Privacy Policy

1. An overview of data pro­tection

General infor­mation

The fol­lowing infor­mation will provide you with an easy to navigate overview of what will happen with your per­sonal data when you visit this website. The term “per­sonal data” com­prises all data that can be used to per­so­nally identify you. For detailed infor­mation about the subject matter of data pro­tection, please consult our Data Pro­tection Decla­ration, which we have included beneath this copy.

Data recording on this website

Who is the respon­sible party for the recording of data on this website (i.e., the “con­troller”)?

The data on this website is pro­cessed by the ope­rator of the website, whose contact infor­mation is available under section “Infor­mation about the respon­sible party (referred to as the “con­troller” in the GDPR)” in this Privacy Policy.

How do we record your data?

We collect your data as a result of your sharing of your data with us. This may, for ins­tance be infor­mation you enter into our contact form.

Other data shall be recorded by our IT systems auto­ma­ti­cally or after you consent to its recording during your website visit. This data com­prises pri­marily tech­nical infor­mation (e.g., web browser, ope­rating system, or time the site was accessed). This infor­mation is recorded auto­ma­ti­cally when you access this website.

What are the pur­poses we use your data for?

A portion of the infor­mation is gene­rated to gua­rantee the error free pro­vision of the website. Other data may be used to analyze your user pat­terns.

What rights do you have as far as your infor­mation is con­cerned?

You have the right to receive infor­mation about the source, reci­pients, and pur­poses of your archived per­sonal data at any time without having to pay a fee for such dis­clo­sures. You also have the right to demand that your data are rec­tified or era­di­cated. If you have con­sented to data pro­cessing, you have the option to revoke this consent at any time, which shall affect all future data pro­cessing. Moreover, you have the right to demand that the pro­cessing of your data be rest­ricted under certain cir­cum­s­tances. Fur­thermore, you have the right to log a com­plaint with the com­petent super­vising agency.

Please do not hesitate to contact us at any time if you have ques­tions about this or any other data pro­tection related issues.

Ana­lysis tools and tools pro­vided by third parties

There is a pos­si­bility that your browsing pat­terns will be sta­tis­ti­cally ana­lyzed when your visit this website. Such ana­lyses are per­formed pri­marily with what we refer to as ana­lysis pro­grams.

For detailed infor­mation about these ana­lysis pro­grams please consult our Data Pro­tection Decla­ration below.

2. Hosting and Content Delivery Net­works (CDN)

We are hosting the content of our website at the fol­lowing pro­vider:

RAIDBOXES

The pro­vider is the RAIDBOXES GmbH, Hafenstr. 32, 48151 Münster, Germany (her­ein­after referred to as: RAIDBOXES). Whenever you visit our website, RAIDBOXES will record a variety of log­files, including your IP addresses.

For details, please refer to the Data Privacy Policy of RAIDBOXES: https://raidboxes.io/legal/privacy/.

We use RAIDBOXES on the basis of Art. 6(1)(f) GDPR. We have a legi­timate interest in making the depiction of our website as depen­dable as pos­sible. If you have been asked for your respective consent, pro­cessing shall occur exclu­sively on the basis of Art. 6 (1)(a) GDPR and § 25(1) TDDDG, if the consent com­prises the archiving of cookies or access to infor­mation on the user’s device (e.g., device finger printing) as defined in the TDDDG. Such consent may be revoked at any time.

Cloud­flare

We use the “Cloud­flare” service pro­vided by Cloud­flare Inc., 101 Townsend St., San Fran­cisco, CA 94107, USA. (her­ein­after referred to as “Cloud­flare”).

Cloud­flare offers a content delivery network with DNS that is available worldwide. As a result, the infor­mation transfer that occurs between your browser and our website is tech­ni­cally routed via Cloudflare’s network. This enables Cloud­flare to analyze data tran­sac­tions between your browser and our website and to work as a filter between our servers and poten­tially mali­cious data traffic from the Internet. In this context, Cloud­flare may also use cookies or other tech­no­logies deployed to reco­gnize Internet users, which shall, however, only be used for the herein described purpose.

The use of Cloud­flare is based on our legi­timate interest in a pro­vision of our website offe­rings that is as error free and secure as pos­sible (Art. 6(1)(f) GDPR).

Data trans­mission to the US is based on the Standard Con­tractual Clauses (SCC) of the European Com­mission. Details can be found here: https://www.cloudflare.com/privacypolicy/.

For more infor­mation on Cloudflare’s security pre­cau­tions and data privacy policies, please follow this link: https://www.cloudflare.com/privacypolicy/.

The company is cer­tified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure com­pliance with European data pro­tection stan­dards for data pro­cessing in the US. Every company cer­tified under the DPF is obliged to comply with these data pro­tection stan­dards. For more infor­mation, please contact the pro­vider under the fol­lowing link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000GnZKAA0&status=Active

3. General infor­mation and man­datory infor­mation

Data pro­tection

The ope­rators of this website and its pages take the pro­tection of your per­sonal data very seriously. Hence, we handle your per­sonal data as con­fi­dential infor­mation and in com­pliance with the sta­tutory data pro­tection regu­la­tions and this Data Pro­tection Decla­ration.

Whenever you use this website, a variety of per­sonal infor­mation will be coll­ected. Per­sonal data com­prises data that can be used to per­so­nally identify you. This Data Pro­tection Decla­ration explains which data we collect as well as the pur­poses we use this data for. It also explains how, and for which purpose the infor­mation is coll­ected.

We herewith advise you that the trans­mission of data via the Internet (i.e., through e‑mail com­mu­ni­ca­tions) may be prone to security gaps. It is not pos­sible to com­pletely protect data against third-party access.

Infor­mation about the respon­sible party (referred to as the “con­troller” in the GDPR)

The data pro­cessing con­troller on this website is:

URLAUBSARCHITEKTUR GmbH
Bozener Straße 6
30519 Han­nover

Phone: +49.511.165819362
E‑mail: kontakt@urlaubsarchitektur.de

The con­troller is the natural person or legal entity that single-han­dedly or jointly with others makes decisions as to the pur­poses of and resources for the pro­cessing of per­sonal data (e.g., names, e‑mail addresses, etc.).

Storage duration

Unless a more spe­cific storage period has been spe­cified in this privacy policy, your per­sonal data will remain with us until the purpose for which it was coll­ected no longer applies. If you assert a jus­tified request for deletion or revoke your consent to data pro­cessing, your data will be deleted, unless we have other legally per­mis­sible reasons for storing your per­sonal data (e.g., tax or com­mercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.

General infor­mation on the legal basis for the data pro­cessing on this website

If you have con­sented to data pro­cessing, we process your per­sonal data on the basis of Art. 6(1)(a) GDPR or Art. 9 (2)(a) GDPR, if special cate­gories of data are pro­cessed according to Art. 9 (1) DSGVO. In the case of explicit consent to the transfer of per­sonal data to third countries, the data pro­cessing is also based on Art. 49 (1)(a) GDPR. If you have con­sented to the storage of cookies or to the access to infor­mation in your end device (e.g., via device fin­ger­printing), the data pro­cessing is addi­tio­nally based on § 25 (1) TDDDG. The consent can be revoked at any time. If your data is required for the ful­fillment of a con­tract or for the imple­men­tation of pre-con­tractual mea­sures, we process your data on the basis of Art. 6(1)(b) GDPR. Fur­thermore, if your data is required for the ful­fillment of a legal obli­gation, we process it on the basis of Art. 6(1)© GDPR. Fur­thermore, the data pro­cessing may be carried out on the basis of our legi­timate interest according to Art. 6(1)(f) GDPR. Infor­mation on the relevant legal basis in each indi­vidual case is pro­vided in the fol­lowing para­graphs of this privacy policy.

Infor­mation on the data transfer to third-party countries that are not secure under data pro­tection law and the transfer to US com­panies that are not DPF-cer­tified

We use, among other tech­no­logies, tools from com­panies located in third-party countries that are not safe under data pro­tection law, as well as US tools whose pro­viders are not cer­tified under the EU-US Data Privacy Framework (DPF). If these tools are enabled, your per­sonal data may be trans­ferred to and pro­cessed in these countries. We would like you to note that no level of data pro­tection com­pa­rable to that in the EU can be gua­ranteed in third countries that are insecure in terms of data pro­tection law.

We would like to point out that the US, as a secure third-party country, gene­rally has a level of data pro­tection com­pa­rable to that of the EU. Data transfer to the US is the­r­efore per­mitted if the reci­pient is cer­tified under the “EU-US Data Privacy Framework” (DPF) or has appro­priate addi­tional assu­rances. Infor­mation on transfers to third-party countries, including the data reci­pients, can be found in this Privacy Policy.

Reci­pients of per­sonal data

In the scope of our business acti­vities, we cooperate with various external parties. In some cases, this also requires the transfer of per­sonal data to these external parties. We only dis­close per­sonal data to external parties if this is required as part of the ful­fillment of a con­tract, if we are legally obli­gated to do so (e.g., dis­closure of data to tax aut­ho­rities), if we have a legi­timate interest in the dis­closure pur­suant to Art. 6 (1)(f) GDPR, or if another legal basis permits the dis­closure of this data. When using pro­cessors, we only dis­close per­sonal data of our cus­tomers on the basis of a valid con­tract on data pro­cessing. In the case of joint pro­cessing, a joint pro­cessing agreement is con­cluded.

Revo­cation of your consent to the pro­cessing of data

A wide range of data pro­cessing tran­sac­tions are pos­sible only subject to your express consent. You can also revoke at any time any consent you have already given us. This shall be without pre­judice to the lawfulness of any data coll­ection that occurred prior to your revo­cation.

Right to object to the coll­ection of data in special cases; right to object to direct adver­tising (Art. 21 GDPR)

IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA BASED ON GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS, ON WHICH ANY PROCESSING OF DATA IS BASED, PLEASE CONSULT THIS DATA PROTECTION DECLARATION. IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA, THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING, EXERCISING OR DEFENCE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS BEING PROCESSED IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR AFFECTED PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING AT ANY TIME. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to log a com­plaint with the com­petent super­visory agency

In the event of vio­la­tions of the GDPR, data sub­jects are entitled to log a com­plaint with a super­visory agency, in par­ti­cular in the member state where they usually maintain their domicile, place of work or at the place where the alleged vio­lation occurred. The right to log a com­plaint is in effect regardless of any other admi­nis­trative or court pro­cee­dings available as legal recourses.

Right to data por­ta­bility

You have the right to have data that we process auto­ma­ti­cally on the basis of your consent or in ful­fillment of a con­tract handed over to you or to a third party in a common, machine-rea­dable format. If you should demand the direct transfer of the data to another con­troller, this will be done only if it is tech­ni­cally fea­sible.

Infor­mation about, rec­ti­fi­cation and era­di­cation of data

Within the scope of the appli­cable sta­tutory pro­vi­sions, you have the right to demand infor­mation about your archived per­sonal data, their source and reci­pients as well as the purpose of the pro­cessing of your data at any time. You may also have a right to have your data rec­tified or era­di­cated. If you have ques­tions about this subject matter or any other ques­tions about per­sonal data, please do not hesitate to contact us at any time.

Right to demand pro­cessing rest­ric­tions

You have the right to demand the impo­sition of rest­ric­tions as far as the pro­cessing of your per­sonal data is con­cerned. To do so, you may contact us at any time. The right to demand rest­riction of pro­cessing applies in the fol­lowing cases:

• In the event that you should dispute the cor­rectness of your data archived by us, we will usually need some time to verify this claim. During the time that this inves­ti­gation is ongoing, you have the right to demand that we restrict the pro­cessing of your per­sonal data.
• If the pro­cessing of your per­sonal data was/is con­ducted in an unlawful manner, you have the option to demand the rest­riction of the pro­cessing of your data instead of demanding the era­di­cation of this data.
• If we do not need your per­sonal data any longer and you need it to exercise, defend or claim legal entit­le­ments, you have the right to demand the rest­riction of the pro­cessing of your per­sonal data instead of its era­di­cation.
• If you have raised an objection pur­suant to Art. 21(1) GDPR, your rights and our rights will have to be weighed against each other. As long as it has not been deter­mined whose inte­rests prevail, you have the right to demand a rest­riction of the pro­cessing of your per­sonal data.

If you have rest­ricted the pro­cessing of your per­sonal data, these data – with the exception of their archiving – may be pro­cessed only subject to your consent or to claim, exercise or defend legal entit­le­ments or to protect the rights of other natural persons or legal entities or for important public interest reasons cited by the European Union or a member state of the EU.

SSL and/or TLS encryption

For security reasons and to protect the trans­mission of con­fi­dential content, such as purchase orders or inquiries you submit to us as the website ope­rator, this website uses either an SSL or a TLS encryption program. You can reco­gnize an encrypted con­nection by che­cking whether the address line of the browser switches from “http://” to “https://” and also by the appearance of the lock icon in the browser line.

If the SSL or TLS encryption is acti­vated, data you transmit to us cannot be read by third parties.

Rejection of unso­li­cited e‑mails

We herewith object to the use of contact infor­mation published in con­junction with the man­datory infor­mation to be pro­vided in our Site Notice to send us pro­mo­tional and infor­mation material that we have not expressly requested. The ope­rators of this website and its pages reserve the express right to take legal action in the event of the unso­li­cited sending of pro­mo­tional infor­mation, for ins­tance via SPAM mes­sages.

4. Recording of data on this website

Cookies

Our web­sites and pages use what the industry refers to as “cookies.” Cookies are small data packages that do not cause any damage to your device. They are either stored tem­po­r­arily for the duration of a session (session cookies) or they are per­ma­nently archived on your device (per­manent cookies). Session cookies are auto­ma­ti­cally deleted once you ter­minate your visit. Per­manent cookies remain archived on your device until you actively delete them, or they are auto­ma­ti­cally era­di­cated by your web browser.

Cookies can be issued by us (first-party cookies) or by third-party com­panies (so-called third-party cookies). Third-party cookies enable the inte­gration of certain ser­vices of third-party com­panies into web­sites (e.g., cookies for handling payment ser­vices).

Cookies have a variety of func­tions. Many cookies are tech­ni­cally essential since certain website func­tions would not work in the absence of these cookies (e.g., the shopping cart function or the display of videos). Other cookies may be used to analyze user behavior or for pro­mo­tional pur­poses.

Cookies, which are required for the per­for­mance of elec­tronic com­mu­ni­cation tran­sac­tions, for the pro­vision of certain func­tions you want to use (e.g., for the shopping cart function) or those that are necessary for the opti­mization (required cookies) of the website (e.g., cookies that provide mea­surable insights into the web audience), shall be stored on the basis of Art. 6(1)(f) GDPR, unless a dif­ferent legal basis is cited. The ope­rator of the website has a legi­timate interest in the storage of required cookies to ensure the tech­ni­cally error-free and opti­mized pro­vision of the operator’s ser­vices. If your consent to the storage of the cookies and similar reco­gnition tech­no­logies has been requested, the pro­cessing occurs exclu­sively on the basis of the consent obtained (Art. 6(1)(a) GDPR and § 25 (1) TDDDG); this consent may be revoked at any time.

You have the option to set up your browser in such a manner that you will be notified any time cookies are placed and to permit the accep­tance of cookies only in spe­cific cases. You may also exclude the accep­tance of cookies in certain cases or in general or activate the delete-function for the auto­matic era­di­cation of cookies when the browser closes. If cookies are deac­ti­vated, the func­tions of this website may be limited.

Which cookies and ser­vices are used on this website can be found in this privacy policy.

Consent with Borlabs Cookie

Our website uses the Borlabs consent tech­nology to obtain your consent to the storage of certain cookies in your browser or for the use of certain tech­no­logies and for their data privacy pro­tection com­pliant docu­men­tation. The pro­vider of this tech­nology is Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany (her­ein­after referred to as Borlabs).

Whenever you visit our website, a Borlabs cookie will be stored in your browser, which archives any decla­ra­tions or revo­ca­tions of consent you have entered. These data are not shared with the pro­vider of the Borlabs tech­nology.

The recorded data shall remain archived until you ask us to era­dicate them, delete the Borlabs cookie on your own or the purpose of storing the data no longer exists. This shall be without pre­judice to any retention obli­ga­tions man­dated by law. To review the details of Borlabs’ data pro­cessing policies, please visit https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/

We use the Borlabs cookie consent tech­nology to obtain the decla­ra­tions of consent man­dated by law for the use of cookies. The legal basis for the use of such cookies is Art. 6(1)© GDPR.

Server log files

The pro­vider of this website and its pages auto­ma­ti­cally collects and stores infor­mation in so-called server log files, which your browser com­mu­ni­cates to us auto­ma­ti­cally. The infor­mation com­prises:

• The type and version of browser used
• The used ope­rating system
• Referrer URL
• The hostname of the accessing com­puter
• The time of the server inquiry
• The IP address

This data is not merged with other data sources.

This data is recorded on the basis of Art. 6(1)(f) GDPR. The ope­rator of the website has a legi­timate interest in the tech­ni­cally error free depiction and the opti­mization of the operator’s website. In order to achieve this, server log files must be recorded.

Contact form

If you submit inquiries to us via our contact form, the infor­mation pro­vided in the contact form as well as any contact infor­mation pro­vided therein will be stored by us in order to handle your inquiry and in the event that we have further ques­tions. We will not share this infor­mation without your consent.

The pro­cessing of these data is based on Art. 6(1)(b) GDPR, if your request is related to the exe­cution of a con­tract or if it is necessary to carry out pre-con­tractual mea­sures. In all other cases the pro­cessing is based on our legi­timate interest in the effective pro­cessing of the requests addressed to us (Art. 6(1)(f) GDPR) or on your agreement (Art. 6(1)(a) GDPR) if this has been requested; the consent can be revoked at any time.

The infor­mation you have entered into the contact form shall remain with us until you ask us to era­dicate the data, revoke your consent to the archiving of data or if the purpose for which the infor­mation is being archived no longer exists (e.g., after we have con­cluded our response to your inquiry). This shall be without pre­judice to any man­datory legal pro­vi­sions, in par­ti­cular retention periods.

Request by e‑mail, tele­phone, or fax

If you contact us by e‑mail, tele­phone or fax, your request, including all resulting per­sonal data (name, request) will be stored and pro­cessed by us for the purpose of pro­cessing your request. We do not pass these data on without your consent.

These data are pro­cessed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the ful­fillment of a con­tract or is required for the per­for­mance of pre-con­tractual mea­sures. In all other cases, the data are pro­cessed on the basis of our legi­timate interest in the effective handling of inquiries sub­mitted to us (Art. 6(1)(f) GDPR) or on the basis of your consent (Art. 6(1)(a) GDPR) if it has been obtained; the consent can be revoked at any time.

The data sent by you to us via contact requests remain with us until you request us to delete, revoke your consent to the storage or the purpose for the data storage lapses (e.g. after com­pletion of your request). Man­datory sta­tutory pro­vi­sions — in par­ti­cular sta­tutory retention periods — remain unaf­fected.

The comment function on this website

When you use the comment function on this website, infor­mation on the time the comment was gene­rated and your e‑mail-address and, if you are not posting anony­mously, the username you have sel­ected will be archived in addition to your comments.

Storage of the IP address

Our comment function stores the IP addresses of all users who enter comments. Given that we do not review the comments prior to publi­shing them, we need this infor­mation in order to take action against the author in the event of rights vio­la­tions, such as defa­mation or pro­pa­ganda.

Storage period for comments

Comments and any affi­liated infor­mation shall be stored by us and remain on this website until the content the comment per­tained to has been deleted in its entirety or if the comments had to be deleted for legal reasons (e.g., insulting comments).

Legal basis

Comments are stored on the basis of your consent (Art. 6(1)(a) GDPR). You have the right to revoke at any time any consent you have already given us. To do so, all you are required to do is sent us an informal noti­fi­cation via e‑mail. This shall be without pre­judice to the lawfulness of any data coll­ection that occurred prior to your revo­cation.

5. Ana­lysis tools and adver­tising

Matomo

This website uses the open-source web ana­lysis service Matomo.

Through Matomo, we are able to collect and analyze data on the use of our website-by-website visitors. This enables us to find out, for ins­tance, when which page views occurred and from which region they came. In addition, we collect various log files (e.g. IP address, referrer, browser, and ope­rating system used) and can measure whether our website visitors perform certain actions (e.g. clicks, purchases, etc.).

The use of this ana­lysis tool is based on Art. 6(1)(f) GDPR. The website ope­rator has a legi­timate interest in the ana­lysis of user pat­terns, in order to optimize the operator’s web offe­rings and adver­tising. If appro­priate consent has been obtained, the pro­cessing is carried out exclu­sively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to infor­mation in the user’s end device (e.g., device fin­ger­printing) within the meaning of the TDDDG. This consent can be revoked at any time.

IP anony­mization

For ana­lysis with Matomo we use IP anony­mization. Your IP address is shor­tened before the ana­lysis, so that it is no longer clearly assi­gnable to you.

Hosting

We host Matomo with the fol­lowing third-party pro­vider:

Matomo, c/o Inno­Craft, 7 Waterloo Quay PO625, 6140 Wel­lington, New Zealand

Data pro­cessing

We have con­cluded a data pro­cessing agreement (DPA) for the use of the above-men­tioned service. This is a con­tract man­dated by data privacy laws that gua­rantees that they process per­sonal data of our website visitors only based on our ins­truc­tions and in com­pliance with the GDPR.

6. News­letter

News­letter data

If you would like to receive the news­letter offered on the website, we require an e‑mail address from you as well as infor­mation that allows us to verify that you are the owner of the e‑mail address pro­vided and that you agree to receive the news­letter. Further data is not coll­ected or only on a vol­untary basis. For the handling of the news­letter, we use news­letter service pro­viders, which are described below.

Mailchimp

This website uses the ser­vices of Mailchimp to send out its news­letters. The pro­vider is the Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.

Among other things, Mailchimp is a service that can be deployed to organize and analyze the sending of news­letters. Whenever you enter data for the purpose of sub­scribing to a news­letter (e.g. your e‑mail address), the infor­mation is stored on Mailchimp servers in the United States.

With the assis­tance of the Mailchimp tool, we can analyze the per­for­mance of our news­letter cam­paigns. If you open an e‑mail that has been sent through the Mailchimp tool, a file that has been inte­grated into the e‑mail (a so-called web-beacon) con­nects to Mailchimp’s servers in the United States. As a result, it can be deter­mined whether a news­letter message has been opened and which links the reci­pient pos­sibly clicked on. Tech­nical infor­mation is also recorded at that time (e.g. the time of access, the IP address, type of browser and ope­rating system). This infor­mation cannot be allo­cated to the respective news­letter reci­pient. Their sole purpose is the per­for­mance of sta­tis­tical ana­lyses of news­letter cam­paigns. The results of such ana­lyses can be used to tailor future news­letters to the inte­rests of their reci­pients more effec­tively.

If you do not want to permit an ana­lysis by Mailchimp, you must unsub­scribe from the news­letter. We provide a link for you to do this in every news­letter message.

The data is pro­cessed based on your consent (Art. 6(1)(a) GDPR). You may revoke any consent you have given at any time by unsub­scribing from the news­letter. This shall be without pre­judice to the lawfulness of any data pro­cessing tran­sac­tions that have taken place prior to your revo­cation.

The data depo­sited with us for the purpose of sub­scribing to the news­letter will be stored by us until you unsub­scribe from the news­letter or the news­letter service pro­vider and deleted from the news­letter dis­tri­bution list after you unsub­scribe from the news­letter. Data stored for other pur­poses with us remain unaf­fected.

Data trans­mission to the US is based on the Standard Con­tractual Clauses (SCC) of the European Com­mission. Details can be found here: https://mailchimp.com/eu-us-data-transfer-statement/ and https://mailchimp.com/legal/data-processing-addendum/#Annex_C_-_Standard_Contractual_Clauses.

After you unsub­scribe from the news­letter dis­tri­bution list, your e‑mail address may be stored by us or the news­letter service pro­vider in a blacklist, if such action is necessary to prevent future mai­lings. The data from the blacklist is used only for this purpose and not merged with other data. This serves both your interest and our interest in com­plying with the legal requi­re­ments when sending news­letters (legi­timate interest within the meaning of Art. 6(1)(f) GDPR). The storage in the blacklist is inde­finite. You may object to the storage if your inte­rests out­weigh our legi­timate interest.

For more details, please consult the Data Privacy Policies of Mailchimp at: https://mailchimp.com/legal/terms/.

The company is cer­tified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure com­pliance with European data pro­tection stan­dards for data pro­cessing in the US. Every company cer­tified under the DPF is obliged to comply with these data pro­tection stan­dards. For more infor­mation, please contact the pro­vider under the fol­lowing link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000TXVKAA4&status=Active

Data pro­cessing

We have con­cluded a data pro­cessing agreement (DPA) for the use of the above-men­tioned service. This is a con­tract man­dated by data privacy laws that gua­rantees that they process per­sonal data of our website visitors only based on our ins­truc­tions and in com­pliance with the GDPR.

7. Plug-ins and Tools

YouTube with expanded data pro­tection inte­gration

This website inte­grates videos from the YouTube website. The ope­rator of the website is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of these web­sites on which YouTube is inte­grated, a con­nection to the YouTube servers is estab­lished. This tells the YouTube server which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your per­sonal profile. You can prevent this by logging out of your YouTube account.

We use YouTube in extended data pro­tection mode. According to YouTube, videos that are played in extended data pro­tection mode are not used to per­so­nalize browsing on YouTube. Ads that are played in extended data pro­tection mode are also not per­so­na­lized. No cookies are set in extended data pro­tection mode. Instead, so-called local storage ele­ments are stored in the user’s browser, which contain per­sonal data similar to cookies and can be used for reco­gnition. Details on the extended data pro­tection mode can be found here: https://support.google.com/youtube/answer/171780.

After acti­vating a YouTube video, further data pro­cessing ope­ra­tions may be trig­gered over which we have no influence.

The use of YouTube is based on our interest in pre­senting our online content in an appe­aling manner. Pur­suant to Art. 6(1)(f) GDPR, this is a legi­timate interest. If appro­priate consent has been obtained, the pro­cessing is carried out exclu­sively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to infor­mation in the user’s end device (e.g., device fin­ger­printing) within the meaning of the TDDDG. This consent can be revoked at any time.

For more infor­mation on how YouTube handles user data, please consult the YouTube Data Privacy Policy under: https://policies.google.com/privacy?hl=en.

The company is cer­tified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure com­pliance with European data pro­tection stan­dards for data pro­cessing in the US. Every company cer­tified under the DPF is obliged to comply with these data pro­tection stan­dards. For more infor­mation, please contact the pro­vider under the fol­lowing link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

Vimeo

This website uses plug-ins of the video portal Vimeo. The pro­vider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.

If you visit one of the pages on our website into which a Vimeo video has been inte­grated, a con­nection to Vimeo’s servers will be estab­lished. As a con­se­quence, the Vimeo server will receive infor­mation as to which of our pages you have visited. Moreover, Vimeo will receive your IP address. This will also happen if you are not logged into Vimeo or do not have an account with Vimeo. The infor­mation recorded by Vimeo will be trans­mitted to Vimeo’s server in the United States.

If you are logged into your Vimeo account, you enable Vimeo to directly allocate your browsing pat­terns to your per­sonal profile. You can prevent this by logging out of your Vimeo account.

Vimeo uses cookies or com­pa­rable reco­gnition tech­no­logies (e.g. device fin­ger­printing) to reco­gnize website visitors.

The use of Vimeo is based on our interest in pre­senting our online content in an appe­aling manner. Pur­suant to Art. 6(1)(f) GDPR, this is a legi­timate interest. If appro­priate consent has been obtained, the pro­cessing is carried out exclu­sively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to infor­mation in the user’s end device (e.g., device fin­ger­printing) within the meaning of the TDDDG. This consent can be revoked at any time.

Data trans­mission to the US is based on the Standard Con­tractual Clauses (SCC) of the European Com­mission and, according to Vimeo, on “legi­timate business inte­rests”. Details can be found here: https://vimeo.com/privacy.

For more infor­mation on how Vimeo handles user data, please consult the Vimeo Data Privacy Policy under: https://vimeo.com/privacy.

The company is cer­tified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure com­pliance with European data pro­tection stan­dards for data pro­cessing in the US. Every company cer­tified under the DPF is obliged to comply with these data pro­tection stan­dards. For more infor­mation, please contact the pro­vider under the fol­lowing link: https://www.dataprivacyframework.gov/list

Adobe Fonts

In order to ensure the uniform depiction of certain fonts, this website uses fonts called Adobe Fonts pro­vided by Adobe Systems Incor­po­rated, 345 Park Avenue, San Jose, CA 95110–2704, USA (Adobe).

When you access pages of this website, your browser will auto­ma­ti­cally load the required fonts directly from the Adobe site to be able to display them cor­rectly on your device. As a result, your browser will establish a con­nection with Adobe’s servers in the United States. Hence, Adobe learns that your IP address was used to access this website. According to the infor­mation pro­vided by Adobe, no cookies will be stored in con­junction with the pro­vision of the fonts.

Data are stored and ana­lyzed on the basis of Art. 6(1)(f) GDPR. The website ope­rator has a legi­timate interest in a uniform pre­sen­tation of the font on the operator’s website. If appro­priate consent has been obtained, the pro­cessing is carried out exclu­sively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to infor­mation in the user’s end device (e.g., device fin­ger­printing) within the meaning of the TDDDG. This consent can be revoked at any time.

Data trans­mission to the US is based on the Standard Con­tractual Clauses (SCC) of the European Com­mission. Details can be found here: https://www.adobe.com/de/privacy/eudatatransfers.html.

For more infor­mation about Adobe Fonts, please read the policies under: https://www.adobe.com/privacy/policies/adobe-fonts.html.

Adobe’s Data Privacy Decla­ration may be reviewed under: https://www.adobe.com/privacy/policy.html.

The company is cer­tified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure com­pliance with European data pro­tection stan­dards for data pro­cessing in the US. Every company cer­tified under the DPF is obliged to comply with these data pro­tection stan­dards. For more infor­mation, please contact the pro­vider under the fol­lowing link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000TNo9AAG&status=Active

Open­StreetMap

We are using the mapping service pro­vided by Open­StreetMap (OSM).

We embed the map data from Open­StreetMap on the server of the Open­StreetMap Foun­dation, St John’s Inno­vation Centre, Cowley Road, Cam­bridge, CB4 0WS, United Kingdom. The United Kingdom is con­sidered a secure third country under data pro­tection law. This means that the United Kingdom has a level of data pro­tection that is equi­valent to the level of data pro­tection in the European Union. When using the Open­StreetMap maps, a con­nection is estab­lished to the servers of the Open­StreetMap-Foun­dation. In the process and among other things, your IP address and other infor­mation about your behavior on this website may be for­warded to the OSMF. Open­StreetMap may store cookies in your browser or use similar reco­gnition tech­no­logies for this purpose.

We use Open­StreetMap with the objective of ensuring the attractive pre­sen­tation of our online offers and to make it easy for visitors to find the loca­tions we specify on our website. This estab­lishes legi­timate grounds as defined in Art. 6(1)(f) GDPR. If appro­priate consent has been obtained, the pro­cessing is carried out exclu­sively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to infor­mation in the user’s end device (e.g., device fin­ger­printing) within the meaning of the TDDDG. This consent can be revoked at any time.

Google reCAPTCHA

We use “Google reCAPTCHA” (her­ein­after referred to as “reCAPTCHA”) on this website. The pro­vider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

The purpose of reCAPTCHA is to determine whether data entered on this website (e.g., infor­mation entered into a contact form) is being pro­vided by a human user or by an auto­mated program. To determine this, reCAPTCHA ana­lyzes the behavior of the website visitors based on a variety of para­meters. This ana­lysis is trig­gered auto­ma­ti­cally as soon as the website visitor enters the site. For this ana­lysis, reCAPTCHA eva­luates a variety of data (e.g., IP address, time the website visitor spent on the site or cursor move­ments initiated by the user). The data tracked during such ana­lyses are for­warded to Google.

reCAPTCHA ana­lyses run entirely in the back­ground. Website visitors are not alerted that an ana­lysis is underway.

Data are stored and ana­lyzed on the basis of Art. 6(1)(f) GDPR. The website ope­rator has a legi­timate interest in the pro­tection of the operator’s web­sites against abusive auto­mated spying and against SPAM. If appro­priate consent has been obtained, the pro­cessing is carried out exclu­sively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar the consent includes the storage of cookies or the access to infor­mation in the user’s end device (e.g., device fin­ger­printing) within the meaning of the TDDDG. This consent can be revoked at any time.

For more infor­mation about Google reCAPTCHA please refer to the Google Data Privacy Decla­ration and Terms Of Use under the fol­lowing links: https://policies.google.com/privacy?hl=en and https://policies.google.com/terms?hl=en.

The company is cer­tified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure com­pliance with European data pro­tection stan­dards for data pro­cessing in the US. Every company cer­tified under the DPF is obliged to comply with these data pro­tection stan­dards. For more infor­mation, please contact the pro­vider under the fol­lowing link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

Akismet

We have imple­mented Akismet on this website. The pro­vider is Aut O’Mattic A8C Ireland Ltd, Business Centre, No.1 Lower Mayor Street, Inter­na­tional Financial Ser­vices Centre, Dublin 1, Ireland (her­ein­after Aut O’Mattic), whose parent company is based in the US.

Akismet enables us to analyze posted comments for being SPAM. For this purpose, we process the pro­vided visitor name, mail address, IP address, comment text, browser type and access time.

The website ope­rator has a legi­timate interest in undis­turbed, spam-free com­mu­ni­cation with website visitors. If a cor­re­sponding consent has been requested, the pro­cessing is carried out exclu­sively on the basis of Art. 6 (1)(a) GDPR and § 25 (1) TDDDG, insofar as the consent includes the storage of cookies or access to infor­mation in the user’s ter­minal device (e.g., for device fin­ger­printing) as defined by the TDDDG. Such consent may be revoked at any time.

Further details can be found here: https://akismet.com/gdpr/.

Data transfer to the US is based on the standard con­tractual clauses of the EU Com­mission. Details can be found here: https://wordpress.com/support/data-processing-agreements/.

The company is cer­tified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure com­pliance with European data pro­tection stan­dards for data pro­cessing in the US. Every company cer­tified under the DPF is obliged to comply with these data pro­tection stan­dards. For more infor­mation, please contact the pro­vider under the fol­lowing link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000CbqcAAC&status=Active

8. Online-based Audio and Video Con­fe­rences (Con­fe­rence tools)

Data pro­cessing

We use online con­fe­rence tools, among other things, for com­mu­ni­cation with our cus­tomers. The tools we use are listed in detail below. If you com­mu­nicate with us by video or audio con­fe­rence using the Internet, your per­sonal data will be coll­ected and pro­cessed by the pro­vider of the respective con­fe­rence tool and by us. The con­fe­rencing tools collect all infor­mation that you provide/access to use the tools (email address and/or your phone number). Fur­thermore, the con­fe­rence tools process the duration of the con­fe­rence, start and end (time) of par­ti­ci­pation in the con­fe­rence, number of par­ti­ci­pants and other “context infor­mation” related to the com­mu­ni­cation process (metadata).

Fur­thermore, the pro­vider of the tool pro­cesses all the tech­nical data required for the pro­cessing of the online com­mu­ni­cation. This includes, in par­ti­cular, IP addresses, MAC addresses, device IDs, device type, ope­rating system type and version, client version, camera type, micro­phone or loud­speaker and the type of con­nection.

Should content be exch­anged, uploaded, or otherwise made available within the tool, it is also stored on the servers of the tool pro­vider. Such content includes, but is not limited to, cloud recor­dings, chat/ instant mes­sages, voicemail uploaded photos and videos, files, white­boards, and other infor­mation shared while using the service.

Please note that we do not have com­plete influence on the data pro­cessing pro­ce­dures of the tools used. Our pos­si­bi­lities are largely deter­mined by the cor­porate policy of the respective pro­vider. Further infor­mation on data pro­cessing by the con­fe­rence tools can be found in the data pro­tection decla­ra­tions of the tools used, and which we have listed below this text.

Purpose and legal bases

The con­fe­rence tools are used to com­mu­nicate with pro­s­pective or existing con­tractual partners or to offer certain ser­vices to our cus­tomers (Art. 6(1)(b) GDPR). Fur­thermore, the use of the tools serves to gene­rally sim­plify and acce­lerate com­mu­ni­cation with us or our company (legi­timate interest in the meaning of Art. 6(1)(f) GDPR). Insofar as consent has been requested, the tools in question will be used on the basis of this consent; the consent may be revoked at any time with effect from that date.

Duration of storage

Data coll­ected directly by us via the video and con­fe­rence tools will be deleted from our systems imme­diately after you request us to delete it, revoke your consent to storage, or the reason for storing the data no longer applies. Stored cookies remain on your end device until you delete them. Man­datory legal retention periods remain unaf­fected.

We have no influence on the duration of storage of your data that is stored by the ope­rators of the con­fe­rence tools for their own pur­poses. For details, please directly contact the ope­rators of the con­fe­rence tools.

Con­fe­rence tools used

We employ the fol­lowing con­fe­rence tools:

Zoom

We use Zoom. The pro­vider of this service is Zoom Com­mu­ni­ca­tions Inc, San Jose, 55 Almaden Bou­levard, 6th Floor, San Jose, CA 95113, USA. For details on data pro­cessing, please refer to Zoom’s privacy policy: https://explore.zoom.us/en/privacy/.

Data trans­mission to the US is based on the Standard Con­tractual Clauses (SCC) of the European Com­mission. Details can be found here: https://explore.zoom.us/en/privacy/.

Microsoft Teams

We use Microsoft Teams. The pro­vider is the Microsoft Ireland Ope­ra­tions Limited, One Microsoft Place, South County Business Park, Leo­pard­stown, Dublin 18, Ireland. For details on data pro­cessing, please refer to the Microsoft Teams privacy policy: https://privacy.microsoft.com/en-us/privacystatement.

The company is cer­tified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure com­pliance with European data pro­tection stan­dards for data pro­cessing in the US. Every company cer­tified under the DPF is obliged to comply with these data pro­tection stan­dards. For more infor­mation, please contact the pro­vider under the fol­lowing link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000KzNaAAK&status=Active