06/2023
Privacy policy
Information on the handling of personal data
We are very pleased about your interest in our website – and thus in our company. The protection of your privacy is important to us; we will only use your data for the purposes intended. Because it is important to us that you are always aware of how we collect, use, and potentially share your data with third parties, we provide you with comprehensive information below regarding the processing of your personal data collected by us or stored by us.
Visiting our website is generally possible without providing any (personal) data; if there are exceptions to this for selected services, we will explain these in the following sections. When processing personal data, we strictly adhere to the requirements of the EU General Data Protection Regulation (GDPR) and, where applicable, other data protection-related regulations.
Provider and person responsible
Digital Language Testing UG (limited liability)
Vorm Berge 49
32429 Minden, Germany
Email: support@deutschtest.digital
Up-to-dateness of the privacy policy
To ensure that data protection information relating to the services on our website is always up-to-date, we use the CLOUD DSE service of Cookiebox GmbH from Münster.
Data Subject Rights
Chapter III of the EU General Data Protection Regulation (GDPR) provides extensive rights for data subjects, which we explain to you below with regard to the processing of your personal data:
Right to information
This requirement particularly concerns information on the following details of data processing:
- Purposes of Processing
- Categories of data
- Recipients or categories of recipients, if applicable
- If applicable, the planned storage period or the criteria for determining this period
- Note on the respective right to rectification, erasure, restriction or objection
- Existence of the right to lodge a complaint with a supervisory authority
- If applicable, origin of the data (if not collected from you)
- Where applicable, the existence of automated decision-making, including profiling, including meaningful information about the logic involved, the scope and the expected effects
- If applicable (planned) transfer to a third country or international organization
Right to rectification
We will correct any incorrect data immediately if you inform us accordingly.
Right to erasure (right to be forgotten)
If processing is no longer necessary and one of the following conditions is met:
- Loss of the processing purpose
- Withdrawal of your consent and lack of any other legal basis for processing
- Objection to processing without an important reason
- Unlawful processing
- Necessary to fulfill a legal obligation
- Data collection was carried out in accordance with Art. 8 (1) GDPR
Right to demand processing restrictions
If one of the following conditions is met:
- You dispute the accuracy of your data (restrictions may be imposed on our site for the duration of the review)
- In the case of unlawful processing and if the data is not to be deleted, the deletion will be replaced by a restriction of processing
- If the processing purposes no longer apply, but at the same time you need your data to assert, exercise or defend legal claims
- After you have objected in accordance with Art. 21 (1) GDPR and for the duration of the examination as to whether our legitimate reasons outweigh yours.
Right to data portability
If it is technically possible and does not affect the rights and freedoms of other persons, we will – at your request – transmit your data to another recipient (controller).
Right to objection
If we collect or have collected and process personal data from you (on the basis of Art. 6 Para. 1 e or f or Art. 9 Para. 2 a GDPR), you have the right to object to data processing (including profiling) at any time (with effect for the future). In exceptional cases, the objection may be ineffective, e.g. if we can demonstrate compelling legitimate interests for the processing that outweigh your interests or if processing serves to assert, exercise or defend legal claims. If we process your personal data in order to conduct direct advertising, you have the right to object to this processing at any time. This also applies to profiling insofar as it is related to such direct advertising. You also have the right to object to the processing of your data concerning you which we carry out for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 (1) GDPR, unless such processing is necessary to perform a task carried out in the public interest.
Automated decisions in individual cases including profiling
If we collect, have collected, and process personal data from you, you have the right not to be subjected to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you. Exceptions to this requirement apply if the decision is necessary for entering into or fulfilling a contract between you and us, or if you have explicitly consented to the processing. In any case, we will take appropriate measures to safeguard your rights and freedoms as well as your legitimate interests, including at least the right to obtain human intervention on our part, to express your point of view, and to contest the decision.
Right to revoke a data protection consent
You have the right to revoke your consent to the processing of personal data at any time.
Right to complain to a supervisory authority
A list of the supervisory authorities responsible in Germany can be found on the website of the Federal Commissioner for Data Protection or at the following link: https://www.bfdi.bund.de/DE/Service/Kontakt/Kontaktfinder/kontaktfinder_node.html.
General information on data processing on the website
The following information applies to data processing on our website in general. Any exceptions or additions to this information are described in detail in the respective sections.
Information on data security
We protect our website and other systems through technical and organizational measures against the loss, destruction, access, alteration, or distribution of your data by unauthorized persons. We have also implemented SSL encryption (SHA256) on our website to protect your data. Despite regular checks, complete protection against all threats is not possible.
Legal basis of processing
We process personal data in accordance with the GDPR, depending on the type and purpose of processing as follows:
| Permission | GDPR requirement |
| Informed consent | Article 6 paragraph 1 a |
| fulfillment of a contract | Article 6 paragraph 1 b |
| Implementation of pre-contractual measures | Article 6 paragraph 1 b |
| Fulfillment of legal obligations | Article 6 paragraph 1 c |
| Protection of vital Interests | Article 6 paragraph 1 d |
| Safeguarding our legitimate interests | Article 6 paragraph 1 f |
Our legitimate interest
Our legitimate interest, as defined in Article 6 (1) (f) GDPR, is based on the performance of our business activities to maintain our operational capability and secure the employment of our employees.
General deadlines for data deletion
Once the storage purpose no longer applies, the retention periods are generally at least six or ten years. Data is generally deleted immediately in accordance with our deletion policy, unless there is a retention obligation, necessity for contractual fulfillment, or a legitimate interest that conflicts with this.
Deletion or blocking of personal data
We store your personal data only for the period necessary to fulfill the specified purpose. Once the purpose no longer applies and after any retention periods have expired, your data will be deleted immediately. If deletion is not possible, the data will be blocked instead.
Collection of general data and information
As soon as you visit our website, our web server collects some general data and technical information – as shown in the table below:
Data collected | Purpose of the survey |
|---|---|
| browser types and versions used | correct display of page content |
| operating system used, visitor origin (referrer, e.g. Google), subpages clicked | Optimization of our website content and our advertising |
| Date and time of access to the website as well as the visitor’s IP address and Internet service provider | Ensuring the continued functionality of our IT systems (for operating the website) and preventing misuse |
other data and information for threat prevention in the event of attacks | Providing relevant information to law enforcement authorities in the event of a cyberattack |
Obligation to provide personal data
Under certain circumstances (e.g., due to legal or contractual regulations), you are required to provide us with your personal data. Examples of such processing include the following:
Type or purpose of processing | Notwendigkeit |
|---|---|
| Conclusion of a purchase contract (e.g. your address) | Fulfillment of the contractual obligation (e.g. delivery of the goods to your address) |
| In the employee context (e.g. transmission of data to the tax office) | Compliance with legal requirements (e.g. tax regulations) |
Information about specific data processing on the website
If applicable. Deviating from or in addition to the general information mentioned above, you will find details about the individual data processing on our website below.
Apple Pay
| Purpose of processing | Payment |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Apple Payments Inc.One Apple Park Way Cupertino, CA 95014, United States |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Without the data, the product order or payment cannot be processed. |
| Consequences of violation (if the required data is not provided) | Without the data, the product order or payment cannot be processed. |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Payment card information, first name, last name, address |
| If applicable. Change of purpose | no |
Applications and application procedures
| Purpose of processing | Applicants’ data is collected, processed and used for the purpose of selecting potential employees. |
| Recipient (if passed on) | There will be no transfer to third parties and/or to a third country. |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Forwarding does not take place and is not planned. |
| If known: Duration of data storage | The personal data of applicants whom we do not hire will be retained for the necessary period (maximum 6 months) for possible legal claims (e.g. under the General Equal Treatment Act (AGG)) and will then be destroyed or deleted immediately. |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | To ensure a smooth application process, it is necessary that you provide us with the requested information truthfully. |
| Consequences of violation (if the required data is not provided) | A violation (i.e. failure to provide the required data) could result in an employment contract not being concluded with you. |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject himself, but may also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Master data, contact details, application data |
| If applicable. Change of purpose | If we offer you employment after completing the application process, the purpose for processing the data in question will change: in this case, it will be used in the future to implement and maintain the employment relationship. |
Bing Ads
| Purpose of processing | Placement of advertisements in search engines and networks |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Microsoft Ireland Operations Limited, Attn: Data Protection Officer, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Telephone: +353 (0) 1 295 3826 |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA The data transfer is based on the EU-US Data Privacy Framework, which Microsoft Corporation is certified to. |
| If known: Duration of data storage | A conversion cookie is stored on the visitor's PC, which remains valid for 30 days. See general deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | As a rule, the data comes from the person concerned themselves. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | |
| Opt-Out | |
| Add-in privacy information | https://privacy.microsoft.com/de-de/privacystatement |
Credit and identity checks and scoring
| Purpose of processing | To process payments, we pass on your payment details to the credit institution responsible for the payment. If we make advance payments, our company regularly checks your creditworthiness when concluding contracts and in certain cases where there is a legitimate interest. |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Credit agency or service provider for credit and creditworthiness information |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | For the payment methods mentioned, the provision of the relevant data is mandatory. |
| Consequences of violation (if the required data is not provided) | Without the data, the relevant payment methods cannot be used. |
| If applicable. Existence of automated decision making | To the extent that score values are included in the result of the credit report, these are based on a scientifically recognized mathematical-statistical procedure. Address data, among other things, is used to calculate the score values. We use the result of the credit check in relation to the statistical probability of default for the purpose of deciding on the justification, Execution or termination of a contractual relationship. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data comes from the data subject himself. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Address, date of birth, name |
| If applicable. Change of purpose | no |
| Opt-Out | We will retain the credit report until the customer account is closed. You can delete your customer account yourself at any time. |
Borlabs
| Purpose of processing | Saving users' cookie settings, compliance with legal obligations |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Borlabs; Operator: Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Opt-in and opt-out data, IP address, time and type of consent, |
| If applicable. Change of purpose | no |
| Data protection officer of the provider | datenschutz@borlabs.io |
| Provider's privacy policy | https://de.borlabs.io/datenschutz/ |
Calendly
| Purpose of processing | Communication, event planning, analysis |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Calendly BB&T Tower 271 17th St NW, Atlanta, GA 30363, United States of America |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Log data, IP address, unique device identifier, internet provider, appointment information, calendar information, cookie information, geographic location, device operating system |
| If applicable. Change of purpose | no |
Cookies
We use cookies on this website; these are small text files that are placed or saved on your computer via your internet browser (e.g. Google Chrome, Safari, Firefox, Edge). These cookies are used for various purposes: Many cookies are technically necessary to provide you with certain website functions (e.g. shopping cart functions, saving your login information), other cookies serve to ensure the security of your data or the website, and some cookies can be used to analyze your user behavior. The latter cookies may contain a so-called cookie ID - a unique identifier consisting of a character string that enables websites and servers to be assigned to the saving browser.
Cookies that are necessary to transmit a message over a public telecommunications network and cookies that are absolutely necessary to provide you with a function you have expressly requested are referred to as "technically necessary cookies" and may be set without your explicit consent (Section 25 (2) TTDSG). All other cookies require your consent (Section 25 (1) TTDSG); if necessary, this is regulated by our consent management platform.
We use some cookies only for the duration of your visit to the website, some for a predefined period, and some permanently. You can delete all of these cookies manually or automatically at any time via your web browser.
Our services may be used without cookies (although they may not be fully functional). Most browsers are set to automatically accept cookies. However, you can disable cookies or configure your browser to notify you when cookies are sent.
Direct marketing to existing customers
For marketing purposes, we send promotional emails to existing customers, provided we received the email address as part of the sale of a product or service and the additional requirements of Section 7 (3) of the German Unfair Competition Act (UWG) are met. You can object to the use of your email address for direct marketing at any time.
GDPR scan
| Purpose of processing | Conducting a GDPR scan of the website requested by the user |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Cookiebox GmbH; Hafenweg 24, 48155 Münster, Germany We have concluded a data processing agreement with Cookiebox GmbH. |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | Without the data, the scan may not be able to be performed. |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data comes from the data subject. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | IP address, user agent, time of access, scanned website |
| If applicable. Change of purpose | no |
GDPR scan (including contact)
| Purpose of processing | Conducting a GDPR scan of the website requested by the user, contacting |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Cookiebox GmbH; Hafenweg 24, 48155 Münster, Germany We have concluded a data processing agreement with Cookiebox GmbH. |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | Without the data, the scan may not be able to be performed. |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data comes from the data subject. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | IP address, user agent, time of access, scanned website, name (for contact purposes only), email address (for contact purposes only) |
| If applicable. Change of purpose | no |
etracker
| Purpose of processing | Optimization, Analytics |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | etracker GmbH; Erste Brunnenstraße 1, 20459 Hamburg, Germany |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Browser language, date and time of visit, operating system, IP address, previously visited website, browser data. |
| If applicable. Change of purpose | no |
| Data protection officer of the provider | privacy@etracker.com |
| Provider's privacy policy | https://www.etracker.com/datenschutz/ |
Facebook Connect
| Purpose of processing | This is a single sign-on application service that allows users to log in to third-party websites using their Facebook account. |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America The data transfer is based on the EU-US Data Privacy Framework, for which Meta Platforms, Inc. is certified. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Profile information, browser information, user agent, usage data, profile picture, age, IP address, gender, geographical location, referrer URL, HTTP header, email address |
| If applicable. Change of purpose | no |
Facebook Connect
| Purpose of processing | Identity verification, registration, personalization |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America The data transfer is based on the EU-US Data Privacy Framework, for which Meta Platforms, Inc. is certified. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Profile information, browser information, user agent, usage data, profile picture, age, IP address, gender, geographic location, referrer URL, HTTP header, email address. |
| If applicable. Change of purpose | no |
Fast Fonts
| Purpose of processing | Providing written documents |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Monotype Imaging Holdings Inc., 600 Unicorn Park Drive, Woburn, Massachusetts 01801, United States of America |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Referrer URL, customer ID, URL, IP address, user agent |
| If applicable. Change of purpose | no |
| Data protection officer of the provider | privacy@monotype.com |
| Provider's privacy policy | https://www.monotype.com/legal/privacy-policy |
Font Awesome
| Purpose of processing | Uniform representation of fonts |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Fonticons, Inc.; 6 Porter Road, Apartment 3R, Cambridge, MA 02140, United States of America |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America |
| If known: Duration of data storage | Unknown duration See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | IP address, access time, access date |
| If applicable. Change of purpose | no |
Friendly Captcha
| Purpose of processing | This service is used to prevent spam and bots on the website, improve the service, and comply with legal obligations. |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Friendly Captcha GmbH, Am Anger 3-5, 82237 Woerthsee, Germany |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Due to necessity |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Anonymized IP address, referrer URL, URL user agent, timestamp |
| If applicable. Change of purpose | no |
| Data Protection Officer of the Service | privacy@friendlycaptcha.com |
| Provider's privacy policy | https://friendlycaptcha.com/legal/privacy-end-users/ |
FunnelCockpit
| Purpose of processing | Creation and delivery of websites as well as for the implementation and analysis of advertising measures, optimization of our offers |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Just Viral GmbH & Co. KG Reinholdstrasse 5, 21073 Hamburg Management: Resul Mert Capa HRB: 138201, VAT ID: DE 306 459 825 |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | The retention period is the period of time during which the collected data is stored for processing. The data must be deleted as soon as it is no longer needed for the specified processing purposes. Data will be deleted as soon as it is no longer needed for processing. See General Data Deletion Periods |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | User data, IP addresses, user agent, contact details |
| If applicable. Change of purpose | no |
| Cookie Policy of the add-in | https://funnelcockpit.com/datenschutz/ |
| Data protection officer of the add-in | Email: support@funnelcockpit.com |
Google Ads
| Purpose of processing | Placement of advertisements for relevant search queries in the Google search engine results and in the network of Google Ads participants. Evaluation of success rates of placed advertisements (conversion tracking) |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA; Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | which pages and functions are accessed or clicked during the website visit (click behavior), IP address assigned by the Internet Service Provider (ISP) in anonymized form, previously visited website (referrer), visited subpages, time spent on the website, frequency of visits, date, access location, Time of visit, user agent |
| If applicable. Change of purpose | no |
| Opt-Out | Prevent cookies from being set, interest-based advertising by Google on https://adssettings.google.de/ contradict, See also Cookies |
| Data protection officer of the provider | https://support.google.com/policies/contact/general_privacy_form |
| Provider's privacy policy | https://policies.google.com/privacy?hl=en |
Google Ads conversion tracking
| Purpose of processing | This service records what happens when users visit the website after clicking on an ad served by us through Google Ads. Conversions measure whether users perform a specific, predefined action on the website (e.g., whether they order services) after clicking on an ad served through Google Ads. This makes it possible to understand which keywords, ads, ad groups, or campaigns lead to the desired user interaction. |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA, Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Browser language, browser type, clicked ads, cookie ID, date and time of visit, IP address, referrer URL, web request, user behavior, user agent |
| If applicable. Change of purpose | no |
| Opt-Out | Prevent cookies from being set, interest-based advertising by Google on https://adssettings.google.de/ contradict, See also Cookies |
| Data protection officer of the provider | https://support.google.com/policies/contact/general_privacy_form |
| Provider's privacy policy | https://policies.google.com/privacy?hl=en |
Google Adsense
| Purpose of processing | Marketing. |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google LLC, Google Ireland Limited, Alphabet Inc. |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA, Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | Data will be deleted as soon as it is no longer required for the processing purposes. |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Ads viewed, click path, IP address, mouse movements, usage data. |
| If applicable. Change of purpose | no |
Google Analytics
| Purpose of processing | Creation of user profiles to optimize the cost-benefit factor on the website |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA, Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | As a rule, the data comes from the person concerned themselves. |
| If applicable, categories of personal data (if not collected directly from the data subject) | which pages and functions are accessed or clicked during the website visit (click behavior), IP address assigned by the Internet service provider (ISP) in anonymized form, previously visited website (referrer), visited subpages, time spent on the website, frequency of visits, date, access location, time of visit, user agent |
| If applicable. Change of purpose | no |
| Opt-Out | Installing the browser plugin: https://tools.google.com/dlpage/gaoptout, See also Cookies |
| Data protection officer of the provider | https://support.google.com/policies/contact/general_privacy_form |
| Provider's privacy policy | https://policies.google.com/privacy?hl=en |
Google Enhanced Conversions
| Purpose of processing | Conversion tracking, conversion optimization, measurement partners - ensuring security |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Transfer, storage and processing in the United States of America, Taiwan, Chile, Singapore; Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Email address, first name, last name, address, telephone number, subscription service login details, purchase information |
| If applicable. Change of purpose | no |
Google Fonts
| Purpose of processing | Uniform representation of fonts |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA, Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | Unknown duration See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | IP address, access time, access date |
| If applicable. Change of purpose | no |
| Opt-Out | Use a browser that does not support Google Fonts See also Cookies |
| Add-in privacy information | https://www.google.com/policies/privacy/ |
Google Maps
| Purpose of processing | Providing maps. |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google Ireland Limited, Google LLC, Alphabet Inc, United States of America |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA, Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | IP address, date and time of visit, location information, URL, usage data, search terms, geographical location, user agent |
| If applicable. Change of purpose | no |
| Data protection officer of the provider | https://support.google.com/policies/contact/general_privacy_form |
| Provider's privacy policy | http://www.google.com/intl/de/policies/privacy/ |
Google Pay
| Purpose of processing | Payment |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google Ireland LimitedGordon House, Barrow StreetDublin 4Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA, Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Without the data, the product order or payment cannot be processed. |
| Consequences of violation (if the required data is not provided) | Without the data, the product order or payment cannot be processed. |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Browser information, credit and debit card number, first name, geographical location, Internet service provider, IP address, last name, payment information, purchase activity, transaction information, bank details, master and contract data, password, TAN and checksum, device type, type of network connection, account information, email address |
| If applicable. Change of purpose | no |
Google reCaptcha
| Purpose of processing | Bot protection, spam prevention, fraud detection |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA, Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Screen resolution, browser language, browser plug-ins, click path, date and time of visit, IP address, user behavior, time spent on a page, user input, device information, mouse movements, geographical location, device operating system, user agent |
| If applicable. Change of purpose | no |
| Data protection officer of the provider | https://support.google.com/policies/contact/general_privacy_form |
| Provider's privacy policy | https://policies.google.com/privacy?hl=en |
Google signals
| Description of processing | Google Signals are session data from websites and apps that Google links to users who are logged into their Google Account and have enabled personalized advertising. Google Signals identifies you through your Google profile, and the collected data is linked to your profile. This allows us to track you across different sessions and devices and combine the collected data into a user profile. As a website operator, we only receive anonymized reports from Google. |
| Purpose of processing | Analysis, optimization, remarketing |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Transfer, storage and processing in the United States of America, Singapore, Taiwan, Chile; Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Search terms, usage data, device information, browser information, content viewed, geographic location, IP address, demographic data. |
| If applicable. Change of purpose | no |
Google Tag Manager
| Purpose of processing | Simplified management of analysis tools through central control and management of the collected analysis mechanisms |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA, Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | As a rule, the data comes from the person concerned themselves. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | which pages and functions are accessed or clicked during the website visit (click behavior), IP address assigned by the Internet service provider (ISP) in anonymized form, previously visited website (referrer), visited subpages, time spent on the website, frequency of visits, date, access location, time of visit |
| Opt-Out | See also Cookies |
| Data protection officer of the provider | https://support.google.com/policies/contact/general_privacy_form |
| Provider's privacy policy | https://policies.google.com/privacy?hl=en |
Website Hosting
This website is operated by a hosting service provider whose European servers store the website content. The hosting partner records certain metadata (including IP addresses of website visitors) in log files to ensure system security and for verification purposes; see also "Collection of General Data and Information."
The hosting service provider was carefully selected; all necessary measures were taken to ensure data processing in compliance with data protection law (e.g., the conclusion of a contract processing agreement, AVV).
Hotjar
| Purpose of processing | Creation of user profiles to optimize the website in terms of cost-benefit factor |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | As a rule, the data comes from the person concerned themselves. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Date and time of visit, device type, geographical location, IP address, mouse movements, pages visited, referrer URL, screen resolution, own device identifier, language information, device operating system, browser type, clicks, domain name, own user ID, user agent |
| Change of purpose if necessary | no |
| Opt-Out | See Cookies and https://www.hotjar.com/legal/compliance/opt-out |
| Data protection officer of the provider | dpo@hotjar.com |
| Provider's privacy policy | https://www.hotjar.com/legal/policies/privacy |
| Purpose of processing | Displaying Instagram content, retargeting or marketing |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Meta Platforms Ireland Limited, Meta Platforms Inc., 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Meta Platforms Ireland Limited, Meta Platforms Inc., Worldwide The data transfer is based on the EU-US Data Privacy Framework, for which Meta Platforms, Inc. is certified. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Device information, interactions with the embed, IP address, referrer URL, user agent |
| If applicable. Change of purpose | no |
| Data protection officer of the provider | https://www.facebook.com/help/contact/540977946302970 |
| Provider's privacy policy | https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect |
Klarna
| Purpose of processing | Payment |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Klarna; Operator: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Without the data, the product order or payment cannot be processed. |
| Consequences of violation (if the required data is not provided) | Without the data, the product order or payment cannot be processed. |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data comes from the data subject himself. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Address, browser language, device operating system, email address, first name, last name, IP address, billing information |
| If applicable. Change of purpose | no |
Contact form
| Purpose of processing | Processing and, if necessary, answering the request from the form sender |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | There will be no transfer to third parties and/or to a third country. |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | There is no obligation. |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data comes from the data subject himself. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | In this context, we do not use automated decision-making. |
| If applicable. Change of purpose | no |
Customer account and product order
| Purpose of processing general data |
| ||||||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||||||
| Recipient (if passed on) | Parcel service providers, logistics service providers, payment service providers | ||||||||
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. | ||||||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | The data (in the mandatory fields) must be provided as part of the underlying contract. | ||||||||
| Consequences of violation (if the required data is not provided) | In this case, it is not possible to create a customer account. | ||||||||
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. | ||||||||
| If applicable. Origin of the data (if not collected directly from the data subject) | The data comes from the data subject himself. | ||||||||
| Where applicable, categories of personal data (if not collected directly from the data subject). | The data comes from the data subject himself. | ||||||||
| If applicable. Change of purpose | no |
LiveChat
| Purpose of processing | Providing a chat program for customer support |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | LiveChat Inc, 101 Arch Street, 8th Floor, Boston MA 02110, United States of America |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America, LiveChat Inc The data transfer is based on the EU-US Data Privacy Framework, to which LiveChat Inc is certified. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | IP address, user agent, timestamp, if applicable, content of the message history |
| If applicable. Change of purpose | no |
| Add-in privacy information | https://www.livechat.com/legal/gdpr-faq/#main |
Meta Pixel (formerly Facebook Pixel)
| Purpose of processing | Marketing, analytics, retargeting, advertising, conversion tracking, personalization. |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Meta Ireland Ltd, 4 Grand Canal Square Grand Canal Harbor Dublin 2 Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA, Meta Platforms, Inc. The data transfer is based on the EU-US Data Privacy Framework, for which Meta Platforms, Inc. is certified. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Ads viewed, browser information, content accessed, device information, geographic location, interactions with ads, services and products, IP address, marketing information, pixel ID, referrer URL, usage data, user behavior, Facebook user ID, device operating system, device ID, HTTP header, clicked items, pages accessed, Facebook cookie information, page/click behavior, user agent, browser type |
| If applicable. Change of purpose | no |
| Data protection officer of the provider | https://www.facebook.com/help/contact/540977946302970 |
| Provider's privacy policy | https://www.facebook.com/privacy/explanation |
Newsletter
| Purpose of processing | Provision of information in the form of electronic circulars |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | no |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | There is no obligation to provide personal data. Newsletters will only be sent after registration via a double opt-in process (voluntary and revocable informed consent in accordance with Article 6 (1) (a) GDPR) or after a purchase contract has been successfully concluded and the email address was collected in this process (pursuant to Section 7 (3) of the German Unfair Competition Act). |
| Consequences of violation (if the required data is not provided) | Any violation (i.e. failure to provide the required data) would result in the newsletter not being delivered to you. |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data comes from the data subject himself. |
| If applicable. Change of purpose | no |
Optimise-it
| Purpose of processing | Service for integrating live chats; Marketing |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Optimise-it GmbH; Karnapp 25, 21079 Hamburg, Germany |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | User agent, IP address, geographical location, chat history |
| If applicable. Change of purpose | no |
| Data protection officer of the provider | ext-dsb@b3-gruppe.de |
| Provider's privacy policy | https://www.optimise-it.de/en/privacy-policy/ |
PayPal
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Paypal; Operator: PayPal (Europe) S.à rl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Without the data, the product order or payment cannot be processed. |
| Consequences of violation (if the required data is not provided) | Without the data, the product order or payment cannot be processed. |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data comes from the data subject himself. |
| If applicable. Change of purpose | no |
| Categories of personal data | Browser information, credit and debit card number, first name, geographical location, Internet service provider, IP address, last name, payment information, purchase activity, transaction information, bank details, master and contract data, password, TAN and checksum, device type, type of network connection, account information, email address |
reCaptcha v3
| Purpose of processing | Analysis, bot protection |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Google LCC, Alphabet Inc., Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America, Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LLC is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Screen resolution, date and time of visit, IP address, browser language, mouse movements, visitor behavior, responses and forms |
| If applicable. Change of purpose | no |
| Add-in privacy information | https://policies.google.com/privacy?hl=en |
| Data protection officer of the add-in | https://support.google.com/policies/troubleshooter/7575787?hl=en |
Stripe
| Purpose of processing | Payment |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Stripe, Inc. 3180 18th Street, San Francisco, CA 94110, United States of America |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America, Stripe, Inc. The data transfer is based on the EU-US Data Privacy Framework, which Stripe, Inc. is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Without the data, the product order or payment cannot be processed. |
| Consequences of violation (if the required data is not provided) | Without the data, the product order or payment cannot be processed. |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Purchase date, payment information, purchase activity, payment card information |
| If applicable. Change of purpose | no |
User login
| Purpose of processing |
| ||||
| Legal basis (according to Art. 6 / 9 GDPR) | |||||
| Recipient (if passed on) | no | ||||
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | Data transfer to a third country does not take place and is not planned. | ||||
| If known: Duration of data storage | See General deadlines for data deletion | ||||
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | Without the data the user account cannot be created. | ||||
| Consequences of violation (if the required data is not provided) | Without the data the user account cannot be created. | ||||
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. | ||||
| If applicable. Origin of the data (if not collected directly from the data subject) | The data comes from the data subject himself. | ||||
| If applicable. Change of purpose | no |
Wordfence
| Purpose of processing | Firewall and malware scan |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Defiant, Inc. 800 5th Ave., Suite 4100, Seattle, WA 98104, United States of America |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | IP address, date and time of visit, browser information, information about the operating system, device information |
| If applicable. Change of purpose | no |
Wordpress
| Purpose of processing | Website Hosting |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Automattic Inc.; 60 29th Street #343, San Francisco, CA 94110, United States of America |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | IP address, log files, page views, interaction data |
| If applicable. Change of purpose | no |
| Add-in privacy information | https://wordpress.org/about/privacy/ |
YouTube videos
| Purpose of processing | This is a video player service from Google. |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Alphabet Inc., Google LLC, Google Ireland Limited |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | if applicable, transfer, storage and processing in the USA, Google LLC The data transfer is based on the EU-US Data Privacy Framework, which Google LCC is certified to. |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| If applicable. Change of purpose | no |
Zapier
| Purpose of processing | Online automation |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Zapier Inc. 548 Market St # 62411, San Francisco, California 94104, United States of America |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | no |
| Consequences of violation (if the required data is not provided) | no |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Booking details, event-based messages, customer data, first name, last name, address, payment card information, IP address, token, identifiers, password. |
| If applicable. Change of purpose | no |
Zoom
| Purpose of processing | Provide service, provide support, display user avatar, send marketing messages, provide announcements, conduct promotional activities, provide event information, create an account, respond to inquiries, service optimization, monitor data center performance, provide account dashboards, maintain security, manage disaster recovery plans and policies, detect fraud and abuse, comply with legal obligations |
| Legal basis (according to Art. 6 / 9 GDPR) | |
| Recipient (if passed on) | Zoom Video Communications Inc.; 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, United States |
| If applicable, intention to transfer to a third country or international organization (including information on the Commission's adequacy decision or appropriate safeguards) | United States of America |
| If known: Duration of data storage | See General deadlines for data deletion |
| Obligation to provide personal data (e.g. due to legal or contractual regulations) / necessity | The provision of data is mandatory based on the underlying contract. |
| Consequences of violation (if the required data is not provided) | The provision of data is mandatory based on the underlying contract. |
| If applicable. Existence of automated decision making | In this context, we do not use automated decision-making. |
| If applicable. Origin of the data (if not collected directly from the data subject) | The data usually comes from the data subject, but can also come from third parties. |
| Where applicable, categories of personal data (if not collected directly from the data subject). | Date of birth, name, telephone number, email address, language preference, user ID, password, profile picture, session schedule, configuration data, session metadata, feature usage data, performance data, service logs, billing information, location, IP address, browser type, ISP, referrer URL, operating system, date/time stamp |
| If applicable. Change of purpose | no |