Data protection measures of the participants: Please note the details of the processing of your data by the conference platforms in their data protection notices and select the security and data protection settings that are optimal for you within the framework of the settings of the conference platforms. Furthermore, please ensure data and privacy protection in the background of your recording for the duration of a videoconference (e.g., by notifying roommates, locking doors, and using the background obscuring function, if technically possible). Links to the conference rooms as well as access data, may not be passed on to unauthorized third parties.

Notes on legal bases: if, in addition to the conference platforms, we also process users' data and ask users for their consent to use the conference platforms or certain functions (e.g., consent to a recording of conferences), the legal basis of the processing is this consent. Furthermore, our processing may be necessary for the fulfillment of our contractual obligations (e.g., in lists of participants, in the case of reprocessing of call results, etc.). Otherwise, user data is processed based on our legitimate interests in efficient and secure communication with our communication partners.

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., entries in online forms), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Communication partners, users (e.g., website visitors, users of online services).
• Purposes of processing: provision of contractual services and customer service, contact requests and communication, office, and organizational procedures.
• Legal bases: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• Microsoft Ireland Operations Ltd:
  Software-as-a-Service (including M365 covering Mail, Sharepoint, OneDrive, Teams, etc.); Infrastructure-as-a-Service, Platform-as-a-Service (including Azure)
  Address: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521
  Website: https://microsoft.com/de-de; privacy policy: https://privacy.microsoft.com/de-de/privacystatement, security information: https://www.microsoft.com/de-de/trustcenter.
• TeamViewer: conferencing software; service provider: TeamViewer GmbH, Jahnstr. 30, 73037 Göppingen, Germany; website: https://www.teamviewer.com/de; privacy policy: https://www.teamviewer.com/de/datenschutzerklaerung/.
• Zoom: video conferencing, web conferencing, and webinars; service provider: Zoom Video Communications, Inc, 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA; Website: https://zoom.us; Privacy Policy: https://zoom.us/docs/de-de/privacy-and-legal.html; Standard Contractual Clauses (ensuring level of data protection in case of processing in third countries): https://zoom.us/docs/de-de/privacy-and-legal.html (Designated as Global DPA).

Application Procedure

The application procedure requires applicants to provide us with the data necessary for their assessment and selection. What information is required is determined by the job description or, in the case of online forms, by the information provided there.

In principle, the required information includes personal information such as name, address, contact details, and proof of the qualifications required for a position. Upon request, we will be happy to provide additional information as to what information is required.

If provided, applicants can submit their applications to us using an online form. The data is transmitted to us in encrypted form in accordance with the state of the art. Applicants can also send us their applications by e-mail. Please note, however, that e-mails sent via the Internet are generally not encrypted. As a rule, e-mails are encrypted in transit, but not on the servers from which they are sent and received. Therefore, we cannot assume any responsibility for the transmission path of the application between the sender and the reception on our server.

For purposes of applicant search, submission of applications, and selection of applicants, we may use third-party applicant management, or recruitment software and platforms and services, subject to legal requirements.
Applicants are welcome to contact us regarding the method of submission of the application or to send us the application by mail.

Processing of special categories of data: insofar as special categories of personal data within the meaning of Art. 9 (1) DSGVO (e.g. health data, such as severely disabled status or ethnic origin) are requested from applicants as part of the application process in order for the controller or the data subject to exercise the rights accruing to him or her under labor law and social security and social protection law and to comply with his or her obligations in this regard, their processing is carried out in accordance with Art. 9 (2) letter b. DSGVO, in case of protection of vital interests of the applicants or other persons according to Art. 9 para. 2 lit. c. DSGVO or for the purposes of preventive health care or occupational medicine, for the assessment of the employee's ability to work, for medical diagnostics, for care or treatment in the health or social sector or for the management of systems and services in the health or social sector pursuant to Art. 9 para. 2 lit. h. DSGVO. In the case of notification of the special categories of data based on voluntary consent, their processing is based on Art. 9 para. 2 lit. a. DSGVO.

Deletion of data: The data provided by applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if the application for a job offer is not successful, the applicants' data will be deleted. Applicants' data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Subject to a justified withdrawal by the applicants, the deletion will take place at the latest after the expiry of a period of six months so that we can answer any follow-up questions about the application and meet our obligations to provide evidence under the regulations on equal treatment of applicants. Invoices for any reimbursement of travel expenses will be archived in accordance with tax law requirements.

Inclusion in an applicant pool: Inclusion in an applicant pool, if offered, is based on consent. Applicants are informed that their consent to inclusion in the talent pool is voluntary, has no influence on the current application process, and that they can revoke their consent at any time in the future.

• Types of data processed: applicant data (e.g., personal details, postal and contact addresses, the documents belonging to the application, and the information contained therein, such as cover letter, CV, certificates, and other information provided regarding a specific position or voluntarily by applicants regarding their person or qualifications).
• Data subjects: Applicants.
• Purposes of processing: application procedure (establishment and possible subsequent implementation as well as possible subsequent termination of the employment relationship).
• Legal basis: application procedure as a pre-contractual or contractual relationship (Art. 9(2)(b) DSGVO).

Services used and service providers:

Stepstone: recruiting platform and services; service provider: StepStone Deutschland GmbH, Völklinger Straße 1, 40219 Düsseldorf, Germany; website: https://www.stepstone.de; privacy policy: https://www.stepstone.de/Ueber-StepStone/Rechtliche-Hinweise/datenschutzerklaerung/.

Cloud services

We use software services accessible via the Internet and running on the servers of their providers (so-called "cloud services", also referred to as "software as a service") for the following purposes: document storage and management, calendar management, e-mail dispatch, spreadsheets and presentations, exchange of documents, content, and information with specific recipients or publication of web pages, forms or other content and information, as well as chats and participation in audio and video conferences.

In this context, personal data may be processed and stored on the servers of the providers to the extent that these are part of communication processes with us or are otherwise processed by us as set out in the context of this privacy policy. This data may include master data and contact data of users, data on transactions, contracts, other processes and their contents. The cloud service providers also process usage data and metadata used by them for security purposes and service optimization.

If we use the cloud services to provide forms or other documents and content to other users or publicly accessible websites, the providers may store cookies on the users' devices for the purpose of web analytics or to remember users' settings (e.g., in the case of media control).

Notes on legal bases: If we ask for consent to use the cloud services, the legal basis of the processing is consent. Furthermore, their use may be a component of our (pre)contractual services, provided that the use of the cloud services has been agreed upon within this framework. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient and secure management and collaboration processes)

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, phone numbers), content data (e.g., entries in online forms), usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Customers, employees (e.g., employees, applicants, former employees), prospective customers, communication partners.
• Purposes of processing: office and organizational procedures.
• Legal bases: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• Microsoft Ireland Operations Ltd
  Software-as-a-Service (including M365 covering Mail, Sharepoint, OneDrive, Teams, etc.); Infrastructure-as-a-Service, Platform-as-a-Service (including Azure)
  Address: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521
  Website: https://microsoft.com/de-de; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement, Security Notice: https://www.microsoft.com/de-de/trustcenter.
• DarkTrace
  Email and Office365 Security
  Address: Maurice Wilkes Building, Cow-ley Road, Cam-bridge, CB4 0DS
  Web site: https://www.darktrace.com
• NetApp
  SaaS Backup Solution for Office 365 and Exchange
  Address: 3060 Olsen Drive, San Jose, CA 95128, United States
• Trust-Center: https://us.saasbackup.netapp.com/resources/trustcenter?__hstc=&__hssc=&hsCtaTracking=751d1cfb-2f6f-474c-859a-6404c6fa9cd1%7C66942063-339e-4242-925c-0c0619b02c73

Newsletter and electronic notifications

We send newsletters, emails and other electronic notifications (hereinafter "newsletter") exclusively with the consent of the recipient or on the basis of a legal basis. If the contents of the newsletter are mentioned in the context of a registration for the newsletter, these contents are decisive for the consent of the users. To subscribe to our newsletter, it is normally sufficient to provide your e-mail address. However, in order to be able to offer you a personalized service, we may ask you to provide your name so that we can address you personally in the newsletter or to provide further information if this is necessary for the purpose of the newsletter.

Deletion and restriction of processing: We may store the unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before deleting them in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of a potential defense against claims. An individual request for erasure is possible at any time, provided that the former existence of consent is confirmed at the same time. In the event of obligations to permanently observe objections, we reserve the right to store the e-mail address in a block list solely for this purpose.

The registration process is logged on the basis of our legitimate interests for the purpose of verifying that it is carried out properly. If we commission a service provider to send e-mails, this is done on the basis of our legitimate interests in an efficient and secure sending system.

Contents:

Information about us, our services, promotions and offers.

• • Processed data types: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); meta, communication and process data (e.g. IP addresses, time data, identification numbers, persons involved). Usage data (e.g. page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
  • Affected persons: Communication partner.
  • Purposes of processing: Direct marketing (e.g. by email or post).
  • Retention and deletion: 3 years - Contractual claims (AT) (Data necessary to consider potential warranty and compensation claims or similar contractual claims and rights, as well as to process related inquiries, based on past business experience and standard industry practices, will be stored for the duration of the regular statutory limitation period of three years (§§ 1478, 1480 ABGB)). 10 years - Contractual claims (CH) (Data necessary for the consideration of potential claims for damages or similar contractual claims and rights, as well as for the processing of related inquiries, based on past business experience and standard industry practices, will be stored for the statutory limitation period of ten years, unless a shorter period of 5 years applies, which is relevant in certain cases (Art. 127, 130 CO)).
  • Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).
  • Option to object (opt-out): You can cancel the receipt of our newsletter at any time, i.e. revoke your consent or object to further receipt. You will find a link to unsubscribe from the newsletter either at the end of each newsletter or you can use one of the contact options listed above, preferably e-mail.

Further information on processing operations, procedures and services:

• Measurement of opening and click rates: The newsletters contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved from our server or its server, if we use a dispatch service provider, when the newsletter is opened. As part of this retrieval, technical information, such as details of the browser and your system, as well as your IP address and the time of retrieval are initially collected. This information is used for the technical improvement of our newsletter based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or the access times. This analysis also includes determining whether and when the newsletters are opened and which links are clicked on. The information is assigned to the individual newsletter recipients and stored in their profiles until it is deleted. The evaluations are used to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. The measurement of opening and click rates as well as the storage of the measurement results in the user profiles and their further processing are based on the user's consent. Unfortunately, it is not possible to revoke the performance measurement separately; in this case, the entire newsletter subscription must be canceled or objected to. In this case, the stored profile information will be deleted; legal basis: consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

Services used and service providers:

• Pardot (Salesforce Account Engagement): Marketing automation for the acquisition of contacts, their management, targeting and conversion measurement; Service provider: salesforce.com Deutschland GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.salesforce.com/de; Privacy Policy: https://www.salesforce.com/de/company/privacy; Data processing agreement: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/data-processing-addendum.pdf; Basis for third country transfers: Standard Contractual Clauses (https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/scc-amendment.pdf); Further information: Data transfer impact assessment &.
  Salesforce Services: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Privacy/dpia-and-salesforce-services.pdf.

Promotional communication via e-mail, mail, fax, or telephone

We process personal data for the purposes of promotional communication, which may take place via various channels, such as e-mail, telephone, mail, or fax, in accordance with legal requirements.

Recipients have the right to revoke consent given at any time or to object to promotional communication at any time.
After revocation or objection, we may store the data required to prove consent for up to three years based on our legitimate interests before deleting it. The processing of this data will be limited to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time.

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers).
• Data subjects: Communication partners.
• Purposes of processing: direct marketing (e.g., by e-mail or post).
• Legal basis: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Surveys and polls

The surveys and questionnaires we conduct (hereinafter "surveys") are evaluated anonymously. Personal data is only processed insofar as this is necessary for the provision and technical implementation of the surveys (e.g. processing of the IP address in order to display the survey in the user's browser or to enable the survey to be resumed with the aid of a temporary cookie (session cookie)) or users have consented to this.

Notes on legal bases: if we ask participants for consent to process their data, this is the legal basis for the processing; otherwise, the processing of participants' data is based on our legitimate interests in conducting an objective survey.

• Types of data processed: contact data (e.g., email, phone numbers), content data (e.g., input in online forms, interview responses), usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Communication partners, customers
• Purposes of processing: contact inquiries and communication, direct marketing (e.g., by e-mail or postal mail).
• Legal basis: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• SurveyMonkey: SurveyMonkey survey services; service provider: SurveyMonkey Inc, 1 Curiosity Way, San Mateo, California 94403, USA; website: https://www.surveymonkey.de; privacy policy: https://www.surveymonkey.de/mp/policy/privacy-policy/?ut_source=footer.
• Verinion: agency:
  Verinion, Am Sandtorkai 1, 20457 Hamburg, Germany;
  Website: https://verinion.com/; Privacy policy: https://verinion.com/datenschutz/

Web analysis, monitoring and optimization

Web analysis (also referred to as "reach measurement") is used to evaluate the flow of visitors to our online offering and may include behavior, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognize at what time our online offer or its functions or content are most frequently used, or invite visitors to reuse them. It also enables us to understand which areas require optimization.

In addition to web analysis, we may also use test procedures, for example to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e. data summarized for a usage process, can be created for these purposes and information can be stored in a browser or in a terminal device and then read out. The information collected includes, in particular, websites visited and the elements used there as well as technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data from us or from the providers of the services we use, it is also possible to process location data.

In addition, the IP addresses of users are stored. However, we use an IP masking procedure (i.e. pseudonymization by shortening the IP address) to protect users. In general, no clear user data (such as e-mail addresses or names) is stored in the context of web analysis, A/B testing and optimization, but pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purpose of the respective process.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and process data (e.g. IP addresses, time data, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles). Provision of our online services and user-friendliness.
• Storage and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion". Storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Services used and service providers:

• Google Analytics: We use Google Analytics to measure and analyze the use of our online offering on the basis of a pseudonymous user identification number. This identification number does not contain any unique data, such as names or e-mail addresses. It is used to assign analysis information to an end device in order to recognize which content users have called up within one or more usage processes, which search terms they have used, which they have called up again or which they have interacted with our online offering. The time of use and its duration are also stored, as well as the sources of the users who refer to our online offering and technical aspects of their end devices and browsers.
   Pseudonymous profiles of users are created with information from the use of various devices, whereby cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides rough geographic location data by deriving the following metadata from IP addresses: City (and the city's inferred latitude and longitude), Continent, Country, Region, Subcontinent (and ID-based counterparts). For EU traffic, IP address data is used exclusively for this derivation of geolocation data before it is immediately deleted. They are not logged, are not accessible and are not used for other purposes. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers before the traffic is forwarded to Analytics servers for processing; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymization of the IP address); Privacy Policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third country transfers: Data Privacy Framework (DPF); Opt-Out: Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=de; Settings for the display of advertisements: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (types of processing and processed data).
• Google Tag Manager: We use Google Tag Manager, a software from Google that enables us to manage so-called website tags centrally via a user interface. Tags are small code elements on our website that are used to record and analyze visitor activity. This technology helps us to improve our website and the content offered on it. The Google Tag Manager itself does not create any user profiles, does not store any cookies with user profiles and does not carry out any independent analyses. Its function is limited to simplifying the integration and management of tools and services that we use on our website and making them more efficient. Nevertheless, when using the Google Tag Manager, the user's IP address is transmitted to Google, which is necessary for technical reasons in order to implement the services we use. Cookies may also be set in the process. However, this data processing only takes place if services are integrated via the Tag Manager. For more detailed information on these services and their data processing, please refer to the further sections of this privacy policy; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Data processing agreement:
  https://business.safety.google/adsprocessorterms. Basis for third country transfers: Data Privacy Framework (DPF).

Online marketing

We process personal data for the purpose of online marketing, which may include in particular the marketing of advertising space or the presentation of advertising and other content (collectively referred to as "content") based on the potential interests of users and the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (the so-called "cookie") or similar procedures are used, by means of which the information about the user relevant for the presentation of the aforementioned content is stored. This may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information, such as the browser used, the computer system used and information on usage times and functions used. If users have consented to the collection of their location data, this can also be processed.

The IP addresses of users are also stored. However, we use available IP masking procedures (i.e. pseudonymization by shortening the IP address) for user protection. In general, no clear user data (such as e-mail addresses or names) is stored as part of the online marketing process, but pseudonyms. This means that neither we nor the providers of the online marketing procedures know the actual identity of the users, but only the information stored in their profiles.

The statements in the profiles are generally stored in cookies or by means of similar procedures. These cookies can generally also be read later on other websites that use the same online marketing process and analyzed for the purpose of displaying content and supplemented with further data and stored on the server of the online marketing process provider.

In exceptional cases, it is possible to assign clear data to the profiles, primarily if, for example, the users are members of a social network whose online marketing processes we use and the network links the user profiles with the aforementioned data. Please note that users can make additional agreements with the providers, for example by giving their consent during registration.

In principle, we only receive access to summarized information about the success of our advertisements. However, as part of so-called conversion measurements, we can check which of our online marketing procedures have led to a so-called conversion, i.e., for example, to the conclusion of a contract with us. The conversion measurement is used solely to analyze the success of our marketing measures.

Unless otherwise stated, we ask you to assume that cookies are stored for a period of two years.

• Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is permission. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.
• Information on revocation and objection: We refer to the data protection notices of the respective providers and the opt-out options provided by the providers. If no explicit opt-out option has been specified, you have the option of deactivating cookies in your browser settings. However, this may restrict the functions of our online offer. We therefore recommend the following additional opt-out options, which are summarized for the respective areas:

1. a) Europe: https://www.youronlinechoices.eu.
2. b) Canada: https://www.youradchoices.ca/choices.
3. c) USA: https://www.aboutads.info/choices.
4. d) Cross-territory: https://optout.aboutads.info.

• Processed data types: Usage data (e.g. page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, time data, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of Processing: Web Analytics (e.g. access statistics, recognition of returning visitors); Targeting (e.g. profiling based on interests and behavior, use of cookies); Custom Audiences; Marketing; Profiles with user-related information (Creating user profiles); Conversion tracking (Measurement of the effectiveness of marketing activities); Remarketing; Provision of our online services and usability.
• Storage and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion"; storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).

Further information on processing operations, procedures and services:

• Google Ads and conversion measurement: online marketing process for the purpose of placing content and ads within the service provider's advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who have a presumed interest in the ads. In addition, we measure the conversion of the ads, i.e. whether users have taken them as an opportunity to interact with the ads and use the advertised offers (so-called conversions). However, we only receive anonymous information and no personal information about individual users; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland); Further information: Types of processing and data processed: https://business.safety.google/adsservices/; Data processing conditions between controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms.
• Google Ads Remarketing: Google Remarketing, also known as retargeting, is a technology that allows users who use an online service to be added to a pseudonymous remarketing list so that users can be shown ads on other online offers based on their visit to the online service; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland); Further information: Types of processing and data processed: https://business.safety.google/adsservices/; Data processing conditions between controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms.
• Extended conversions for Google Ads: If users click on our Google ads and subsequently use the advertised service (so-called "conversion"), the data entered by the user, such as the e-mail address, name, home address or telephone number, can be transmitted to Google. The hash values are then compared with existing Google accounts of the users in order to better evaluate and improve the interaction of the users with the ads (e.g. clicks or views) and thus their performance; legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://support.google.com/google-ads/answer/9888656.
• LinkedIn Insight Tag: Code that is loaded when a user visits our online offering and tracks the user's behaviour and conversions and stores them in a profile (possible purposes: measuring campaign performance, optimizing ad delivery, building custom and lookalike audiences); Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy, Cookie Policy: https://www.linkedin.com/legal/cookie_policy; Data processing agreement: https://www.linkedin.com/legal/l/dpa; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland); Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Pardot (Salesforce Account Engagement):Pardot (Salesforce Account Engagement): Marketing automation for the acquisition of contacts, their management, targeting and conversion measurement; Service provider: salesforce.com Deutschland GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://www.salesforce.com/de; Privacy Policy: https://www.salesforce.com/en/company/privacy; Data processing agreement: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/data-processing-addendum.pdf; Basis for third country transfers: EU/EEA - Standard Contractual Clauses (https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/scc-amendment.pdf), Switzerland - Adequacy Decision (Germany); Further information: Data transfer impact assessment &
• Salesforce Services: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Privacy/dpia-and-salesforce-services.pdf.
• Google Analytics: We use Google Analytics to measure and analyze the use of our online offering on the basis of a pseudonymous user identification number. This identification number does not contain any unique data, such as names or e-mail addresses. It is used to assign analysis information to an end device in order to recognize which content users have called up within one or more usage processes, which search terms they have used, which they have called up again or which they have interacted with our online offering. The time of use and its duration are also stored, as well as the sources of the users that refer to our online offering and technical aspects of their end devices and browsers.
• Pseudonymous profiles of users are created with information from the use of various devices, whereby cookies can be used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides rough geographic location data by deriving the following metadata from IP addresses: City (and the city's inferred latitude and longitude), Continent, Country, Region, Subcontinent (and ID-based counterparts). For EU traffic, IP address data is used exclusively for this derivation of geolocation data before it is immediately deleted. They are not logged, are not accessible and are not used for other purposes. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers before the traffic is forwarded to Analytics servers for processing; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymization of the IP address); Privacy Policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - adequacy decision (Ireland); Opt-Out: Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of advertisements: https://myadcenter.google.com/personalizationoff; Further information: https://business.safety.google/adsservices/ (Types of processing and processed data).

Presence in social networks (social media)

We maintain online presences within social networks and process user data in this context to communicate with users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may result in risks for the users because, for example, it could make it more difficult to enforce the rights of the users.

Furthermore, user data is usually processed within social networks for market research and advertising purposes. For example, user profiles can be created based on the user behavior and resulting interests of the users. The user profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users' computers, in which the user behavior and interests of the users are stored. Furthermore, data independent of the devices used by the users may also be stored in the user profiles (especially if the users are members of the respective platforms and are logged in to them).

For a detailed presentation of the respective forms of processing and the options to object (opt-out), we refer to the privacy statements and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. If you still need assistance, you can contact us.

• Types of data processed: contact data (e.g., e-mail, telephone numbers), content data (e.g., entries in online forms), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: contact requests and communication, feedback (e.g., collecting feedback via online form), marketing.
• Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• LinkedIn: social network; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Twitter: social network; service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; parent company: Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; privacy policy: https://twitter.com/de/privacy, (settings) https://twitter.com/personalization.
• YouTube: Social network and video platform; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; privacy policy: https://policies.google.com/privacy; opt-out: https://adssettings.google.com/authenticated.

Plugins and embedded functions and content

We integrate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These can be, for example, graphics, videos, or city maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the user, since without the IP address they could not send the content to their browser. The IP address is thus required for the display of this content or functionality. We strive to use only such content whose respective providers use the IP address only for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to analyze information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit, and other information about the use of our online offer as well as be linked to such information from other sources.

Notes on legal basis: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is consent. Otherwise, users' data is processed based on our legitimate interests (i.e., interest in efficient, economic, and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Integration of third-party software, scripts, or frameworks (e.g., jQuery): We integrate software into our online offering that we retrieve from servers of other providers (e.g., function libraries that we use for the purpose of displaying or making our online offering user-friendly). In doing so, the respective providers collect the IP address of the users and may process this for purposes of transmitting the software to the users' browsers and for security purposes, as well as for evaluating and optimizing their offer.

• Types of data processed: Usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses), inventory data (e.g. names, addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., entries in online forms).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: provision of our online offer and user-friendliness, provision of contractual services and customer service.
• Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO), consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO).

Services used and service providers:

• MyFonts: Fonts; data processed as part of font retrieval the webfont project identification number (anonymized), the URL of the licensed website associated with a customer number to identify the licensee and the licensed webfonts, and the referrer URL; the anonymized webfont project identification number is stored in encrypted log files with such data for 30 days to determine the monthly number of page views; After such extraction and storage of the number of page views, the log files are deleted; Service Provider: Monotype Imaging Holdings Inc, 600 Unicorn Park Drive, Woburn, Massachusetts 01801, USA; Website: https://www.myfonts.co; Privacy Policy: https://www.myfonts.com/info/legal/#Privacy.
• reCAPTCHA: We integrate the "reCAPTCHA" function to be able to recognize whether entries (e.g., in online forms) are made by humans and not by automatically acting machines (so-called "bots"). Processed data may include IP addresses, information about operating systems, devices or browsers used, language settings, location, mouse movements, keyboard strokes, time spent on web pages, previously visited web pages, interactions with ReCaptcha on other web pages, possibly cookies, and results of manual recognition processes (e.g., answering questions asked or selecting objects in images). Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.google.com/recaptcha/; privacy policy: https://policies.google.com/privacy; opt-out: Opt-Out Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Ad Display Settings: https://adssettings.google.com/authenticated.
• YouTube videos: Video content; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.youtube.com; privacy policy: https://policies.google.com/privacy; opt-out: Opt-Out Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Ad Display Settings: https://adssettings.google.com/authenticated.
• YouTube videos: Video content; YouTube is integrated via the domain https://www.youtube-nocookie.com in the so-called "Enhanced Privacy Mode", whereby no cookies on user activities are collected to personalize video playback. Nevertheless, information on user interaction with the video (e.g. remembering the last playback point), may be stored; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.youtube.com; privacy policy: https://policies.google.com/privacy.

Management, organization, and support tools

We use services, platforms, and software from other providers (hereinafter referred to as "Third Party Providers") for the purposes of organizing, managing, planning as well as providing our services. When selecting third-party providers and their services, we observe the legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. This may involve various data that we process in accordance with this privacy policy. This data may include master data and contact data of users, data on transactions, contracts, other processes, and their contents.

If users are referred to the third-party providers or their software or platforms during communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimization or marketing purposes. We therefore ask you to observe the data protection notices of the respective third-party providers.

Notes on legal basis: If we ask users for their consent to use the third-party providers, the legal basis for processing data is consent. Furthermore, their use may be a component of our (pre)contractual services, provided that the use of the third-party providers has been agreed within this framework. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., entries in online forms), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Communication partners, users (e.g., website visitors, users of online services).
• Purposes of processing: contact requests and communication, managing and responding to requests, feedback (e.g., collecting feedback via online form), surveys and questionnaires (e.g., surveys with input options, multiple choice questions), profiles with user-related information (creating user profiles).
• Legal basis: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• Hootsuite: social media management platform that offers a range of integrated solutions for measurement & benchmarking, performance optimization, visualization & analysis, content creation and publishing, and community maintenance; service provider: HootSuite Media Inc, 5 East 8th Ave. Vancouver, V5T 1R6, Canada; website: https://hootsuite.com; privacy policy: https://hootsuite.com/legal/privacy.

Rights of data subjects

As a data subject, you are entitled to various rights under the GDPR, which arise from Articles 15 to 21 GDPR:

• Right to object: you have the right to object at any time, on grounds relating to your situation, to the processing of personal data relating to you which is carried out based on Art. 6(1)(e) or (f) DSGVO; this also applies to profiling based on these provisions. If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to revoke any consent given at any time.
• Right to information: you have the right to request confirmation as to whether data in question is being processed and to information about this data, as well as further information and a copy of the data in accordance with the legal requirements.
• Right to rectification: you have the right, in accordance with the law, to request that data concerning you be completed or that inaccurate data concerning you be rectified.
• Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to demand that data concerning you be deleted without delay, or alternatively, in accordance with the legal requirements, to demand restriction of the processing of the data.
• Right to data portability: you have the right to receive data relating to you that you have provided to us in a structured, common, and machine-readable format, or to request that it be transferred to another controller, in accordance with the law.
• Complaint to supervisory authority: In accordance with the legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State where you usually reside, the supervisory authority of your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Supervisory authority responsible for us

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str 22, 7th floor
20459 Hamburg
Germany

Phone: +49 40 42854-4040
E-mail: mailbox@datenschutz.hamburg.de
De-Mail: hmbbfdi@hamburg.de-mail.de

Identification check

If you exercise one or more of the above rights, please understand that we may require you to provide evidence that you are the person you claim to be.

Modification and updating of the privacy policy

We will revise this privacy policy whenever changes are made to this website or other occasions require it. You will always find the current version on this website.

Status September 2023