Privacy Policy

Privacy Policy

Introduction With the following privacy policy, we would like to inform you about which types of your personal data (hereinafter also referred to as “data” for short) we process, for what purposes, and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offer”).

The terms used are not gender-specific.

Status: October 28, 2026

Table of Contents

  • Introduction
  • Controller
  • Overview of processing activities
  • Contact Data Protection Officer
  • Relevant legal bases
  • Security measures
  • Transmission and disclosure of personal data
  • Data processing in third countries
  • Use of cookies
  • Commercial and business services
  • Payment service providers
  • Credit check
  • Provision of the online offer and web hosting
  • Contact
  • Newsletter and electronic notifications
  • Web analysis, monitoring and optimization
  • Online marketing
  • Presences in social networks (Social Media)
  • Plugins and embedded functions as well as content
  • Deletion of data
  • Modification and update of the privacy policy
  • Rights of data subjects
  • Definitions of terms

Controller Anja Hofmann / KreativUndCleverLernen Hirtgrasstr. 11 85737 Ismaning Germany Email address: anja_hofmann@email.de Legal Notice: https://lernende.eu/legal_information/

Overview of processing activities The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of processed data

  • Inventory data (e.g., names, addresses).
  • Content data (e.g., entries in online forms).
  • Contact data (e.g., email, telephone numbers).
  • Meta-/communication data (e.g., device information, IP addresses).
  • Usage data (e.g., visited websites, interest in content, access times).
  • Location data (information on the geographical position of a device or a person).
  • Contract data (e.g., subject matter of contract, term, customer category).
  • Payment data (e.g., bank details, invoices, payment history).

Categories of data subjects

  • Business and contractual partners.
  • Interested parties.
  • Communication partners.
  • Customers.
  • Users (e.g., website visitors, users of online services).

Purposes of processing

  • Assessment of creditworthiness and credit standing.
  • Provision of our online offer and user-friendliness.
  • Visit action evaluation.
  • Office and organizational procedures.
  • Cross-Device Tracking (cross-device processing of user data for marketing purposes).
  • Direct marketing (e.g., by email or postal mail).
  • Interest-based and behavioral marketing.
  • Contact requests and communication.
  • Conversion measurement (measurement of the effectiveness of marketing measures).
  • Profiling (creating user profiles).
  • Remarketing.
  • Reach measurement (e.g., access statistics, recognition of returning visitors).
  • Security measures.
  • Tracking (e.g., interest-/behavioral profiling, use of cookies).
  • Provision of contractual services and customer service.
  • Management and answering of inquiries.
  • Target group formation (determination of target groups relevant for marketing purposes or other output of content).

Automated individual decision-making

  • Credit report (decision based on a credit check).

Relevant legal bases In the following, we inform you of the legal bases of the General Data Protection Regulation (GDPR) on the basis of which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection regulations may apply in your or our country of residence and domicile. Furthermore, should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

  • Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR) The data subject has given consent to the processing of his or her personal data for one or more specific purposes.
  • Performance of a contract and prior requests (Art. 6 Para. 1 S. 1 lit. b. GDPR) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6 Para. 1 S. 1 lit. c. GDPR) Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Security measuresWe take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as access to, input of, transmission of, safeguarding of availability of, and separation of the data. Furthermore, we have established procedures that ensure the exercise of data subject rights, the deletion of data, and responses to data endangerment. We also take the protection of personal data into account as early as the development or selection of hardware, software, and procedures, in accordance with the principle of data protection by design and by default.

SSL encryption (https): To protect your data transmitted via our online offer, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Transmission and disclosure of personal data In the context of our processing of personal data, it may happen that the data is transmitted to or disclosed to other bodies, companies, legally independent organizational units, or persons. The recipients of this data may include, for example, payment institutions in the context of payment transactions, service providers commissioned with IT tasks, or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

Data processing in third countries If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or if processing takes place in the context of the use of third-party services or disclosure or transmission of data to other persons, bodies or companies, this will only take place in accordance with the legal requirements.

Subject to explicit consent or contractually or legally required transmission, we process or have the data processed only in third countries with a recognized level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, in the presence of certifications, or binding internal data protection regulations (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de ).

Under the so-called “Data Privacy Framework” (DPF), the EU Commission has also recognized the level of data protection as safe for certain companies from the USA in the context of the adequacy decision of July 10, 2023. You can find the list of certified companies as well as further information on the DPF on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English). We will inform you within the privacy policy which of the service providers we use are certified under the Data Privacy Framework.

Use of cookies Cookies are small text files, or other memory markers, that store information on end devices and read information from the end devices. E.g., to store the login status in a user account, shopping cart content in an e-shop, the accessed content, or used functions of an online offer. Cookies can also be used for different purposes, e.g., for purposes of the functionality, security, and comfort of online offers as well as the creation of analyses of visitor flows.

Notes on consent: We use cookies in accordance with legal regulations. Therefore, we obtain prior consent from users, unless it is not required by law. In particular, consent is not necessary if the storage and reading of information, including cookies, are absolutely necessary in order to provide the users with a telemedia service explicitly requested by them (i.e., our online offer). The revocable consent is communicated clearly to the users and contains the information on the respective cookie use.

Notes on legal bases under data protection law: The legal basis under data protection law on which we process users’ personal data with the help of cookies depends on whether we ask users for consent. If the users consent, the legal basis for processing your data is the declared consent. Otherwise, the data processed using cookies will be processed on the basis of our legitimate interests (e.g., in the economic operation of our online offer and improvement of its usability) or, if this is done in the context of fulfilling our contractual obligations, if the use of cookies is necessary to fulfill our contractual obligations. We explain the purposes for which the cookies are processed by us in the course of this privacy policy or as part of our consent and processing procedures.

Storage duration: With regard to the storage duration, the following types of cookies are distinguished:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed their end device (e.g., browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. Likewise, user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information on the type and storage duration of cookies (e.g., in the context of obtaining consent), users should assume that cookies are permanent and the storage duration can be up to two years.

General notes on revocation and objection (Opt-Out): Depending on whether the processing is based on consent or legal permission, you have the option at any time to revoke any consent given or to object to the processing of your data by cookie technologies (collectively referred to as “Opt-Out”). You can initially declare your objection using your browser settings, e.g., by deactivating the use of cookies (which may also restrict the functionality of our online offer). An objection to the use of cookies for online marketing purposes can also be declared using a variety of services, especially in the case of tracking, via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/. In addition, you can receive further information on objections in the context of the information on the service providers and cookies used.

Processing of cookie data based on consent: We use a procedure for cookie consent management, within the scope of which the users’ consent to the use of cookies, or the processing and providers mentioned within the cookie consent management procedure, is obtained and can be managed and revoked by the users. Here, the declaration of consent is stored so as not to have to repeat its request and to be able to prove the consent in accordance with the legal obligation. Storage can take place server-side and/or in a cookie (so-called opt-in cookie, or with the help of comparable technologies) in order to be able to assign the consent to a user or their device. Subject to individual details on the providers of cookie management services, the following notes apply: The duration of the storage of consent can be up to two years. Here, a pseudonymous user identifier is created and stored with the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers), as well as the browser, system, and end device used.

Cookie settings / objection options

Change privacy settings History of privacy settings Einwilligungen widerrufen

Business Services

We process personal data of our contractual and business partners, such as customers, clients, interested parties, suppliers, and other cooperation partners (collectively “Contractual Partners”), for the initiation, execution, and processing of contractual relationships as well as comparable legal relationships. This also includes pre-contractual measures that take place upon request, as well as communication in connection with the respective contractual relationship.

The processing serves in particular the fulfillment of our main and ancillary contractual obligations. This includes the provision of the agreed services, any updating and information obligations, the handling of warranty and other service disruptions, the processing of revocations, terminations of continuing obligations, reversals, refunds, as well as the processing of other contract-related declarations and inquiries. Both one-off contracts and ongoing contractual relationships are covered.

Processed in particular are master data such as name, address and, if applicable, company, contact data such as e-mail address and telephone number, contract and service data such as subject matter of the contract, contract duration, order or transaction number, usage and service data, payment and billing data, as well as communication contents and histories. Where necessary, we also process data disclosed or transmitted to us as part of the execution of an order.

In addition, we process the data to safeguard our rights and to fulfill legal obligations. This includes, in particular, retention obligations under commercial and tax law, documentation obligations, and, if applicable, proof and accountability obligations. Furthermore, processing takes place on the basis of our legitimate interests in proper business management, internal administration, risk management, and IT security, as well as the protection of our business operations and our Contractual Partners against misuse, endangerment of data, secrets, and other legal interests. This may also include the involvement of external service providers such as IT and telecommunications providers, transport and logistics companies, payment service providers, banks, tax and legal advisors, or other vicarious agents, provided this is necessary for the execution of the contract or to fulfill legal obligations.

A transfer of personal data to third parties occurs exclusively to the extent necessary for the fulfillment of the contract, for the execution of pre-contractual measures, to safeguard legitimate interests, or to fulfill legal obligations. We inform separately about processing beyond this, in particular for marketing purposes, within the scope of this privacy policy.

We inform the Contractual Partners which data is required in individual cases as part of the data collection, for example in online forms through corresponding marking or in personal contact.

The deletion of data takes place as soon as it is no longer required for the aforementioned purposes and no legal retention obligations oppose it. Statutory retention periods, in particular under commercial and tax law, may require longer storage. We delete data transmitted in the context of a specific order after completion of the order and expiration of any retention periods, provided there are no further legal or contractual obligations to store it.

The legal basis for the processing is Art. 6 Para. 1 lit. b GDPR for the execution of pre-contractual measures and for the fulfillment of the respective contractual relationship, as well as Art. 6 Para. 1 lit. c GDPR for the fulfillment of legal obligations. Insofar as the processing is based on legitimate interests, it takes place on the basis of Art. 6 Para. 1 lit. f GDPR. Insofar as the processing is based on Art. 6 Para. 1 lit. f GDPR, it serves to safeguard our legitimate interests in a proper and efficient business organization, the internal administration and documentation of business transactions, the enforcement and defense of legal claims, ensuring IT and data security, the prevention of misuse and fraud, as well as the economic management and further development of our business operations. These interests consist in particular in ensuring safe and legally compliant business operations as well as in safeguarding our entrepreneurial capacity to act.

Customer account: Contractual Partners can create an account within our online offer (e.g., customer or user account, “Customer Account” for short). If the registration of a Customer Account is required, Contractual Partners will be informed of this as well as the information required for registration. The Customer Accounts are not public and cannot be indexed by search engines. As part of the registration and subsequent logins and uses of the Customer Account, we store the IP addresses of the customers along with the access times in order to be able to prove the registration and prevent any misuse of the Customer Account.

If customers have terminated their Customer Account, the data relating to the Customer Account will be deleted, provided its retention is not required for legal reasons. It is the responsibility of the customers to secure their data upon successful termination of the Customer Account.

Economic analyses and market research: For business reasons and to be able to recognize market trends, wishes of Contractual Partners and users, we analyze the data available to us regarding business transactions, contracts, inquiries, etc., whereby the group of data subjects may include Contractual Partners, interested parties, customers, visitors, and users of our online offer.

The analyses are carried out for the purpose of business evaluations, marketing, and market research (e.g., to determine customer groups with different characteristics). In doing so, we can, if available, take into account the profiles of registered users including their details, e.g., regarding services used. The analyses serve solely us and are not disclosed externally, unless they are anonymous analyses with aggregated, i.e., anonymized values. Furthermore, we take the privacy of the users into consideration and process the data for analysis purposes as pseudonymously as possible and, if feasible, anonymously (e.g., as aggregated data).

Shop and E-Commerce: We process our customers’ data to enable them to select, purchase, or order the chosen products, goods, and associated services, as well as their payment and provision, or delivery, or execution. If required for the execution of an order, we use service providers, in particular postal, forwarding, and shipping companies, to carry out the delivery or execution for our customers. For the processing of payment transactions, we use the services of banks and payment service providers. The required information is marked as such within the scope of the order or comparable purchase process and includes the information required for delivery, provision, and billing, as well as contact information to be able to hold any consultations.

  • Processed data types: Inventory data (e.g., names, addresses), Payment data (e.g., bank details, invoices, payment history), Contact data (e.g., e-mail, telephone numbers), Contract data (e.g., subject matter of contract, term, customer category), Usage data (e.g., visited websites, interest in content, access times), Meta-/communication data (e.g., device information, IP addresses).
  • Data subjects: Interested parties, Business and contractual partners, Customers.
  • Purposes of processing: Provision of contractual services and customer service, Contact requests and communication, Office and organizational procedures, Management and answering of inquiries, Security measures, Visit action evaluation, Interest-based and behavioral marketing, Profiling (creating user profiles).
  • Legal bases: Performance of a contract and pre-contractual requests (Art. 6 Para. 1 S. 1 lit. b. GDPR), Legal obligation (Art. 6 Para. 1 S. 1 lit. c. GDPR), Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

Payment Service Providers

In the context of contractual and other legal relationships, due to legal obligations, or otherwise on the basis of our legitimate interests, we offer the data subjects efficient and secure payment options and use other payment service providers in addition to banks and credit institutions for this purpose (collectively “Payment Service Providers”).

The data processed by the Payment Service Providers includes inventory data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, sum, and recipient-related information. The information is required to carry out the transactions. However, the entered data is processed solely by the Payment Service Providers and stored with them. This means that we do not receive any account or credit card-related information, but merely information confirming or negatively confirming the payment. Under certain circumstances, the Payment Service Providers may transmit the data to credit reporting agencies. The purpose of this transmission is to check identity and creditworthiness. We refer to the general terms and conditions and the privacy policy of the Payment Service Providers in this regard.

The terms and conditions and privacy notices of the respective Payment Service Providers apply to payment transactions, which can be accessed within the respective websites or transaction applications. We also refer to these for further information and assertion of rights of revocation, information, and other data subject rights.

  • Processed data types: Inventory data (e.g., names, addresses), Payment data (e.g., bank details, invoices, payment history), Contract data (e.g., subject matter of contract, term, customer category), Usage data (e.g., visited websites, interest in content, access times), Meta-/communication data (e.g., device information, IP addresses).
  • Data subjects: Customers, Interested parties.
  • Purposes of processing: Provision of contractual services and customer service.
  • Legal bases: Performance of a contract and pre-contractual requests (Art. 6 Para. 1 S. 1 lit. b. GDPR), Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

Used services and service providers:

Provision of the Online Offer and Web Hosting

In order to be able to provide our online offer securely and efficiently, we use the services of one or more web hosting providers, from whose servers (or servers managed by them) the online offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space, and database services as well as security services and technical maintenance services.

The data processed within the provision of the hosting offer may include all information regarding the users of our online offer that arises in the context of use and communication. This regularly includes the IP address, which is necessary to be able to deliver the content of online offers to browsers, and all entries made within our online offer or from websites.

E-mail transmission and hosting: The web hosting services used by us also include the transmission, receipt, and storage of e-mails. For these purposes, the addresses of the recipients and senders as well as further information concerning the e-mail transmission (e.g., the providers involved) and the content of the respective e-mails are processed. The aforementioned data may also be processed for the purposes of spam detection. We ask you to note that e-mails are generally not sent encrypted on the internet. As a rule, e-mails are encrypted during transit, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and received. We therefore cannot assume any responsibility for the transmission path of e-mails between the sender and receipt on our server.

Collection of access data and log files: We ourselves (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the accessed web pages and files, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page), and generally IP addresses and the requesting provider.

The server log files can be used, on the one hand, for security purposes, e.g., to avoid server overload (especially in the case of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the utilization of the servers and their stability.

  • Processed data types: Content data (e.g., entries in online forms), Usage data (e.g., visited websites, interest in content, access times), Meta-/communication data (e.g., device information, IP addresses).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Legal bases: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

Hosting: 1&1 Mail & Media GmbH, Brauerstraße 48, 76135 Karlsruhe, Germany

Contact

When contacting us (e.g., via contact form, e-mail, telephone, or via social media), the details of the inquiring persons are processed insofar as this is necessary to answer the contact inquiries and any requested measures.

The answering of contact inquiries in the context of contractual or pre-contractual relationships is carried out to fulfill our contractual obligations or to answer (pre)contractual inquiries and otherwise on the basis of legitimate interests in answering the inquiries.

  • Processed data types: Inventory data (e.g., names, addresses), Contact data (e.g., e-mail, telephone numbers), Content data (e.g., entries in online forms), Usage data (e.g., visited websites, interest in content, access times), Meta-/communication data (e.g., device information, IP addresses).
  • Data subjects: Communication partners, Interested parties.
  • Purposes of processing: Contact requests and communication, Management and answering of inquiries.
  • Legal bases: Performance of a contract and pre-contractual requests (Art. 6 Para. 1 S. 1 lit. b. GDPR), Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

Used services and service providers:

  • Contact form: When users contact us via our contact form, e-mail, or other communication channels, we process the data communicated to us in this context to handle the communicated request. For this purpose, we process personal data in the context of pre-contractual and contractual business relationships, provided this is necessary for their fulfillment, and otherwise on the basis of our legitimate interests and the interests of the communication partners in answering the requests, as well as our legal retention obligations.

Newsletter and Electronic Notifications

We send newsletters, e-mails, and other electronic notifications (hereinafter “Newsletter”) only with the consent of the recipient or a legal permission. If the contents of a Newsletter are specifically described as part of a registration, they are decisive for the consent of the users. For the rest, our Newsletters contain information about our services and us.

To sign up for our Newsletters, it is generally sufficient if you provide your e-mail address. However, we may ask you to provide a name for the purpose of personal address in the Newsletter, or further information, provided this is necessary for the purposes of the Newsletter.

Double-Opt-In procedure: Registration for our Newsletter generally takes place in a so-called Double-Opt-In procedure. This means that after registration, you will receive an e-mail asking you to confirm your registration. This confirmation is necessary so that no one can register with external e-mail addresses. Registrations for the Newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation as well as the IP address. Changes to your data stored with the mailing service provider are also logged.

Deletion and restriction of processing: We can store unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before deleting them to be able to prove previously given consent. The processing of this data is limited to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the e-mail address solely for this purpose in a blocklist (so-called “blacklist”).

The logging of the registration process is based on our legitimate interests for the purpose of proving its proper execution. Insofar as we commission a service provider to dispatch e-mails, this is done on the basis of our legitimate interests in an efficient and secure dispatch system.

Notes on legal bases: The dispatch of the Newsletters is based on the consent of the recipients or, if consent is not required, on the basis of our legitimate interests in direct marketing, provided and insofar as this is legally permitted, e.g., in the case of existing customer advertising. Insofar as we commission a service provider to dispatch e-mails, this is done on the basis of our legitimate interests. The registration procedure is recorded on the basis of our legitimate interests in order to prove that it was carried out in accordance with the law.

Content: Information about us, our services, promotions, and offers.

  • Processed data types: Inventory data (e.g., names, addresses), Contact data (e.g., e-mail, telephone numbers), Meta-/communication data (e.g., device information, IP addresses), Usage data (e.g., visited websites, interest in content, access times).
  • Data subjects: Communication partners.
  • Purposes of processing: Direct marketing (e.g., by e-mail or postal mail).
  • Legal bases: Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).
  • Right of objection (Opt-Out): You can cancel the receipt of our Newsletter at any time, i.e., revoke your consent or object to further receipt. You can find a link to cancel the Newsletter either at the end of each Newsletter or you can otherwise use one of the contact options provided above, preferably e-mail, for this purpose.

Presences in Social Networks (Social Media)

We maintain online presences within social networks and process user data in this context to communicate with the users active there or to offer information about us.

We point out that user data may be processed outside the European Union. This may result in risks for the users because, for example, the enforcement of the users’ rights could be made more difficult.

Furthermore, user data within social networks is usually processed for market research and advertising purposes. For example, user profiles can be created based on user behavior and resulting interests. The user profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users’ computers, in which the user behavior and interests are stored. Furthermore, data can also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged into them).

For a detailed description of the respective forms of processing and the objection options (opt-out), we refer to the privacy policies and information of the operators of the respective networks.

Also in the case of requests for information and the assertion of data subject rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the users’ data and can take direct appropriate measures and provide information. If you still need help, you can contact us.

  • Processed data types: Inventory data (e.g., names, addresses), Contact data (e.g., e-mail, telephone numbers), Content data (e.g., entries in online forms), Usage data (e.g., visited websites, interest in content, access times), Meta-/communication data (e.g., device information, IP addresses).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: Contact requests and communication, Tracking (e.g., interest-/behavioral profiling, use of cookies), Remarketing, Reach measurement (e.g., access statistics, recognition of returning visitors).
  • Legal bases: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).

Used services and service providers:

  • Instagram: Social network, enables the sharing of photos and videos, commenting on and favoriting posts, messaging, subscribing to profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://www.instagram.com; Privacy Policy: https://privacycenter.instagram.com/policy/; Basis for third-country transfers: Data Privacy Framework (DPF).
  • Pinterest: Social network, enables the sharing of photos, commenting, favoriting and curating posts, messaging, subscribing to profiles; Service provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Website: https://www.pinterest.com; Privacy Policy: https://policy.pinterest.com/de/privacy-policy.
  • YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f) GDPR); Privacy Policy: https://business.safety.google/privacy/; Basis for third-country transfers: Data Privacy Framework (DPF); Objection option (opt-out): https://myadcenter.google.com/.

Plugins and Embedded Functions as well as Content

We integrate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as “Third-Party Providers”). These can be, for example, graphics, videos, or social media buttons as well as posts (hereinafter uniformly referred to as “Content”).

The integration always requires that the Third-Party Providers of this Content process the IP address of the users, since they could not send the Content to their browser without the IP address. The IP address is therefore required for the display of this Content or functions. We endeavor to use only such Content whose respective providers use the IP address solely for the delivery of the Content. Third-Party Providers can also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. Through the “pixel tags”, information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information can also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit, and other information about the use of our online offer, as well as be linked to such information from other sources.

Notes on legal bases: If we ask users for their consent to the use of Third-Party Providers, the legal basis for processing data is consent. Otherwise, the users’ data is processed on the basis of our legitimate interests (i.e., interest in efficient, economic, and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

  • Processed data types: Usage data (e.g., visited websites, interest in content, access times), Meta-/communication data (e.g., device information, IP addresses), Location data (information on the geographical position of a device or a person), Content data (e.g., entries in online forms), Inventory data (e.g., names, addresses), Contact data (e.g., e-mail, telephone numbers).
  • Data subjects: Users (e.g., website visitors, users of online services), Communication partners.
  • Purposes of processing: Provision of our online offer and user-friendliness, Provision of contractual services and customer service, Contact requests and communication, Tracking (e.g., interest-/behavioral profiling, use of cookies), Interest-based and behavioral marketing, Profiling (creating user profiles), Security measures, Management and answering of inquiries.
  • Legal bases: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR), Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), Performance of a contract and pre-contractual requests (Art. 6 Para. 1 S. 1 lit. b. GDPR).

Used services and service providers:

  • To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the consent tool “Real Cookie Banner”. Details on how “Real Cookie Banner” works can be found at https://devowl.io/de/rcb/datenverarbeitung/.
  • Legal bases for the processing of personal data in this context are Art. 6 Para. 1 lit. c GDPR and Art. 6 Para. 1 lit. f GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.
  • The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we cannot manage your consents.

Deletion of Data

We delete personal data that we process in accordance with statutory provisions as soon as the underlying consents are revoked or there are no further legal bases for processing. This applies to cases in which the original purpose of processing ceases to apply or the data is no longer required. Exceptions to this rule exist if legal obligations or special interests require a longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax reasons or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that specifically apply to certain processing procedures.

If there are multiple specifications for the retention period or deletion periods of data, the longest period is always decisive. We process data that is no longer retained for the originally intended purpose but due to legal requirements or other reasons exclusively for the reasons that justify its retention.

Retention and deletion of data under German law: The following general periods apply to retention and archiving under German law:

  • 10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, as well as the work instructions and other organizational documents required to understand them (Sec. 147 Para. 1 No. 1 in conjunction with Para. 3 of the German Fiscal Code (AO), Sec. 14b Para. 1 of the Value Added Tax Act (UStG), Sec. 257 Para. 1 No. 1 in conjunction with Para. 4 of the German Commercial Code (HGB)).
  • 8 years – Accounting vouchers, such as invoices and expense receipts (Sec. 147 Para. 1 No. 4 and 4a in conjunction with Para. 3 Sentence 1 AO as well as Sec. 257 Para. 1 No. 4 in conjunction with Para. 4 HGB).
  • 6 years – Other business documents: received commercial or business letters, reproductions of dispatched commercial or business letters, other documents insofar as they are relevant for taxation, e.g., hourly wage slips, business accounting sheets, calculation documents, price tags, but also payroll accounting documents, provided they are not already accounting vouchers, and cash register strips (Sec. 147 Para. 1 No. 2, 3, 5 in conjunction with Para. 3 AO, Sec. 257 Para. 1 No. 2 and 3 in conjunction with Para. 4 HGB).
  • 3 years – Data required to consider potential warranty and damage claims or similar contractual claims and rights and to process related inquiries, based on past business experiences and usual industry practices, are stored for the duration of the regular statutory limitation period of three years (Sec. 195, 199 BGB).

Rights of Data Subjects

As a data subject under the GDPR, you are entitled to various rights, which arise in particular from Art. 15 to 21 GDPR:

  • Right of objection: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 Para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions. Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.
  • Right to revoke consent: You have the right to revoke any given consent at any time.
  • Right of access: You have the right to request confirmation as to whether the data in question is being processed and to request access to this data, as well as further information and a copy of the data in accordance with legal requirements.
  • Right to rectification: You have the right, in accordance with legal requirements, to request the completion of the data concerning you or the rectification of inaccurate data concerning you.
  • Right to erasure and restriction of processing: You have the right, in accordance with legal requirements, to request that data concerning you be erased without undue delay, or alternatively, in accordance with legal requirements, to request a restriction of the processing of the data.
  • Right to data portability: You have the right to receive data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format in accordance with legal requirements, or to demand its transmission to another controller.
  • Complaint to supervisory authority: In accordance with legal requirements, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

Definitions of Terms

In this section you will find an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are defined primarily in Art. 4 GDPR. The legal definitions are binding. The following explanations, on the other hand, are primarily intended to aid understanding. The terms are sorted alphabetically.

  • Conversion Tracking: This refers to a procedure used to determine the effectiveness of marketing measures. To do this, a cookie is usually stored on the user’s devices within the websites on which the marketing measures take place and then accessed again on the target website. For example, we can use this to understand whether the ads we placed on other websites were successful.
  • Credit report: Automated decisions are based on automatic data processing without human intervention (e.g., in the case of an automatic rejection of a purchase on account, an online loan application, or an online application process without any human intervention). Such automated decisions are only permissible under Art. 22 GDPR if data subjects consent, if they are necessary for the performance of a contract, or if national laws permit these decisions.
  • Cross-Device Tracking: Cross-device tracking is a form of tracking in which behavioral and interest information of users is recorded across devices in so-called profiles by assigning an online identifier to the users. This allows user information to usually be analyzed for marketing purposes independently of the browsers or devices used (e.g., mobile phones or desktop computers). With most providers, the online identifier is not linked to clear data such as names, postal addresses, or e-mail addresses.
  • IP Masking: “IP masking” is a method in which the last octet, i.e., the last two numbers of an IP address, is deleted so that the IP address can no longer be used to uniquely identify a person. Therefore, IP masking is a means of pseudonymizing processing procedures, especially in online marketing.
  • Interest-based and behavioral marketing: Interest- and/or behavioral-based marketing occurs when potential interests of users in advertisements and other content are predetermined as accurately as possible. This is done on the basis of information about their prior behavior (e.g., visiting and lingering on certain websites, purchasing behavior, or interaction with other users), which is stored in a so-called profile. Cookies are generally used for these purposes.
  • Conversion measurement: Conversion measurement is a procedure that can be used to determine the effectiveness of marketing measures. To do this, a cookie is usually stored on the user’s devices within the websites on which the marketing measures take place and then accessed again on the target website. For example, we can use this to understand whether the ads we placed on other websites were successful.
  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Profiling: “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person (depending on the type of profiling, this includes information regarding age, gender, location data and movement data, interaction with websites and their content, shopping behavior, social interactions with other people), to analyze or predict them (e.g., interests in certain content or products, click behavior on a website, or location). Cookies and web beacons are often used for profiling purposes.
  • Reach measurement: Reach measurement (also referred to as web analytics) serves to evaluate the visitor flows of an online offer and may include the behavior or interests of visitors in certain information, such as the content of websites. With the help of reach analysis, website owners can recognize, for example, at what time visitors visit their website and what content they are interested in. This allows them to better adapt the content of the website to the needs of their visitors, for example. Pseudonymous cookies and web beacons are frequently used for the purposes of reach analysis to recognize returning visitors and thus obtain more accurate analyses of the use of an online offer.
  • Remarketing: “Remarketing” or “retargeting” is used when, for example for advertising purposes, it is noted which products a user was interested in on a website in order to remind the user of these products on other websites, e.g., in advertisements.
  • Location data: Location data is created when a mobile device (or another device with the technical prerequisites for location determination) connects to a radio cell, a WLAN, or similar technical means and functions of location determination. Location data serves to indicate the geographically determinable position on earth at which the respective device is located. Location data can be used, for example, to display map functions or other location-dependent information.
  • Tracking: “Tracking” occurs when the behavior of users can be traced across multiple online offers. As a rule, behavioral and interest information regarding the used online offers is stored in cookies or on servers of the providers of the tracking technologies (so-called profiling). This information can then be used, for example, to show users advertisements that are likely to correspond to their interests.
  • Controller: The “controller” is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: “Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, be it collection, evaluation, storage, transmission, or deletion.
  • Target group formation: Target group formation (or “Custom Audiences”) occurs when target groups are determined for advertising purposes, e.g., the display of advertisements. For example, based on a user’s interest in certain products or topics on the internet, it can be concluded that this user is interested in advertisements for similar products or the online shop in which they viewed the products. “Lookalike Audiences” (or similar target groups) are used when content deemed suitable is displayed to users whose profiles or interests presumably correspond to the users for whom the profiles were created. Cookies and web beacons are generally used for the purposes of creating Custom Audiences and Lookalike Audiences.