Responsible persons

Kevin J. Hall, MSc
WISH Mindscience
Straßgschwandtnerstraße 4/1
1140 Vienna
Austria

Authorised representatives: Kevin J. Hall, MSc

E-mail address: kevin.hall@wish.wien

Phone: +43 1 9900858

Imprint: https://www.wish.wien/impressum/

Overview of processing operations

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

• Inventory data (e.g. names, addresses).
• Content data (e.g. text input, photographs, videos).
• Contact details (e.g. e-mail, phone numbers).
• Meta/communication data (e.g. device information, IP addresses).
• Usage data (e.g. visited websites, interest in content, access times).
• Location data (data that indicates the location of an end-user’s terminal).
• Contract data (e.g. subject matter, term, customer category).
• Payment data (e.g. bank details, invoices, payment history).

Special categories of data

• Political opinions.

Categories of affected persons

• Employees (e.g. employees, applicants, former employees).
• business and contractual partners.
• Interested parties.
• Communication.
• customers (or clients).
• Users (e.g. website visitors, users of online services).

Purposes of processing

• Provision of our online offer and user-friendliness.
• Visiting action evaluation.
• office and organizational procedures.
• Direct marketing (e.g. by e-mail or by post).
• Feedback (e.g. Collect feedback via online form).
• Contact requests and communication.
• Conversion measurement (measurement of the effectiveness of marketing measures).
• Profiling.
• range measurement (e.g. access statistics, detection of returning visitors).
• Security.
• Tracking (e.g. interest/behavioural profiling, use of cookies).
• Contractual services and services.
• Manage and respond to requests.

Relevant legal frameworks

In the following, we refer to the legal framework of the General Data Protection Regulation (GDPR), on the basis of which we process personal data. Please note that in addition to the GDPR regulations, the national data protection requirements in your country of residence and residence. Should more specific legal bases be relevant in individual cases, we will inform you of them in the data protection declaration.

• Consent (Art. 6 abs. 1 p. 1 lit. a GDPR) – The data subject has given his consent to the processing of personal data concerning him or her for a specific purpose or for several specific purposes.
• Performance of the contract and pre-contractual enquiries (Art. 6 abs. 1 p. 1 lit. B. GDPR) – Processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures carried out at the request of the data subject.
• Legal obligation (Art. 6 abs. 1 p. 1 lit. C. GDPR) – Processing is necessary to fulfill a legal obligation to which the controller is subject.
• Eligible interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR) – The processing is necessary to safeguard the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail.

National data protection regulations in Austria: In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection apply in Austria. This includes, in particular, the Federal Act on the Protection of Natural Persons in the Processing of Personal Data (Data Protection Act – DSG). In particular, the Data Protection Act contains special provisions on the right to information, the right to rectification or deletion, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision-making in individual cases.

Security

We shall take appropriate technical and organizational measures to ensure a level of protection commensurate with the risk, taking into account the state of the art, the cost of implementation, the nature, and the scope of the processing, as well as the different probability of occurrence and the extent of the threat to the rights and freedoms of natural persons.

Measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, entry, disclosure, securing availability, and separation. In addition, we have established procedures that ensure the exercise of data subjects’ rights, the erasure of data and reactions to the risk of the data. Furthermore, we take into account the protection of personal data during the development or selection of hardware, software, and procedures according to the principle of data protection, through technical design and through data protection-friendly presets.

SSL encryption (https): In order to protect your data transmitted via our online offer, we use SSL encryption. You can detect encrypted connections by the prefix https:// in the address bar of your browser.

Data processing in third countries

Insofar as we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing in the context of the use of third-party services or disclosure or The transfer of data to other persons, entities or companies takes place only in accordance with the legal requirements.

Subject to express consent or contractual or statutory transmission, we will process or release the data only in third countries with a recognised level of data protection, which includes the Us processors certified under the “Privacy Shield”, or on the basis of special guarantees, such as: contractual obligation by so-called standard safeguard clauses of the EU Commission, the existence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR, information page of the European Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de ).

Use of cookies

Cookies are text files that contain data from websites or domains visited and are stored by a browser on the user’s computer. A cookie is primarily used to store the information about a user during or after his visit within an online offer. For example, the stored information can be the language settings on a website, the login status, a shopping cart, or the place where a video was viewed. The term cookies also includes other technologies that perform the same functions as cookies (e.g. when user information is stored on the basis of pseudonymous online identifiers, also known as “user IDs”)

The following types of cookies and functions are distinguished:

• Temporary cookies (also session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed his browser.
• Permanent cookies: Permanent cookies remain stored even after closing the browser. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. Similarly, the interests of users used for range measurement or marketing purposes may be stored in such a cookie.
• First-party cookies: First-party cookies are set by us.
• Third-party cookies (also: third-party cookies): Third-party cookies are mainly used by advertisers (so-called third party) used to process user information.
• Necessary (also essential or absolutely necessary) cookies: Cookies may be absolutely necessary for the operation of a website (e.g. to save logins or other user input or for security reasons).
• Statistics, marketing and personalization cookies: In addition, cookies are usually used in the context of range measurement as well as when a user’s interests or behaviour (e.g. view of certain content, benefits of functions, etc.) stored in a user profile on individual websites. Such profiles are used to provide users with e.g. content that matches their potential interests. This procedure is also referred to as “tracking”, i.e. tracking the potential interests of users. Insofar as we use cookies or “tracking” technologies, we will inform you separately in our privacy policy or in the context of obtaining consent.

Notes on legal bases: On what legal basis we process your personal data with the help of cookies depends on whether we ask you for your consent. If this is the case and you consent to the use of cookies, the legal basis for the processing of your data is the declared consent. Otherwise, the data processed by cookies will be processed on the basis of our legitimate interests (e.g. business operation of our online offer and its improvement) or, if the use of cookies is necessary to fulfill our contractual obligations.

General notices on revocation and opposition (opt-out): Depending on whether the processing is based on consent or legal permission, you have the possibility at any time to revoke a given consent or to object to the processing of your data by cookie technologies (collectively, “opt-out”). You can first declare your objection by means of the settings of your browser, e.g. by disabling the use of cookies (whereby the functionality of our online offer may also be limited). An objection to the use of cookies for online marketing purposes can also be explained by means of a variety of services, especially in the case of tracking, through the websites https://optout.aboutads.info and https://www.youronlinechoices.com/. In addition, you can receive further notices of objection within the scope of the information on the service providers and cookies used.

Processing of cookie data on the basis of consent: Before we process or have data processed in the context of the use of cookies, we ask the users for a revocable consent at any time. Until consent has been given, cookies that are necessary for the operation of our online offer will be used. Their use is based on our interest and the interest of the users in the expected functionality of our online offer.

• Types of data processed: Usage data (e.g. visited websites, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected persons: Users (e.g. website visitors, users of online services).
• Legal bases: Consent (Art. 6 abs. 1 p. 1 lit. a GDPR), Eligible Interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR).

Commercial and business services

We process data of our contract and business partners, e.g. Customers and interested parties (collectively referred to as “contractors”) in the context of contractual and comparable legal relationships as well as related measures and in the context of communication with the contracting parties (or pre-contractual), e.g. to answer inquiries.

We process this data for the purpose of fulfilling our contractual obligations, for the protection of our rights and for the purposes of the administrative tasks associated with this information as well as the business organization. Within the scope of the applicable law, we only pass on the data of the contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or for the fulfillment of legal obligations or is carried out with the consent of the contractual partners (e.g. telecommunications, transport and other auxiliary services involved, as well as subcontractors, banks, tax, and legal advisers, payment service providers or tax authorities). About other processing forms, e.g. for marketing purposes, the contracting parties will be informed within the framework of this data protection declaration.

We will provide the contracting parties with information which data is required for the aforementioned purposes before or within the scope of data collection, e.g. in online forms, through special marking (e.g. colors) or symbols (e.g. asterisks or similar), or in person.

We delete the data after expiry of legal warranty and comparable obligations, i.e. basically after 4 years, unless the data is stored in a customer account, e.g. as long as it must be stored for legal reasons of archiving (e.g. for tax purposes usually 10 years). Data disclosed to us in the context of an order by the contractual partner, we delete in accordance with the specifications of the order, in principle after the end of the order.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third parties or platforms apply in the relationship between the users and the providers.

Health services: We process the data of our patients and interested parties and other clients or contractors (uniformly referred to as “patients”) in order to be able to provide our services to them. The data processed, the nature, scope, purpose and necessity of their processing are determined by the underlying contractual relationship and the patient relationship.

As part of our activities, we may also provide specific categories of data, in particular information on patient health, if necessary. with reference to their sex life or sexual orientation, as well as data showing racial and ethnic origin, political opinions, religious or ideological beliefs or trade union membership. For this purpose, we obtain, if necessary, an explicit consent of the patients and otherwise process the special categories of data for the purposes of health care or for the protection of vital interests of the patients.

If it is necessary for our performance of the contract, for the protection of vital interests or by law, or consent of the patients, we disclose or transmit the data of the clients to third parties or agents, e.g. public authorities, medical facilities, laboratories, billing agencies and in the field of IT, office or similar services.

Therapeutic services: We process the data of our clients as well as interested parties and other clients or contractors (uniformly referred to as “clients”) in order to be able to provide our services to them. The processed data, the nature, scope, purpose, and necessity of their processing are determined by the underlying contractual relationship and client relationship.

As part of our activities, we may also provide special categories of data, in particular information on the health of the clients, if necessary. with reference to their sex life or sexual orientation, as well as data showing racial and ethnic origin, political opinions, religious or ideological beliefs or trade union membership. For this purpose, we obtain, if necessary, an express consent of the clients and process the special categories of data otherwise, if this serves the health of the clients, the data are public or other legal permits are available.

If it is necessary for our performance of the contract, for the protection of vital interests or by law, or consent of the clients, we disclose or transmit the data of the clients to third parties or agents, such as e.g. public authorities, medical facilities, laboratories, billing agencies and in the field of IT, office or similar services.

• Processed data types: Inventory data (e.g. names, addresses), payment data (e.g. bank details, invoices, payment history), contact details (e.g. e-mail, telephone numbers), contract data (e.g. subject matter, term, customer category).
• Special categories of personal data: health data (Art. 9 abs. 1 DGSVO), data on sex life or sexual orientation (Art. 9 abs. 1 DGSVO), Religious or ideological beliefs (Art. 9 abs. 1 DGSVO), data showing racial and ethnic origin, biometric data (art. 9 abs. 1 DGSVO), Genetic Data (Article 9 (1) GDPR), Political Opinions.
• Affected persons: interested parties, business and contractual partners.
• Purposes of processing: Contractual services and services, contact requests and communication, office and organizational procedures, management and response of enquiries.
• Legal bases: Performance of the contract and pre-contractual requests (Art. 6 abs. 1 p. 1 lit. B. GDPR), legal obligation (Art. 6 abs. 1 p. 1 lit. C. GDPR), legitimate interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR).

Provision of the online offer and web hosting

In order to be able to provide our online offer securely and efficiently, we use the services of one or more web-hosting providers, from whose servers (or servers) servers managed by them) the online offer can be retrieved. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security and technical maintenance.

The data processed in the context of the provision of the hosting offer may include all information concerning the users of our online offer that is incurred in the context of use and communication. This regularly includes the IP address necessary to deliver the contents of online offers to browsers and all entries made within our online offer or from websites.

E-mail sending and hosting: The web hosting services we use also include sending, receiving and storing e-mails. For these purposes, the addresses of the recipients as well as senders as well as other information concerning the e-mail (e.g. the participating providers) as well as the contents of the respective e-mails. The aforementioned data may also be processed for the purpose of detecting SPAM. Please note that e-mails are not sent encrypted on the Internet. As a rule, e-mails are encrypted by transport, but (unless an end-to-end encryption method is used) are not encrypted on the servers from which they are sent and received. We therefore cannot accept any responsibility for the transmission of the e-mails between the sender and the receipt on our server.

Collection of access data and log files: We ourselves (or our web hosting provider) collects data about every access to the server (so-called server log files). The server log files may include the address and name of the retrieved websites and files, the date and time of the retrieval, the amount of data transferred, the notification of successful retrieval, the browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.

The server log files can be used for security purposes, e.g. to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the utilization of the servers and their stability.

• Types of data processed: Content data (e.g. text input, photographs, videos), usage data (e.g. visited websites, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected persons: Users (e.g. website visitors, users of online services).
• Legal bases: Legitimate interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR).

Blogs and publication media

We use blogs or similar means of online communication and publication (hereinafter “publication medium”). The data of the readers are processed for the purposes of the publication medium only to the extent that it is necessary for its presentation and communication between authors and readers or for reasons of security. In addition, we refer to the information on the processing of visitors to our publication medium within the framework of these data protection notices.

• Processed data types: Inventory data (e.g. names, addresses), contact details (e.g. e-mail, phone numbers), content data (e.g. text input, photographs, videos), usage data (e.g. visited websites, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected persons: Users (e.g. website visitors, users of online services).
• Purposes of processing: Contractual services and services, feedback (e.g. Collect feedback via online form), security measures.
• Legal bases: Performance of the contract and pre-contractual requests (Art. 6 abs. 1 p. 1 lit. B. GDPR), legitimate interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR).

Services and service providers used:

• UpdraftPlus: backup software and backup storage; Service providers: Simba Hosting Ltd., 11, Barringer Way, St. Neots, Cambs., PE19 1LW, GB; Website: https://updraftplus.com/.
• Wordfence: firewall and security and error detection features; Service Providers: Defiant, Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA; Website: https://www.wordfence.com/.com; Privacy Policy: https://www.wordfence.com/privacy-policy/; Standard contractual clauses (guarantee of data protection level for processing in third countries): https://www.wordfence.com/help/general-data-protection-regulation/.

Contact

When contacting us (e.g. by contact form, e-mail, telephone or via social media) the information of the requesting persons will be processed, insofar as this is necessary to answer the contact requests and any requested measures.

The answer to contact requests in the context of contractual or pre-contractual relationships is to fulfil our contractual obligations or to answer (pre)contractual enquiries and, in addition, on the basis of the legitimate interests in answering the enquiries.

• Processed data types: Inventory data (e.g. names, addresses), contact details (e.g. e-mail, phone numbers), content data (e.g. text input, photographs, videos).
• Affected persons: communication partners.
• Purposes of processing: contact requests and communication.
• Legal bases: Performance of the contract and pre-contractual requests (Art. 6 abs. 1 p. 1 lit. B. GDPR), legitimate interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR).

Videoconferencing, online meetings, webinars and screen sharing

We use third-party platforms and applications (hereinafter referred to as “Third Parties”) for the purpose of conducting video and audio conferencing, webinars, and other types of video and audio meetings. When selecting third-party providers and their services, we comply with the legal requirements.

Within this framework, data of the communication participants are processed and stored on the servers of the third-party providers, insofar as these are part of communication processes with us. This data may include, in particular, login and contact details, visual and vocal posts, as well as input into chats and shared screen content.

If users use third-party providers, or/ whose software or platforms are referenced, the third parties may process usage data and metadata for security purposes, service optimization, or marketing purposes. We therefore ask you to observe the privacy policy of the respective third parties.

Notes on legal bases: If we ask users to give their consent to the use of third parties or certain functions (e.g. For example, consent to a recording of conversations), the legal basis of the processing is consent. Furthermore, their use may be part of our (pre)contractual services, provided that the use of the third-party providers has been agreed upon within this framework. Otherwise, the data of the users will be processed on the basis of our legitimate interests in an efficient and secure communication with our communication partners. In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

• Processed data types: Inventory data (e.g. names, addresses), contact details (e.g. e-mail, phone numbers), content data (e.g. text input, photographs, videos), usage data (e.g. visited websites, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected persons: communication partners, users (e.g. website visitors, users of online services).
• Purposes of processing: Contractual services and services, contact requests and communication, office and organizational procedures, direct marketing (e.g. by e-mail or by post).
• Legal bases: Consent (Art. 6 abs. 1 p. 1 lit. a GDPR), performance of the contract and pre-contractual enquiries (Art. 6 abs. 1 p. 1 lit. B. GDPR), legitimate interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR).

Services and service providers used:

• Zoom: Messenger and Conference Software: Zoom Video Communications, Inc, San Jose Headquarters, 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113; Website: https://zoom.us/; Privacy Policy: https://zoom.us/docs/de-de/privacy-and-legal.html; Safety instructions: https://zoom.us/de-de/security.html
• Skype: Messenger and Conference software; Service providers: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Website: https://www.skype.com/de/; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement, Security Notices: https://www.microsoft.com/de-de/trustcenter; Privacy Policy for U.S. Data Processing: https://www.privacyshield.gov/participant?id=a2zt0000000KzNaAAK&status=Active.

Cloud services

We use software services accessible over the Internet and performed on their providers’ servers (so-called “cloud services,” also known as “Software as a Service”) for the following purposes: document storage and management, calendar management, email delivery, spreadsheets and presentations, exchange of documents, content and information with specific recipients or publication of websites, forms or other content and information, as well as chats and participation in audio and video conferencing.

In this context, personal data may be processed and stored on the servers of the providers, insofar as these are part of communication processes with us or are otherwise processed by us as set out in this data protection declaration. This data may include, in particular, master data and contact data of the users, data on transactions, contracts, other processes and their contents. Cloud service providers also process usage data and metadata they use for security and service optimization purposes.

Insofar as we use the cloud services for other users or publicly accessible websites forms, etc. documents and content, providers may provide cookies on users’ devices for the purpose of web analysis or to adjust user settings (e.g. in the case of media control).

Notes on legal bases: If we ask for consent to the use of cloud services, the legal basis of the processing is consent. Furthermore, their use may be part of our (pre)contractual services, provided that the use of the cloud services has been agreed within this framework. Otherwise, the data of the users will be processed on the basis of our legitimate interests (i.e., interest in efficient and secure management and collaboration processes)

• Processed data types: Inventory data (e.g. names, addresses), contact details (e.g. e-mail, phone numbers), content data (e.g. text input, photographs, videos), usage data (e.g. visited websites, interest in content, access times), meta/communication data (e.g. device information, IP addresses), contract data (e.g. subject matter, term, customer category).
• Affected persons: customers, employees (e.g. employees, applicants, former employees), prospects, communication partners.
• Purposes of processing: office and organisational procedures.
• Legal bases: Consent (Art. 6 abs. 1 p. 1 lit. a GDPR), performance of the contract and pre-contractual enquiries (Art. 6 abs. 1 p. 1 lit. B. GDPR), legitimate interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR).

Services and service providers used:

• Apple iCloud: Cloud storage services; Service providers: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA; Website: https://www.apple.com/de/; Privacy Policy: https://www.apple.com/legal/privacy/de-ww/.
• Microsoft Cloud Services: Cloud storage services; Service providers: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, Website: https://microsoft.com/de-de; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement, Security Notices: https://www.microsoft.com/de-de/trustcenter;Privacy Policy for U.S. Data Processing: https://www.privacyshield.gov/participant?id=a2zt0000000KzNaAAK&status=Active.

Online marketing

We process personal data for the purposes of online marketing, which may include in particular the marketing of advertising space or the presentation of advertising and other content (collectively referred to as “content”) based on potential interests of users and the measurement of their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (so-called “cookie”) or similar methods are used by which the information relevant to the presentation of the aforementioned contents about the user is stored. For example, this information may be content, websites visited, online networks used, but also communication partners and technical information, such as the browser used, the computer system used and information about usage times. If users have consented to the collection of their location data, these can also be processed.

The IP addresses of the users are also stored. However, we use available IP masking methods (i.e., pseudonymization by shortening the IP address) to protect users. As a general rule, the online marketing process does not provide clear data of the users (e.g. e-mail addresses or names) but pseudonyms. This means that we, as well as the providers of online marketing procedures, do not know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is usually stored in cookies or by similar procedures. These cookies can later generally also be used on other websites that use the same online marketing method, read out and analyzed for the purposes of displaying content as well as supplemented with further data and stored on the server of the online marketing process provider.

Exceptionally, clear data can be assigned to the profiles. This is the case if, for example, the users Are members of a social network whose online marketing procedures we use and the network connects the profiles of the users with the aforementioned information. We kindly ask you to note that users make additional agreements with the providers, e.g. consent within the scope of registration.

In principle, we only have access to aggregated information about the success of our advertisements. However, in the context of so-called conversion measurements, we can check which of our online marketing procedures have led to a so-called conversion, i.e. e.g., to conclude a contract with us. Conversion measurement is used solely to analyze the success of our marketing efforts.

Unless otherwise stated, we ask you to assume that cookies used will be stored for a period of two years.

Notes on legal bases: If we  ask the users for their consent to the use of third-party providers, the legal basis for the processing of data is the consent. Otherwise, the data of the users will be processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Types of data processed: Usage data (e.g. visited websites, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected persons: Users (e.g. website visitors, users of online services), interested parties.
• Purposes of processing: Tracking (e.g. interest/behavioural profiling, use of cookies), remarketing, visit action evaluation, interest-based and behavioral marketing, profiling (creating user profiles), conversion measurement (measurement of the effectiveness of marketing measures), range measurement (e.g. access statistics, detection of returning visitors).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal bases: Consent (Art. 6 abs. 1 p. 1 lit. a GDPR), Eligible Interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR).
• Possibility of objection (opt-out): We refer to the data protection notices of the respective providers and the possibilities of objection indicated to the providers (so-called “Opt-Out”). Unless an explicit opt-out option has been specified, you may switch off cookies in your browser settings. However, this may limit the functions of our online offer. We therefore also recommend the following opt-out options, which are offered in summary to specific areas) Europe: https://www.youronlinechoices.eu/.
  (b) Canada:https://www.youradchoices.ca/choices.
  (c) USA:https://www.aboutads.info/choices.
  (d) Cross-territorial: https://optout.aboutads.info.

Services and service providers used:

• Google Analytics: Online marketing and web analytics; Service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA: Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy Policy: https://policies.google.com/privacy; Privacy Shield: hhttps://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active; Opt-out: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de; Settings for displaying advertisements: https://adssettings.google.com/authenticated.

Social media presences

We maintain online presences within social networks and process users’ data in this context in order to communicate with the users active there or to offer information about us.

We would like to point out that users’ data can be processed outside the European Union. This can lead to risks for the users, e.g. enforcement of users’ rights. With regard to U.S. providers that are certified under the Privacy Shield or offer similar guarantees of a secure level of privacy, we would like to point out that they are committed to complying with EU data protection standards.

Furthermore, users’ data within social networks are usually processed for market research and advertising purposes. For example, you can based on the usage behaviour and the resulting interests of the users. The usage profiles can in turn be used to Advertisements within and outside the networks that are presumed to be in the interests of users. For these purposes, cookies are usually stored on the users’ computers, in which the user’s usage behaviour and the interests of the users are stored. Furthermore, data may also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

For a detailed description of the respective processing methods and the opt-out, we refer to the data protection declarations and information of the operators of the respective networks.

We would also like to point out that these can be asserted most effectively by the providers in the case of requests for information and the assertion of data subjects’ rights. Only the providers have access to the data of the users and can take direct action and provide information. If you still need help, you can contact us.

• Processed data types: Inventory data (e.g. names, addresses), contact details (e.g. e-mail, phone numbers), content data (e.g. text input, photographs, videos), usage data (e.g. visited websites, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected persons: Users (e.g. website visitors, users of online services).
• Purposes of processing: contact requests and communication, tracking (e.g. interest/behavioural profiling, use of cookies), remarketing, range measurement (e.g. access statistics, tracking of returning visitors), affiliate tracking.
• Legal bases: Legitimate interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR).

Services and service providers used:

• Instagram : Social network; Service provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Website: https://www.instagram.com/; Privacy Policy: https://instagram.com/about/legal/privacy.
• Facebook: Social network; Service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; Website: https://www.facebook.com/about/privacy; Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Activ; Ad settings: ahttps://www.facebook.com/settings?tab=ads on data ; Agreement on the joint processing of personal data on Facebook pages: https://www.facebook.com/legal/terms/page_controller_addendum; privacy notice for Facebook pages: https://www.facebook.com/legal/terms/information_about_page_insights_data.
• Flickr: Social network; Service providers: Flickr Inc., 475 Sansome St San Francisco, California 94111, USA; Website: https://www.flickr.com/; Privacy Policy: https://www.flickr.com/help/privacy.
• LinkedIn: Social network; Service providers: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Website: https://www.linkedin.com; Privacy Policy: www.linkedin.com/legal/privacy-policy; Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active; Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Pinterest: Social network; Service providers: Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA; Website: https://www.pinterest.com/; Privacy Policy: https://about.pinterest.com/de/privacy-policy; Opt-out: https://about.pinterest.com/de/privacy-policy.
• Twitter: Social Network; Service providers: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Privacy Policy: https://twitter.com/de/privacy, Settings: https://twitter.com/personalization); Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active.
• YouTube: Social network; Service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Privacy Policy: https://policies.google.com/privacy; Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active; Opt-out: https://adssettings.google.com/authenticated.
• Xing: Social network; Service provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany; Website:https://www.xing.de/; Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung.

Plugins and embedded functions as well as content

We incorporate functional and content elements from the servers of their respective providers (hereinafter referred to as “Third Parties”) in our online offering. These may include graphics, videos, social media buttons, and posts (hereinafter referred to as “Content”).
The integration always presupposes that the third parties of this content process the IP address of the users, since they could not send the content to their browser without the IP address. The IP address is therefore required for the presentation of this content or functions. We make every effort to use only those content whose respective providers use the IP address only for the delivery of the content. Third parties may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the user’s device and may include, among other things, technical information about the browser and operating system, websites to be referenced, the time of visit as well as other information on the use of our online offer, as well as to be linked to such information from other sources.

Notes on legal bases: If we ask the users for their consent to the use of third-party providers, the legal basis for the processing of data is the consent. Otherwise, the data of the users will be processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Types of data processed: Usage data (e.g. visited websites, interest in content, access times), meta/communication data (e.g. device information, IP addresses), location data (data that indicates the location of an end-user’s terminal), inventory data (e.g. names, addresses), contact details (e.g. e-mail, phone numbers), content data (e.g. text input, photographs, videos).
• Affected persons: Users (e.g. website visitors, users of online services).
• Purposes of processing: provision of our online offer and user-friendliness, contractual services and service, security measures, management and response of enquiries.
• Legal bases: Legitimate interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR), consent (Art. 6 abs. 1 p. 1 lit. a GDPR), performance of the contract and pre-contractual enquiries (Art. 6 abs. 1 p. 1 lit. B. GDPR).

Services and service providers used:

• Google Fonts: We integrate the fonts (“Google Fonts”) of the provider Google, whereby the data of the users are used solely for the purpose of displaying the fonts in the browser of the users. The integration is based on our legitimate interests in a technically safe, maintenance-free and efficient use of fonts, their uniform presentation and taking into account possible licensing restrictions for their integration. Service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://fonts.google.com/; Privacy Policy: https://policies.google.com/privacy; Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.
• Google Maps: We include the maps of the “Google Maps” service of the provider Google. The data processed may include, in particular, IP addresses and location data of the users, but these may not be collected without their consent (usually carried out within the framework of the settings of their mobile devices); Service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://cloud.google.com/maps-platform; Privacy Policy: https://policies.google.com/privacy; Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000TRkEAAW&status=Active; Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying advertisements: https://adssettings.google.com/authenticated.
• ReCaptcha: We bind the “ReCaptcha” function for the detection of bots, e.g. in the case of entries in online forms. The user’s behavioural information (e.g. mouse movements or queries) are evaluated to distinguish people from bots. Service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://www.google.com/recaptcha/; Privacy Policy: https://policies.google.com/privacy; Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000TRkEAAW&status=Active; Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying advertisements: https://adssettings.google.com/authenticated.
• YouTube videos: video content; Service providers: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://www.youtube.com; Privacy Policy: https://policies.google.com/privacy; Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active; Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying advertisements: https://adssettings.google.com/authenticated.

Planning, organization, and tools

We use third-party services, platforms, and software (hereinafter referred to as “Third Party”) for the purposes of organizing, managing, planning, and providing our services. When selecting third-party providers and their services, we comply with the legal requirements.
In this context, personal data may be processed and stored on the servers of the third-party providers. This may affect various data that we process in accordance with this data protection declaration. This data may include, in particular, master data and contact data of the users, data on transactions, contracts, other processes and their contents.
If users use third-party providers or third parties in the context of communication, business or other relationships with us, whose software or platforms are referenced, the third parties may process usage data and metadata for security purposes, service optimization or marketing purposes. We therefore ask you to observe the privacy policy of the respective third parties.

Notes on legal bases: If we ask the users for their consent to the use of third-party providers, the legal basis for the processing of data is the consent. Furthermore, their use may be part of our (pre)contractual services, provided that the use of the third-party providers has been agreed within this framework. Otherwise, the data of the users will be processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Inventory data (e.g. names, addresses), contact details (e.g. e-mail, phone numbers), content data (e.g. text input, photographs, videos), usage data (e.g. visited websites, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Affected persons: communication partners, users (e.g. website visitors, users of online services).
• Legal bases: Consent (Art. 6 abs. 1 p. 1 lit. a GDPR), performance of the contract and pre-contractual enquiries (Art. 6 abs. 1 p. 1 lit. B. GDPR), legitimate interests (Art. 6 abs. 1 p. 1 lit. Q. GDPR).

Modification and updating of the Privacy Policy

We kindly ask you to keep up to know regularly about the content of our privacy policy. We will adjust the Privacy Policy as soon as the changes to the data processing we perform make this necessary. We will inform you as soon as the changes will affect you (e.g. consent) or any other individual notification.
If we provide addresses and contact information of companies and organizations in this Privacy Policy, please note that the addresses may change over time and ask you to check the information before contacting them.

Rights of data subjects

As a party under the GDPR, you are entitled to various rights, which are based in particular on the part of Art. 15 to 18 and 21 GDPR:

• Right to object: For reasons arising from your particular situation, you have the right to object at any time to the processing of personal data concerning you, which is due to the nature of the 6 abs. 1 lit. e or f GDPR to object; this also applies to profiling based on these provisions. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling in so far as it is related to such direct marketing.
• Right of withdrawal in the case of consent: You have the right to revoke consents given at any time.
• Right of access: You have the right to request confirmation as to whether the data in question is being processed and to obtain information about this data as well as to further information and copy of the data in accordance with the legal requirements.
• Right to rectification: You have the right to request the completion of the data concerning you or the correction of the inaccurate data concerning you in accordance with the legal requirements.
• Right to erasure and restriction of processing: You have the right to request that you delete data concerning you immediately, or alternatively, in accordance with the statutory requirements, to request a restriction of the processing of the data.
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, common and machine-readable format in accordance with the legal requirements or to request their transmission to another controller.
• Complaint to the supervisory authority: You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, workplace or place of alleged infringement, in accordance with the legal requirements, if you believe that the processing of personal data concerning you is in breach of the GDPR.

Definitions

This section provides an overview of the terms used in this Privacy Policy. Many of the terms are taken from the law and, above all, in kind. 4 GDPR defined. The legal definitions are binding. The following explanations, on the other hand, are primarily intended for understanding. The terms are sorted alphabetically.

• Affiliate Tracking: As part of affiliate tracking, links that link the linking websites to users to websites with product or other offers are logged. The operators of the respective linked websites can receive a commission if users follow these so-called affiliate links and then take advantage of the offers (e.g. goods or use services). For this purpose, it is necessary that the providers can track whether users who are interested in certain offers subsequently perceive them at the instigation of the affiliate links. Therefore, for the functionality of affiliate links, it is necessary that they are supplemented by certain values that become part of the link or otherwise, e.g. stored in a cookie. The values include in particular the source website (referrer), the time, an online identifier of the operators of the website on which the affiliate link was located, an online identifier of the respective offer, an online identifier of the user as well as tracking-specific values, such as, for example. Advertising media ID, partner ID, and categorizations.
• Visit Action Evaluation: “Conversion Tracking” is a method for determining the effectiveness of marketing activities. As a rule, a cookie is stored on the users’ devices within the websites on which the marketing measures are carried out and then retrieved again on the destination website. For example, we can track whether the ads we run on other websites were successful).
• IP masking: IP masking is a method in which the last octet, i.e. the last two numbers of an IP address, is deleted so that the IP address can no longer be used to uniquely identify a person. Therefore, IP masking is a means of pseudonymizing processing methods, especially in online marketing
• Interest-based and behavioral marketing: Interest- and/or behavioral marketing is when potential interests of users in advertisements and other content are predetermined as precisely as possible. This is done on the basis of information on their previous behaviour (e.g. Visiting certain websites and staying on them, buying behavior or interaction with other users), which are stored in a so-called profile. Cookies are usually used for these purposes.
• Conversion measurement: Conversion measurement is a method by which the effectiveness of marketing measures can be determined. As a rule, a cookie is stored on the users’ devices within the websites on which the marketing measures are carried out and then retrieved again on the destination website. For example, we can track whether the ads we run on other websites were successful.
• Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); Identifiable is a natural person who, directly or indirectly, is identified, in particular by associating him to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more specific characteristics that are an expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
• Profiling: “Profiling” means any type of automated processing of personal data that consists in the use of such personal data to analyze certain personal aspects relating to a natural person (depending on the type of profiling, information on age, gender, location data and movement data, interaction with websites and their content, shopping behavior, social interactions with other people) , or to predict them (e.g. interests in certain content or products, click-through behaviour on a website or whereyou to stay). Cookies and web beacons are often used for profiling purposes.
• Range measurement: The range measurement (also known as web analytics) is used to evaluate the visitor flows of an online offer and may affect the behaviour or interests of visitors in certain information, such as content of websites. With the help of the range analysis, website owners can, for example, recognize the time at which visitors visit their website and what content they are interested in. This allows them, for example, to adapt the contents of the website to the needs of its visitors. For the purposes of range analysis, pseudonymous cookies and web beacons are often used to recognize returning visitors and thus obtain more accurate analyses of the use of an online offer.
• Remarketing: From “remarketing” or “remarketing” “Retargeting” is used when, for example, for advertising purposes, which products a user has been interested in on a website in order to acquire these products on other websites, e.g. in advertisements.
• Tracking: “Tracking” is when the behavior of users can be tracked across multiple online offers. As a rule, with regard to the online offers used, behavioural and interest information is stored in cookies or on servers of the providers of the tracking technologies (so-called profiling). This information can then be used, for example, to display advertisements to users that are likely to be in their interests.
• Responsible person: The “responsible person” means the natural or legal person, authority, body or other body that decides, alone or jointly with others, on the purposes and means of processing personal data.
• Processing: “Processing” means any operation or series of operations carried out with or without the help of automated procedures in connection with personal data. The term goes far and covers virtually every use of data, be it the collection, the evaluating, the saving, the transmission or the deletion.