Privacy Policy

Controller

MaMori Betriebs GmbH
Wasserburger Landstr. 8
81825 München

Authorised representatives: Felix Niedermann

Email address: office@mamori-gmbh.de

Imprint: https://www.mloft-apartments-muenchen.de/en/imprint/

Overview of processing operations

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

• Master data.
• Employee data.
• Payment data.
• Location data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication and process data.
• Social data.
• Applicant data.
• Image and/or video recordings.
• Audio recordings.
• Contact information (Facebook).
• Event data (Facebook).
• Log data.
• Performance and behavioural data.
• Working time data.
• Salary data.

Special categories of data

• Health data.
• Religious or philosophical beliefs.
• Trade union membership.

Categories of data subjects

• Service recipients and clients.
• Employees.
• Prospective customers.
• Communication partners.
• Users.
• Applicants.
• Business and contractual partners.
• Participants.
• Persons depicted.
• Third parties.
• Customers.

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations.
• Communication.
• Security measures.
• Reach measurement.
• Tracking.
• Office and organisational procedures.
• Remarketing.
• Conversion tracking.
• Target group formation.
• Affiliate tracking.
• A/B tests.
• Organisational and administrative procedures.
• Application procedure.
• Content Delivery Network (CDN).
• Feedback.
• Marketing.
• Profiles with user-related information.
• Cross-device tracking.
• Provision of our online services and usability.
• Establishment and performance of employment relationships.
• Information technology infrastructure.
• Financial and payment management.
• Public relations.
• Sales promotion.
• Business processes and management procedures.
• Artificial intelligence (AI).

Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or registered office. Should more specific legal bases also be relevant in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6 (1) sentence 1 (a) GDPR) - The data subject has given their consent to the processing of personal data concerning them for a specific purpose or for several specific purposes.
• Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR) - The processing is necessary for the performance of a contract to which the data subject is party or in order to take pre-contractual measures carried out at the request of the data subject.
• Legal obligation (Art. 6 (1) sentence 1 (c) GDPR) - The processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR) - the processing is necessary for the purposes of the legitimate interests of the controller or of a third party, provided that the interests, fundamental rights and fundamental freedoms of the data subject which require the protection of personal data do not override them.
• Application procedure as a pre-contractual or contractual relationship (Art. 6 (1) sentence 1 (b) GDPR) - Insofar as special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g. health data, such as severely disabled status, or ethnic origin) are requested from applicants in the course of the application procedure so that the controller or the data subject can exercise the rights arising for him or her from employment law and social security and social protection law and fulfil his or her obligations in this respect, they are processed in accordance with Art. 9 (2) (b) GDPR, in the case of the protection of the vital interests of applicants or other persons in accordance with Art. 9 (2) (c) GDPR, or for the purposes of preventive health care or occupational medicine, for the assessment of the working capacity of the employee, for medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services in accordance with Art. 9 (2) (h) GDPR. In the case of a communication of special categories of data based on voluntary consent, they are processed on the basis of Art. 9 (2) (a) GDPR.
• Processing of special categories of personal data relating to healthcare, occupation and social security (Art. 9 (2) (h) GDPR) - The processing is necessary for the purposes of preventive health care or occupational medicine, for the assessment of the working capacity of the employee, for medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to a contract with a health professional.

National data protection regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include in particular the Federal Data Protection Act (BDSG). The BDSG contains in particular special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated individual decision-making, including profiling. Furthermore, the data protection laws of the individual federal states may apply.

Relevant legal bases under the Swiss Federal Act on Data Protection: We process your personal data in accordance with the Swiss Federal Act on Data Protection, "Swiss FADP" for short. Personal data must be processed lawfully, in good faith and proportionately (Art. 6 (1) and (2) FADP). It may only be collected for a specific purpose that is recognisable to the data subject and may only be processed in a manner compatible with this purpose (Art. 6 (3) FADP). Unlike the GDPR, the Swiss FADP does not, as a rule, make the lawfulness of processing by private controllers dependent on the selection of a specific legal basis from a catalogue laid down by law. Therefore, as a rule, there is also no general obligation to state such a legal basis in the privacy policy for each processing operation.

Note on the applicability of the GDPR and the Swiss FADP: This privacy notice serves to provide information both under the Swiss FADP and under the General Data Protection Regulation (GDPR). For this reason, please note that the terms of the GDPR are used owing to its broader territorial application and comprehensibility. In particular, instead of the terms "processing" of "personal data", "overriding interest" and "particularly sensitive personal data" used in the Swiss FADP, the terms "processing" of "personal data" as well as "legitimate interest" and "special categories of data" used in the GDPR are used. However, within the scope of the Swiss FADP, the legal meaning of the terms continues to be determined in accordance with the Swiss FADP.

Security measures

In accordance with the legal requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of processing as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, transfer, securing of availability and separation relating to it. Furthermore, we have established procedures that ensure the exercise of data subjects' rights, the deletion of data and responses to threats to the data. In addition, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection, through technology design and through privacy-friendly default settings.

Securing online connections through TLS/SSL encryption technology (HTTPS): To protect users' data transmitted via our online services from unauthorised access, we rely on TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user's browser (or between two servers), thereby protecting the data from unauthorised access. TLS, as the further developed and more secure version of SSL, ensures that all data transmissions meet the highest security standards. If a website is secured by an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator for users that their data is being transmitted securely and in encrypted form.

Transmission of personal data

In the course of our processing of personal data, it may happen that the data is transmitted to, or disclosed to, other bodies, companies, legally independent organisational units or persons. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are embedded in a website. In such cases, we comply with the legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

International data transfers

Data processing in third countries: If we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in the context of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies (which becomes apparent from the postal address of the respective provider or where the privacy policy expressly refers to the transfer of data to third countries), this is always done in accordance with the legal requirements.

For data transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of the European Commission of 10 July 2023. In addition, we have concluded Standard Contractual Clauses with the respective providers which comply with the requirements of the European Commission and set out contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the Standard Contractual Clauses serve as additional security. Should changes occur within the framework of the DPF, the Standard Contractual Clauses take effect as a reliable fallback option. In this way, we ensure that your data always remains adequately protected, even in the event of any political or legal changes.

For the individual service providers, we inform you whether they are certified under the DPF and whether Standard Contractual Clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English).

For data transfers to other third countries, corresponding safeguards apply, in particular Standard Contractual Clauses, explicit consent or transfers required by law. Information on third-country transfers and applicable adequacy decisions can be found in the information provided by the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

Disclosure of personal data abroad: In accordance with the Swiss FADP, we only disclose personal data abroad if adequate protection of the data subjects is ensured (Art. 16 Swiss FADP). If the Federal Council has not determined that adequate protection exists (list: https://www.bj.admin.ch/de/schweizerische-anerkennung-von-staaten-die-einen-angemessenen-datenschutz-gewaehrleisten), we take alternative safeguards.

For data transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of Switzerland of 15 September 2024. In addition, we have concluded standard data protection clauses with the respective providers which have been approved by the Federal Data Protection and Information Commissioner (FDPIC) and set out contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the standard data protection clauses serve as additional security. Should changes occur within the framework of the DPF, the standard data protection clauses take effect as a reliable fallback option. In this way, we ensure that your data always remains adequately protected, even in the event of any political or legal changes.

For the individual service providers, we inform you whether they are certified under the DPF and whether standard data protection clauses are in place. The list of certified companies and further information on the DPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English).

For data transfers to other third countries, corresponding safeguards apply, including international agreements, specific guarantees, standard data protection clauses approved by the FDPIC or binding corporate data protection rules recognised in advance by the FDPIC or by a competent data protection authority of another country.

General information on data retention and deletion

We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consents are withdrawn or there are no further legal bases for the processing. This concerns cases in which the original purpose of processing no longer applies or the data is no longer required. Exceptions to this rule exist where statutory obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for the pursuit of legal claims or for the protection of the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing operations.

Where there are several statements on the retention period or deletion periods for an item of data, the longest period always prevails. Data that is no longer retained for its originally intended purpose but due to legal requirements or other reasons is processed by us exclusively for the reasons that justify its retention.

Retention and deletion of data: The following general periods apply to retention and archiving under German law:

• 10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheet and the working instructions and other organisational documents required to understand them (Section 147 (1) No. 1 in conjunction with (3) AO, Section 257 (1) No. 1 in conjunction with (4) HGB).
• 8 years - Accounting vouchers, such as invoices and expense receipts (Section 147 (1) No. 4 and 4a in conjunction with (3) sentence 1 AO, Section 14b (1) UStG and Section 257 (1) No. 4 in conjunction with (4) HGB).
• 6 years - Other business documents: received commercial or business letters, copies of sent commercial or business letters, other documents insofar as they are relevant for taxation, e.g. hourly wage slips, cost accounting sheets, calculation documents, price labels, but also payroll documents insofar as they are not already accounting vouchers, and till receipts (Section 147 (1) No. 2, 3, 5 in conjunction with (3) AO, Section 257 (1) No. 2 and 3 in conjunction with (4) HGB).
• 3 years - Data required to take into account potential warranty and damage claims or similar contractual claims and rights and to process related requests, based on previous business experience and customary industry practice, is stored for the duration of the regular statutory limitation period of three years (Sections 195, 199 BGB).

Retention and deletion of data: The following general periods apply to retention and archiving under Swiss law:

• 10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting vouchers and invoices, and all necessary working instructions and other organisational documents (Art. 958f of the Swiss Code of Obligations (CO)).
• 10 years - Data necessary to take into account potential claims for damages or similar contractual claims and rights, and to process related requests, based on previous business experience and customary industry practice, is stored for the period of the statutory limitation period of ten years, unless a shorter period of five years is relevant, which applies in certain cases (Art. 127, 130 CO). Claims for rent, lease and capital interest and other periodic payments, for the supply of food, for board and for innkeepers' debts, as well as for craftwork, the retail sale of goods, medical care, professional work of lawyers, legal agents, procurators and notaries, and from the employment relationship of employees become time-barred after five years (Art. 128 CO).

Start of the period at the end of the year: If a period does not expressly begin on a specific date and is at least one year long, it automatically begins at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in the course of which data is stored, the event triggering the period is the time at which the termination or other ending of the legal relationship takes effect.

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw consent you have given at any time.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to obtain access to this data as well as further information and a copy of the data in accordance with the legal requirements.
• Right to rectification: In accordance with the legal requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
• Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, in accordance with the legal requirements, to request a restriction of the processing of the data.
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
• Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. The complaint may be lodged in particular with a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

Rights of data subjects under the Swiss FADP:

As a data subject, you have the following rights in accordance with the provisions of the Swiss FADP:

• Right of access: You have the right to request confirmation as to whether personal data concerning you is being processed and to receive the information required for you to assert your rights under this Act and to ensure transparent data processing.
• Right to data release or transfer: You have the right to request the release of the personal data that you have disclosed to us in a commonly used electronic format.
• Right to rectification: You have the right to request the rectification of inaccurate personal data concerning you.
• Right to object, erasure and destruction: You have the right to object to the processing of your data and to request that personal data concerning you be erased or destroyed.

Business services

We process personal data of our contractual and business partners, such as customers, clients, prospective customers, suppliers and other cooperation partners (collectively "contractual partners"), for the initiation, performance and handling of contractual relationships and comparable legal relationships. This also includes pre-contractual measures taken on request and communication in connection with the respective contractual relationship.

The processing serves in particular to fulfil our primary and ancillary contractual obligations. These include the provision of the agreed services, any obligations to update and inform, the handling of warranty claims and other irregularities in performance, the processing of withdrawals, terminations of continuing obligations, reversals and refunds, and the processing of other contract-related declarations and requests. This covers both one-off contracts and ongoing contractual relationships.

In particular, we process master data such as name, address and, where applicable, company, contact data such as email address and telephone number, contract and service data such as subject matter of the contract, contract term, order or transaction number, usage and performance data, payment and billing data as well as communication content and histories. Where necessary, we also process data that is disclosed or transmitted to us in the course of carrying out an order.

In addition, we process the data to protect our rights and to fulfil legal obligations. This includes in particular retention obligations under commercial and tax law, documentation obligations and, where applicable, obligations to provide evidence and accountability obligations. Processing also takes place on the basis of our legitimate interests in proper business management, internal administration, risk management and IT security, and in protecting our business operations and our contractual partners against misuse and threats to data, secrets and other legally protected interests. This may also include the involvement of external service providers such as IT and telecommunications providers, transport and logistics companies, payment service providers, banks, tax and legal advisers or other vicarious agents, insofar as this is necessary for the performance of the contract or to fulfil legal obligations.

Personal data is passed on to third parties only insofar as this is necessary for the performance of the contract, for carrying out pre-contractual measures, for safeguarding legitimate interests or for fulfilling legal obligations. We provide separate information within this privacy policy about any processing that goes beyond this, in particular for marketing purposes.

We inform contractual partners which data is required in the individual case when the data is collected, for example by appropriate marking in online forms or in personal contact.

The data is deleted as soon as it is no longer required for the aforementioned purposes and no statutory retention obligations prevent this. Statutory retention periods, in particular under commercial and tax law, may require longer storage. We delete data transmitted in the context of a specific order after completion of the order and expiry of any retention periods, unless there are further statutory or contractual obligations to store it.

The legal basis for the processing is Art. 6 (1) (b) GDPR for carrying out pre-contractual measures and for the performance of the respective contractual relationship, and Art. 6 (1) (c) GDPR for fulfilling legal obligations. Insofar as the processing is based on legitimate interests, it takes place on the basis of Art. 6 (1) (f) GDPR. Insofar as the processing is based on Art. 6 (1) (f) GDPR, it takes place to safeguard our legitimate interests in a proper and efficient business organisation, the internal administration and documentation of business transactions, the enforcement and defence of legal claims, ensuring IT and data security, the prevention of misuse and fraud, and the economic management and further development of our business operations. These interests consist in particular in ensuring secure and legally compliant business operations and in safeguarding our entrepreneurial capacity to act.

• Processed data types: Master data (e.g. full name, residential address, contact information, customer number, etc.); Payment data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or telephone numbers). Contract data (e.g. subject matter of the contract, term, customer category).
• Special categories of personal data: Health data.
• Data subjects: Service recipients and clients; Prospective customers. Business and contractual partners.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; Communication; Office and organisational procedures; Organisational and administrative procedures. Business processes and management procedures.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR); Legal obligation (Art. 6 (1) sentence 1 (c) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Hospitality, hotel and accommodation services: We process the details of our guests, visitors and prospective customers (collectively referred to as "guests") in order to provide our accommodation services and related services of a tourist or gastronomic nature and to invoice the services provided.
  
  In the course of our engagement, it may be necessary for us to process special categories of data within the meaning of Art. 9 (1) GDPR, in particular information on a person's health or information relating to their religious beliefs. The processing takes place in order to protect the health interests of the visitors (e.g. in the case of information on allergies) or otherwise to meet their physical or mental needs at their request and with their consent.
  
  Where necessary for the performance of the contract or required by law, or where guests have consented or it takes place on the basis of our legitimate interests, we disclose or transmit the guests' data, e.g. to the service providers involved in the performance of our services or to authorities, billing offices and in the area of IT, office or comparable services; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR).

Business processes and procedures

Personal data of service recipients and clients – including customers, clients or, in special cases, principals, patients or business partners as well as other third parties – is processed in the context of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates business processes in areas such as customer management, sales, payment transactions, accounting and project management.

The data collected serves to fulfil contractual obligations and to make operational processes efficient. This includes the handling of business transactions, the management of customer relationships, the optimisation of sales strategies and ensuring internal invoicing and financial processes. In addition, the data supports the safeguarding of the controller's rights and promotes administrative tasks and the organisation of the company.

Personal data may be passed on to third parties if this is necessary to fulfil the aforementioned purposes or legal obligations. The data is deleted after the expiry of statutory retention periods or when the purpose of the processing no longer applies. This also includes data that must be stored for longer due to tax law and statutory obligations to provide evidence.

• Processed data types: Master data (e.g. full name, residential address, contact information, customer number, etc.); Payment data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); Contract data (e.g. subject matter of the contract, term, customer category); Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved). Log data (e.g. log files relating to logins or the retrieval of data or access times.).
• Data subjects: Service recipients and clients; Prospective customers; Business and contractual partners; Communication partners; Third parties; Users (e.g. website visitors, users of online services). Customers.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; Office and organisational procedures; Business processes and management procedures; Communication; Marketing; Sales promotion; Public relations; Financial and payment management. Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)).
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR); Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR). Legal obligation (Art. 6 (1) sentence 1 (c) GDPR).

Further information on processing operations, procedures and services:

• Customer management and customer relationship management (CRM): Procedures required in the context of customer management and customer relationship management (CRM) (e.g. customer acquisition in compliance with data protection requirements, measures to promote customer retention and loyalty, effective customer communication, complaint management and customer service with due regard to data protection, data management and analysis to support the customer relationship, administration of CRM systems, secure account management, customer segmentation and target group formation); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Contact management and contact maintenance: Procedures required in the context of organising, maintaining and securing contact information (e.g. setting up and maintaining a central contact database, regular updates of contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, carrying out backups and restorations of contact data, training employees in the effective use of contact management software, regular review of the communication history and adjustment of contact strategies); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• General payment transactions: Procedures required for carrying out payment transactions, monitoring bank accounts and controlling payment flows (e.g. preparing and checking bank transfers, processing direct debits, checking account statements, monitoring incoming and outgoing payments, managing returned direct debits, account reconciliation, cash management); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Accounting, accounts payable, accounts receivable: Procedures required for recording, processing and controlling business transactions in the area of accounts payable and accounts receivable (e.g. preparing and checking incoming and outgoing invoices, monitoring and managing open items, carrying out payment transactions, handling dunning, account reconciliation in the context of receivables and liabilities, accounts payable and accounts receivable); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Financial accounting and taxes: Procedures required for recording, managing and controlling finance-related business transactions and for calculating, reporting and paying taxes (e.g. account assignment and posting of business transactions, preparation of quarterly and annual financial statements, carrying out payment transactions, handling dunning, account reconciliation, tax advice, preparation and submission of tax returns, handling tax matters); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Marketing, advertising and sales promotion: Procedures required in the context of marketing, advertising and sales promotion (e.g. market analysis and target group definition, development of marketing strategies, planning and execution of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and participation in trade fairs, customer loyalty programmes, sales promotion measures, performance measurement and optimisation of marketing activities, budget management and cost control); Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Economic analyses and market research: In order to fulfil business management purposes and to identify market trends and the wishes of contractual partners and users, the available data on business transactions, contracts, requests, etc. is analysed. The group of data subjects may include contractual partners, prospective customers, customers, visitors and users of the controller's online services. The analyses are carried out for the purposes of business evaluations, marketing and market research (e.g. to determine customer groups with different characteristics). Where available, the profiles of registered users, including their details of the services they have used, are taken into account. The analyses serve the controller exclusively and are not disclosed externally, unless they are anonymous analyses with aggregated, i.e. anonymised, values. In addition, the privacy of users is respected; for analysis purposes, the data is processed in pseudonymised form as far as possible and, where feasible, in anonymised form (e.g. as aggregated data); Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Public relations: Procedures required in the context of public relations work and PR (e.g. development and implementation of communication strategies, planning and execution of PR campaigns, preparation and distribution of press releases, maintenance of media contacts, monitoring and analysis of media response, organisation of press conferences and public events, crisis communication, creation of content for social media and corporate websites, management of corporate branding); Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Use of online platforms for offering and selling our services

We offer our services on online platforms operated by other service providers. In this context, the privacy notices of the respective platforms apply in addition to our privacy notices. This applies in particular with regard to the processing of payments and the procedures used on the platforms for reach measurement and interest-based marketing.

• Processed data types: Master data (e.g. full name, residential address, contact information, customer number, etc.); Payment data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or telephone numbers); Contract data (e.g. subject matter of the contract, term, customer category); Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features). Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved).
• Data subjects: Service recipients and clients; Business and contractual partners. Prospective customers.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; Marketing; Business processes and management procedures; Conversion tracking (measuring the effectiveness of marketing measures). Provision of our online services and usability.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Booking.com: Brokering and booking of accommodation; management of reservations; communication with guests; Service provider: Booking.com B.V., Herengracht 597, 1017 CE Amsterdam, Netherlands; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.booking.com. Privacy policy: https://www.booking.com/content/privacy.de.html.
• AirBnB: Rental and booking of accommodation, experiences and discoveries; management of reservations; communication between hosts and guests; payment processing; Service provider: Airbnb Ireland UC, 8 Hanover Quay, D02 DP23 Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.airbnb.de. Privacy policy: https://www.airbnb.de/help/article/2855/datenschutzerklärung.
• Expedia: Brokering and booking of accommodation; management of reservations; communication with guests; Service provider: Expedia, Inc., 1111 Expedia Group Way W, Seattle, WA 98119, USA; representative in the EU: EG Vacation Rentals Ireland Limited, 53 Merrion Square South, Suite 303, Dublin 2, D02 PR63, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.expedia.de. Privacy policy: https://www.expedia.de/legal/privacy. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).
• HRS: Brokering and booking of accommodation; management of reservations; communication with guests; Service provider: HRS GmbH, Breslauer Platz 4, 50668 Köln, Germany; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.hrs.de. Privacy policy: https://www.hrs.com/en/privacypolicy.
• SilverDoor: Brokering of serviced apartments and accommodation for business travellers and corporate clients; management of reservations; communication with guests; Service provider: SilverDoor Limited, Building 7, Chiswick Park, 566 Chiswick High Road, London W4 5YG, United Kingdom; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.silverdoor.com. Privacy policy: https://www.silverdoor.com/policies/privacy. Basis for third-country transfers: United Kingdom - adequacy decision of the EU Commission.

Providers and services used in the course of our business

In the course of our business, we use additional services, platforms, interfaces or plug-ins from third-party providers ("services" for short) in compliance with the legal requirements. Their use is based on our interests in the proper, lawful and economic management of our business operations and our internal organisation.

• Processed data types: Master data (e.g. full name, residential address, contact information, customer number, etc.); Payment data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); Contract data (e.g. subject matter of the contract, term, customer category); Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features). Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved).
• Data subjects: Service recipients and clients; Prospective customers; Business and contractual partners; Employees (e.g. salaried staff, applicants, temporary workers and other personnel); Communication partners; Users (e.g. website visitors, users of online services). Third parties.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; Office and organisational procedures; Business processes and management procedures; Organisational and administrative procedures; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); Reach measurement (e.g. access statistics, recognition of returning visitors); Tracking (e.g. interest/behaviour-based profiling, use of cookies); Conversion tracking (measuring the effectiveness of marketing measures); Target group formation; Marketing; Profiles with user-related information (creating user profiles); Provision of our online services and usability. Artificial intelligence (AI).
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR). Consent (Art. 6 (1) sentence 1 (a) GDPR).

Further information on processing operations, procedures and services:

• DATEV: Provision of cloud applications for accounting, payroll, document and data exchange and collaboration with tax advisers and companies. Processing, storage and transmission of data in data centres (servers) for the use of the respective applications; Service provider: DATEV eG, Paumgartnerstr. 6 - 14, 90429 Nürnberg, Germany; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.datev.de/web/de/mydatev/datev-cloud-anwendungen/; Privacy policy: https://www.datev.de/web/de/berufsgruppenuebergreifend/ueber-datev/datenschutz-und-compliance/datenschutz-und-unternehmenssicherheit. Data processing agreement: Provided by the service provider.
• Hotelpartner (booking engine): Online booking system through which guests book accommodation with us. Bookings are made via Hotelpartner's system, not directly on our website. In particular, master data, contact data and contract data (booking data) are processed. Processing is carried out on our behalf on the basis of a data processing agreement (Art. 28 GDPR); Service provider: Hotelpartner Deutschland GmbH, Steinstraße 27, 20095 Hamburg, Germany; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://hotelpartner.com/de/. Privacy policy: https://hotelpartner.com/de/datenschutzerklaerung/.
• SoftTec (hotel software "Hotline"): Hotel management software for managing reservations, guest data and invoices. The software runs on a computer belonging to SoftTec GmbH, which we access remotely. According to the provider, the data is hosted exclusively in European data centres. We also send payment links via Adyen from the hotel software (see section "Payment procedures"). Processing is carried out on our behalf on the basis of a data processing agreement (Art. 28 GDPR); Service provider: SoftTec GmbH, Hindelanger Straße 35, 87527 Sonthofen, Germany; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://softtec.de/. Privacy policy: https://softtec.de/datenschutz/.
• Microsoft 365 Outlook: Use of email and calendar functions for communication and the organisation of meetings. Contact data (name, email address), content data (messages, attachments, meeting content) and metadata are processed for the purposes of, and out of an interest in, increased efficiency and productivity, cost efficiency, flexibility, mobility, improved communication and integration with M365. The retention of emails and calendar entries is governed by the policies set by the administrator or users; by default, there is no automatic deletion. Mailboxes and calendars are generally removed 30 days after the user leaves. In addition, diagnostic data on product stability and improvement is collected; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.microsoft.com/; Privacy policy: https://privacy.microsoft.com/de-de/privacystatement, Security information: https://www.microsoft.com/de-de/trustcenter; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
• Microsoft Sharepoint: Support for collaboration through storage and access management for documents, spreadsheets, presentations, etc. Content data (files) and contact data (name, email address) are processed for the purposes of, and out of an interest in, increased efficiency and productivity, cost efficiency, flexibility, mobility, integration with M365 and improved collaboration. Retention depends on the business function of the content; SharePoint sites must be renewed every 180 days, otherwise content is deleted. In addition, diagnostic data on product stability and improvement is collected; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.microsoft.com/; Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
• Microsoft EU Data Boundary: Our use of Microsoft cloud services takes place within the framework of the so-called "EU Data Boundary" (in German also referred to as "EU-Datengrenze"), which ensures that data is stored and processed within the European Union (EU) and the European Free Trade Association (EFTA).
  
  The EU Data Boundary is a defined region in which Microsoft undertakes to store and process customer data and personal data for certain online services (Microsoft 365, Azure, Dynamics 365 and the Power Platform). Companies that use these services can ensure that their data remains within the EU/EFTA region. This includes both general customer data and support data generated in the course of technical services. In many cases, pseudonymised data is also processed within this region.
  
  The EU Data Boundary covers all EU countries as well as the EFTA states (Liechtenstein, Iceland, Norway and Switzerland). Microsoft operates data centres in several of these countries, including Germany, France, Ireland, the Netherlands, Sweden, Spain and Switzerland. Further locations may be added.
  
  In the course of its operations, Microsoft automatically creates logs to ensure the security and functionality of its services. These logs mainly contain technical information, but in certain cases may also include personal data, e.g. when user actions are documented.
  
  To protect this data, Microsoft uses techniques such as encryption, masking and tokenisation (replacement of sensitive data with untraceable character strings). This ensures that Microsoft employees only see pseudonymised data and cannot draw any direct conclusions about individual users. In addition, there are strict access rules and deletion periods for this data.
  
  Microsoft has given assurances that data transfers outside the EU only take place in a few, precisely defined cases. This may be necessary, e.g., to implement global cybersecurity measures or to ensure the functionality of the cloud services. These transfers always take place under high security standards such as encryption and pseudonymisation.
  
  Further information on the EU Data Boundary and Microsoft's data protection measures can be found in the Microsoft EU Data Boundary Trust Center: https://www.microsoft.com/de-de/trust-center/privacy/european-data-boundary-eudb.
• Microsoft Advertising: Online marketing procedures for the purpose of placing content and advertisements within the service provider's advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who are presumed to be interested in the advertisements. In addition, we measure the conversion of the advertisements, i.e. whether users have taken them as an occasion to interact with the advertisements and to use the advertised offers (so-called conversion). However, we only receive anonymous information and no personal information about individual users; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://about.ads.microsoft.com/; Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF). Opt-out: https://account.microsoft.com/privacy/ad-settings/.
• Claude API: AI-powered service designed to understand and generate natural language and related inputs, to analyse information and to make predictions ("AI", i.e. "artificial intelligence", is to be understood in the legal sense of the term applicable in each case). The provision of the AI services comprises the processing (including collection, storage, organisation and structuring) of personal data as part of a machine learning process based on natural language; the performance of measures to review and maintain the quality of the services; the identification and rectification of errors that may impair the intended functionality, as well as support in ensuring the security and integrity of the AI services; Service provider: Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.anthropic.com/; Privacy policy: https://www.anthropic.com/legal/privacy; Data processing agreement: https://www.anthropic.com/legal/data-processing-addendum. Basis for third-country transfers: EU/EEA - Standard Contractual Clauses (https://www.anthropic.com/legal/data-processing-addendum), Switzerland - Standard Contractual Clauses (https://www.anthropic.com/legal/data-processing-addendum).

Payment procedures

In the context of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and, for this purpose, use other service providers in addition to banks and credit institutions (collectively "payment service providers"). Payments are processed exclusively via encrypted connections in accordance with the state of the art, so that the data entered is protected against unauthorised access during transmission.

The data processed by the payment service providers includes master data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, amount and recipient-related information. This information is required to carry out the transactions. However, the data entered is only processed by the payment service providers and stored with them. That is, we do not receive any account or credit card-related information, but only information confirming or declining the payment. Under certain circumstances, the payment service providers may transmit the data to credit reference agencies. The purpose of this transmission is to check identity and creditworthiness. In this regard, we refer to the terms and conditions and the privacy notices of the payment service providers.

The payment transactions are subject to the terms and conditions and the privacy notices of the respective payment service providers, which can be accessed on the respective websites or transaction applications. We also refer to these for further information and for asserting rights of withdrawal, rights of access and other data subject rights.

• Processed data types: Master data (e.g. full name, residential address, contact information, customer number, etc.); Payment data (e.g. bank details, invoices, payment history); Contract data (e.g. subject matter of the contract, term, customer category); Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved). Contact data (e.g. postal and email addresses or telephone numbers).
• Data subjects: Service recipients and clients; Business and contractual partners. Prospective customers.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations. Business processes and management procedures.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Stripe: Payment services (technical integration of online payment methods). We use Stripe to send guests a payment link before arrival. The link is created via Stripe's online portal; Service provider: Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR); Website: https://stripe.com; Privacy policy: https://stripe.com/de/privacy. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).
• Adyen: Payment services (technical integration of online payment methods). We use Adyen to send guests a payment link before arrival. The link is created from our hotel software "Hotline" by SoftTec GmbH; Service provider: Adyen N.V., PO Box 10095, 1001 EB Amsterdam, Netherlands; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR); Website: https://www.adyen.com/de_DE. Privacy policy: https://www.adyen.com/de_DE/richtlinien-und-haftungsausschluss/privacy-policy.

Provision of online services and web hosting

We process users' data in order to be able to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

• Processed data types: Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved); Log data (e.g. log files relating to logins or the retrieval of data or access times.). Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of our online services and usability; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); Security measures; Content Delivery Network (CDN); Provision of contractual services and fulfilment of contractual obligations. Establishment and performance of employment relationships (processing of employee data in the context of the establishment and performance of employment relationships).
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Provision of online services on rented storage space: To provide our online services, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also referred to as a "web host"); Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Collection of access data and log files: Access to our online services is logged in the form of so-called "server log files". Server log files may include the address and name of the web pages and files accessed, the date and time of access, the volumes of data transferred, notification of successful retrieval, browser type and version, the user's operating system, the referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files can be used, on the one hand, for security purposes, e.g. to prevent the servers from being overloaded (in particular in the event of abusive attacks, so-called DDoS attacks), and, on the other hand, to ensure the utilisation and stability of the servers; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further retention is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
• Email sending and hosting: The web hosting services we use also include the sending, receipt and storage of emails. For these purposes, the addresses of the recipients and senders as well as further information relating to the sending of emails (e.g. the providers involved) and the contents of the respective emails are processed. The aforementioned data may also be processed for the purpose of detecting SPAM. Please note that emails on the internet are generally not sent in encrypted form. As a rule, emails are encrypted in transit, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and on which they are received. We therefore cannot accept any responsibility for the transmission path of emails between the sender and their receipt on our server; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Hetzner: Services in the field of the provision of information technology infrastructure and related services (e.g. storage space and/or computing capacity); Service provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.hetzner.com; Privacy policy: https://docs.hetzner.com/de/general/company-and-policy/data-protection-at-hetzner. Data processing agreement: https://docs.hetzner.com/de/general/company-and-policy/data-protection-at-hetzner.
• Backups: We back up the database of our website (requests and contact messages) every night. We additionally store the backups in encrypted form with Hetzner outside the server and delete them after 30 days. Deleted data may therefore remain in a backup for up to 30 days; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• IONOS: Provision and management of domains (internet addresses), web hosting (storage space for websites), email services, SSL certificates (encryption of data transmission), cloud servers (virtual computing resources) and tools for website and server administration; Service provider: IONOS SE, Elgendorfer Str. 57 56410 Montabaur, Germany; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.ionos.de; Privacy policy: https://www.ionos.de/datenschutzerklaerung. Data processing agreement: https://www.ionos.de/hilfe/datenschutz/allgemeine-informationen-zur-datenschutz-grundverordnung-dsgvo/vereinbarung-zur-auftragsverarbeitung-avv-mit-ionos-abschliessen/.
• Cloudflare CDN: A service for delivering and securing web content, through which operators can deliver their content via a globally distributed network (content delivery network). For this purpose, customers forward web requests to Cloudflare so that websites, web resources (e.g. files) and network functions are processed or provided on behalf of the operator. In particular, IP addresses, times of access, URL/resource details, information about the device or browser as well as log data and other technical metadata may be processed, insofar as they are necessary for delivery, error diagnosis, security and the detection of misuse. Depending on the configuration, configuration and status data for security functions (e.g. access and protection rules) may also be included. The service is typically used by configuring the operator's DNS or web server integrations, so that Cloudflare acts as an intermediary between the end user and the origin server; Service provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.cloudflare.com; Privacy policy: https://www.cloudflare.com/privacypolicy/; Data processing agreement: https://www.cloudflare.com/cloudflare-customer-dpa/. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.cloudflare.com/cloudflare-customer-scc/), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.cloudflare.com/cloudflare-customer-scc/).
• Google Search Console: Monitoring of website performance, analysis of search queries, detection of indexing problems, provision of data on visibility in search results, checking of mobile usability, identification of security problems and management of sitemaps; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://search.google.com/search-console/about; Privacy policy: https://business.safety.google/privacy/. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).

Use of cookies

The term "cookies" refers to functions that store information on users' devices and read it from them. Cookies can also be used for various purposes, such as the functionality, security and convenience of online services and the analysis of visitor flows. We use cookies in accordance with the statutory provisions. To this end, we obtain users' consent in advance where necessary. If consent is not necessary, we rely on our legitimate interests. This applies if storing and reading information is essential in order to be able to provide expressly requested content and functions. This includes, for example, saving settings and ensuring the functionality and security of our online services. Consent can be withdrawn at any time. We provide clear information about its scope and which cookies are used.

Notes on legal bases under data protection law: Whether we process personal data using cookies depends on consent. If consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage duration: With regard to the storage duration, a distinction is made between the following types of cookies:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their device (e.g. browser or mobile application).
• Permanent cookies: Permanent cookies remain stored even after the device has been closed. For example, the login status can be saved and preferred content displayed directly when the user visits a website again. Likewise, the user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information on the type and storage duration of cookies (e.g. when obtaining consent), they should assume that these are permanent and that the storage period can be up to two years.

General information on withdrawal and objection (opt-out): Users can withdraw the consents they have given at any time and also object to the processing in accordance with the legal requirements, including by means of the privacy settings of their browser.

• Processed data types: Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved). Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of our online services and usability.
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR). Consent (Art. 6 (1) sentence 1 (a) GDPR).

Further information on processing operations, procedures and services:

• Processing of cookie data on the basis of consent: We use a consent management solution through which users' consent to the use of cookies, or to the procedures and providers named within the consent management solution, is obtained. This procedure serves to obtain, log, manage and withdraw consents, in particular with regard to the use of cookies and comparable technologies used to store, read and process information on users' devices. As part of this procedure, users' consents to the use of cookies and the associated processing of information, including the specific processing operations and providers named in the consent management procedure, are obtained. Users also have the option of managing and withdrawing their consents. The declarations of consent are stored in order to avoid asking again and to be able to provide proof of consent in accordance with the legal requirements. Storage takes place on the server side and/or in a cookie (so-called opt-in cookie) or by means of comparable technologies in order to be able to assign the consent to a specific user or their device. Unless specific information on the providers of consent management services is available, the following general information applies: consent is stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of consent (e.g. relevant categories of cookies and/or service providers) and information about the browser, the system and the device used; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR).
• Cookie opt-out: In the footer of our website you will find a link through which you can change your cookie settings and withdraw the corresponding consents.

Contact and request management

When you contact us (e.g. by post, contact form, email, telephone or via social media) and in the context of existing user and business relationships, the information provided by the persons making the enquiry is processed insofar as this is necessary to respond to the contact enquiries and any measures requested.

• Processed data types: Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation). Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Communication; Organisational and administrative procedures; Feedback (e.g. collecting feedback via an online form). Provision of our online services and usability.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR). Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR).

Further information on processing operations, procedures and services:

• Contact form: When you contact us via our contact form, by email or by other means of communication, we process the personal data transmitted to us in order to respond to and deal with your request. This generally includes information such as name, contact information and, where applicable, other information that is communicated to us and is necessary for appropriate processing. We use this data exclusively for the stated purpose of making contact and communicating; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Request form and offer: If you send us a booking request via the request form, we process your details in order to handle the request and to send you an offer by email. Mandatory details are the travel dates, apartment type, last name and email address; all other details are optional. We delete the request after 6 months, or after 12 months once we have sent you an offer. If a booking is made, we keep the documents for 6 years from the end of the calendar year of the booking (Section 257 HGB). We delete messages sent via the contact form after 6 months; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR).
• Optional information "How did you hear about us?": In our request form, you can optionally state how you heard about us. This information is not required to process your request. If you leave the field blank, this has no disadvantages for you. We only use your answer to evaluate the channels through which guests find us, and we align our advertising measures accordingly. For the evaluation, we combine the answers statistically, without reference to you personally. We use the information neither for advertising to you nor for user profiles. We store the information together with your request and delete it together with your request (see section "General information on data retention and deletion"). The aggregated statistics do not contain any personal data. You can object to the processing of this information at any time under Art. 21 GDPR, for example by email to the address given in the section "Controller". We will then delete the information. Our legitimate interest consists in assessing the effectiveness of our advertising channels; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Communication via messenger

We use messengers for communication purposes and therefore ask you to observe the following information on the functionality of the messengers, on encryption, on the use of the metadata of the communication and on your options to object.

You can also contact us by alternative means, e.g. by telephone or email. Please use the contact options provided to you or the contact options stated within our online services.

In the case of end-to-end encryption of content (i.e. the content of your message and attachments), we point out that the communication content (i.e. the content of the message and attached images) is encrypted end to end. This means that the content of the messages cannot be viewed, not even by the messenger providers themselves. You should always use an up-to-date version of the messengers with encryption enabled to ensure that the message content is encrypted.

However, we additionally point out to our communication partners that, although the messenger providers cannot view the content, they can find out that and when communication partners communicate with us, and that technical information about the device used by the communication partners and, depending on the settings of their device, also location information (so-called metadata) is processed.

Notes on legal bases: If we ask communication partners for permission before communicating with them via messenger, the legal basis for our processing of their data is their consent. Otherwise, if we do not ask for consent and they, for example, contact us on their own initiative, we use messengers in relation to our contractual partners and in the context of initiating contracts as a contractual measure and, in the case of other prospective customers and communication partners, on the basis of our legitimate interests in fast and efficient communication and in meeting our communication partners' needs for communication via messenger. Furthermore, we point out that we do not transmit the contact data provided to us to the messengers for the first time without your consent.

Withdrawal, objection and deletion: You can withdraw any consent given at any time and object to communication with us via messenger at any time. In the case of communication via messenger, we delete the messages in accordance with our general deletion policies (i.e., e.g., as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise as soon as we can assume that we have answered any enquiries from the communication partners, if no reference back to a previous conversation is to be expected and the deletion does not conflict with any statutory retention obligations.

Reservation regarding referral to other communication channels: To ensure your security, we ask for your understanding that, for certain reasons, we may not be able to answer enquiries via messenger. This applies to situations in which, for example, contract details must be treated with particular confidentiality or a reply via messenger does not meet the formal requirements. In these cases, we recommend that you use more suitable communication channels.

• Processed data types: Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features). Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Communication.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• WhatsApp Business: We use the app "WhatsApp Business" on a mobile phone. WhatsApp is a communication service that enables the sending and receiving of text messages, voice messages, images, videos and documents as well as voice and video calls via the internet. Communication is end-to-end encrypted, which means that content is only accessible to the communication partners involved. To provide the service, the platform processes metadata (e.g. telephone numbers, times, device information) and may use it to improve functionality, for security and to optimise its services; Service provider: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.whatsapp.com/. Privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea.

Artificial intelligence (AI)

We use artificial intelligence (AI), in the course of which personal data is processed. The specific purposes and our interest in using AI are stated below. In line with the term "AI system" within the meaning of Article 3 No. 1 of the AI Act, we understand AI to mean a machine-based system that is designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that, from the input it receives, generates outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

Our AI systems are used in strict compliance with the statutory requirements. These include both specific regulations on artificial intelligence and data protection requirements. In doing so, we observe in particular the principles of lawfulness, transparency, fairness, human control, purpose limitation, data minimisation and integrity as well as confidentiality. We ensure that personal data is always processed on a legal basis. This can be either the consent of the data subjects or a statutory permission.

When using external AI systems, we carefully select their providers (hereinafter "AI providers"). In accordance with our legal obligations, we ensure that the AI providers comply with the applicable provisions. We likewise observe the obligations incumbent on us when using or operating the AI services we obtain. The processing of personal data by us and the AI providers takes place exclusively on the basis of consent or statutory authorisation. In doing so, we attach particular importance to transparency, fairness and maintaining human control over AI-supported decision-making processes.

To protect the processed data, we implement appropriate and robust technical and organisational measures. These ensure the integrity and confidentiality of the processed data and minimise potential risks. By regularly reviewing the AI providers and their services, we ensure ongoing compliance with current legal and ethical standards.

• Processed data types: Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation). Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features).
• Data subjects: Users (e.g. website visitors, users of online services). Third parties.
• Purposes of processing and legitimate interests: Artificial intelligence (AI).
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Claude API: AI-supported service designed to understand and generate natural language and related inputs, to analyse information and to make predictions ("AI", i.e. "artificial intelligence", is to be understood in the legal sense of the term applicable in each case). The provision of the AI services comprises the processing (including collection, storage, organisation and structuring) of personal data in the context of a machine learning procedure based on natural language; the performance of measures to review and maintain the quality of the services; the identification and remediation of errors that may impair the intended functionality, as well as support in ensuring the security and integrity of the AI services; Service provider: Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.anthropic.com/; Privacy policy: https://www.anthropic.com/legal/privacy; Data processing agreement: https://www.anthropic.com/legal/data-processing-addendum. Basis for third-country transfers: EU/EEA - Standard Contractual Clauses (https://www.anthropic.com/legal/data-processing-addendum), Switzerland - Standard Contractual Clauses (https://www.anthropic.com/legal/data-processing-addendum).

Video conferences, online meetings, webinars and screen sharing

We use platforms and applications of other providers (hereinafter referred to as "conference platforms") for the purpose of holding video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as "conference"). When selecting the conference platforms and their services, we observe the statutory requirements.

Data processed by conference platforms: In the course of participation in a conference, the conference platforms process the personal data of the participants listed below. The scope of the processing depends, on the one hand, on which data is required in the context of a specific conference (e.g. provision of access data or real names) and which optional information is provided by the participants. In addition to processing for the purpose of holding the conference, the participants' data may also be processed by the conference platforms for security purposes or service optimisation. The data processed includes personal details (first name, surname), contact information (email address, telephone number), access data (access codes or passwords), profile pictures, information on professional position/function, the IP address of the internet access, information on the participants' end devices, their operating system, the browser and its technical and language settings, information on the content-related communication processes, i.e. entries in chats as well as audio and video data, as well as the use of other available functions (e.g. surveys). The content of communications is encrypted to the extent technically provided by the conference providers. If the participants are registered as users with the conference platforms, further data may be processed in accordance with the agreement with the respective conference provider.

Logging and recordings: If text entries, participation results (e.g. from surveys) or video or audio recordings are logged, this will be communicated transparently to the participants in advance and they will – where necessary – be asked for their consent.

Data protection measures of the participants: For details of the processing of your data by the conference platforms, please refer to their privacy notices and, within the settings of the conference platforms, choose the security and data protection settings that are optimal for you. Furthermore, for the duration of a video conference, please ensure data and privacy protection in the background of your recording (e.g. by informing housemates, locking doors and using, where technically possible, the function for blurring the background). Links to the conference rooms as well as access data must not be passed on to unauthorised third parties.

Notes on legal bases: If, in addition to the conference platforms, we also process the users' data and ask the users for their consent to the use of the conference platforms or certain functions (e.g. consent to the recording of conferences), the legal basis of the processing is this consent. Furthermore, our processing may be necessary for the fulfilment of our contractual obligations (e.g. in participant lists, in the case of follow-up work on the results of discussions, etc.). Otherwise, users' data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

• Processed data types: Master data (e.g. full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features); Image and/or video recordings (e.g. photographs or video recordings of a person); Audio recordings; Log data (e.g. log files relating to logins or the retrieval of data or access times.); Contract data (e.g. subject matter of the contract, term, customer category). Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved).
• Data subjects: Communication partners; Users (e.g. website visitors, users of online services); Persons depicted; Service recipients and clients; Prospective customers. Participants.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; Communication; Office and organisational procedures. Provision of our online services and usability.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Microsoft Teams: Used for holding online events and conferences and for communication with internal and external participants. Voice transmission, direct messages, group communication and collaboration functions are used; name, business contact data, work profile, participation and content (audio/video, voice, chat, files, speech transcription) are processed for the purposes of and out of interest in increasing efficiency and productivity, cost efficiency, flexibility, mobility, improved communication, IT security, the use of a central platform and Microsoft's business operations. Audio signals are generally not stored unless recording is activated. Meeting and conference recordings are stored for 90 days by default unless a different period is specified. Chat and file content is stored in accordance with the policies determined by the administrator or user; by default, there is no automatic deletion. Channels must be renewed every 180 days, otherwise content is deleted. In addition, system-generated log, diagnostic and metadata are processed and diagnostic data is collected for product stability, security and improvement; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.microsoft.com/de-de/microsoft-teams/; Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
• TeamViewer: Conference and communication software; Service provider: TeamViewer GmbH, Jahnstr. 30, 73037 Göppingen, Germany; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.teamviewer.com/de/. Privacy policy: https://www.teamviewer.com/de/legal/privacy-and-cookies/.

Cloud services

We use software services that are accessible via the internet and run on their providers' servers (so-called "cloud services", also referred to as "Software as a Service") for the storage and management of content (e.g. document storage and management, exchange of documents, content and information with specific recipients or publication of content and information).

In this context, personal data may be processed and stored on the providers' servers insofar as it forms part of communication processes with us or is otherwise processed by us as set out in this privacy policy. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes and their content. The providers of the cloud services also process usage data and metadata, which they use for security purposes and for service optimisation.

If we use the cloud services to provide forms or other documents and content for other users or publicly accessible websites, the providers may store cookies on users' devices for the purposes of web analytics or to remember users' settings (e.g. in the case of media control).

• Processed data types: Master data (e.g. full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation). Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features).
• Data subjects: Prospective customers; Communication partners. Business and contractual partners.
• Purposes of processing and legitimate interests: Office and organisational procedures. Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)).
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Microsoft 365 and Microsoft cloud services: Provision of applications, protection of data and IT systems and use of system-generated log, diagnostic and metadata by Microsoft for the performance of the contract. Contact data (name, email address), content data (files, comments, profiles), software setup and inventory data, device connectivity and configuration data, work interactions (badge swipe) as well as log and metadata are processed. The processing takes place for the purposes of increasing efficiency and productivity, cost efficiency, flexibility, mobility, improved communication, integration of Microsoft services, IT security and Microsoft's business operations. The retention of data depends on the respective documents and company policies; for Defender (protection of data and IT systems) up to 12 months, for print management 10 days. In addition, diagnostic data is collected for product stability and improvement; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.microsoft.com/de-de; Privacy policy: https://privacy.microsoft.com/de-de/privacystatement, Security information: https://www.microsoft.com/de-de/trustcenter; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).

Web analytics, monitoring and optimisation

Web analytics (also referred to as "reach measurement") serves to evaluate the flow of visitors to our online services and may include behaviour, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognise at what time our online services or their functions or content are used most frequently, or invite users to use them again. It also enables us to understand which areas require optimisation.

In addition to web analytics, we may also use testing procedures, for example to test and optimise different versions of our online services or their components.

Unless otherwise stated below, profiles, i.e. data combined into a usage session, may be created for these purposes and information may be stored in a browser or on an end device and then read out. The information collected includes, in particular, websites visited and elements used there as well as technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data by us or by the providers of the services we use, the processing of location data is also possible.

In addition, the IP addresses of users are stored. However, we use an IP masking procedure (i.e. pseudonymisation by shortening the IP address) to protect users. In general, no directly identifying user data (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimisation, but rather pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the data processing is consent. Otherwise, users' data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

• Processed data types: Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features). Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Reach measurement (e.g. access statistics, recognition of returning visitors); Profiles with user-related information (creating user profiles); Tracking (e.g. interest/behaviour-based profiling, use of cookies); Conversion tracking (measuring the effectiveness of marketing measures); Target group formation; Marketing; Provision of our online services and usability. Remarketing.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion". Storage of cookies for up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years).
• Security measures: IP masking (pseudonymisation of the IP address).
• Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• IONOS WebAnalytics: Collection and evaluation of visitor numbers, analysis of page views (how often a page is visited), identification of traffic sources (e.g. search engine or direct access), storage of anonymised usage data, creation of aggregated reports on website usage; Service provider: IONOS SE, Elgendorfer Str. 57 56410 Montabaur, Germany; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://www.ionos.de; Privacy policy: https://www.ionos.de/datenschutzerklaerung; Data processing agreement: https://www.ionos.de/hilfe/datenschutz/allgemeine-informationen-zur-datenschutz-grundverordnung-dsgvo/vereinbarung-zur-auftragsverarbeitung-avv-mit-ionos-abschliessen/; Further information: The data is collected either by a pixel or by a log file, without the use of cookies; the IP address of visitors is transmitted when a page request is transmitted, anonymised immediately after transmission and processed further without reference to a person. The processing of the data takes place on the basis of a data processing agreement.
• Google Analytics: We use Google Analytics to measure and analyse the use of our online services on the basis of a pseudonymous user identification number. This identification number does not contain any unique data such as names or email addresses. It serves to assign analysis information to an end device in order to recognise which content users have accessed within one or various usage sessions, which search terms they have used, whether they have accessed them again or have interacted with our online services. The time of use and its duration are also stored, as well as the sources of users referring to our online services and technical aspects of their end devices and browsers.
  In the process, pseudonymous profiles of users are created with information from the use of various devices, whereby cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides coarse geographical location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). For EU traffic, the IP address data is used exclusively for this derivation of geolocation data before being deleted immediately. It is not logged, is not accessible and is not used for any further purposes. When Google Analytics collects measurement data, all IP lookups are performed on EU-based servers before the traffic is forwarded to Analytics servers for processing; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymisation of the IP address); Privacy policy: https://business.safety.google/privacy/; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses ( https://business.safety.google/adsprocessorterms); Opt-out: Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of advertisements: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (types of processing and of the data processed).
• Google Tag Manager: We use Google Tag Manager, software from Google that enables us to manage so-called website tags centrally via a user interface. Tags are small code elements on our website that serve to record and analyse visitor activities. This technology helps us to improve our website and the content offered on it. Google Tag Manager itself does not create user profiles, does not store cookies with user profiles and does not carry out any independent analyses. Its function is limited to simplifying the integration and management of tools and services that we use on our website and making them more efficient. Nevertheless, when Google Tag Manager is used, the users' IP address is transmitted to Google, which is necessary for technical reasons in order to implement the services we use. Cookies may also be set in the process. However, this data processing only takes place if services are integrated via the Tag Manager. For more detailed information on these services and their data processing, please refer to the further sections of this privacy policy; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://business.safety.google/privacy/; Data processing agreement:
  https://business.safety.google/adsprocessorterms. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses ( https://business.safety.google/adsprocessorterms).
• Google Tag Manager (server-side use): Google Tag Manager is an application with which we can manage so-called website tags via an interface and thus integrate other services into our online services (see also the further information in this privacy policy). With the Tag Manager itself (which implements the tags), therefore, neither user profiles nor cookies are stored. The other services are integrated on the server side. This means that the users' data is not transmitted directly from their end device to the respective service or to Google. In particular, the users' IP address is not transmitted to the other service. Instead, the data is first transmitted to our server, where the users' data records are assigned to our internal user identification number. The subsequent transmission of the data from our server to the servers of the respective service providers takes place only in this pseudonymised form. The user identification number does not contain any unique data such as names or email addresses; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://business.safety.google/privacy/; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms//), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses ( https://business.safety.google/adsprocessorterms//). Further information: https://business.safety.google/adsservices/ (types of processing and of the data processed).

Online marketing

We process personal data for the purpose of online marketing, which may include in particular the marketing of advertising space or the display of promotional and other content (collectively referred to as "content") based on the potential interests of users, as well as the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (the so-called "cookie"), or similar procedures are used by means of which the information about the user that is relevant for the display of the aforementioned content is stored. This information may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information, such as the browser used, the computer system used and information on usage times and functions used. If users have consented to the collection of their location data, this data may also be processed.

In addition, the IP addresses of users are stored. However, we use available IP masking procedures (i.e. pseudonymisation by shortening the IP address) to protect users. In general, no directly identifying user data (such as email addresses or names) is stored in the context of the online marketing procedure, but pseudonyms. This means that neither we nor the providers of the online marketing procedures know the actual identity of the users, but only the information stored in their profiles.

As a rule, the information in the profiles is stored in the cookies or by means of similar procedures. These cookies can later generally also be read on other websites that use the same online marketing procedure, analysed for the purpose of displaying content, supplemented with further data and stored on the server of the online marketing procedure provider.

Exceptionally, it is possible to assign directly identifying data to the profiles, primarily when users are, for example, members of a social network whose online marketing procedures we use and the network links the user profiles with the aforementioned information. Please note that users may make additional agreements with the providers, for example by giving consent as part of the registration.

As a matter of principle, we only receive access to summarised information about the success of our advertisements. However, within the framework of so-called conversion measurements, we can check which of our online marketing procedures have led to a so-called conversion, i.e., for example, to the conclusion of a contract with us. Conversion measurement is used solely to analyse the success of our marketing measures.

Unless otherwise stated, please assume that cookies used are stored for a period of two years.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the data processing is that permission. Otherwise, users' data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

Notes on withdrawal and objection:

We refer to the privacy notices of the respective providers and the options to object stated for the providers (so-called "opt-out"). If no explicit opt-out option has been specified, you have, on the one hand, the option of deactivating cookies in the settings of your browser. However, this may restrict functions of our online services. We therefore additionally recommend the following opt-out options, which are offered collectively for the respective regions:

a) Europe: https://youronlinechoices.eu/.

b) Canada: https://youradchoices.ca/.

c) USA: https://optout.aboutads.info/.

d) Cross-regional: https://optout.aboutads.info.

• Processed data types: Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved); Event data (Facebook) ("Event data" is information that is sent to the provider Meta, for example via the Meta Pixel (whether via apps or other channels), and relates to persons or their actions. This data includes, for example, details of website visits, interactions with content and features, app installations and product purchases. Event data is processed for the purpose of creating target groups for content and advertising messages (Custom Audiences). It is important to note that event data does not include actual content such as written comments, login information or contact information such as names, email addresses or telephone numbers. "Event data" is deleted by Meta after a maximum of two years, and the target groups formed from it disappear with the deletion of our Meta user accounts.); Contact information (Facebook) ("Contact information" is data that (clearly) identifies data subjects, such as names, email addresses and telephone numbers, which may be transmitted to Facebook, e.g. via the Facebook Pixel or by upload for matching purposes in order to form Custom Audiences. After matching for the purpose of forming target groups, the contact information is deleted).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Reach measurement (e.g. access statistics, recognition of returning visitors); Tracking (e.g. interest/behaviour-based profiling, use of cookies); Conversion tracking (measuring the effectiveness of marketing measures); Target group formation; Marketing; Profiles with user-related information (creating user profiles); Provision of our online services and usability; Remarketing; A/B tests. Cross-device tracking (processing of user data across devices for marketing purposes).
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion". Storage of cookies for up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years).
• Security measures: IP masking (pseudonymisation of the IP address).
• Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Meta Pixel and target group formation (Custom Audiences): With the help of the Meta Pixel (or comparable functions for transmitting event data or contact information by means of interfaces in apps), the company Meta is able, on the one hand, to determine the visitors to our online services as a target group for the display of advertisements (so-called "Meta Ads"). Accordingly, we use the Meta Pixel to display the Meta Ads placed by us only to those users on Meta platforms and within the services of partners cooperating with Meta (so-called "Audience Network" https://www.facebook.com/audiencenetwork/ ) who have also shown an interest in our online services or who have certain characteristics (e.g. interest in certain topics or products, as evident from the websites visited) that we transmit to Meta (so-called "Custom Audiences"). With the help of the Meta Pixel, we also want to ensure that our Meta Ads correspond to the potential interest of users and are not perceived as a nuisance. With the help of the Meta Pixel, we can furthermore track the effectiveness of the Meta Ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Meta Ad (so-called "conversion tracking"); Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/; Data processing agreement: https://www.facebook.com/legal/terms/dataprocessing; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum). Further information: Users' event data, i.e. information on behaviour and interests, is processed for the purposes of targeted advertising and target group formation on the basis of the agreement on joint controllership ("Controller Addendum", https://www.facebook.com/legal/controller_addendum). The joint controllership is limited to the collection by and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which concerns in particular the transfer of the data to the parent company Meta Platforms, Inc. in the USA (on the basis of the Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
• Advanced matching for the Meta Pixel: In addition to the processing of event data in the context of the use of the Meta Pixel (or comparable functions, e.g. in apps), contact information (data identifying individual persons, such as names, email addresses and telephone numbers) is also collected by Meta within our online services or transmitted to Meta. The processing of the contact information serves to form target groups (so-called "Custom Audiences") for a display of content and advertising information oriented to the presumed interests of the users. The collection or transmission and the matching with data held by Meta do not take place in plain text, but as so-called "hash values", i.e. mathematical representations of the data (this method is used, for example, for storing passwords). After matching for the purpose of forming target groups, the contact information is deleted; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Privacy policy: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Data processing agreement: https://www.facebook.com/legal/terms/dataprocessing; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum). Further information: https://www.facebook.com/legal/terms/data_security_terms.
• Meta - target group formation via data upload: Formation of target groups for marketing purposes - We transmit contact information (names, email addresses and telephone numbers) in list form to Meta for the purpose of forming target groups (so-called "Custom Audiences") for a display of content and advertising information oriented to the presumed interests of the users. The transmission and the matching with data held by Meta do not take place in plain text, but as so-called "hash values", i.e. mathematical representations of the data (this method is used, for example, for storing passwords). After matching for the purpose of forming target groups, the contact information is deleted; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/; Data processing agreement: https://www.facebook.com/legal/terms/dataprocessing. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
• Facebook advertisements: Placement of advertisements within the Facebook platform and evaluation of the advertisement results; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF); Opt-out: We refer to the privacy and advertising settings in the users' profiles on the Facebook platforms as well as to Facebook's consent procedures and contact options for exercising rights of access and other data subject rights, as described in Facebook's privacy policy. Further information: Users' event data, i.e. information on behaviour and interests, is processed for the purposes of targeted advertising and target group formation on the basis of the agreement on joint controllership ("Controller Addendum", https://www.facebook.com/legal/controller_addendum). The joint controllership is limited to the collection by and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which concerns in particular the transfer of the data to the parent company Meta Platforms, Inc. in the USA (on the basis of the Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
• FunnelCockpit: Creation and management of websites as well as website elements and marketing functions (in particular reach measurement, A/B testing, interest-based marketing, processing of user profiles, online forms, sending of messages and direct communication); Service provider: Denis Hoeger Caballero, owner: Denis Hoeger - Caballero, Nobelstr- 3-5, 41189 Mönchengladbach, Germany; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://funnelcockpit.com/. Privacy policy: https://funnelcockpit.com/datenschutz/.
• Google Ad Manager: We use the "Google Ad Manager" service to place advertisements in the Google advertising network (e.g. in search results, in videos, on websites, etc.). Google Ad Manager is characterised by the fact that advertisements are displayed in real time based on the presumed interests of users. This allows us to display advertisements for our online services to users who might have a potential interest in our offering or who had previously shown an interest in it, and to measure the success of the advertisements; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://business.safety.google/privacy/; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF); Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/; Data processing terms for Google advertising products: information on the services, data processing terms between controllers and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms. where Google acts as a processor, data processing terms for Google advertising products and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adsprocessorterms.
• Google Ads and conversion tracking: Online marketing procedure for the purpose of placing content and advertisements within the service provider's advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who have a presumed interest in the advertisements. In addition, we measure the conversion of the advertisements, i.e. whether users have taken them as an occasion to interact with the advertisements and to make use of the advertised offers (so-called conversions). However, we only receive anonymous information and no personal information about individual users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://business.safety.google/privacy/; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF); Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/. Data processing terms between controllers and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.
• Google Ads - enhanced conversion tracking: Enhanced conversions are used to measure and optimise advertising success. This is an extension of the existing conversion tracking (measurement of user actions such as purchases or requests), in which certain first-party data provided by users (data collected directly by the website operator, e.g. email address or telephone number) is technically processed in order to attribute conversions to an advertisement more reliably. The processing takes place exclusively in hashed form using the cryptographic one-way hash algorithm SHA-256 (a mathematical procedure for the irreversible transformation of data). In this process, personal data is encrypted before transmission in such a way that it is not available in plain text and cannot be calculated back. The hashed data is transmitted to Google either at the time of a conversion on the website or – in the case of so-called lead conversions (transactions concluded outside the website, e.g. by telephone or email), with a time delay. The transmission takes place either on the client side via a tag (tracking code, e.g. via Google Tag Manager) or on the server side via an API (programming interface for system-side data transfer). In the case of server-side transmission, the data is transferred via an HTTPS connection (encrypted internet connection). The purpose of the processing is to record and attribute conversions correctly even if conventional tracking methods such as cookies (small text files or functions for recognising users) or device identifiers are restricted or not available. The transmitted hashed data may be matched with existing Google accounts if users are logged in at the time of the conversion. The processing serves exclusively for conversion tracking, the evaluation of the success of advertising campaigns and the optimisation of automated bidding strategies (automatic adjustment of ad bids based on measured conversions) on the basis of first-party data; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://business.safety.google/privacy/; Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/. Data processing terms between controllers and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.
• Google Ads Remarketing: Google Remarketing, also known as retargeting, is a technology with which users who use an online service are included in a pseudonymous remarketing list so that advertisements can be displayed to the users on other online services on the basis of their visit to the online service; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://business.safety.google/privacy/; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF); Further information: Types of processing and of the data processed: https://business.safety.google/adsservices/. Data processing terms between controllers and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.
• Enhanced conversions for Google Ads: When users click on our Google ads and then make use of the advertised service (so-called "conversion"), the data entered by the user, such as the email address, name, residential address or telephone number, may be transmitted to Google. The hash values are then matched with the users' existing Google accounts in order to be able to better evaluate and improve the users' interaction with the ads (e.g. clicks or views) and thus their performance; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR). Website: https://support.google.com/google-ads/answer/9888656.
• Instagram advertisements: Placement of advertisements within the Instagram platform and evaluation of the advertisement results; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://www.instagram.com; Privacy policy: https://privacycenter.instagram.com/policy/; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF); Opt-out: We refer to the privacy and advertising settings in the users' profiles on the Instagram platform as well as to Instagram's consent procedures and Instagram's contact options for exercising rights of access and other data subject rights in Instagram's privacy policy. Further information: Users' event data, i.e. information on behaviour and interests, is processed for the purposes of targeted advertising and target group formation on the basis of the agreement on joint controllership ("Controller Addendum", https://www.facebook.com/legal/controller_addendum). The joint controllership is limited to the collection by and transmission of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which concerns in particular the transfer of the data to the parent company Meta Platforms, Inc. in the USA.
• Microsoft Advertising: Online marketing procedure for the purpose of placing content and advertisements within the service provider's advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who have a presumed interest in the advertisements. In addition, we measure the conversion of the advertisements, i.e. whether users have taken them as an occasion to interact with the advertisements and to make use of the advertised offers (so-called conversion). However, we only receive anonymous information and no personal information about individual users; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://about.ads.microsoft.com/; Privacy policy: https://www.microsoft.com/de-de/privacy/privacystatement; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF). Opt-out: https://account.microsoft.com/privacy/ad-settings/.
• Advanced Analytics: Analysis software with the help of which we measure the use of and interaction with our offerings on or in connection with Meta platforms (by means of so-called events, such as viewing posts or clicking "Like" buttons) and in order to obtain demographic data about our users (e.g. average age, place of residence, language used). The user data is processed by Meta for the purpose of displaying content and advertisements based on the presumed interests of the users, created on the basis of user profiles. The data is made available to us only in aggregated, i.e. summarised, form, so that we do not see the data of individual users. We use the results to design our content and services in a user-oriented manner; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland Execution on servers and/or computers under own data protection responsibility; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://about.meta.com/; Data processing agreement: Provided by the service provider. Basis for third-country transfers: EU/EEA - Standard Contractual Clauses (Provided by the service provider), Switzerland - Standard Contractual Clauses (Provided by the service provider).

Customer reviews and rating procedures

We participate in review and rating procedures in order to evaluate, optimise and promote our services. If users rate us via the participating rating platforms or procedures or otherwise provide feedback, the general terms and conditions or terms of use and the privacy notices of the providers also apply. As a rule, the rating also requires registration with the respective providers.

In order to ensure that the persons submitting a rating have actually used our services, we transmit, with the customers' consent, the data required for this purpose with regard to the customer and the service used to the respective rating platform (including name, email address and order number or item number). This data is used solely to verify the authenticity of the user.

• Processed data types: Contract data (e.g. subject matter of the contract, term, customer category); Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved); Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); Master data (e.g. full name, residential address, contact information, customer number, etc.); Payment data (e.g. bank details, invoices, payment history). Contact data (e.g. postal and email addresses or telephone numbers).
• Data subjects: Service recipients and clients; Users (e.g. website visitors, users of online services); Prospective customers. Business and contractual partners.
• Purposes of processing and legitimate interests: Feedback (e.g. collecting feedback via an online form); Marketing; Provision of contractual services and fulfilment of contractual obligations; Conversion tracking (measuring the effectiveness of marketing measures); Provision of our online services and usability. Affiliate tracking.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Rating widget: We integrate so-called "rating widgets" into our online services. A widget is a functional and content element integrated into our online services that displays variable information. It may be displayed, for example, in the form of a seal or comparable element, sometimes also called a "badge". Although the corresponding content of the widget is displayed within our online services, it is retrieved at that moment from the servers of the respective widget provider. Only in this way can the current content always be shown, above all the current rating. For this purpose, a data connection must be established from the web page accessed within our online services to the server of the widget provider, and the widget provider receives certain technical data (access data, including the IP address) that are necessary so that the content of the widget can be delivered to the user's browser. Furthermore, the widget provider receives information that users have visited our online services. This information may be stored in a cookie and used by the widget provider to recognise which online services participating in the rating procedure have been visited by the user. The information may be stored in a user profile and used for advertising or market research purposes; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Google Customer Reviews: Service for obtaining and/or displaying customer satisfaction and customer opinions; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.google.com/; Privacy policy: https://business.safety.google/privacy/; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF); Further information: In the course of obtaining customer reviews, an identification number and the time of the business transaction to be rated, in the case of review requests sent directly to customers the customer's email address and their information on the country of residence, as well as the review details themselves are processed; Further information on the types of processing and of the data processed: https://business.safety.google/adsservices/. Data processing terms for Google advertising products: information on the services, data processing terms between controllers and Standard Contractual Clauses for third-country transfers of data: https://business.safety.google/adscontrollerterms.
• Yelp: Managing and displaying user reviews (ratings and comments on services or products), providing search functions for local businesses, filtering and sorting results, displaying business information (e.g. address, opening hours), collecting usage statistics (anonymised evaluation of page usage); Service provider: Yelp Ireland Ltd., 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.yelp.de. Privacy policy: https://terms.yelp.de/privacy/de_de/20260101_de_de/.
• TripAdvisor: Travel platform with reviews; Service provider: Tripadvisor LLC, 400 1st Avenue, Needham, MA 02494 USA; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.tripadvisor.de/. Privacy policy: https://tripadvisor.mediaroom.com/de-privacy-policy.

Presence on social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We would like to point out that user data may be processed outside the area of the European Union. This may result in risks for users because, for example, it could make it more difficult to enforce users' rights.

Furthermore, users' data within social networks is generally processed for market research and advertising purposes. For example, usage profiles can be created on the basis of users' usage behaviour and the resulting interests of the users. These in turn may be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For this reason, cookies are usually stored on users' computers, in which the usage behaviour and the interests of the users are stored. Furthermore, data may also be stored in the usage profiles independently of the devices used by the users (in particular if they are members of the respective platforms and are logged in there).

For a detailed description of the respective forms of processing and the options to object (opt-out), we refer to the privacy policies and information provided by the operators of the respective networks.

In the case of requests for access and the assertion of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the latter have access to the users' data and can take appropriate measures and provide information directly. Should you nevertheless need help, you can contact us.

• Processed data types: Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation). Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Communication; Feedback (e.g. collecting feedback via an online form). Public relations.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Instagram: Social network that enables sharing photos and videos, commenting on and favouriting posts, sending messages, subscribing to profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.instagram.com; Privacy policy: https://privacycenter.instagram.com/policy/. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).
• Facebook pages: Profiles within the social network Facebook - The controller is jointly responsible with Meta Platforms Ireland Limited for the collection and transmission of data of visitors to our Facebook page ("fan page"). This includes in particular information about user behaviour (e.g. content viewed or interacted with, actions performed) as well as device information (e.g. IP address, operating system, browser type, language settings, cookie data). Further details can be found in the Facebook data policy: https://www.facebook.com/privacy/policy/. Facebook also uses this data to provide us with statistical analyses via the "Page Insights" service, which provide information on how people interact with our page and its content. The basis for this is an agreement with Facebook ("Information about Page Insights": https://www.facebook.com/legal/terms/page_controller_addendum), which regulates, among other things, security measures and the exercise of data subject rights. Further information can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data. Users can therefore address requests for access or deletion directly to Facebook. The rights of users (in particular access, deletion, objection, complaint to a supervisory authority) remain unaffected by this. The joint controllership is limited exclusively to the collection of the data by Meta Platforms Ireland Limited (EU). Meta Platforms Ireland Limited is solely responsible for the further processing, including any transfer to Meta Platforms Inc. in the USA; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
• LinkedIn: Social network - We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not the further processing) of visitor data used to create the "Page Insights" (statistics) of our LinkedIn profiles. This data includes information about the types of content that users view or interact with, as well as the actions they take. In addition, details about the devices used are collected, such as IP addresses, operating system, browser type, language settings and cookie data, as well as information from the user profiles, such as job function, country, industry, seniority, company size and employment status. Privacy information on the processing of user data by LinkedIn can be found in LinkedIn's privacy notices: https://www.linkedin.com/legal/privacy-policy.
  We have concluded a special agreement with LinkedIn Ireland ("Page Insights Joint Controller Addendum", https://legal.linkedin.com/pages-joint-controller-addendum), which regulates in particular which security measures LinkedIn must observe and in which LinkedIn has agreed to fulfil the rights of data subjects (i.e. users can, for example, send requests for access or deletion directly to LinkedIn). The rights of users (in particular the right of access, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. The joint controllership is limited to the collection and transmission of the data to LinkedIn Ireland Unlimited Company, a company based in the EU. The further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, in particular with regard to the transfer of the data to the parent company LinkedIn Corporation in the USA; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.linkedin.com/legal/privacy-policy), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.linkedin.com/legal/privacy-policy). Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Plug-ins and embedded functions and content

We integrate functional and content elements into our online services that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may be, for example, graphics, videos or city maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the users, as without the IP address they would not be able to send the content to their browser. The IP address is therefore required for the display of this content or these functions. We endeavour to use only content whose respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may furthermore be stored in cookies on the users' devices and may contain, among other things, technical information about the browser and operating system, referring websites, the time of the visit and other information on the use of our online services, but may also be linked with such information from other sources.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the data processing is that permission. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved). Location data (information on the geographical position of a device or a person).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of our online services and usability.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion". Storage of cookies for up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years).
• Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Google Fonts (provision on our own server): Provision of font files for the purpose of a user-friendly presentation of our online services; Service provider: The Google Fonts are hosted on our server; no data is transmitted to Google; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Google Maps: We integrate the maps of the "Google Maps" service of the provider Google. The data processed may include, in particular, IP addresses and location data of the users; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://business.safety.google/privacy/. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).
• Google Maps APIs and SDKs: Interfaces to Google's map and location services which allow, for example, the completion of address entries, the determination of locations, the calculation of distances or the provision of supplementary information on locations and other places; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://business.safety.google/privacy/. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).

Management, organisation and auxiliary tools

We use services, platforms and software from other providers (hereinafter referred to as "third-party providers") for the purposes of organising, administering, planning and providing our services. When selecting third-party providers and their services, we comply with the legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. This may affect various data that we process in accordance with this privacy policy. These data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes and their contents.

Where users are referred to the third-party providers or their software or platforms in the course of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, for service optimisation or for marketing purposes. We therefore ask you to observe the privacy notices of the respective third-party providers.

• Processed data types: Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features). Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved).
• Data subjects: Communication partners; Users (e.g. website visitors, users of online services). Service recipients and clients.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; Office and organisational procedures. Provision of our online services and usability.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Google Translate: Translation of content and input into other languages; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://translate.google.com/; Privacy policy: https://business.safety.google/privacy/; Data processing agreement: https://cloud.google.com/terms/data-processing-addendum. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause).

Processing of data in employment relationships

In the context of employment relationships, personal data are processed with the aim of organising the establishment, performance and termination of such relationships effectively. This data processing supports various operational and administrative functions that are necessary for managing employee relationships.

The data processing covers various aspects ranging from the initiation of the contract to the termination of the contract. It includes the organisation and administration of daily working hours, the management of access rights and authorisations, and the handling of personnel development measures and employee reviews. The processing also serves payroll accounting and the administration of wage and salary payments, which are critical aspects of the performance of the contract.

In addition, the data processing takes into account legitimate interests of the employer as controller, such as ensuring safety in the workplace or recording performance data to evaluate and optimise operational processes. Furthermore, the data processing includes the disclosure of employee data in the context of external communication and publication processes where this is necessary for operational or legal purposes.

These data are always processed in compliance with the applicable legal framework, the aim always being to create and maintain a fair and efficient working environment. This also includes taking into account the data protection of the employees concerned, and the anonymisation or deletion of data once the purpose of processing has been fulfilled or in accordance with statutory retention periods.

• Processed data types: Employee data (information on employees and other persons in an employment relationship); Payment data (e.g. bank details, invoices, payment history); Contract data (e.g. subject matter of the contract, term, customer category); Master data (e.g. full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); Social data (data that are subject to social secrecy and are processed, e.g., by social insurance institutions, social welfare agencies or benefits authorities.); Log data (e.g. log files relating to logins or the retrieval of data or access times.); Performance and behavioural data (e.g. performance and behavioural aspects such as performance appraisals, feedback from supervisors, participation in training, compliance with company policies, self-assessments and behavioural assessments.); Working time data (e.g. start of working time, end of working time, actual working time, scheduled working time, break times, overtime, days of leave, days of special leave, sick days, absences, home office days, business trips); Salary data (e.g. basic salary, bonus payments, premiums, tax class information, supplements for night work/overtime, tax deductions, social security contributions, net payout amount); Image and/or video recordings (e.g. photographs or video recordings of a person); Usage data (e.g. page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and features). Meta, communication and process data (e.g. IP addresses, times, identification numbers, persons involved).
• Special categories of personal data: Health data; Religious or philosophical beliefs. Trade union membership.
• Data subjects: Employees (e.g. salaried employees, applicants, temporary staff and other staff members). Business and contractual partners.
• Purposes of processing and legitimate interests: Establishment and performance of employment relationships (processing of employee data in the context of the establishment and performance of employment relationships); Business processes and management procedures; Security measures; Provision of contractual services and fulfilment of contractual obligations; Office and organisational procedures. Public relations.
• Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR); Legal obligation (Art. 6 (1) sentence 1 (c) GDPR); Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR). Processing of special categories of personal data relating to healthcare, occupation and social security (Art. 9 (2) (h) GDPR).

Further information on processing operations, procedures and services:

• Working time recording: Procedures for recording employees' working hours include both manual and automated methods, such as the use of time clocks, time recording software or mobile apps. This involves activities such as entering arrival and departure times, break times, overtime and absences. Checking and validating the recorded working hours includes comparing them with duty or shift rosters, reviewing absences and the approval of overtime by supervisors. Reports and analyses are prepared on the basis of the recorded working hours in order to provide working time records, overtime reports and absence statistics for management and the human resources department; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Authorisation management: Procedures required for defining, managing and controlling access rights and user roles within a system or an organisation (e.g. creating authorisation profiles, role- and access-based control, reviewing and approving access requests, regular review of access rights, tracking and auditing user activities, drawing up security policies and procedures); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Special categories of personal data: Special categories of personal data are processed in the context of the employment relationship or to fulfil legal obligations. The special categories of personal data processed include data concerning the health, trade union membership or religious affiliation of employees. These data may, for example, be passed on to health insurance funds or be processed to assess the employees' fitness for work, for occupational health management or for information provided to the tax office; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Sources of the processed data: We process personal data that were received in the context of the application and/or the employment relationship of the employees. In addition, where required by law, personal data are collected from other sources. These may be tax authorities for tax-relevant information, the respective health insurance fund for information on incapacity for work, third parties such as employment agencies or publicly accessible sources such as professional social networks in the context of application procedures; Legal bases: Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Video surveillance: The monitoring of employees serves the security of the company, the protection of property and the safety of employees. Various procedures and data processing steps are carried out for this purpose.
  First, surveillance cameras are installed and positioned following a site analysis in order to identify security-relevant areas. The cameras are then installed at suitable locations, and notice of the surveillance may be given by putting up signs or warning notices.
  Regular checks are carried out to ensure that the cameras are working properly and that no failures occur that could impair security.
  The actual surveillance takes place by making video recordings in order to capture and document potential security incidents. These recordings are then evaluated and analysed in order to identify suspicious activities and respond to them appropriately.
  All recorded video data are archived in accordance with the statutory provisions and data protection policies. It should be noted that the data are deleted after 96 hours at the latest, unless there is a specific case of suspicion that requires longer retention in order to clarify the facts or to ensure the security of the company.
  In addition, measures for data deletion are implemented as soon as the retention periods have expired or the data are no longer required, in order to comply with the data protection policies and to protect the privacy of employees; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Purposes of data processing: The personal data of employees are processed primarily for the establishment, performance and termination of the employment relationship. In addition, the processing of these data is necessary in order to fulfil legal obligations in the area of tax and social security law. Besides these primary purposes, employee data are also used to meet regulatory and supervisory requirements, to optimise electronic data processing procedures and to compile internal or cross-company data, possibly including statistical data. Furthermore, employee data may be processed to assert legal claims and for defence in legal disputes; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Transmission of employee data: Internally, employee data are processed only by those units that need them to fulfil operational, contractual and legal obligations.
  Data are disclosed to external recipients only if this is required by law or if the employees concerned have given their consent. Possible scenarios for this may be requests for information from authorities or the existence of capital-forming benefits. Furthermore, the controller may forward personal data to other recipients insofar as this is necessary to fulfil its contractual and legal obligations as an employer. These recipients may include: a) banks b) health insurance funds, pension insurance institutions, providers of retirement provision and other social insurance institutions c) authorities, courts (e.g. tax authorities, labour courts, other supervisory authorities in the context of fulfilling reporting and information obligations) d) tax and legal advisers e) third-party debtors in the event of wage and salary garnishments f) other bodies to which legally required declarations must be made.
  In addition, data may be passed on to third parties if this is necessary for communication with business partners, suppliers or other service providers. Examples of this are details in the sender area of emails or in letterheads and the creation of profiles on external platforms; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Transfer of employee data to third countries: Employee data are transferred to third countries, i.e. countries outside the European Union (EU) and the European Economic Area (EEA), only if this is necessary for the performance of the employment relationship, is required by law or if employees have given their consent to this. Where required by law, employees will be informed separately about the details; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Business trips and travel expense accounting: Procedures required for planning, carrying out and settling business trips (e.g. booking trips, organising accommodation and means of transport, managing travel expense advances, submitting and checking travel expense claims, monitoring and booking the costs incurred, compliance with travel policies, handling travel expense management); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Remuneration accounting and payroll accounting: Procedures required for calculating, paying out and documenting wages, salaries and other remuneration of employees (e.g. recording working hours, calculating deductions and supplements, paying over taxes and social security contributions, preparing wage and salary statements, keeping payroll accounts, reporting to the tax office and social insurance institutions); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR).
• Deletion of employee data: Under German law, employee data are deleted when they are not required for the purpose for which they were collected, unless they must be retained or archived due to legal obligations or due to the interests of the employer. In this context, the following retention and archiving obligations are observed:
  • General personnel documents - General personnel documents (such as employment contract, reference, supplementary agreements) are retained for up to three years after the end of the employment relationship (Section 195 BGB).
  • Tax-relevant documents - Tax-relevant documents in the personnel file are retained for six years (Section 147 AO, Section 257 HGB).
  • Information on wages and working hours - Information on wages and working hours for (accident) insured persons with proof of wages is retained for five years (Section 165 (1) sentence 1, (4) sentence 2 SGB VII).
  • Salary lists including lists for special payments - Salary lists including lists for special payments are retained for ten years if an accounting voucher exists (Section 147 AO, Section 257 HGB).
  • Wage lists for interim, final and special payments - Wage lists for interim, final and special payments are retained for six years (Section 147 AO, Section 257 HGB).
  • Documents on salaried employees' insurance - Documents on salaried employees' insurance are retained for ten years if accounting vouchers exist (Section 147 AO, Section 257 HGB).
  • Contribution statements to social insurance institutions - Contribution statements to social insurance institutions are retained for ten years (Section 165 SGB VII).
  • Payroll accounts - Payroll accounts are retained for six years (Section 41 (1) sentence 9 EStG).
  • Applicant data - Are retained for a maximum of six months from receipt of the rejection.
  • Working time records (for more than 8 hours on working days) - Are retained for two years (Section 16 (2) Working Hours Act (ArbZG)).
  • Application documents (following an online job advertisement) - Are retained for three to a maximum of six months after receipt of the rejection (Section 26 Federal Data Protection Act (BDSG) new version, Section 15 (4) General Equal Treatment Act (AGG)).
  • Certificates of incapacity for work (AU) - Are retained for up to five years (Section 6 (1) Expenditure Compensation Act (AAG)).
  • Documents on occupational retirement provision - Are retained for 30 years (Section 18a Act on the Improvement of Occupational Retirement Provision (BetrAVG)).
  • Employees' sickness data - Are retained for twelve months after the onset of the illness if the absences in one year do not exceed six weeks.
  • Maternity protection documents - Are retained for two years (Section 27 (5) MuSchG).

Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR), Processing of special categories of personal data relating to healthcare, occupation and social security (Art. 9 (2) (h) GDPR).

• Personnel file management: Procedures required for organising, updating and managing employee data and documents (e.g. recording personnel master data, keeping employment contracts, references and certificates, updating data in the event of changes, compiling documents for employee reviews, archiving personnel files, compliance with data protection regulations); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR), Processing of special categories of personal data relating to healthcare, occupation and social security (Art. 9 (2) (h) GDPR).
• Personnel development, performance appraisal and employee reviews: Procedures required in the area of supporting and developing employees, in assessing their performance and in the context of employee reviews (e.g. analysis of training needs, planning and carrying out training measures, preparing performance appraisals, conducting target agreement and feedback meetings, career planning and talent management, succession planning); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR), Processing of special categories of personal data relating to healthcare, occupation and social security (Art. 9 (2) (h) GDPR).
• Obligation to provide data: The controller informs employees that the provision of their data is required. This is generally the case if the data are required for the establishment and performance of the employment relationship or if their collection is required by law. The provision of data may also be required if employees assert claims or if employees are entitled to claims. The implementation of these measures or the provision of benefits depends on the provision of these data (for example, the provision of data for the purpose of receiving wages); Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legal obligation (Art. 6 (1) sentence 1 (c) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).
• Publication and disclosure of employee data: Employee data are only published or disclosed to third parties if, on the one hand, this is necessary for the performance of work tasks in accordance with the employment contract. This applies, for example, if employees are named as contact persons in correspondence, on the website or in public registers by arrangement or in accordance with an agreed job description, or if the field of work includes representative functions. Likewise, this may be the case if a presentation or communication with the public takes place in the course of performing tasks, such as photographs in the context of public relations work. Otherwise, employee data are only published with their consent or on the basis of legitimate interests of the employer, for example in the case of stage or group photographs at a public event; Legal bases: Performance of a contract and pre-contractual requests (Art. 6 (1) sentence 1 (b) GDPR), Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Application procedure

The application procedure requires applicants to provide us with the data necessary for their assessment and selection. Which information is required is set out in the job description or, in the case of online forms, in the information given there.

In principle, the required information includes personal details such as name, address, a means of contact and proof of the qualifications necessary for a position. Upon request, we will also be happy to let you know which information is required.

Where available, applicants are welcome to submit their applications via our online form, which is encrypted in accordance with the latest state of the art. Alternatively, it is also possible to send applications to us by email. However, we would like to point out that emails on the internet are generally not sent in encrypted form. Although emails are usually encrypted in transit, this is not the case on the servers from which they are sent and received. We therefore cannot accept any responsibility for the security of the application on its transmission path between the sender and our server.

For the purposes of searching for applicants, submitting applications and selecting applicants, we may, in compliance with the legal requirements, make use of applicant management or recruitment software and platforms and services of third-party providers.

Applicants are welcome to contact us regarding how to submit their application or to send us their application by post.

Processing of special categories of data: Insofar as special categories of personal data (Art. 9 (1) GDPR, e.g. health data, such as severe disability status, or ethnic origin) are requested from applicants or communicated by them in the course of the application procedure, they are processed so that the controller or the data subject can exercise the rights arising for him or her from employment law and the law of social security and social protection and fulfil his or her obligations in this regard, in the case of protecting the vital interests of applicants or other persons, or for the purposes of preventive or occupational medicine, for the assessment of the employee's working capacity, for medical diagnosis, for the provision of health or social care or treatment, or for the management of health or social care systems and services.

Deletion of data: In the event of a successful application, the data provided by applicants may be further processed by us for the purposes of the employment relationship. Otherwise, if the application for a job offer is unsuccessful, the applicants' data will be deleted. Applicants' data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Subject to a justified revocation by the applicants, deletion takes place at the latest after the expiry of a period of six months, so that we can answer any follow-up questions regarding the application and comply with our obligations to provide evidence under the regulations on the equal treatment of applicants. Invoices for any reimbursement of travel expenses are archived in accordance with tax law requirements.

Inclusion in an applicant pool: Inclusion in an applicant pool, if offered, takes place on the basis of consent. Applicants are informed that their consent to inclusion in the talent pool is voluntary, has no influence on the ongoing application procedure and that they can withdraw their consent at any time with effect for the future.

• Processed data types: Master data (e.g. full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or telephone numbers); Content data (e.g. text or image messages and posts as well as information relating to them, such as details of authorship or time of creation). Applicant data (e.g. personal details, postal and contact addresses, the documents belonging to the application and the information contained therein, such as cover letter, CV, references and other information on their person or qualifications provided by applicants with regard to a specific position or voluntarily).
• Data subjects: Applicants.
• Purposes of processing and legitimate interests: Application procedure (establishment and possible subsequent performance as well as possible subsequent termination of the employment relationship).
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Application procedure as a pre-contractual or contractual relationship (Art. 6 (1) sentence 1 (b) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures and services:

• Stepstone: Services in connection with staff acquisition/ recruitment (searching for employees, communication, application procedures, contract negotiations); Service provider: StepStone Deutschland GmbH, Völklinger Straße 1, 40219 Düsseldorf, Germany; Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); Website: https://www.stepstone.de; Privacy policy: https://www.stepstone.de/e-recruiting/rechtliches/datenschutzerklarung/. Data processing agreement: https://www.stepstone.de/e-recruiting/rechtliches/auftragsdatenverarbeitungsvereinbarung/.

Changes and updates

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organisations in this privacy policy, please note that the addresses may change over time, and please check the information before contacting them.

Definitions of terms

This section provides an overview of the terms used in this privacy policy. Where the terms are defined by law, their statutory definitions apply. The following explanations, on the other hand, are primarily intended to aid understanding.

• A/B tests: A/B tests serve to improve the usability and performance of online services. For example, users are shown different versions of a website or its elements, such as input forms, on which the placement of the content or the labels of the navigation elements may differ. Subsequently, the behaviour of users, e.g. staying longer on the website or interacting more frequently with the elements, can be used to determine which of these websites or elements better meet the needs of users.
• Affiliate tracking: In the context of affiliate tracking, links with which the linking websites refer users to websites with product or other offers are logged. The operators of the respective linking websites may receive a commission if users follow these so-called affiliate links and subsequently take up the offers (e.g. buy goods or use services). For this purpose, it is necessary for the providers to be able to track whether users who are interested in certain offers subsequently take them up at the instigation of the affiliate links. It is therefore necessary for the functionality of affiliate links that they are supplemented by certain values that become part of the link or are stored otherwise, e.g. in a cookie. The values include, in particular, the originating website (referrer), the time, an online identifier of the operators of the website on which the affiliate link was located, an online identifier of the respective offer, an online identifier of the user and tracking-specific values such as advertising medium ID, partner ID and categorisations
• Employees: Employees are persons who are in an employment relationship, whether as staff members, salaried employees or in similar positions. An employment relationship is a legal relationship between an employer and an employee that is established by an employment contract or an agreement. It includes the employer's obligation to pay the employee remuneration while the employee performs their work. The employment relationship comprises various phases, including establishment, in which the employment contract is concluded, performance, in which the employee carries out their work, and termination, when the employment relationship ends, whether by notice of termination, termination agreement or otherwise. Employee data are all information relating to these persons and connected with their employment. This includes aspects such as personal identification data, identification numbers, salary and bank details, working hours, holiday entitlements, health data and performance appraisals.
• Master data: Master data comprise essential information that is necessary for the identification and management of contractual partners, user accounts, profiles and similar assignments. These data may include, among other things, personal and demographic details such as names, contact information (addresses, telephone numbers, email addresses), dates of birth and specific identifiers (user IDs). Master data form the basis for any formal interaction between persons and services, facilities or systems by enabling unambiguous assignment and communication.
• Content Delivery Network (CDN): A "Content Delivery Network" (CDN) is a service with the help of which content of online services, in particular large media files such as graphics or program scripts, can be delivered faster and more securely with the help of regionally distributed servers connected via the internet.
• Cross-device tracking: Cross-device tracking is a form of tracking in which behavioural and interest information of users is recorded across devices in so-called profiles by assigning an online identifier to the users. This means that user information can be analysed, as a rule for marketing purposes, regardless of the browsers or devices used (e.g. mobile phones or desktop computers). For most providers, the online identifier is not linked to directly identifying data such as names, postal addresses or email addresses.
• Content data: Content data comprise information generated in the course of creating, editing and publishing content of all kinds. This category of data may include texts, images, videos, audio files and other multimedia content published on various platforms and media. Content data are not limited to the actual content but also include metadata that provide information about the content itself, such as tags, descriptions, author information and publication dates
• Contact data: Contact data are essential information that enables communication with persons or organisations. They include, among other things, telephone numbers, postal addresses and email addresses, as well as means of communication such as social media handles and instant messaging identifiers.
• Conversion tracking: Conversion tracking (also referred to as "visit action evaluation") is a procedure with which the effectiveness of marketing measures can be determined. For this purpose, a cookie is usually stored on users' devices within the websites on which the marketing measures take place and then retrieved again on the target website. For example, this allows us to trace whether the advertisements we have placed on other websites were successful.
• Artificial intelligence (AI): The purpose of the processing of data by artificial intelligence (AI) comprises the automated analysis and processing of user data in order to recognise patterns, make predictions and improve the efficiency and quality of our services. This includes the collection, cleansing and structuring of the data, the training and application of AI models and the continuous review and optimisation of the results, and takes place exclusively with the consent of users or on the basis of statutory legal permissions.
• Performance and behavioural data: Performance and behavioural data refer to information relating to how persons perform tasks or behave in a particular context, such as in an educational, work or social environment. These data may include metrics such as productivity, efficiency, quality of work, attendance and compliance with policies or procedures. Behavioural data could include interactions with colleagues, communication styles, decision-making processes and reactions to different situations. These types of data are often used for performance appraisals, training and development measures and decision-making within organisations.
• Meta, communication and process data: Meta, communication and process data are categories that contain information about the way in which data are processed, transmitted and managed. Metadata, also known as data about data, comprise information that describes the context, origin and structure of other data. They may include details of the file size, the creation date, the author of a document and the change histories. Communication data capture the exchange of information between users via various channels, such as email traffic, call logs, messages on social networks and chat histories, including the persons involved, timestamps and transmission paths. Process data describe the processes and workflows within systems or organisations, including workflow documentation, logs of transactions and activities, and audit logs used to track and review operations.
• Usage data: Usage data refer to information that captures how users interact with digital products, services or platforms. These data comprise a wide range of information showing how users use applications, which features they prefer, how long they stay on certain pages and the paths by which they navigate through an application. Usage data may also include the frequency of use, timestamps of activities, IP addresses, device information and location data. They are particularly valuable for analysing user behaviour, optimising user experiences, personalising content and improving products or services. In addition, usage data play a crucial role in identifying trends, preferences and possible problem areas within digital offerings
• Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Profiles with user-related information: The processing of "profiles with user-related information", or "profiles" for short, includes any kind of automated processing of personal data that consists of using these personal data to analyse or evaluate certain personal aspects relating to a natural person (depending on the type of profiling, this may include different information concerning demographics, behaviour and interests, such as interaction with websites and their content, etc.) or to predict them (e.g. interests in certain content or products, click behaviour on a website or location). Cookies and web beacons are often used for profiling purposes.
• Log data: Log data are information about events or activities that have been logged in a system or network. These data typically contain information such as timestamps, IP addresses, user actions, error messages and other details about the use or operation of a system. Log data are often used to analyse system problems, for security monitoring or to generate performance reports.
• Reach measurement: Reach measurement (also referred to as web analytics) serves to evaluate the visitor flows of an online service and may include the behaviour or interests of visitors in certain information, such as website content. With the help of reach analysis, operators of online services can, for example, recognise at what time users visit their websites and what content they are interested in. This enables them, for example, to better adapt the content of their websites to the needs of their visitors.
• Remarketing: "Remarketing" or "retargeting" refers to when, for example for advertising purposes, a note is made of which products a user was interested in on a website in order to remind the user of these products on other websites, e.g. in advertisements.
• Location data: Location data arise when a mobile device (or another device with the technical requirements for determining location) connects to a radio cell, a Wi-Fi network or similar technical means and functions for determining location. Location data serve to indicate the geographically determinable position on earth at which the respective device is located. Location data can be used, for example, to display map functions or other information dependent on a location.
• Tracking: "Tracking" refers to when the behaviour of users can be traced across several online services. As a rule, behavioural and interest information relating to the online services used is stored in cookies or on servers of the providers of the tracking technologies (so-called profiling). This information can then be used, for example, to show users advertisements that are likely to match their interests.
• Controller: The "controller" is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: "Processing" means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data, be it collection, evaluation, storage, transmission or deletion.
• Contract data: Contract data are specific information relating to the formalisation of an agreement between two or more parties. They document the conditions under which services or products are provided, exchanged or sold. This data category is essential for the management and fulfilment of contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data may include the start and end dates of the contract, the type of services or products agreed, price agreements, payment terms, termination rights, renewal options and special conditions or clauses. They serve as the legal basis for the relationship between the parties and are crucial for clarifying rights and obligations, enforcing claims and resolving disputes.
• Payment data: Payment data comprise all information required to process payment transactions between buyers and sellers. These data are of crucial importance for e-commerce, online banking and any other form of financial transaction. They include details such as credit card numbers, bank details, payment amounts, transaction dates, verification numbers and invoice information. Payment data may also contain information about the payment status, chargebacks, authorisations and fees.
• Target group formation: Target group formation (English: "Custom Audiences") refers to when target groups are determined for advertising purposes, e.g. the display of advertisements. For example, based on a user's interest in certain products or topics on the internet, it can be concluded that this user is interested in advertisements for similar products or for the online shop in which they viewed the products. "Lookalike Audiences" (or similar target groups), in turn, refers to when content assessed as suitable is displayed to users whose profiles or interests presumably correspond to those of the users for whom the profiles were formed. For the purposes of forming Custom Audiences and Lookalike Audiences, cookies and web beacons are generally used.