Back to Home

Privacy Policy

🇬🇧English🇩🇪Deutsch🇫🇷Français🇳🇱Nederlands🇮🇹Italiano🇪🇸Español🇵🇹Português

Privacy Policy

1. Introduction

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online services").

The terms used are not gender-specific.

Table of Contents

2. Data Controller

Qimondo Limited Partnership
Monavalley Business Park
Tralee, County Kerry
V92 YP84
Ireland
Telephone: +353 66 913048-0
Fax: +353 66 913048-8
Email: {{EMAIL_PROTECTED}}

Company website: www.qimondo.ie

3. Overview of Processing

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

  • Master data.
  • Payment data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta/communication data.
  • Event data (Facebook).

Special categories of data

  • Health data.
  • Data concerning sex life or sexual orientation.
  • Religious or philosophical beliefs.
  • Data revealing racial and ethnic origin.

Categories of data subjects

  • Customers.
  • Prospective customers.
  • Communication partners.
  • Users.
  • Business and contractual partners.
  • Pupils/students/participants.
  • Participants.

Purposes of processing

  • Provision of contractual services and customer service.
  • Contact enquiries and communication.
  • Security measures.
  • Direct marketing.
  • Reach measurement.
  • Tracking.
  • Office and organisational procedures.
  • Remarketing.
  • Conversion measurement.
  • Audience building.
  • Affiliate tracking.
  • Management and response to enquiries.
  • Feedback.
  • Marketing.
  • Profiles with user-related information.
  • Audience building.
  • Provision of our online services and user-friendliness.
  • Information technology infrastructure.

4. Applicable Legal Bases

The following provides an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

  • Consent (Art. 6(1)(a) GDPR) - The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6(1)(c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1)(f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

5. Security Measures

We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of processing as well as the different likelihood and extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, disclosure, ensuring availability and separation thereof. Furthermore, we have established procedures that ensure the exercise of data subjects' rights, the deletion of data and responses to data threats. We also take the protection of personal data into account already during the development or selection of hardware, software and procedures in accordance with the principle of data protection, through technology design and data protection-friendly default settings.

SSL encryption (https): To protect your data transmitted via our online services, we use SSL encryption. You can recognise such encrypted connections by the prefix https:// in the address bar of your browser.

6. Transfer of Personal Data

In the course of our processing of personal data, the data may be transferred to or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and in particular conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

Data transfer within the corporate group: We may transfer personal data to other companies within our corporate group or grant them access to such data. Where this disclosure is for administrative purposes, the disclosure of data is based on our legitimate corporate and business interests or is carried out where it is necessary for the fulfilment of our contractual obligations or where the consent of the data subjects or a legal permission exists.

Data transfer within the organisation: We may transfer personal data to other bodies within our organisation or grant them access to such data. Where this disclosure is for administrative purposes, the disclosure of data is based on our legitimate corporate and business interests or is carried out where it is necessary for the fulfilment of our contractual obligations or where the consent of the data subjects or a legal permission exists.

7. Data Processing in Third Countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this shall only be done in accordance with the legal requirements.

Subject to express consent or contractually or legally required transfer, we only process or have the data processed in third countries with a recognised level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

8. Deletion of Data

The data processed by us will be deleted in accordance with the legal requirements as soon as the consents permitted for processing are revoked or other permissions cease to apply (e.g., if the purpose of processing this data has ceased to exist or it is not required for the purpose). If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted to these purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

Within the framework of our data protection notices, we may provide users with further information on the deletion and retention of data that is specific to the respective processing operations.

9. Use of Cookies

Cookies are small text files or other storage notes that store information on end devices and read information from end devices. For example, to save the login status in a user account, shopping cart contents in an e-shop, the content accessed or functions used in an online service. Cookies can also be used for various purposes, e.g. for the functionality, security and convenience of online services as well as for the creation of analyses of visitor flows.

Notes on consent: We use cookies in accordance with legal requirements. Therefore, we obtain prior consent from users, unless this is not required by law. Consent is particularly not necessary if the storage and retrieval of information, including cookies, is strictly necessary to provide the users with a telemedia service they have explicitly requested (i.e. our online services). Revocable consent is clearly communicated to users and contains information about the respective cookie usage.

Notes on data protection legal bases: The data protection legal basis on which we process users' personal data using cookies depends on whether we ask users for consent. If users consent, the legal basis for processing their data is their declared consent. Otherwise, the data processed using cookies is processed on the basis of our legitimate interests (e.g. in the commercial operation of our online services and improvement of their usability) or, if this is done in the course of fulfilling our contractual obligations, where the use of cookies is necessary to fulfil our contractual obligations. We will clarify the purposes for which cookies are processed by us in the course of this privacy policy or as part of our consent and processing procedures.

Storage duration: With regard to the storage duration, the following types of cookies are distinguished:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their end device (e.g. browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user revisits a website. Likewise, user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information about the type and storage duration of cookies (e.g. as part of obtaining consent), users should assume that cookies are permanent and the storage duration can be up to two years.

General notes on revocation and objection (opt-out): Users can revoke the consent they have given at any time and also file an objection to the processing in accordance with the legal requirements of Art. 21 GDPR. Users can also declare their objection via the settings of their browser, e.g. by deactivating the use of cookies (which may also limit the functionality of our online services). An objection to the use of cookies for online marketing purposes can also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

Further information on processing operations, procedures and services:

  • Processing of cookie data based on consent: We use a cookie consent management procedure in which the consent of users to the use of cookies, or the processing and providers mentioned in the cookie consent management procedure, can be obtained, managed and revoked by users. The consent declaration is stored so that it does not have to be retrieved again and consent can be demonstrated in accordance with the legal obligation. Storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or using comparable technologies) in order to assign the consent to a user or their device. Subject to individual information about the providers of cookie management services, the following notes apply: The duration of storage of consent can be up to two years. A pseudonymous user identifier is created and stored with the time of consent, information about the scope of consent (e.g. which categories of cookies and/or service providers) as well as the browser, system and end device used.

10. Business Services

We process data of our contractual and business partners, e.g. customers and prospects (collectively referred to as "contractual partners") within the framework of contractual and comparable legal relationships and related measures and in the context of communication with contractual partners (or pre-contractually), e.g. to answer enquiries.

We process this data to fulfil our contractual obligations. These include in particular the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other service disruptions. In addition, we process the data to protect our rights and for the purpose of administrative tasks associated with these obligations as well as corporate organisation. Furthermore, we process the data on the basis of our legitimate interests in proper and business-oriented management as well as security measures to protect our contractual partners and our business operations from misuse, endangerment of their data, secrets, information and rights (e.g. for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of applicable law, we only disclose the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or for the fulfilment of legal obligations. Contractual partners will be informed about further forms of processing, e.g. for marketing purposes, within the scope of this privacy policy.

We inform the contractual partners which data is required for the aforementioned purposes before or in the course of data collection, e.g. in online forms, through special marking (e.g. colours) or symbols (e.g. asterisks or similar), or in person.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e. generally after 4 years, unless the data is stored in a customer account, e.g. as long as it must be retained for legal archiving reasons. The statutory retention period for tax-relevant documents as well as for commercial books, inventories, opening balance sheets, annual financial statements, the work instructions necessary for understanding these documents and other organisational documents and accounting records is ten years, and for received commercial and business letters and reproductions of sent commercial and business letters, six years. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance sheet, the annual financial statement or the management report was prepared, the commercial or business letter was received or sent or the accounting record was created, and furthermore the recording was made or the other documents were created.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between users and the providers.

  • Types of data processed: Master data (e.g. names, addresses); Payment data (e.g. bank details, invoices, payment history); Contact data (e.g. email, telephone numbers); Contractual data (e.g. subject of contract, duration, customer category); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
  • Special categories of personal data: Health data (Art. 9(1) GDPR); Data concerning sex life or sexual orientation (Art. 9(1) GDPR); Religious or philosophical beliefs (Art. 9(1) GDPR); Data revealing racial and ethnic origin (Art. 9(1) GDPR).
  • Data subjects: Customers; Prospects; Business and contractual partners; Students/pupils/participants.
  • Purposes of processing: Provision of contractual services and customer service; Security measures; Contact inquiries and communication; Office and organisational procedures; Management and response to inquiries.
  • Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legal obligation (Art. 6(1)(c) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Customer account: Contractual partners can create an account within our online services (e.g. customer or user account, referred to as "customer account"). If registration of a customer account is required, contractual partners will be informed of this as well as of the information required for registration. Customer accounts are not public and cannot be indexed by search engines. In the course of registration and subsequent logins and use of the customer account, we store the IP addresses of customers together with the access times in order to be able to prove registration and prevent any misuse of the customer account. If customers have terminated their customer account, the data relating to the customer account will be deleted, unless its retention is required for legal reasons. It is the responsibility of the customers to back up their data upon termination of the customer account; Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).
  • Shop and e-commerce: We process the data of our customers to enable them to select, purchase or order the chosen products, goods and related services, as well as their payment and delivery or execution. If necessary for the execution of an order, we use service providers, in particular postal, shipping and freight companies, to carry out the delivery or execution to our customers. For the processing of payment transactions, we use the services of banks and payment service providers. The required information is identified as such in the course of the order or comparable acquisition process and includes the information needed for delivery, provision and billing as well as contact information for any consultations; Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).
  • Education and training services: We process the data of participants in our educational and training programmes (uniformly referred to as "trainees and further education participants") in order to provide our training services to them. The data processed in this context, the type, scope, purpose and necessity of its processing are determined by the underlying contractual and training relationship. Processing activities also include performance assessment and evaluation of our services as well as those of the instructors. In the course of our activities, we may also process special categories of data, in particular information about the health of trainees and further education participants as well as data revealing ethnic origin, political opinions, religious or philosophical beliefs. For this purpose, we obtain, where necessary, the express consent of the trainees and further education participants and otherwise process the special categories of data only if it is necessary for the provision of training services, for purposes of health care, social protection or the protection of vital interests of the trainees and further education participants; Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).
  • Coaching: We process the data of our clients as well as prospects and other principals or contractual partners (uniformly referred to as "clients") in order to provide our services to them. The data processed, the type, scope, purpose and necessity of its processing are determined by the underlying contractual and client relationship. In the course of our activities, we may also process special categories of data, in particular information about the health of clients, possibly relating to their sex life or sexual orientation, as well as data revealing racial and ethnic origin, political opinions, religious or philosophical beliefs or trade union membership. For this purpose, we obtain, where necessary, the express consent of the clients and otherwise process the special categories of data if this serves the health of the clients, the data is publicly available or other legal permissions exist. Insofar as it is necessary for the performance of our contract, for the protection of vital interests or as required by law, or if consent of the clients exists, we disclose or transmit the data of clients to third parties or agents, e.g. authorities, billing offices and in the field of IT, office or comparable services, in compliance with professional regulations; Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).
  • Online courses and online training: We process the data of participants in our online courses and online training programmes (uniformly referred to as "participants") in order to provide our course and training services to them. The data processed in this context, the type, scope, purpose and necessity of its processing are determined by the underlying contractual relationship. The data generally includes information about the courses and services used and, where part of our service offering, personal preferences and results of the participants. Processing activities also include performance assessment and evaluation of our services and those of the course and training instructors; Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

11. Use of Online Platforms for Offer and Sales Purposes

We offer our services on online platforms operated by other service providers. In this context, the privacy notices of the respective platforms apply in addition to our privacy notices. This applies in particular with regard to the processing of payment transactions and the methods used on the platforms for reach measurement and interest-based marketing.

  • Types of data processed: Master data (e.g. names, addresses); Payment data (e.g. bank details, invoices, payment history); Contact data (e.g. email, telephone numbers); Contractual data (e.g. subject of contract, duration, customer category); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Customers.
  • Purposes of processing: Provision of contractual services and customer service; Marketing.
  • Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

12. Payment Methods

Within the framework of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and use other service providers in addition to banks and credit institutions for this purpose (collectively "payment service providers").

The data processed by the payment service providers includes master data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums as well as contract, sum and recipient-related information. The information is necessary to carry out the transactions. However, the data entered is only processed and stored by the payment service providers. This means that we do not receive any account or credit card related information, but only information confirming or declining the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit agencies. This transmission is intended for identity and credit checks. In this regard, we refer to the terms and conditions and privacy notices of the payment service providers.

The terms and conditions and privacy notices of the respective payment service providers apply to payment transactions and can be accessed within the respective websites or transaction applications. We also refer to these for the purpose of further information and the assertion of revocation, information and other data subject rights.

  • Types of data processed: Master data (e.g. names, addresses); Payment data (e.g. bank details, invoices, payment history); Contractual data (e.g. subject of contract, duration, customer category); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses); Contact data (e.g. email, telephone numbers).
  • Data subjects: Customers; Prospects.
  • Purposes of processing: Provision of contractual services and customer service.
  • Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Further information on processing operations, procedures and services:

13. Provision of Online Services and Web Hosting

We process the data of users in order to provide them with our online services. For this purpose, we process the IP address of the user, which is necessary to transmit the content and functions of our online services to the user's browser or end device.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses); Content data (e.g. entries in online forms).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of our online services and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); Security measures.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Provision of online services on rented storage space: For the provision of our online services, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also called "web host"); Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
  • Provision of online services on own/dedicated server hardware: For the provision of our online services, we use server hardware operated by us as well as the associated storage space, computing capacity and software; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
  • Collection of access data and log files: Access to our online services is logged in the form of so-called "server log files". Server log files may include the address and name of the web pages and files accessed, date and time of access, data volumes transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files can be used for security purposes, e.g. to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks) and to ensure the utilisation of the servers and their stability; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Deletion of data: Log file information is stored for a maximum period of 30 days and then deleted or anonymised. Data whose further retention is required for evidentiary purposes is exempt from deletion until the respective incident has been finally resolved.
  • Email sending and hosting: The web hosting services we use also include the sending, receiving and storage of emails. For these purposes, the addresses of recipients and senders as well as further information regarding the email dispatch (e.g. the providers involved) and the contents of the respective emails are processed. The aforementioned data may also be processed for the purpose of SPAM detection. We ask you to note that emails on the internet are generally not sent in encrypted form. As a rule, emails are encrypted in transit, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and received. We can therefore not assume any responsibility for the transmission path of emails between the sender and reception on our server; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
  • Content delivery network: We use a "content delivery network" (CDN). A CDN is a service with the help of which the content of an online service, in particular large media files such as graphics or programme scripts, can be delivered faster and more securely with the help of regionally distributed servers connected via the internet; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

14. Special Notes on Applications (Apps)

We process the data of users of our application insofar as this is necessary to provide the users with the application and its functionalities, to monitor its security and to develop it further. We may also contact users in compliance with legal requirements if the communication is necessary for the purposes of administration or use of the application. Otherwise, we refer to the privacy notices in this privacy policy with regard to the processing of user data.

Legal bases: The processing of data necessary for the provision of the application's functionalities serves the fulfilment of contractual obligations. This also applies if the provision of the functionalities requires user authorisation (e.g. release of device functions). If the processing of data is not necessary for the provision of the application's functionalities but serves the security of the application or our business interests (e.g. collection of data for the purpose of optimising the application or for security purposes), it is carried out on the basis of our legitimate interests. If users are expressly asked for their consent to the processing of their data, the processing of data covered by the consent is carried out on the basis of this consent.

  • Types of data processed: Master data (e.g. names, addresses); Meta/communication data (e.g. device information, IP addresses); Payment data (e.g. bank details, invoices, payment history); Contractual data (e.g. subject of contract, duration, customer category).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service.
  • Legal bases: Consent (Art. 6(1)(a) GDPR); Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Commercial use: We process the data of users of our application, registered users and any test users (hereinafter uniformly referred to as "users") in order to provide our contractual services to them and on the basis of legitimate interests to ensure the security of our application and to develop it further. The required information is identified as such in the course of the usage, order, purchase or comparable contract conclusion and may include the information needed for service provision and any billing as well as contact information for any consultations; Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).
  • Device permissions for access to functions and data: The use of our application or its functionalities may require permissions from users for access to certain functions of the devices used or to data stored on or accessible via the devices. By default, these permissions must be granted by users and can be revoked at any time in the settings of the respective devices. The exact procedure for controlling app permissions may depend on the device and software of the users. Users can contact us if they need clarification. We point out that the refusal or revocation of the respective permissions may affect the functionality of our application.

15. Obtaining Applications via App Stores

Our application is obtained via special online platforms operated by other service providers (so-called "app stores"). In this context, the privacy notices of the respective app stores apply in addition to our privacy notices. This applies in particular with regard to the methods used on the platforms for reach measurement and interest-based marketing as well as any charges.

  • Types of data processed: Master data (e.g. names, addresses); Payment data (e.g. bank details, invoices, payment history); Contact data (e.g. email, telephone numbers); Contractual data (e.g. subject of contract, duration, customer category); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses); Content data (e.g. entries in online forms).
  • Data subjects: Customers; Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; Marketing.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

16. Registration, Login and User Account

Users can create a user account. During registration, the required mandatory information is communicated to users and processed for the purpose of providing the user account on the basis of contractual obligation fulfilment. The data processed includes in particular the login information (username, password and an email address).

In the course of using our registration and login functions as well as the use of the user account, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests as well as those of the users in protection against misuse and other unauthorised use. This data is generally not disclosed to third parties unless it is necessary for the pursuit of our claims or there is a legal obligation to do so.

Users may be informed by email about events relevant to their user account, such as technical changes.

  • Types of data processed: Master data (e.g. names, addresses); Contact data (e.g. email, telephone numbers); Content data (e.g. entries in online forms); Meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; Security measures; Management and response to inquiries; Provision of our online services and user-friendliness.
  • Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Deletion of data after termination: When users have terminated their user account, their data relating to the user account will be deleted, subject to any legal permission, obligation or consent of the users; Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).
  • No obligation to retain data: It is the responsibility of the users to back up their data before the end of the contract in the event of termination. We are entitled to irreversibly delete all data of the user stored during the term of the contract; Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

17. Community Features

The community features we provide allow users to engage in conversations or otherwise interact with each other. Please note that the use of community features is only permitted in compliance with applicable law, our terms and guidelines and the rights of other users and third parties.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; Security measures.
  • Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Further information on processing operations, procedures and services:

  • Protection of own data: Users decide for themselves which data they disclose about themselves within our online services. For example, when users provide information about themselves or participate in conversations. We ask users to protect their data and to publish personal data only with caution and only to the extent necessary. In particular, we ask users to note that they must take special care to protect access credentials and use secure passwords (i.e. above all, as long and random character combinations as possible); Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

18. Contact and Inquiry Management

When contacting us (e.g. via contact form, email, telephone or via social media) as well as in the context of existing user and business relationships, the information of the enquiring persons is processed insofar as this is necessary for responding to the contact inquiries and any requested measures.

The response to contact inquiries as well as the management of contact and inquiry data in the context of contractual or pre-contractual relationships is carried out for the fulfilment of our contractual obligations or for responding to (pre-)contractual inquiries and otherwise on the basis of legitimate interests in responding to the inquiries and maintaining user or business relationships.

  • Types of data processed: Contact data (e.g. email, telephone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners.
  • Purposes of processing: Contact inquiries and communication; Management and response to inquiries; Feedback (e.g. collecting feedback via online form); Provision of our online services and user-friendliness; Provision of contractual services and customer service.
  • Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Contact form: When users contact us via our contact form, email or other communication channels, we process the data communicated to us in this context for the purpose of processing the communicated matter. For this purpose, we process personal data in the context of pre-contractual and contractual business relationships, insofar as this is necessary for their fulfilment and otherwise on the basis of our legitimate interests as well as the interests of the communication partners in responding to the matters and our legal retention obligations; Legal bases: Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR), Legitimate interests (Art. 6(1)(f) GDPR).

19. Push Notifications

With the consent of users, we may send users so-called "push notifications". These are messages that are displayed on the screens, devices or in browsers of the users, even when our online service is not actively being used.

To subscribe to push notifications, users must confirm the request from their browser or device to receive push notifications. This consent process is documented and stored. The storage is necessary to determine whether users have consented to receiving push notifications and to be able to prove the consent. For these purposes, a pseudonymous identifier of the browser (so-called "push token") or the device ID of a device is stored.

Push notifications may, on the one hand, be necessary for the fulfillment of contractual obligations (e.g., technical and organizational information relevant to the use of our online service) and are otherwise, unless specifically mentioned below, sent on the basis of the users' consent. Users can change the receipt of push notifications at any time using the notification settings of their respective browsers or devices.

  • Types of data processed: Usage data (e.g., websites visited, interest in content, access times); Meta/communication data (e.g., device information, IP addresses).
  • Data subjects: Communication partners.
  • Purposes of processing: Provision of our online service and user-friendliness.
  • Legal bases: Consent (Art. 6(1)(a) GDPR); Performance of contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).

20. Newsletters and Electronic Notifications

We send newsletters, emails and other electronic notifications (hereinafter "newsletters") only with the consent of the recipients or a legal permission. If the contents of the newsletter are specifically described in the context of a registration, they are decisive for the consent of the users. Otherwise, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for the purpose of personal addressing in the newsletter, or further information if this is necessary for the purposes of the newsletter.

Double opt-in procedure: Registration for our newsletter generally takes place in a so-called double opt-in procedure. This means that after registration you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register with someone else's email address. Registrations for the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes the storage of the registration and confirmation time as well as the IP address. Likewise, changes to your data stored with the mailing service provider are logged.

Deletion and restriction of processing: We may store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of a consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a blocklist (so-called "blocklist").

The logging of the registration process takes place on the basis of our legitimate interests for the purpose of proving its proper course. Insofar as we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure sending system.

Contents:

Information about us, our services, promotions and offers.

  • Types of data processed: Master data (e.g., names, addresses); Contact data (e.g., email, telephone numbers); Meta/communication data (e.g., device information, IP addresses); Usage data (e.g., websites visited, interest in content, access times).
  • Data subjects: Communication partners.
  • Purposes of processing: Direct marketing (e.g., by email or postal).
  • Legal bases: Consent (Art. 6(1)(a) GDPR).
  • Right to object (opt-out): You can cancel the receipt of our newsletter at any time, i.e., revoke your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter or you can use one of the contact options listed above, preferably email, for this purpose.

Further information on processing operations, procedures and services:

  • Measurement of open and click rates: The newsletters contain a so-called "web beacon", i.e., a pixel-sized file that is retrieved from our server, or, if we use a mailing service provider, from their server, when the newsletter is opened. Within the scope of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, are initially collected. This information is used for the technical improvement of our newsletter based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined with the help of the IP address) or the access times. This analysis also includes determining whether the newsletters are opened, when they are opened and which links are clicked. This information is assigned to the individual newsletter recipients and stored in their profiles until they are deleted. The evaluations serve us to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. The measurement of open rates and click rates as well as the storage of the measurement results in the profiles of the users and their further processing are based on the consent of the users. A separate revocation of the performance measurement is unfortunately not possible; in this case, the entire newsletter subscription must be cancelled or objected to. In this case, the stored profile information will be deleted; Legal bases: Consent (Art. 6(1)(a) GDPR).

21. Promotional Communication via Email, Post, Fax or Telephone

We process personal data for the purposes of promotional communication, which may take place via various channels, such as email, telephone, post or fax, in accordance with legal requirements.

The recipients have the right to revoke consent given at any time or to object to the promotional communication at any time.

After revocation or objection, we store the data required to prove the previous authorization to contact or send communications for up to three years after the end of the year of the revocation or objection on the basis of our legitimate interests. The processing of this data is limited to the purpose of a possible defense against claims. On the basis of the legitimate interest in permanently observing the revocation or objection of the users, we also store the data required to avoid renewed contact (e.g., depending on the communication channel, the email address, telephone number, name).

  • Types of data processed: Master data (e.g., names, addresses); Contact data (e.g., email, telephone numbers).
  • Data subjects: Communication partners.
  • Purposes of processing: Direct marketing (e.g., by email or postal).
  • Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

22. Surveys and Polls

We conduct surveys and polls to collect information for the respective communicated survey or poll purpose. The surveys and polls carried out by us (hereinafter "surveys") are evaluated anonymously. Personal data is only processed insofar as this is necessary for the provision and technical implementation of the surveys (e.g. processing of the IP address to display the survey in the user's browser or to enable the resumption of the survey using a cookie).

  • Types of data processed: Contact data (e.g. email, telephone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Kommunikationspartner; Teilnehmer.
  • Purposes of processing: Feedback (e.g. collecting feedback via online form).
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

23. Web Analytics, Monitoring and Optimisation

Web analytics (also referred to as "reach measurement") is used to evaluate the visitor flows of our online services and can include behaviour, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, identify when our online services or their functions or content are most frequently used or invite reuse. Likewise, we can identify which areas require optimisation.

In addition to web analytics, we may also use testing procedures to test and optimise, for example, different versions of our online services or their components.

Unless otherwise stated below, profiles, i.e. data summarised for a usage process, may be created and information may be stored in and read from a browser or terminal device for these purposes. The data collected includes in particular websites visited and elements used there, as well as technical information such as the browser used, the computer system used and information on usage times. If users have agreed to the collection of their location data to us or to the providers of the services we use, location data may also be processed.

The IP addresses of users are also stored. However, we use an IP masking procedure (i.e. pseudonymisation by shortening the IP address) to protect users. In general, no clear data of users (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimisation, but only pseudonyms. This means that we, as well as the providers of the software used, do not know the actual identity of the users, but only the information stored in their profiles for the purpose of the respective procedures.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Remarketing; Audience building (determination of target groups relevant for marketing purposes or other output of content); Reach measurement (e.g. access statistics, recognition of returning visitors); Profiles with user-related information (creation of user profiles); Tracking (e.g. interest/behaviour-based profiling, use of cookies); Provision of our online services and user-friendliness.
  • Security measures: IP-Masking (Pseudonymisierung der IP-Adresse).
  • Legal bases: Consent (Art. 6(1)(a) GDPR).

Further information on processing operations, procedures and services:

24. Online Marketing

We process personal data for the purposes of online marketing, which may include in particular the marketing of advertising space or the display of advertising and other content (collectively referred to as "content") based on the potential interests of users and the measurement of their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (so-called "cookie") or similar procedures are used, by means of which information about the user relevant for the display of the aforementioned content is stored. This information may include, for example, content viewed, websites visited, online networks used, as well as communication partners and technical information such as the browser used, the computer system used, and information on usage times and functions used. If users have consented to the collection of their location data, these may also be processed.

The IP addresses of users are also stored. However, we use available IP masking procedures (i.e. pseudonymisation by shortening the IP address) to protect users. In general, no clear data of users (such as email addresses or names) is stored in the context of the online marketing process, but only pseudonyms. This means that we, as well as the providers of the online marketing procedures, do not know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is usually stored in cookies or by means of similar procedures. These cookies can generally also be read later on other websites that use the same online marketing procedure and analysed for the purposes of displaying content, as well as supplemented with further data and stored on the server of the online marketing procedure provider.

In exceptional cases, clear data may be assigned to the profiles. This is the case, for example, when users are members of a social network whose online marketing procedures we use and the network connects the profiles of users with the aforementioned information. We ask you to note that users may enter into additional agreements with the providers, e.g. by giving consent during registration.

In principle, we only have access to summarised information about the success of our advertisements. However, in the context of so-called conversion measurements, we can check which of our online marketing procedures have led to a so-called conversion, i.e. for example, to the conclusion of a contract with us. The conversion measurement is used solely to analyse the success of our marketing measures.

Unless otherwise stated, please assume that the cookies used are stored for a period of two years.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses); Event data (Facebook) ("event data" is data that can be transmitted by us to Facebook via Facebook Pixel (via apps or by other means) and relates to persons or their actions; the data includes e.g. information about visits to websites, interactions with content, functions, installations of apps, purchases of products, etc.; the event data is processed for the purpose of forming target groups for content and advertising information (custom audiences); event data does not include the actual content (such as written comments), no login information and no contact information (i.e. no names, email addresses and telephone numbers). Event data is deleted by Facebook after a maximum of two years, the target groups formed from them upon deletion of our Facebook account).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); Tracking (e.g. interest/behaviour-based profiling, use of cookies); Marketing; Profiles with user-related information (creation of user profiles); Conversion measurement (measuring the effectiveness of marketing measures); Provision of our online services and user-friendliness; Audience building; Audience building (determination of target groups relevant for marketing purposes or other output of content).
  • Security measures: IP-Masking (Pseudonymisierung der IP-Adresse).
  • Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).
  • Right to object (opt-out): We refer to the privacy notices of the respective providers and the objection options (so-called "opt-out") specified for the providers. If no explicit opt-out option has been specified, you have the option of deactivating cookies in the settings of your browser. However, this may restrict the functions of our online services. We therefore additionally recommend the following opt-out options, which are offered on a summary basis for the respective areas: a) Europa: https://www.youronlinechoices.eu. b) Canada: https://www.youradchoices.ca/choices. c) USA: https://www.aboutads.info/choices. d) Cross-territory: https://optout.aboutads.info.

Further information on processing operations, procedures and services:

  • Amazon: Marketing of advertising media and advertising space; Service provider: Amazon EU S.à r.l. (Société à responsabilité limitée), 38 avenue John F. Kennedy, L-1855 Luxembourg; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://www.amazon.de; Privacy policy: https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010.
  • Facebook Werbeanzeigen: Schaltung von Werbeanzeigen innerhalb der Facebook Plattform und Auswertung der Anzeigenergebnisse; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Right to object (opt-out): We refer to the privacy and advertising settings in the profile of users on the Facebook platform as well as within Facebook's consent procedure and Facebook's contact options for exercising information and other data subject rights in Facebook's privacy policy; Further information: Event data of users, i.e. behavioural and interest data, are processed for the purposes of targeted advertising and audience building on the basis of the joint controllership agreement ("Controller Addendum", https://www.facebook.com/legal/controller_addendum). The joint controllership is limited to the collection and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which in particular concerns the transmission of data to the parent company Meta Platforms, Inc. in the USA (on the basis of the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
  • Google Ad Manager: Wir nutzen die "Google Marketing Platform" (und Dienste wie z.B. "Google Ad Manager"), um Anzeigen im Google-Werbe-Netzwerk zu platzieren (z.B., in Suchergebnissen, in Videos, auf Websiten, etc.). The Google Marketing Platform is characterised by the fact that advertisements are displayed in real time based on the presumed interests of users. This allows us to display advertisements for and within our online services in a more targeted manner, in order to present users only with advertisements that potentially correspond to their interests. If, for example, a user is shown advertisements for products in which they have shown interest on other online services, this is referred to as "remarketing"; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Further information: Types of processing and processed data: https://privacy.google.com/businesses/adsservices; Data processing conditions for Google advertising products: Information on services data processing conditions between controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms; if Google acts as a processor, data processing conditions for Google advertising products and standard contractual clauses for third country transfers of data: https://business.safety.google/adsprocessorterms.
  • Google Ads und Konversionsmessung: We use the online marketing procedure "Google Ads" to place advertisements in the Google advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who have a presumed interest in the advertisements (so-called "conversion"). Furthermore, we measure the conversion of the advertisements. However, we only learn the anonymous total number of users who clicked on our advertisement and were redirected to a page with a so-called "conversion tracking tag". However, we ourselves do not receive any information that could be used to identify users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Further information: Types of processing and processed data: https://privacy.google.com/businesses/adsservices; Data processing conditions between controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms.
  • Enhanced Conversions for Google Ads: When customers click on our Google advertisements and subsequently use the advertised service (so-called "conversion"), the data entered by the user, such as the email address, name, residential address or telephone number, can be transmitted to Google. The hash values are then matched with existing Google accounts of users in order to better evaluate and improve the interaction of users with the advertisements (e.g. clicks or views) and thus their performance; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://support.google.com/google-ads/answer/9888656.
  • Instagram Werbeanzeigen: Schaltung von Werbeanzeigen innerhalb der Plattform Instagram und Auswertung der Anzeigenergebnisse; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy; Right to object (opt-out): We refer to the privacy and advertising settings in the profile of users on the Instagram platform as well as within Instagram's consent procedure and Instagram's contact options for exercising information and other data subject rights in Instagram's privacy policy; Further information: Event data of users, i.e. behavioural and interest data, are processed for the purposes of targeted advertising and audience building on the basis of the joint controllership agreement ("Controller Addendum", https://www.facebook.com/legal/controller_addendum). The joint controllership is limited to the collection and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which in particular concerns the transmission of data to the parent company Meta Platforms, Inc. in the USA (on the basis of the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).

25. Affiliate Programs and Affiliate Links

We integrate so-called affiliate links or other references (which may include, e.g., search masks, widgets, or discount codes) to the offers and services of third-party providers into our online offering (collectively referred to as "affiliate links"). When users follow the affiliate links or subsequently take advantage of the offers, we may receive a commission or other benefits from these third-party providers (collectively referred to as "commission").

In order to be able to track whether users have taken advantage of the offers of an affiliate link used by us, it is necessary that the respective third-party providers learn that the users followed an affiliate link placed within our online offering. The assignment of the affiliate links to the respective business transactions or other actions (e.g., purchases) serves solely the purpose of commission accounting and is cancelled as soon as it is no longer necessary for this purpose.

For the purposes of the aforementioned assignment of the affiliate links, the affiliate links may be supplemented by certain values that form part of the link or may otherwise be stored, e.g., in a cookie. The values may include, in particular, the source website (referrer), the time, an online identifier of the operator of the website on which the affiliate link was located, an online identifier of the respective offer, the type of link used, the type of offer, and an online identifier of the user.

Notes on legal bases: If we ask users for their consent to use third-party providers, the legal basis for processing data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical, and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

  • Types of data processed: Contract data (e.g., subject matter of contract, term, customer category); Usage data (e.g., websites visited, interest in content, access times); Meta/communication data (e.g., device information, IP addresses).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Affiliate tracking.
  • Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

26. Customer Reviews and Rating Procedures

We participate in review and rating procedures in order to evaluate, optimize, and promote our services. When users rate us through the participating rating platforms or procedures or otherwise provide feedback, the General Terms and Conditions or Terms of Use and the privacy notices of the providers also apply. As a rule, the rating also requires registration with the respective providers.

To ensure that the rating persons have actually used our services, we transmit, with the consent of the customers, the data required for this purpose regarding the customer and the service used to the respective rating platform (including name, email address, and order number or article number). This data is used solely for the verification of the authenticity of the user.

  • Types of data processed: Contract data (e.g., subject matter of contract, term, customer category); Usage data (e.g., websites visited, interest in content, access times); Meta/communication data (e.g., device information, IP addresses).
  • Data subjects: Customers; Users (e.g., website visitors, users of online services).
  • Purposes of processing: Feedback (e.g., collecting feedback via online form); Marketing.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

27. Plugins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may include, for example, graphics, videos, or city maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the users, as without the IP address they would not be able to send the content to their browser. The IP address is therefore required for the display of this content or functions. We endeavor to use only content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. Through the "pixel tags," information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit, and other information about the use of our online offering, as well as be linked with such information from other sources.

  • Types of data processed: Usage data (e.g., websites visited, interest in content, access times); Meta/communication data (e.g., device information, IP addresses); Master data (e.g., names, addresses); Contact data (e.g., email, phone numbers); Content data (e.g., entries in online forms).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Provision of our online offering and user-friendliness; Provision of contractual services and customer service.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Integration of third-party software, scripts or frameworks (e.g., jQuery): We integrate into our online offering software that we retrieve from servers of other providers (e.g., function libraries that we use for the purpose of display or user-friendliness of our online offering). In this process, the respective providers collect the IP address of the users and may process it for the purpose of transmitting the software to the users' browser as well as for security purposes and for the evaluation and optimization of their offering. - We integrate into our online offering software that we retrieve from servers of other providers (e.g., function libraries that we use for the purpose of display or user-friendliness of our online offering). In this process, the respective providers collect the IP address of the users and may process it for the purpose of transmitting the software to the users' browser as well as for security purposes and for the evaluation and optimization of their offering; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
  • Font Awesome (self-hosted): Display of fonts and symbols; Service provider: The Font Awesome icons are hosted on our server, no data is transmitted to the provider of Font Awesome; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
  • Google Maps: We integrate the maps of the service "Google Maps" provided by Google. The data processed may include, in particular, IP addresses and location data of the users, which, however, are not collected without their consent (usually carried out within the settings of their mobile devices); Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://cloud.google.com/maps-platform; Privacy policy: https://policies.google.com/privacy; Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of advertisements: https://adssettings.google.com/authenticated.
  • YouTube Videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy; Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of advertisements: https://adssettings.google.com/authenticated.

28. AI-Powered Features and Data Processing (OpenAI)

Our mobile app Slim-XR Online uses AI technology from OpenAI to provide personalized nutrition features. Before any data is sent to OpenAI, your explicit consent is obtained.

What data is processed

Depending on the AI feature used, the following data may be transmitted to OpenAI via our secure backend server:

  • Photos and text descriptions of meals (meal analysis)
  • Chat messages and voice audio (nutrition assistant)
  • Aggregated weekly nutrition data such as calories, macronutrients, and weight (weekly reports)
  • Remaining macro targets (meal suggestions)
  • Food-mood journal entries (mood insights)
  • Photos of restaurant menus (menu analysis)

What is NOT sent

No personal identification data (name, email address, account ID) is transmitted to OpenAI. All requests are routed through our secure backend server, which removes identifying data before forwarding to OpenAI.

Legal basis

The legal basis for this processing is your explicit consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the app settings.

OpenAI's privacy practices

OpenAI processes the data in accordance with its privacy policy: https://openai.com/policies/privacy-policy

29. Changes and Updates to the Privacy Policy

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g., consent) or other individual notification.

Where we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and we ask you to verify the information before contacting them.

30. Rights of Data Subjects

As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

  • Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
  • Right of withdrawal for consent: You have the right to withdraw consent at any time.
  • Right of access: You have the right to obtain confirmation as to whether data concerning you is being processed and to obtain information about such data as well as further information and a copy of the data in accordance with the legal requirements.
  • Right to rectification: You have the right, in accordance with the legal requirements, to request the completion of data concerning you or the rectification of inaccurate data concerning you.
  • Right to erasure and restriction of processing: You have the right, in accordance with the legal requirements, to demand that data concerning you be deleted without undue delay, or alternatively, in accordance with the legal requirements, to demand restriction of the processing of the data.
  • Right to data portability: You have the right to receive data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format in accordance with the legal requirements, or to demand its transmission to another controller.
  • Complaint to supervisory authority: In accordance with the legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State of your habitual residence, the supervisory authority of your place of work, or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

31. Definitions

In this section, you will find an overview of the terms used in this privacy policy. Many of the terms are taken from the law and defined primarily in Art. 4 GDPR. The legal definitions are binding. The following explanations, on the other hand, are primarily intended to aid understanding. The terms are sorted alphabetically.

  • Affiliate tracking: In the context of affiliate tracking, links by means of which the linking websites refer users to websites with product or other offers are logged. The operators of the respective linking websites may receive a commission if users follow these so-called affiliate links and subsequently take advantage of the offers (e.g., purchase goods or use services). For this purpose, it is necessary that the providers can track whether users who are interested in certain offers subsequently take advantage of them at the instigation of the affiliate links. Therefore, for the functionality of affiliate links, it is necessary that they are supplemented by certain values that become part of the link or are otherwise stored, e.g., in a cookie. The values include, in particular, the source website (referrer), the time, an online identifier of the operator of the website on which the affiliate link was located, an online identifier of the respective offer, an online identifier of the user, as well as tracking-specific values such as, e.g., advertising material ID, partner ID, and categorizations.
  • Conversion measurement: Conversion measurement (also referred to as "visit action evaluation") is a procedure used to determine the effectiveness of marketing measures. For this purpose, a cookie is generally stored on the devices of users within the websites on which the marketing measures take place and then retrieved again on the target website. For example, this allows us to track whether the advertisements we placed on other websites were successful.
  • Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
  • Profiles with user-related information: The processing of "profiles with user-related information," or "profiles" for short, includes any form of automated processing of personal data consisting of the use of such personal data to analyze, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include various information concerning demographics, behavior, and interests, such as interaction with websites and their content, etc.). Cookies and web beacons are frequently used for profiling purposes.
  • Reach measurement: Reach measurement (also referred to as web analytics) is used to evaluate the visitor flows of an online offering and may include the behavior or interests of visitors in certain information, such as content of web pages. With the help of reach analysis, website owners can, for example, recognize at what time visitors visit their website and what content they are interested in. This allows them, for example, to better adapt the content of the website to the needs of their visitors. For the purposes of reach analysis, pseudonymous cookies and web beacons are frequently used to recognize returning visitors and thus obtain more precise analyses of the use of an online offering.
  • Remarketing: "Remarketing" or "retargeting" refers to the practice of noting, for example for advertising purposes, which products a user was interested in on a website, in order to remind the user of these products on other websites, e.g., in advertisements.
  • Tracking: "Tracking" refers to the ability to trace the behavior of users across multiple online offerings. As a rule, behavioral and interest information is stored in cookies or on the servers of the providers of the tracking technologies with regard to the online offerings used (so-called profiling). This information can then be used, for example, to display advertisements to users that are likely to correspond to their interests.
  • Controller: The "controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: "Processing" means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data, be it collection, evaluation, storage, transmission, or erasure.
  • Audience building: Audience building (or "custom audiences") refers to the determination of target groups for advertising purposes, e.g., the display of advertisements. For example, based on a user's interest in certain products or topics on the internet, it can be concluded that this user is interested in advertisements for similar products or the online shop in which they viewed the products. "Lookalike audiences" (or similar audiences) in turn refers to the display of content deemed suitable to users whose profiles or interests presumably correspond to the users for whom the profiles were created. Cookies and web beacons are generally used for the purpose of creating custom audiences and lookalike audiences.