Introduction


With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to briefly as “data”) we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offer”).


The terms used are not gender-specific.


Status: December 28, 2021


 


Table of Contents





Controller


Dennis Geissler
Eschersheimer Landstr. 14
60322 Frankfurt am Main


Persons Authorized to Represent:


Dr. Dennis Geissler, Jürgen Heilbock, Thomas Hopf, Johannes Weisser


E-mail Address: qngrafpuhgm@srebkyrtny.pbz


Legal Notice: https://feroxlegal.com/de/impressum/


 



Overview of Processing Activities


The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects affected.


 


Types of Data Processed


  • Meta/communication data.


Categories of Data Subjects


  • Employees.


Purposes of Processing


  • Provision of contractual services and customer service.
  • Contact requests and communication.
  • Office and organizational procedures.
  • Provision of our online offer and user-friendliness.



Relevant Legal Bases


Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.


  • Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR) – The data subject has given consent to the processing of his or her personal data for one or more specific purposes.
  • Performance of a contract and prior contract inquiries (Art. 6 para. 1 sentence 1 lit. b. GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f. GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
  • Application procedures as a pre-contractual or contractual relationship (Art. 9 para. 2 lit. b GDPR) – Insofar as special categories of personal data within the meaning of Art. 9 para. 1 GDPR (e.g., health data, such as severely disabled status or ethnic origin) are requested from applicants during the application process, so that the controller or the data subject can exercise the rights and comply with the obligations arising from labor law and social security and social protection law, their processing is carried out in accordance with Art. 9 para. 2 lit. b. GDPR, in the case of the protection of vital interests of the applicants or other persons pursuant to Art. 9 para. 2 lit. c. GDPR, or for purposes of preventive medicine or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services pursuant to Art. 9 para. 2 lit. h. GDPR. In the case of a disclosure of special categories of data based on voluntary consent, their processing is based on Art. 9 para. 2 lit. a. GDPR.

In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection apply in Germany. This includes, in particular, the Act on Protection Against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains, in particular, special regulations on the right to information, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission as well as automated individual decision-making in individual cases including profiling. Furthermore, it regulates data processing for employment purposes (§ 26 BDSG), particularly with regard to the establishment, implementation, or termination of employment relationships as well as the consent of employees. In addition, state data protection laws of the individual federal states may apply.


 



Security Measures


In accordance with legal requirements, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.


The measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as access, entry, transfer, securing availability, and separation relating to them. Furthermore, we have established procedures to ensure the exercise of data subject rights, the deletion of data, and responses to data threats. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software, and procedures, in accordance with the principle of data protection by design and by default.


If IP addresses are processed by us or by the service providers and technologies used and the processing of a full IP address is not required, the IP address is shortened (also known as “IP masking”). In this process, the last two digits or the last part of the IP address after a dot are removed or replaced by placeholders. The shortening of the IP address is intended to prevent or significantly complicate the identification of a person based on their IP address.


In order to protect your data transmitted via our online offer, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.


 



Transmission of Personal Data


In the context of our processing of personal data, it may happen that the data is transmitted to other offices, companies, legally independent organizational units, or persons, or disclosed to them. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.


We may transmit personal data to other entities within our organization or grant them access to this data. If this disclosure takes place for administrative purposes, the disclosure of the data is based on our legitimate entrepreneurial and business interests or takes place if it is necessary to fulfill our contract-related obligations or if the consent of the data subjects or a legal permission is available.


 



Deletion of Data


The data processed by us will be deleted in accordance with legal requirements as soon as the consent granted for processing is revoked or other permissions cease to apply (e.g., if the purpose of processing this data no longer applies or it is not required for the purpose).


If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to these purposes. That means the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the assertion, exercise, or defense of legal claims or to protect the rights of another natural or legal person.


Our privacy policy may also contain further details on the retention and deletion of data that take precedence for the respective processing activities.


 



Use of Cookies


Cookies are small text files or other storage notices that store information on terminal devices and read information from the terminal devices. For example, to store the login status in a user account, a shopping cart content in an e-shop, the content accessed, or functions used of an online offer. Cookies can also be used for different purposes, e.g., for purposes of functionality, security, and convenience of online offers as well as the creation of analyses of visitor flows.


Notes on Consent: We use cookies in accordance with legal regulations. Therefore, we obtain prior consent from users, unless this is not legally required. Consent is, in particular, not necessary if the storage and reading of information, including cookies, are absolutely necessary to provide users with a telemedia service explicitly requested by them (i.e., our online offer). The revocable consent is clearly communicated to users and contains information on the respective cookie use.


Notes on Legal Bases under Data Protection Law: The legal basis under data protection law on which we process users’ personal data with the help of cookies depends on whether we ask users for consent. If users consent, the legal basis for processing your data is the declared consent. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g., in a commercial operation of our online offer and improvement of its usability) or, if this takes place within the scope of fulfilling our contractual obligations, when the use of cookies is necessary to fulfill our contractual obligations. We explain the purposes for which cookies are processed by us in the course of this privacy policy or within the scope of our consent and processing procedures.


Storage Duration: With regard to the storage duration, a distinction is made between the following types of cookies:


  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed their terminal device (e.g., browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after closing the terminal device. For example, the login status can be stored or preferred content displayed directly when the user visits a website again. Likewise, the data of users collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information on the type and storage duration of cookies (e.g., within the scope of obtaining consent), users should assume that cookies are permanent and the storage duration can be up to two years.

General Notes on Revocation and Objection (Opt-Out): Users can revoke the consent they have given at any time and also object to the processing in accordance with legal requirements in Art. 21 GDPR (further notes on objection are provided in this privacy policy). Users can also declare their objection via the settings of their browser.


[borlabs-cookie type=’btn-cookie-preference’ title=’Cookie-Einstellungen öffnen’ element=’link’/]


 


Further Notes on Processing Activities, Procedures, and Services:


  • Processing of cookie data based on consent: We use a cookie consent management procedure within the scope of which users’ consent to the use of cookies, or the processing operations and providers mentioned within the scope of the cookie consent management procedure, can be obtained, managed, and revoked by users. In this process, the declaration of consent is stored so as to not have to repeat its request and to be able to prove consent in accordance with the legal obligation. The storage can take place server-side and/or in a cookie (so-called opt-in cookie, or with the help of comparable technologies) in order to be able to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following notes apply: The duration of the storage of consent can be up to two years. In this process, a pseudonymous user identifier is formed and stored with the time of consent, details on the scope of the consent (e.g., which categories of cookies and/or service providers) as well as the browser, system, and terminal device used.



Provision of the Online Offer and Web Hosting


In order to provide our online offer safely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security services and technical maintenance services.


The data processed within the scope of providing the hosting offer may include all information relating to the users of our online offer that arises in the course of use and communication. This regularly includes the IP address, which is necessary to deliver the content of online offers to browsers, and all entries made within our online offer or from websites.


  • Types of Data Processed: Content data (e.g., entries in online forms); Usage data (e.g., websites visited, interest in content, access times); Meta/communication data (e.g., device information, IP addresses).
  • Data Subjects Affected: Users (e.g., website visitors, users of online services).
  • Purposes of Processing: Provision of our online offer and user-friendliness; Provision of contractual services and customer service.
  • Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).


Further Notes on Processing Activities, Procedures, and Services:


  • E-mail sending and hosting: The web hosting services used by us also include the sending, receiving, and storage of emails. For these purposes, the addresses of the recipients and senders as well as further information regarding email sending (e.g., the providers involved) and the contents of the respective emails are processed. The aforementioned data may also be processed for purposes of detecting SPAM. We ask you to note that emails on the Internet are generally not sent encrypted. As a rule, emails are encrypted in transit, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and received. We can therefore assume no responsibility for the transmission path of emails between the sender and receipt on our server.

  • Collection of access data and log files: We ourselves (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the accessed websites and files, date and time of access, data volumes transmitted, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files can be used, on the one hand, for security purposes, e.g., to avoid overloading the servers (in particular in the case of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure server utilization and stability; Deletion of data: Log file information is stored for a maximum period of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is excluded from deletion until final clarification of the respective incident.

  • Content Delivery Network: We use a “Content Delivery Network” (CDN). A CDN is a service with the help of which content of an online offer, in particular large media files such as graphics or program scripts, can be delivered faster and more securely with the help of regionally distributed servers connected via the Internet.

  • WordPress.com: Hosting platform for blogs / websites; Service Provider: Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA; Website: https://wordpress.com; Privacy Policy: https://automattic.com/privacy/; Data Processing Agreement: concluded with provider: https://wordpress.com/support/data-processing-agreements/.



Blogs and Publication Media


We use blogs or comparable means of online communication and publication (hereinafter “publication medium”). The readers’ data is processed for the purposes of the publication medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons. For the rest, we refer to the information on the processing of visitors to our publication medium within the scope of this privacy policy.


  • Types of Data Processed: Inventory data (e.g., names, addresses); Contact data (e.g., email, telephone numbers); Content data (e.g., entries in online forms); Usage data (e.g., websites visited, interest in content, access times); Meta/communication data (e.g., device information, IP addresses).

  • Data Subjects Affected: Users (e.g., website visitors, users of online services).

  • Purposes of Processing: Provision of contractual services and customer service; Feedback (e.g., collecting feedback via online form).

  • Legal Bases: Performance of a contract and prior contract inquiries (Art. 6 para. 1 sentence 1 lit. b. GDPR); Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).



Contact and Inquiry Management


When contacting us (e.g., via contact form, email, telephone, or via social media) as well as within the scope of existing user and business relationships, the details of the inquiring persons are processed insofar as this is necessary to answer the contact inquiries and any requested measures.


The response to contact inquiries and the management of contact and inquiry data within the scope of contractual or pre-contractual relationships takes place to fulfill our contractual obligations or to respond to (pre)contractual inquiries and otherwise on the basis of legitimate interests in responding to inquiries and maintaining user or business relationships.




  • Types of Data Processed: Inventory data (e.g., names, addresses); Contact data (e.g., email, telephone numbers); Content data (e.g., entries in online forms).

  • Data Subjects Affected:

  • Purposes of Processing:Contact requests and communication.

  • Legal Bases: Performance of a contract and prior contract inquiries (Art. 6 para. 1 sentence 1 lit. b. GDPR); Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).



Video Conferences, Online Meetings, Webinars, and Screen Sharing


We use platforms and applications of other providers (hereinafter referred to as “conference platforms”) for purposes of conducting video and audio conferences, webinars, and other types of video and audio meetings (hereinafter collectively referred to as “conference”). When selecting the conference platforms and their services, we comply with legal requirements.


Data Processed by Conference Platforms: Within the scope of participating in a conference, the conference platforms process the personal data of the participants mentioned below. The scope of processing depends, on the one hand, on which data is required within the scope of a specific conference (e.g., details of access data or real names) and what optional information is provided by the participants. In addition to processing to conduct the conference, the participants’ data may also be processed by the conference platforms for security purposes or service optimization. Processed data includes personal data (first name, last name), contact information (email address, telephone number), access data (access codes or passwords), profile pictures, details on professional position/function, the IP address of internet access.


  • Types of Data Processed: Inventory data (e.g., names); Contact data (e.g., email); Content data (e.g., entries); Usage data (e.g., websites visited, interests (blocked)); Meta/communication data (e.g., device information).

  • Data Subjects Affected: Communication partners; Users (e.g., website visitors, users).

  • Purposes of Processing: Provision of contractual services and customer service; Contact requests and communication; Office and organizational procedures.

  • Legal Bases: Consent; Performance of a contract and prior contract inquiries; Legitimate Interests.



Application Procedures


The application procedure requires applicants to provide us with the data necessary for their assessment and selection. The information required can be found in the job description or, in the case of online forms, in the details provided there.


In principle, the required information includes personal details such as name, address, a contact option, as well as proof of the qualifications necessary for a position. Upon request, we will also gladly inform you which details are required.


If provided, applicants can submit their applications to us using an online form. The data is transmitted to us encrypted according to the state of the art. Applicants can also submit their applications to us via email. In this regard, however, we ask you to note that emails on the Internet are generally not sent encrypted. As a rule, emails are encrypted in transit, but not on the servers from which they are sent and received.


  • Types of Data Processed: Applicant data (e.g., personal details, postal and contact addresses, the documents belonging to the application and the information contained therein, such as cover letter, CV).

  • Data Subjects Affected:

  • Purposes of Processing:Application procedure (establishment and any subsequent implementation).

  • Legal Bases: Application procedures as a pre-contractual or contractual relationship.



Cloud Services


We use software services accessible via the Internet and executed on the servers of their providers (so-called “cloud services”, also referred to as “Software as a Service”) for the following purposes: document storage and management, calendar management, email sending, spreadsheets and presentations, exchange of documents, content, and information with specific recipients or publication of websites, forms, or other content and information as well as chats and participation in audio and video conferences.


In this context, personal data may be processed and stored on the providers’ servers, insofar as these are part of communication processes with us or are otherwise processed by us as set out in this privacy policy. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes, and their contents.


  • Types of Data Processed: Inventory data (e.g., names); Contact data (e.g., email); Content data (e.g., entries); Usage data (e.g., websites visited, interest); Meta/communication data (e.g., device information).

  • Data Subjects Affected: Customers; Employees (e.g., employees, applicants, blocked blocked protected blocked); Interested parties; Communication partners.

  • Purposes of Processing: Office and organizational procedures.

  • Legal Bases: Consent (Art. 6 para. 1 sentence [blocked blocked protected blocked protected protected]); Performance of a contract and prior contract inquiries (Art. 6 para. 1 sentence [protected blocked blocked blocked blocked blocked]); Legitimate Interests (Art. 6 para. 1 sentence [blocked protected blocked protected protected protected]).



Newsletters and Electronic Notifications


We send newsletters, emails, and other electronic notifications (hereinafter “newsletter”) only with the consent of the recipients or a legal permission. If the contents of the newsletter are specifically described within the scope of registration, they are decisive for the users’ consent. For the rest, our newsletters contain information about our services and us.


To register for our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for the purpose of personal address in the newsletter, or further details if these are necessary for the purposes of the newsletter.


Double Opt-In Procedure: Registration for our newsletter takes place as a rule in a so-called double opt-in procedure. That means, after registration, you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register with someone else’s email address. Registrations for the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes the storage of the registration and confirmation time as well as the IP address. Likewise, changes to your data stored with the shipping service provider are logged.


Deletion and Restriction of Processing: We can store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them in order to be able to prove a previously given consent. The processing of this data is restricted to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the email address in a blocklist for this purpose alone.


The logging of the registration procedure is based on our legitimate interests for the purpose of proving its proper course. Insofar as we commission a service provider to send emails, this is based on our legitimate interests in an efficient and secure sending system.


Notes on Legal Bases: The newsletter is sent on the basis of the recipients’ consent or, if consent is not required, on the basis of our legitimate interests in direct marketing, if and to the extent permitted by law, e.g., in the case of existing customer advertising. Insofar as we commission a service provider to send emails, this is done on the basis of our legitimate interests in efficient and secure sending. The registration procedure is recorded on the basis of our legitimate interests in order to prove that it was carried out in accordance with the law.


Contents:


Information about us, our services, current events, and references.


  • Types of Data Processed: Inventory data (e.g., names, addresses); Contact data (e.g., email, telephone numbers); Meta/communication data (e.g., device information, IP addresses); Usage data (e.g., websites visited, interest in content, access times).

  • Data Subjects Affected:

  • Purposes of Processing:Direct marketing (e.g., via email or post).

  • Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR); Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

  • Possibility of Objection (Opt-Out): You can cancel the receipt of our newsletter at any time, i.e., revoke your consent or object to further receipt. You can find a link to cancel the newsletter either at the end of each newsletter or use one of the contact options given above, preferably email, for this purpose.


Further Notes on Processing Activities, Procedures, and Services:


  • Measurement of Open and Click Rates: The newsletters contain a so-called “web beacon”, i.e., a pixel-sized file that is retrieved from our server when the newsletter is opened, or, if we use a shipping service provider, from their server. Within the scope of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, are initially collected. This information is used for the technical improvement of our newsletter based on the technical data or the target groups and their reading behavior on the basis of their retrieval locations (which can be determined with the help of the IP address) or access times. This analysis also includes determining whether the newsletters are opened.



Commercial Communication via E-Mail, Post, Fax or Telephone


We process personal data for purposes of commercial communication, which can take place via various channels, such as email, telephone, post, or fax, in accordance with legal requirements.


Recipients have the right to revoke consent granted at any time or to object to commercial communication at any time.


After revocation or objection, we can store the data required to prove consent for up to three years on the basis of our legitimate interests before deleting it. The processing of this data is restricted to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time.


  • Types of Data Processed: Inventory data (e.g., names, addresses); Contact data (e.g., email, telephone numbers).

  • Data Subjects Affected:

  • Purposes of Processing:Direct marketing (e.g., via email or post).

  • Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR); Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).



Presences in Social Networks (Social Media)


We maintain online presences within social networks and process users’ data in this context in order to communicate with users active there or to offer information about us.


We point out that users’ data may be processed outside the territory of the European Union. This may result in risks for users because, for example, the enforcement of users’ rights could be made more difficult.


Furthermore, users’ data within social networks is usually processed for market research and advertising purposes. For example, user profiles can be created based on usage behavior and resulting interests of users. The usage profiles can in turn be used, for example, to place advertisements inside and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on users’ computers, in which the usage behavior and interests of the users are stored. Furthermore, data can also be stored in the usage profiles independently of the devices used by the users (in particular if the users are members of the respective platforms and are logged into them).


For a detailed description of the respective forms of processing and the possibilities of objection (opt-out), we refer to the privacy policies and details of the operators of the respective networks.


Also in the case of requests for information and the assertion of data subject rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the users’ data in each case and can directly take appropriate measures and provide information. Should you nevertheless need help, you can turn to us.


  • Types of Data Processed: Contact data (e.g., email, telephone numbers); Content data (e.g., entries in online forms); Usage data (e.g., visited websites, interest in content, access times); Meta/communication data (e.g., device information, IP addresses).

  • Data Subjects Affected: Users (e.g., website visitors, users of online services).

  • Purposes of Processing: Contact requests and communication; Feedback (e.g., collecting feedback via online form); Marketing.

  • Legal Bases: Legitimate Interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).


Further Notes on Processing Activities, Procedures, and Services:





Changes and Updates to the Privacy Policy


We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require a cooperative action on your part (e.g., consent) or other individual notification.


Insofar as we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and ask you to check the details before contacting us.


 



Rights of Data Subjects


As a data subject under the GDPR, you have various rights, which arise in particular from Articles 15 to 21 GDPR:


  • Right to Object: You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you carried out on the basis of Art. 6 para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed to engage in direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is connected with such direct marketing.

  • Right of Revocation for Consents: You have the right to revoke consents granted at any time.

  • Right of Access: You have the right to request confirmation as to whether data in question is being processed and to access this data as well as further information and a copy of the data in accordance with legal requirements.
  • Right to Rectification: You have the right, in accordance with legal requirements, to request the completion of data concerning you or the correction of incorrect data concerning you.
  • Right to Erasure and Restriction of Processing: You have the right, in accordance with legal requirements, to demand that data concerning you be deleted immediately, or alternatively, in accordance with legal requirements, to demand a restriction of the processing of the data.
  • Right to Data Portability: You have the right to receive data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format in accordance with legal requirements, or to demand its transmission to another controller.
  • Complaint to a Supervisory Authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you violates the provisions of the GDPR.



Definitions of Terms


In this section you will find an overview of the terminology used in this privacy policy. Many of the terms are taken from the law and defined above all in Art. 4 GDPR. The statutory definitions are binding. The following explanations, on the other hand, are intended primarily for understanding. The terms are sorted alphabetically.


  • Personal Data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
  • Controller: “Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. The term is broad and covers practically any handling of data, whether it is collection, evaluation, storage, transmission, or deletion.