The responsible party within the meaning of the EU General Data Protection Regulation (DSGVO) and other national data protection laws of the Federal Republic of Germany as well as other data protection regulations is:

Comet Yxlon GmbH
Essener Bogen 15
22419 Hamburg
Deutschland

Authorized representatives: Dionys van de Ven, Erik Wessel

E-mail address: yxlon@comet.tech
Phone: +49 40 52729-0.
Imprint: yxlon.comet.tech/imprint

Contact data protection officer
E-mail: dataprivacy.yxlon@comet.tech
Phone: +49 40 52729-237

Collection of general data and information about the website

Our website collects a series of general data and information with each call by a data subject or an automated system. This general data and information is stored in the so-called. Logfiles of the server. The types and versions of browsers used, the operating system used by the accessing system, the website from which an accessing system accesses our website (so-called referrer), the sub-websites that are accessed via an accessing system on our website, the date and time of access to the website, an Internet protocol address (IP address), the Internet service provider of the accessing system and other similar data and information that serve to avert danger in the event of attacks on our information technology systems can be collected.

When using these general data and information, we do not draw any conclusions about the data subject. Rather, this information is needed to correctly deliver the content of our website, to optimize the content of our website and the advertising for it, to ensure the long-term functionality of our information technology systems and the technology of our website, and to provide law enforcement authorities with the information necessary for prosecution in the event of a cyber-attack. Therefore, we statistically evaluate this anonymously collected data and information on one hand, and on the other hand, with the aim of increasing the data protection and data security of our enterprise, so as to ultimately ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from any personal data provided by a data subject

Relevant legal basis

Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Furthermore, should more specific legal bases be relevant in individual cases, we will inform you of these in the data protection declaration.

• Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO) - The data subject has given his/her consent to the processing of personal data relating to him/her for a specific purpose or purposes.
• Performance of a contract and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO) - Processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures carried out at the data subject's request.
• Legal obligation (Art. 6 (1) p. 1 lit. c. DSGVO) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 (1) p. 1 lit. f. DSGVO) - Processing is necessary for the purposes of the legitimate interests of the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
• Application procedure as a pre-contractual or contractual relationship (Art. 9 (2) lit. b DSGVO) - Insofar as special categories of personal data within the meaning of Art. 9 (1) DSGVO (e.g. Health data, such as severely disabled status or ethnic origin) are requested from applicants so that the data controller or the data subject can exercise the rights accruing to him or her under labor law and social security and social protection law and fulfill his or her obligations in this regard, their processing is carried out in accordance with Art. 9 (2) lit. b. DSGVO, in case of protection of vital interests of the applicants or other persons according to Art. 9 para. 2 lit. c. DSGVO or for the purposes of preventive health care or occupational medicine, for the assessment of the employee's ability to work, for medical diagnostics, care or treatment in the health or social sector or for the management of systems and services in the health or social sector pursuant to Art. 9 para. 2 lit. h. DSGVO. In the case of a communication of special categories of data based on voluntary consent, their processing is based on Art. 9 para. 2 lit. a. DSGVO.

If personal data is processed based on your consent, you have the right to revoke your consent at any time with effect for the future.

If we process data based on a balance of interests, you as the data subject have the right to object to the processing of personal data, considering the requirements of Art. 21 DSGVO.

National data protection regulations in Germany: In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection apply in Germany. These include the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act - BDSG). In particular, the BDSG contains special regulations on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for employment purposes (Section 26 BDSG), in particular regarding the establishment, implementation or termination of employment relationships as well as the consent of employees. Furthermore, state data protection laws of the individual federal states may apply.

Security measures

We take appropriate technical and organizational measures in accordance with the legal requirements, considering the state of the art, the implementation costs and the nature, scope, circumstances, and purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.

The measures include safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as access to, input of, disclosure of, assurance of availability of and segregation of the data. Furthermore, we have established procedures to ensure the exercise of data subjects' rights, the deletion of data, and responses to data compromise. Furthermore, we already take the protection of personal data into account during the development or selection of hardware, software as well as procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

SSL encryption (https): To protect your data transmitted via our online offer, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Transmission of personal data

During our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organizational units, or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

Data transfer within the group of companies: We may transfer personal data to other companies within our group of companies or grant them access to this data. If this transfer is for administrative purposes, the transfer of data is based on our legitimate business and business interests or is made if it is necessary for the fulfillment of our contract-related obligations or if the consent of the data subjects or legal permission exists.

Data transfer within the organization: we may transfer personal data to other entities within our organization or grant them access to this data. Where this transfer is for administrative purposes, the transfer of data is based on our legitimate business and operational interests or is made where it is necessary to fulfill our contract-related obligations or where there is consent from the data subjects or legal permission.

Data processing in third countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, entities, or companies, this will only be done in accordance with the legal requirements.

Subject to express consent or contractually or legally required transfer, we only process or have data processed in third countries with a recognized level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 DSGVO, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Deletion of data

The data processed by us will be deleted in accordance with the legal requirements as soon as their consents permitted for processing are revoked or other permissions cease to apply (e.g., if the purpose of processing this data has ceased to apply or it is not necessary for the purpose).

If the data are not deleted because they are required for other and legally permissible purposes, their processing will be limited to these purposes. That is, the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for reasons of commercial or tax law or whose storage is necessary for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person.

Within the framework of our privacy notices, we may provide users with further information regarding the deletion as well as the retention of data that is specific to the processing operation in question.

Use of cookies

Cookies are text files that contain data from visited websites or domains and are stored by a browser on the user's computer. The primary purpose of a cookie is to store information about a user during or after his or her visit within an online service. Stored information may include, for example, language settings on a website, login status, a shopping cart, or where a video was watched. We further include in the term cookies other technologies that perform the same functions as cookies (e.g., when user information is stored using pseudonymous online identifiers, also referred to as "user IDs")

The following cookie types and functions are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed his browser.
• Permanent cookies: Permanent cookies remain stored even after the browser is closed. For example, the login status can be saved, or preferred content can be displayed directly when the user visits a website again. Likewise, the interests of users used for reach measurement or marketing purposes can be stored in such a cookie.
• First-party cookies: First-party cookies are set by us.
• Third-party cookies (also: third-party cookies): Third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
• Necessary (also: essential or absolutely necessary) cookies: Cookies may be absolutely necessary for the operation of a website (e.g., to store logins or other user input or for security reasons).
• Statistical, marketing and personalization cookies: Furthermore, cookies are generally also used in the context of range measurement and when a user's interests or behavior (e.g. viewing certain content, using functions, etc.) on individual websites are stored in a user profile. Such profiles are used, for example, to show users content that matches their potential interests. This process is also referred to as "tracking", i.e., tracking the potential interests of users. Insofar as we use cookies or "tracking" technologies, we will inform you separately in our data protection declaration or in the context of obtaining consent.

Notes on legal bases: the legal basis on which we process your personal data using cookies depends on whether we ask you for consent. If this is the case and you consent to the use of cookies, the legal basis for processing your data is your declared consent. Otherwise, the data processed with the help of cookies is processed based on our legitimate interests (e.g., in the business operation of our online offer and its improvement) or, if the use of cookies is necessary to fulfill our contractual obligations.

Processing of cookie data based on consent: We use a cookie consent management procedure, in the context of which the consent of users to the use of cookies, or the processing and providers mentioned in the cookie consent management procedure can be obtained and managed and revoked by users. Here, the declaration of consent is stored in order not to have to repeat its query and to be able to prove the consent in accordance with the legal obligation. The storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or with the help of comparable technologies), to be able to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following information applies: The duration of the storage of consent can be up to two years. Here, a pseudonymous user identifier is formed and stored with the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers) as well as the browser, system and end device used.

Cookie settings/opposition

• Types of data processed: Usage data (e.g. web pages visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses) yxlon.comet.tech/manage-consent.
• Data Subjects: Users (e.g., website visitors, users of online services).
• Legal basis: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• Cookiebot: cookie consent management; service provider: Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark; Website: https://www.cookiebot.com/de; Privacy policy: https://www.cookiebot.com/de/privacy-policy/; Stored data (on the service provider's server): The user's IP number in anonymized form (the last three digits are set to 0), Date and time of consent, Browser details, The URL from which the consent was sent, An anonymous, random and encrypted key value; The user's consent status.

Business services

We process data of our contractual and business partners, e.g., customers and prospective customers (collectively referred to as "contractual partners") in the context of contractual and comparable legal relationships as well as related measures and in the context of communication with contractual partners (or pre-contractual), e.g., to answer inquiries.

We process this data to fulfill our contractual obligations, to secure our rights and for the purposes of the administrative tasks associated with this information as well as for business organization. Within the framework of applicable law, we only disclose the data of contractual partners to third parties to the extent that this is necessary for the purposes or for the fulfillment of legal obligations or with the consent of the data subjects (e.g., to participating telecommunications, transport, and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Contractual partners will be informed about further forms of processing, e.g., for marketing purposes, within the scope of this data protection declaration.

We inform the contractual partners which data is required for the purposes before or during data collection, e.g., in online forms, by means of special marking (e.g., colors) or symbols (e.g., asterisks or similar), or in person.

We delete the data after the expiry of legal warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., if it must be kept for legal archiving reasons (e.g., for tax purposes generally 10 years). We delete data disclosed to us by the contractual partner as part of an order in accordance with the specifications of the order, generally after the end of the order.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and data protection notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

Further information on commercial services: We process the data of our customers as well as clients (hereinafter uniformly referred to as "Customers") to enable them to select, acquire or commission the selected services or works as well as related activities as well as their payment and delivery or execution or performance.

The required data is identified as such in the context of the order, purchase order or comparable contract conclusion and includes the data required for the provision of services and billing as well as contact information to be able to hold any consultations.

• Types of data processed: inventory data (e.g., names, addresses), payment data (e.g., bank details, invoices, payment history), contact data (e.g., e-mail, telephone numbers), contract data (e.g., subject matter of contract, term, customer category).
• Data subjects: Prospective customers, business, and contractual partners.
• Purposes of processing: provision of contractual services and customer services, contact requests and communication, office and organizational procedures, administration, and response to requests.
• Legal basis: Contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legal obligation (Art. 6 para. 1 p. 1 lit. c. DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Credit assessment

If we make advance payments or enter comparable economic risks (e.g., when ordering on account), we reserve the right to obtain identity and creditworthiness information for the purpose of assessing the credit risk based on mathematical-statistical procedures from specialized service providers (credit agencies) to protect our legitimate interests.

We process the information received from the credit agencies on the statistical probability of a payment default within the framework of an appropriate discretionary decision on the establishment, implementation, and termination of the contractual relationship. We reserve the right to refuse payment on account or other advance performance in the event of a negative result of the credit check.

In accordance with Art. 22 DSGVO, the decision as to whether we provide advance performance is made solely based on an automated decision in the individual case, which is made by our software based on the information from the credit agency.

If we obtain explicit consent from contractual partners, the legal basis for the credit rating information and the transmission of the customer's data to the credit agencies is the consent. If no consent is obtained, the credit information is provided based on our legitimate interests in the default security of our payment claims.

• Types of data processed: inventory data (e.g., names, addresses), payment data (e.g., bank details, invoices, payment history), contact data (e.g., e-mail, telephone numbers), contract data (e.g., subject matter of the contract, term, customer category).
• Data subjects: Customers, prospective customers.
• Purposes of processing: assessment of creditworthiness and credit standing.
• Legal basis: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).
• Automated decisions in individual cases: credit information (decision based on a credit check).

Services used and service providers:

• Dun & Bradstreet Deutschland GmbH: credit agency; service provider: Dun & Bradstreet Deutschland GmbH, Robert-Bosch-Strasse 11, 64293 Darmstadt, Germany; website: https://www.dnb.com/de-de/; privacy policy: https://www.dnb.com/de-de/datenschutz/.
• Creditreform Boniversum GmbH and Verband der Vereine Creditreform e.V.: Credit reference agency; service provider: Creditreform Boniversum GmbH, Hammfelddamm 13, 41460 Neuss, Germany; Website: https://www.boniversum.de/ ; Privacy policy: https://www.boniversum.de/datenschutzerklaerung/.

Provision of the online offer and web hosting

To provide our online offer securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security services and technical maintenance services.

The data processed as part of the provision of the hosting offer may include all information relating to the users of our online offer, which is generated as part of the use and communication. This regularly includes the IP address, which is necessary to be able to deliver the contents of online offers to browsers, and all entries made within our online offer or from websites.

E-mail sending and hosting: The web hosting services we use also include the sending, receiving, and storing of e-mails. For these purposes, the addresses of the recipients and senders as well as further information regarding the e-mail dispatch (e.g., the providers involved) and the contents of the respective e-mails are processed. The data may also be processed for SPAM detection purposes. Please note that e-mails are generally not sent encrypted on the Internet. As a rule, e-mails are encrypted in transit, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and received. Therefore, we cannot assume any responsibility for the transmission path of the e-mails between the sender and the reception on our server.

Collection of access data and log files: We ourselves (or our web hosting provider) collect data on each access to the server (so-called server log files). The server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

The server log files may be used on the one hand for security purposes, e.g., to prevent server overload (especially in the event of abusive attacks, so-called DDoS attacks) and on the other hand to ensure the utilization of the servers and their stability.

Microsoft Azure: services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacities); service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; website: https://azure.microsoft.com/de-de/; privacy policy: https://azure.microsoft.com/de-de/overview/trusted-cloud/privacy/.

• Types of data processed: Content data (e.g., entries in online forms), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: provision of our online offer and user-friendliness.
• Legal grounds: legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Blogs and publication media

We use blogs or comparable means of online communication and publication (hereinafter "publication medium"). Readers' data are processed for the purposes of the publication medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons. For the rest, we refer to the information on the processing of visitors to our publication medium within the scope of this data protection notice.

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., entries in online forms), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: provision of contractual services and customer services, feedback (e.g., collecting feedback via online form).
• Legal grounds: contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Contacts

When contacting us (e.g., via contact form, email, telephone or via social media), the information provided by the inquiring persons is processed to the extent necessary to respond to the contact requests and any measures requested.
The response to the contact inquiries in the context of contractual or pre-contractual relationships is carried out to fulfill our contractual obligations or to respond to (pre)contractual inquiries and otherwise based on legitimate interests in responding to the inquiries.

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., entries in online forms).
• Data subjects: Communication partners.
• Purposes of processing: contact requests and communication.
• Legal basis: Contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• Salesforce: management of contact requests and communication; service provider: salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany, parent company: Salesforce.com, inc. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA; website: https://www.salesforce.com/de; privacy policy: https://www.salesforce.com/de/company/privacy.
• PiSA Sales: contact request and communication management; service provider: JustRelate Group GmbH, Kitzingstraße 15, 12277 Berlin, Germany; Website: https://www.justrelate.com/; Privacy policy: https://www.iubenda.com/privacy-policy/26092085.

Video conferencing, online meetings, webinars, and screen sharing

We use platforms and applications of other providers (hereinafter referred to as "conference platforms") for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as "conference"). When selecting the Conference Platforms and their services, we comply with the legal requirements.

Data Processed by Conference Platforms: While participating in a conference, the conference platforms process the personal data of the participants mentioned below. The scope of the processing depends on the one hand, on which data is requested in the context of a specific conference (e.g., provision of access data or clear names) and which optional information is provided by the participants. In addition to processing for the purpose of conducting the conference, participants' data may also be processed by the conference platforms for security purposes or service optimization. The processed data includes personal data (first name, last name), contact information (e-mail address, telephone number), access data (access codes or passwords), profile pictures, information on professional position/function, the IP address of the Internet access, information on the participants' terminal devices, their operating system, the browser and its technical and language settings, information on the content of the communications, i.e. entries in chats and audio and video data, as well as the use of other available functions (e.g. surveys). Content of communications is encrypted to the extent technically provided by the conference providers. If participants are registered as users with the conference platforms, then further data may be processed according to the agreement with the respective conference provider.

Logging and recordings: If text entries, participation results (e.g., from surveys), and video or audio recordings are logged, this will be transparently communicated to participants in advance, and they will be asked for consent - if necessary.

Data protection measures of the participants: Please note the details of the processing of your data by the conference platforms in their data protection notices and select the security and data protection settings that are optimal for you within the framework of the settings of the conference platforms. Furthermore, please ensure data and privacy protection in the background of your recording for the duration of a videoconference (e.g., by notifying roommates, locking doors, and using the background obscuring function, if technically possible). Links to the conference rooms as well as access data, may not be passed on to unauthorized third parties.

Notes on legal bases: if, in addition to the conference platforms, we also process users' data and ask users for their consent to use the conference platforms or certain functions (e.g., consent to a recording of conferences), the legal basis of the processing is this consent. Furthermore, our processing may be necessary for the fulfillment of our contractual obligations (e.g., in lists of participants, in the case of reprocessing of call results, etc.). Otherwise, user data is processed based on our legitimate interests in efficient and secure communication with our communication partners.

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., entries in online forms), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Communication partners, users (e.g., website visitors, users of online services).
• Purposes of processing: provision of contractual services and customer service, contact requests and communication, office, and organizational procedures.
• Legal bases: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• Microsoft Ireland Operations Ltd:
  Software-as-a-Service (including M365 covering Mail, Sharepoint, OneDrive, Teams, etc.); Infrastructure-as-a-Service, Platform-as-a-Service (including Azure)
  Address: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521
  Website: https://microsoft.com/de-de; privacy policy: https://privacy.microsoft.com/de-de/privacystatement, security information: https://www.microsoft.com/de-de/trustcenter.
• TeamViewer: conferencing software; service provider: TeamViewer GmbH, Jahnstr. 30, 73037 Göppingen, Germany; website: https://www.teamviewer.com/de; privacy policy: https://www.teamviewer.com/de/datenschutzerklaerung/.
• Zoom: video conferencing, web conferencing, and webinars; service provider: Zoom Video Communications, Inc, 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA; Website: https://zoom.us; Privacy Policy: https://zoom.us/docs/de-de/privacy-and-legal.html; Standard Contractual Clauses (ensuring level of data protection in case of processing in third countries): https://zoom.us/docs/de-de/privacy-and-legal.html (Designated as Global DPA).

Application Procedure

The application procedure requires applicants to provide us with the data necessary for their assessment and selection. What information is required is determined by the job description or, in the case of online forms, by the information provided there.

In principle, the required information includes personal information such as name, address, contact details, and proof of the qualifications required for a position. Upon request, we will be happy to provide additional information as to what information is required.

If provided, applicants can submit their applications to us using an online form. The data is transmitted to us in encrypted form in accordance with the state of the art. Applicants can also send us their applications by e-mail. Please note, however, that e-mails sent via the Internet are generally not encrypted. As a rule, e-mails are encrypted in transit, but not on the servers from which they are sent and received. Therefore, we cannot assume any responsibility for the transmission path of the application between the sender and the reception on our server.

For purposes of applicant search, submission of applications, and selection of applicants, we may use third-party applicant management, or recruitment software and platforms and services, subject to legal requirements.
Applicants are welcome to contact us regarding the method of submission of the application or to send us the application by mail.

Processing of special categories of data: insofar as special categories of personal data within the meaning of Art. 9 (1) DSGVO (e.g. health data, such as severely disabled status or ethnic origin) are requested from applicants as part of the application process in order for the controller or the data subject to exercise the rights accruing to him or her under labor law and social security and social protection law and to comply with his or her obligations in this regard, their processing is carried out in accordance with Art. 9 (2) letter b. DSGVO, in case of protection of vital interests of the applicants or other persons according to Art. 9 para. 2 lit. c. DSGVO or for the purposes of preventive health care or occupational medicine, for the assessment of the employee's ability to work, for medical diagnostics, for care or treatment in the health or social sector or for the management of systems and services in the health or social sector pursuant to Art. 9 para. 2 lit. h. DSGVO. In the case of notification of the special categories of data based on voluntary consent, their processing is based on Art. 9 para. 2 lit. a. DSGVO.

Deletion of data: The data provided by applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if the application for a job offer is not successful, the applicants' data will be deleted. Applicants' data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Subject to a justified withdrawal by the applicants, the deletion will take place at the latest after the expiry of a period of six months so that we can answer any follow-up questions about the application and meet our obligations to provide evidence under the regulations on equal treatment of applicants. Invoices for any reimbursement of travel expenses will be archived in accordance with tax law requirements.

Inclusion in an applicant pool: Inclusion in an applicant pool, if offered, is based on consent. Applicants are informed that their consent to inclusion in the talent pool is voluntary, has no influence on the current application process, and that they can revoke their consent at any time in the future.

• Types of data processed: applicant data (e.g., personal details, postal and contact addresses, the documents belonging to the application, and the information contained therein, such as cover letter, CV, certificates, and other information provided regarding a specific position or voluntarily by applicants regarding their person or qualifications).
• Data subjects: Applicants.
• Purposes of processing: application procedure (establishment and possible subsequent implementation as well as possible subsequent termination of the employment relationship).
• Legal basis: application procedure as a pre-contractual or contractual relationship (Art. 9(2)(b) DSGVO).

Services used and service providers:

Stepstone: recruiting platform and services; service provider: StepStone Deutschland GmbH, Völklinger Straße 1, 40219 Düsseldorf, Germany; website: https://www.stepstone.de; privacy policy: https://www.stepstone.de/Ueber-StepStone/Rechtliche-Hinweise/datenschutzerklaerung/.

Cloud services

We use software services accessible via the Internet and running on the servers of their providers (so-called "cloud services", also referred to as "software as a service") for the following purposes: document storage and management, calendar management, e-mail dispatch, spreadsheets and presentations, exchange of documents, content, and information with specific recipients or publication of web pages, forms or other content and information, as well as chats and participation in audio and video conferences.

In this context, personal data may be processed and stored on the servers of the providers to the extent that these are part of communication processes with us or are otherwise processed by us as set out in the context of this privacy policy. This data may include master data and contact data of users, data on transactions, contracts, other processes and their contents. The cloud service providers also process usage data and metadata used by them for security purposes and service optimization.

If we use the cloud services to provide forms or other documents and content to other users or publicly accessible websites, the providers may store cookies on the users' devices for the purpose of web analytics or to remember users' settings (e.g., in the case of media control).

Notes on legal bases: If we ask for consent to use the cloud services, the legal basis of the processing is consent. Furthermore, their use may be a component of our (pre)contractual services, provided that the use of the cloud services has been agreed upon within this framework. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient and secure management and collaboration processes)

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, phone numbers), content data (e.g., entries in online forms), usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Customers, employees (e.g., employees, applicants, former employees), prospective customers, communication partners.
• Purposes of processing: office and organizational procedures.
• Legal bases: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• Microsoft Ireland Operations Ltd
  Software-as-a-Service (including M365 covering Mail, Sharepoint, OneDrive, Teams, etc.); Infrastructure-as-a-Service, Platform-as-a-Service (including Azure)
  Address: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521
  Website: https://microsoft.com/de-de; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement, Security Notice: https://www.microsoft.com/de-de/trustcenter.
• DarkTrace
  Email and Office365 Security
  Address: Maurice Wilkes Building, Cow-ley Road, Cam-bridge, CB4 0DS
  Web site: https://www.darktrace.com
• NetApp
  SaaS Backup Solution for Office 365 and Exchange
  Address: 3060 Olsen Drive, San Jose, CA 95128, United States
• Trust-Center: https://us.saasbackup.netapp.com/resources/trustcenter?__hstc=&__hssc=&hsCtaTracking=751d1cfb-2f6f-474c-859a-6404c6fa9cd1%7C66942063-339e-4242-925c-0c0619b02c73

Newsletters and Electronic Notifications

We send newsletters, emails, and other electronic notifications (hereinafter "newsletters") only with the consent of the recipients or a legal permission. If the contents of the Newsletter are specifically described during registration, they are decisive for the consent of the users. Otherwise, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your e-mail address. However, we may ask you to provide a name, for the purpose of personal address in the newsletter, or further information, if this is necessary for the purposes of the newsletter.

Double opt-in procedure: The registration for our newsletter is always carried out in a so-called double opt-in process. This means that after registration you will receive an e-mail in which you are asked to confirm your registration. This confirmation is necessary so that no one can register with other e-mail addresses. The registrations for the newsletter are logged to be able to prove the registration process according to the legal requirements. This includes the storage of the registration and confirmation time as well as the IP address. Likewise, changes to your data stored with the dispatch service provider are logged.

Deletion and restriction of processing: We may store unsubscribed e-mail addresses for up to three years based on our legitimate interests before deleting them to be able to prove consent previously given. The processing of this data will be limited to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that the former existence of a consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the e-mail address in a block list (so-called "block list") for this purpose alone.

The logging of the registration process takes place based on our legitimate interests for the purpose of proving its proper course. If we commission a service provider to send e-mails, this is done based on our legitimate interests in an efficient and secure sending system.

Notes on legal basis: The newsletter is sent on the basis of the recipients' consent or, if consent is not required, on the basis of our legitimate interests in direct marketing, if and to the extent that this is permitted by law, e.g., in the case of existing customer advertising. Insofar as we commission a service provider to send e-mails, this is done based on our legitimate interests. The registration process is recorded based on our legitimate interests to prove that it was carried out in accordance with the law.

Content: Information about us, our services, promotions, and offers.

Measurement of opening and click-through rates: The newsletters contain a so-called "web beacon", i.e., a pixel-sized file that is retrieved from our server, or, if we use a shipping service provider, from their server, when the newsletter is opened. During this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of the retrieval, are initially collected.

This information is used for the technical improvement of our newsletter based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined with the help of the IP address) or the access times. This analysis also includes determining whether the newsletters are opened, when they are opened, and which links are clicked. This information is assigned to the individual newsletter recipients and stored in their profiles until they are deleted. We use the evaluations to identify the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

The measurement of opening rates and click-through rates as well as storage of the measurement results in the users' profiles and their further processing are based on the user's consent.

Unfortunately, a separate revocation of the performance measurement is not possible, in which case the entire newsletter subscription must be canceled, or it must be contradicted. In this case, the stored profile information will be deleted.

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers), meta/communication data (e.g., device information, IP addresses), usage data (e.g., websites visited, interest in content, access times).
• Data subjects: Communication partners.
• Purposes of processing: direct marketing (e.g., by e-mail or postal mail).
• Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).
• Option to object (Opt-Out): You can cancel the receipt of our newsletter at any time, i.e., revoke your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter or you can otherwise use one of the above contact options, preferably e-mail, for this purpose.

Services used and service providers:

• Salesforce: email marketing platform; service provider: salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany, parent company: Salesforce.com, inc. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA; website: https://www.salesforce.com/de; privacy policy: https://www.salesforce.com/de/company/privacy.
• Emakina: website agency; service provider: EMAKINA CEE, Vorgartenstraße 206B, 1020 Vienna, Austria; website: https://www.emakina.com/; privacy policy: https://www.emakina.com/int-en/privacy-policy.

Promotional communication via e-mail, mail, fax, or telephone

We process personal data for the purposes of promotional communication, which may take place via various channels, such as e-mail, telephone, mail, or fax, in accordance with legal requirements.

Recipients have the right to revoke consent given at any time or to object to promotional communication at any time.
After revocation or objection, we may store the data required to prove consent for up to three years based on our legitimate interests before deleting it. The processing of this data will be limited to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time.

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers).
• Data subjects: Communication partners.
• Purposes of processing: direct marketing (e.g., by e-mail or post).
• Legal basis: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Surveys and polls

The surveys and questionnaires we conduct (hereinafter "surveys") are evaluated anonymously. Personal data is only processed insofar as this is necessary for the provision and technical implementation of the surveys (e.g. processing of the IP address in order to display the survey in the user's browser or to enable the survey to be resumed with the aid of a temporary cookie (session cookie)) or users have consented to this.

Notes on legal bases: if we ask participants for consent to process their data, this is the legal basis for the processing; otherwise, the processing of participants' data is based on our legitimate interests in conducting an objective survey.

• Types of data processed: contact data (e.g., email, phone numbers), content data (e.g., input in online forms, interview responses), usage data (e.g., web pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Communication partners, customers
• Purposes of processing: contact inquiries and communication, direct marketing (e.g., by e-mail or postal mail).
• Legal basis: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

SurveyMonkey: SurveyMonkey survey services; service provider: SurveyMonkey Inc, 1 Curiosity Way, San Mateo, California 94403, USA; website: https://www.surveymonkey.de; privacy policy: https://www.surveymonkey.de/mp/policy/privacy-policy/?ut_source=footer.

Verinion: agency:
Verinion, Am Sandtorkai 1, 20457 Hamburg, Germany;
Website: https://verinion.com/; Privacy policy: https://verinion.com/datenschutz/

Web analysis, monitoring, and optimization

Web analytics (also referred to as "reach measurement") is used to evaluate the flow of visitors to our online offering and may include behavior, interests, or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can recognize, for example, at what time our online offer or its functions or content are most frequently used or invite re-use. Likewise, we can understand which areas need optimization

In addition to web analysis, we may also use test procedures, for example, to test and optimize different versions of our online offering or its components.

For these purposes, so-called user profiles may be created and stored in a file (so-called "cookie"), or similar procedures may be used for the same purpose. This information may include, for example, content viewed, web pages visited, and elements used there and technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data, this may also be processed, depending on the provider.

The IP addresses of users are also stored. In general, no clear user data (such as e-mail addresses or names) is stored in the context of web analysis, A/B testing, and optimization, but pseudonyms. This means that we, as well as the providers of the software used, do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: If we ask users for their consent to use the third-party providers, the legal basis for processing data is consent. Otherwise, users' data is processed based on our legitimate interests (i.e., interest in efficient, economical, and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this Privacy Policy.

• Types of data processed: Usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: reach measurement (e.g., access statistics, recognition of returning visitors), profiles with user-related information (creation of user profiles), click tracking, A/B testing, feedback (e.g., collecting feedback via online form), heatmaps (mouse movements on the part of users that are aggregated to form an overall picture.), surveys and questionnaires (e.g., surveys with input options, multiple choice questions), marketing.
• Security measures: IP masking (pseudonymization of the IP address).
• Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• Google Analytics: reach measurement and web analytics; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://marketingplatform.google.com/intl/de/about/analytics/; privacy policy: https://policies.google.com/privacy.
• Google Tag Manager: Google Tag Manager is a solution with which we can manage so-called website tags via an interface and thus integrate other services into our online offering (please refer to further details in this privacy policy). With the Tag Manager itself (which implements the tags), therefore, no profiles of users are created, or cookies are stored, for example. Google only learns the IP address of the user, which is necessary to run the Google Tag Manager. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://marketingplatform.google.com; privacy policy: https://policies.google.com/privacy.
• Hotjar: Software for analyzing and optimizing online offers based on feedback functions as well as pseudonymously performed measurements and analyses of user behavior, which may include in particular A/B tests (measuring the popularity and user-friendliness of different content and functions), measurement of click paths, and interaction with content and functions of the online offer; service provider: Hotjar Ltd, 3 Lyons Range, 20 Bisazza Street, Sliema SLM 1640, Malta ; Website: https://www.hotjar.com; Privacy Policy: https://www.hotjar.com/legal/policies/privacy. Cookie Policy: https://www.hotjar.com/legal/policies/cookie-information; Deletion of Data: The cookies Hotjar uses have different "lifetimes"; some remain valid for up to 365 days, some only during the current visit; Opt-out: https://www.hotjar.com/legal/compliance/opt-out.

Online marketing

We process personal data for online marketing purposes, which may include marketing advertising space or displaying promotional and other content (collectively, "content") based on users' potential interests and measuring its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (so-called "cookie"), or similar procedures are used, by means of which the information about the user relevant to the presentation of the aforementioned content is stored. This information may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data, this may also be processed.

The IP addresses of users are also stored. However, we use available IP masking procedures (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear data of the users (such as e-mail addresses or names) are stored in the context of the online marketing process, but pseudonyms. This means that we, as well as the providers of the online marketing procedures, do not know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is usually stored in the cookies or by means of similar procedures. These cookies can later generally be read on other websites that use the same online marketing procedure and analyzed for the purpose of displaying content as well as supplemented with further data and stored on the server of the online marketing procedure provider.

Exceptionally, clear data can be assigned to the profiles. This is the case if, for example, the users are members of a social network whose online marketing procedure we use, and the network links the users' profiles with the data. We ask to note that users may make additional arrangements with the providers, e.g., by giving consent as part of the registration process.

In principle, we only receive access to summarized information about the success of our advertisements. However, in the context of so-called conversion measurements, we can check which of our online marketing processes have led to a so-called conversion, i.e., for example, to a conclusion of a contract with us. The conversion measurement is used solely to analyze the success of our marketing measures.

Unless otherwise stated, we ask you to assume that the cookies used will be stored for a period of two years.

Notes on legal bases: if we ask users for their consent to use third-party providers, the legal basis for processing data is consent. Otherwise, users' data is processed based on our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this Privacy Policy.

• Types of data processed: Usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: marketing, profiling with user-related information (creating user profiles).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal grounds: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).
• Possibility of objection (opt-out): We refer to the data protection notices of the respective providers and the objection options given to the providers (so-called "opt-out"). If no explicit opt-out option has been specified, you have the option of disabling cookies in your browser settings. However, this may restrict functions of our online offer. We therefore recommend the following additional opt-out options, which are offered in summary for the respective areas:

1. 1. Europe: https://www.youronlinechoices.eu
   2. Canada: https://www.youradchoices.ca/choices.
   3. USA: https://www.aboutads.info/choices.
   4. Cross-territory: https://optout.aboutads.info.

Services used and service providers:

• Google Tag Manager: Google Tag Manager is a solution with which we can manage so-called website tags via an interface and thus integrate other services into our online offering (please refer to further details in this privacy policy). With the Tag Manager itself (which implements the tags), therefore, no profiles of users are created, or cookies are stored, for example. Google only learns the IP address of the user, which is necessary to run the Google Tag Manager. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://marketingplatform.google.com; privacy policy: https://policies.google.com/privacy.
• Google Analytics: online marketing and web analytics; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://marketingplatform.google.com/intl/de/about/analytics/; privacy policy: https://policies.google.com/privacy; opt-out: Opt-Out Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Ad Display Settings: https://adssettings.google.com/authenticated.
• LinkedIn: Insights Tag / Conversion Measurement; Service Provider: LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA; Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy, Cookie policy: https://www.linkedin.com/legal/cookie_policy; Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Presence in social networks (social media)

We maintain online presences within social networks and process user data in this context to communicate with users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may result in risks for the users because, for example, it could make it more difficult to enforce the rights of the users.

Furthermore, user data is usually processed within social networks for market research and advertising purposes. For example, user profiles can be created based on the user behavior and resulting interests of the users. The user profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users' computers, in which the user behavior and interests of the users are stored. Furthermore, data independent of the devices used by the users may also be stored in the user profiles (especially if the users are members of the respective platforms and are logged in to them).

For a detailed presentation of the respective forms of processing and the options to object (opt-out), we refer to the privacy statements and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. If you still need assistance, you can contact us.

• Types of data processed: contact data (e.g., e-mail, telephone numbers), content data (e.g., entries in online forms), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: contact requests and communication, feedback (e.g., collecting feedback via online form), marketing.
• Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• LinkedIn: social network; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Twitter: social network; service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; parent company: Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; privacy policy: https://twitter.com/de/privacy, (settings) https://twitter.com/personalization.
• YouTube: Social network and video platform; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; privacy policy: https://policies.google.com/privacy; opt-out: https://adssettings.google.com/authenticated.

Plugins and embedded functions and content

We integrate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These can be, for example, graphics, videos, or city maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the user, since without the IP address they could not send the content to their browser. The IP address is thus required for the display of this content or functionality. We strive to use only such content whose respective providers use the IP address only for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to analyze information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit, and other information about the use of our online offer as well as be linked to such information from other sources.

Notes on legal basis: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is consent. Otherwise, users' data is processed based on our legitimate interests (i.e., interest in efficient, economic, and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Integration of third-party software, scripts, or frameworks (e.g., jQuery): We integrate software into our online offering that we retrieve from servers of other providers (e.g., function libraries that we use for the purpose of displaying or making our online offering user-friendly). In doing so, the respective providers collect the IP address of the users and may process this for purposes of transmitting the software to the users' browsers and for security purposes, as well as for evaluating and optimizing their offer.

• Types of data processed: Usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses), inventory data (e.g. names, addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., entries in online forms).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: provision of our online offer and user-friendliness, provision of contractual services and customer service.
• Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO), consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO).

Services used and service providers:

• MyFonts: Fonts; data processed as part of font retrieval the webfont project identification number (anonymized), the URL of the licensed website associated with a customer number to identify the licensee and the licensed webfonts, and the referrer URL; the anonymized webfont project identification number is stored in encrypted log files with such data for 30 days to determine the monthly number of page views; After such extraction and storage of the number of page views, the log files are deleted; Service Provider: Monotype Imaging Holdings Inc, 600 Unicorn Park Drive, Woburn, Massachusetts 01801, USA; Website: https://www.myfonts.co; Privacy Policy: https://www.myfonts.com/info/legal/#Privacy.
• reCAPTCHA: We integrate the "reCAPTCHA" function to be able to recognize whether entries (e.g., in online forms) are made by humans and not by automatically acting machines (so-called "bots"). Processed data may include IP addresses, information about operating systems, devices or browsers used, language settings, location, mouse movements, keyboard strokes, time spent on web pages, previously visited web pages, interactions with ReCaptcha on other web pages, possibly cookies, and results of manual recognition processes (e.g., answering questions asked or selecting objects in images). Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.google.com/recaptcha/; privacy policy: https://policies.google.com/privacy; opt-out: Opt-Out Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Ad Display Settings: https://adssettings.google.com/authenticated.
• YouTube videos: Video content; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.youtube.com; privacy policy: https://policies.google.com/privacy; opt-out: Opt-Out Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Ad Display Settings: https://adssettings.google.com/authenticated.
• YouTube videos: Video content; YouTube is integrated via the domain https://www.youtube-nocookie.com in the so-called "Enhanced Privacy Mode", whereby no cookies on user activities are collected to personalize video playback. Nevertheless, information on user interaction with the video (e.g. remembering the last playback point), may be stored; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.youtube.com; privacy policy: https://policies.google.com/privacy.

Management, organization, and support tools

We use services, platforms, and software from other providers (hereinafter referred to as "Third Party Providers") for the purposes of organizing, managing, planning as well as providing our services. When selecting third-party providers and their services, we observe the legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. This may involve various data that we process in accordance with this privacy policy. This data may include master data and contact data of users, data on transactions, contracts, other processes, and their contents.

If users are referred to the third-party providers or their software or platforms during communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimization or marketing purposes. We therefore ask you to observe the data protection notices of the respective third-party providers.

Notes on legal basis: If we ask users for their consent to use the third-party providers, the legal basis for processing data is consent. Furthermore, their use may be a component of our (pre)contractual services, provided that the use of the third-party providers has been agreed within this framework. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

• Types of data processed: inventory data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., entries in online forms), usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
• Data subjects: Communication partners, users (e.g., website visitors, users of online services).
• Purposes of processing: contact requests and communication, managing and responding to requests, feedback (e.g., collecting feedback via online form), surveys and questionnaires (e.g., surveys with input options, multiple choice questions), profiles with user-related information (creating user profiles).
• Legal basis: consent (Art. 6 para. 1 p. 1 lit. a. DSGVO), contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO), legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Services used and service providers:

• Hootsuite: social media management platform that offers a range of integrated solutions for measurement & benchmarking, performance optimization, visualization & analysis, content creation and publishing, and community maintenance; service provider: HootSuite Media Inc, 5 East 8th Ave. Vancouver, V5T 1R6, Canada; website: https://hootsuite.com; privacy policy: https://hootsuite.com/legal/privacy.

Rights of data subjects

As a data subject, you are entitled to various rights under the GDPR, which arise from Articles 15 to 21 GDPR:

• Right to object: you have the right to object at any time, on grounds relating to your situation, to the processing of personal data relating to you which is carried out based on Art. 6(1)(e) or (f) DSGVO; this also applies to profiling based on these provisions. If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to revoke any consent given at any time.
• Right to information: you have the right to request confirmation as to whether data in question is being processed and to information about this data, as well as further information and a copy of the data in accordance with the legal requirements.
• Right to rectification: you have the right, in accordance with the law, to request that data concerning you be completed or that inaccurate data concerning you be rectified.
• Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to demand that data concerning you be deleted without delay, or alternatively, in accordance with the legal requirements, to demand restriction of the processing of the data.
• Right to data portability: you have the right to receive data relating to you that you have provided to us in a structured, common, and machine-readable format, or to request that it be transferred to another controller, in accordance with the law.
• Complaint to supervisory authority: In accordance with the legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State where you usually reside, the supervisory authority of your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Supervisory authority responsible for us

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str 22, 7th floor
20459 Hamburg
Germany

Phone: +49 40 42854-4040
E-mail: mailbox@datenschutz.hamburg.de
De-Mail: hmbbfdi@hamburg.de-mail.de

Identification check

If you exercise one or more of the above rights, please understand that we may require you to provide evidence that you are the person you claim to be.

Modification and updating of the privacy policy

We will revise this privacy policy whenever changes are made to this website or other occasions require it. You will always find the current version on this website.

Status September 2022