Privacy Policy

Preamble
With the following privacy policy, we would like to inform you about which types of your personal data, hereinafter also referred to simply as “data”, we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles, hereinafter collectively referred to as the “online offering”.
The terms used are not gender-specific.
Date: June 18, 2026

Table of Contents
• Preamble• Controller• Overview of Processing Activities• Relevant Legal Bases• Security Measures• Transfer of Personal Data• International Data Transfers• General Information on Data Storage and Deletion• Rights of Data Subjects• Business Services• Business Processes and Procedures• Payment Procedures• Provision of the Online Offering and Web Hosting• Use of Cookies• Contact and Inquiry Management• Communication via Messenger• Presences in Social Networks / Social Media• Changes and Updates• Definitions of Terms

Controller
Yana Boiko / RadiaréBrassertstraße 10645768 Marl, Germany
Vertretungsberechtigte Personen: Yana Boiko
Email address: moc.liamg%40eeeraidar
Legal Notice: https://radiare-eu.com/impressum

Overview of Processing Activities
The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects concerned.

Types of Data Processed
• Master data.• Payment data.• Contact data.• Content data.• Contract data.• Usage data.• Meta, communication and procedural data.• Log data.

Categories of Data Subjects
• Service recipients and clients.• Employees.• Interested persons.• Communication partners.• Users.• Business and contractual partners.• Third parties.

Purposes of Processing
• Provision of contractual services and fulfillment of contractual obligations.• Communication.• Security measures.• Direct marketing.• Office and organizational procedures.• Organizational and administrative procedures.• Feedback.• Marketing.• Provision of our online offering and user-friendliness.• Information technology infrastructure.• Financial and payment management.• Public relations.• Sales promotion.• Business processes and business procedures.

Relevant Legal Bases
Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or establishment. If, in individual cases, more specific legal bases are relevant, we will inform you of these in the privacy policy.
• Consent, Art. 6 para. 1 sentence 1 lit. a GDPR - The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.
• Performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR - Processing is necessary for the performance of a contract to which the data subject is a party or in order to take pre-contractual measures at the request of the data subject.
• Legal obligation, Art. 6 para. 1 sentence 1 lit. c GDPR - Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR - Processing is necessary to protect the legitimate interests of the controller or a third party, provided that the interests, fundamental rights and freedoms of the data subject, which require the protection of personal data, do not override those interests.
National Data Protection Regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. This includes, in particular, the Federal Data Protection Act, BDSG. The BDSG contains special provisions, in particular regarding the right of access, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission, as well as automated decision-making in individual cases, including profiling. Furthermore, the data protection laws of the individual federal states may apply.

Security Measures
We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, implementation costs, the type, scope, circumstances and purposes of processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.
These measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access, input, transfer, availability and separation of the data. Furthermore, we have established procedures that ensure the exercise of data subject rights, the deletion of data and responses to data risks. We also take the protection of personal data into account already during the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.
Securing online connections using TLS/SSL encryption technology, HTTPS: In order to protect the data of users transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer, SSL, and Transport Layer Security, TLS, are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user’s browser, or between two servers, thereby protecting the data from unauthorized access. TLS, as the further developed and more secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by HTTPS in the URL. This serves as an indicator for users that their data is transmitted securely and encrypted.

Transfer of Personal Data
As part of our processing of personal data, it may happen that such data is transferred to other bodies, companies, legally independent organizational units or persons, or disclosed to them. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

International Data Transfers
Data processing in third countries: If we transfer data to a third country, meaning outside the European Union, EU, or the European Economic Area, EEA, or if this occurs in the context of using third-party services or disclosing or transferring data to other persons, bodies or companies, which may be apparent from the postal address of the respective provider or if the privacy policy expressly refers to data transfers to third countries, this is always done in accordance with legal requirements.
For data transfers to the USA, we primarily rely on the Data Privacy Framework, DPF, which was recognized as a secure legal framework by an adequacy decision of the EU Commission dated July 10, 2023. In addition, we have concluded standard contractual clauses with the respective providers that comply with the requirements of the EU Commission and establish contractual obligations to protect your data.
This dual safeguard ensures comprehensive protection of your data: The DPF forms the primary level of protection, while the standard contractual clauses serve as additional security. If changes occur within the framework of the DPF, the standard contractual clauses act as a reliable fallback option. This ensures that your data remains adequately protected even in the event of possible political or legal changes.
For individual service providers, we inform you whether they are certified under the DPF and whether standard contractual clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/ (in englischer Sprache).
For data transfers to other third countries, appropriate security measures apply, in particular standard contractual clauses, explicit consent or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

General Information on Data Storage and Deletion
We delete personal data that we process in accordance with legal requirements as soon as the underlying consents are withdrawn or there are no further legal bases for processing. This applies to cases in which the original processing purpose no longer applies or the data is no longer required. Exceptions to this rule exist when legal obligations or special interests require longer retention or archiving of the data.
In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons, must be archived accordingly.
Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing operations.
Where multiple retention periods or deletion deadlines apply to a piece of data, the longest period is always decisive. Data that is no longer retained for the originally intended purpose, but due to legal requirements or other reasons, is processed by us exclusively for the reasons that justify its retention.
Storage and deletion of data: The following general periods apply to retention and archiving under German law:
• 10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, as well as the work instructions and other organizational documents necessary for their understanding.
• 8 years - Accounting documents, such as invoices and cost receipts.
• 6 years - Other business documents: received commercial or business letters, copies of sent commercial or business letters, other documents insofar as they are relevant for taxation, such as hourly wage slips, operating accounting sheets, calculation documents, price labels, as well as payroll documents insofar as they are not already accounting documents, and cash register strips.
• 3 years - Data that is necessary to consider potential warranty and compensation claims or similar contractual claims and rights, and to process related inquiries based on previous business experience and common industry practices, is stored for the duration of the regular statutory limitation period of three years.
Start of the period at the end of the year: If a period does not expressly begin on a specific date and is at least one year, it automatically starts at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in which data is stored, the event triggering the period is the time when the termination becomes effective or the legal relationship otherwise ends.
Rights of Data Subjects
Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:
• Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is carried out on the basis of Art. 6 para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions. If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw consent you have given at any time.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to request information about this data, as well as further information and a copy of the data in accordance with legal requirements.
• Right to rectification: In accordance with legal requirements, you have the right to request the completion of data concerning you or the correction of incorrect data concerning you.
• Right to deletion and restriction of processing: In accordance with legal requirements, you have the right to request that data concerning you be deleted immediately, or alternatively, to request restriction of the processing of the data in accordance with legal requirements.
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with legal requirements, or to request that it be transferred to another controller.
• Complaint to a supervisory authority: In accordance with legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you believe that the processing of personal data concerning you violates the GDPR.
Business Services
We process personal data of our contractual and business partners, such as customers, clients, interested parties, suppliers and other cooperation partners, collectively referred to as “contractual partners”, for the initiation, performance and settlement of contractual relationships and comparable legal relationships. This also includes pre-contractual measures carried out upon request, as well as communication in connection with the respective contractual relationship.
The processing serves in particular the fulfillment of our main and ancillary contractual obligations. This includes the provision of agreed services, any update and information obligations, the processing of warranty and other service disruptions, the handling of withdrawals, termination of continuing obligations, reversals, refunds, as well as the processing of other contract-related declarations and inquiries. This includes both one-time contracts and ongoing contractual relationships.
In particular, master data such as name, address and, if applicable, company, contact data such as email address and telephone number, contract and service data such as subject matter of the contract, contract duration, order or transaction number, usage and performance data, payment and billing data, as well as communication content and histories are processed. Where necessary, we also process data that is disclosed or transmitted to us as part of the execution of an order.
In addition, we process the data to protect our rights and to fulfill legal obligations. This includes, in particular, retention obligations under commercial and tax law, documentation obligations, and obligations to provide evidence and accountability. Processing is also carried out on the basis of our legitimate interests in proper business management, internal administration, risk management and IT security, as well as in protecting our business operations and our contractual partners from misuse, data risks, secrets and other legal interests. This may also include the involvement of external service providers such as IT and telecommunications providers, transport and logistics companies, payment service providers, banks, tax and legal advisors or other service providers, insofar as this is necessary for the performance of the contract or the fulfillment of legal obligations.
Personal data is passed on to third parties only insofar as this is necessary for the fulfillment of the contract, the implementation of pre-contractual measures, the protection of legitimate interests or the fulfillment of legal obligations. We will provide separate information on any further processing, in particular for marketing purposes, within the scope of this privacy policy.
Which data is required in each individual case will be communicated to the contractual partners as part of the data collection, for example in online forms by means of corresponding labeling or in personal contact.
The data will be deleted as soon as it is no longer required for the aforementioned purposes and there are no statutory retention obligations to the contrary. Statutory retention periods, in particular under commercial and tax law, may require longer storage. Data transmitted within the scope of a specific order will be deleted after completion of the order and expiry of any retention periods, provided that there are no further legal or contractual obligations to store it.
The legal basis for processing is Art. 6 para. 1 lit. b GDPR for the implementation of pre-contractual measures and the fulfillment of the respective contractual relationship, as well as Art. 6 para. 1 lit. c GDPR for the fulfillment of legal obligations. Where processing is based on legitimate interests, it is carried out on the basis of Art. 6 para. 1 lit. f GDPR. Where processing is based on Art. 6 para. 1 lit. f GDPR, it is carried out to protect our legitimate interests in proper and efficient business organization, internal administration and documentation of business transactions, the enforcement and defense of legal claims, ensuring IT and data security, preventing misuse and fraud, as well as the economic management and further development of our business operations. These interests consist in particular in ensuring secure and legally compliant business operations and preserving our ability to act as a company.
• Types of data processed: Master data, for example full name, residential address, contact information, customer number, etc.; payment data, for example bank details, invoices, payment history; contact data, for example postal and email addresses or telephone numbers; contract data, for example subject matter of the contract, duration, customer category; usage data, for example page views and duration of visit, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions; meta, communication and procedural data, for example IP addresses, time information, identification numbers, involved persons.• Data subjects: Service recipients and clients; interested parties; business and contractual partners.• Purposes of processing and legitimate interests: Provision of contractual services and fulfillment of contractual obligations; security measures; communication; office and organizational procedures; organizational and administrative procedures; business processes and business management procedures.• Retention and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”.• Legal bases: Performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR; legal obligation, Art. 6 para. 1 sentence 1 lit. c GDPR; legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR.
Further Information on Processing Operations, Procedures and Services
• Online shop, order forms, e-commerce and service fulfillment: We process the data of our customers in order to enable them to select, purchase or order the selected products, goods and related services, as well as to enable their payment and provision, delivery or execution. If necessary for the execution of an order, we use service providers, in particular postal, freight forwarding and shipping companies, to carry out the delivery or execution for our customers. For the processing of payment transactions, we use the services of banks and payment service providers. The required information is identified as such within the order or comparable purchase process and includes the information required for delivery, provision and billing, as well as contact information in order to be able to make any necessary inquiries. Legal bases: Performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR.
• Marketing and advertising: We process the data of our customers and clients, hereinafter uniformly referred to as “customers”, in order to offer marketing services such as market research, advertising campaigns, content creation and social media management. The required information is identified as such in the context of commissioning and includes the information required for service provision and billing, as well as contact information in order to be able to make any necessary inquiries. If we obtain access to information of end customers, employees or other persons, we process this information in accordance with legal and contractual requirements.
Procedures required in the context of marketing and advertising measures include the creation of marketing strategies and campaigns, the design of advertising materials and content, the selection of advertising channels and platforms, the performance of market analyses and target group surveys, as well as the measurement of success and analysis of marketing measures. In addition, they include the management and maintenance of customer and interested-party data, the segmentation of target groups, the sending of newsletters and advertising emails, the tracking of online marketing activities and cooperation with external service providers in the field of marketing and advertising.
These procedures serve to develop effective marketing strategies for our customers, to design advertising measures in a target group-oriented manner, to measure and analyze the success of marketing activities, and to ensure efficient management of customer contacts and information. Legal bases: Performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR; legal obligation, Art. 6 para. 1 sentence 1 lit. c GDPR; legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR.
Business Processes and Procedures
Personal data of service recipients and clients - including customers, clients or, in special cases, principals, patients or business partners as well as other third parties - is processed within the framework of contractual and comparable legal relationships and pre-contractual measures, such as the initiation of business relationships. This data processing supports and facilitates business operations in areas such as customer management, sales, payment transactions, accounting and project management.
The collected data is used to fulfill contractual obligations and to organize business processes efficiently. This includes the processing of business transactions, the management of customer relationships, the optimization of sales strategies and the safeguarding of internal accounting and financial processes. In addition, the data supports the protection of the rights of the controller and promotes administrative tasks as well as the organization of the company.
Personal data may be disclosed to third parties if this is necessary for the fulfillment of the stated purposes or legal obligations. After the expiry of statutory retention periods or when the purpose of processing no longer applies, the data will be deleted. This also includes data that must be stored for a longer period due to tax law and legal documentation obligations.
• Types of data processed: master data, such as full name, residential address, contact information, customer number, etc.; payment data, such as bank details, invoices, payment history; contact data, such as postal and email addresses or telephone numbers; content data, such as text or image messages and posts as well as information relating to them, such as details about authorship or time of creation; contract data, such as subject matter of the contract, duration, customer category; log data, such as log files relating to logins or data retrieval or access times; usage data, such as page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions; meta, communication and procedural data, such as IP addresses, time information, identification numbers and involved persons.
• Data subjects: service recipients and clients; prospective customers; communication partners; business and contractual partners; third parties; users, such as website visitors and users of online services; employees, such as staff members, applicants, temporary workers and other personnel.
• Purposes of processing and legitimate interests: provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and commercial procedures; communication; marketing; sales promotion; public relations; financial and payment management; information technology infrastructure, including the operation and provision of information systems and technical devices such as computers and servers.
• Retention and deletion: deletion in accordance with the information provided in the section «General Information on Data Storage and Deletion».
• Legal bases: performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR; legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR; legal obligation, Art. 6 para. 1 sentence 1 lit. c GDPR.
Further information on processing activities, procedures and services:
• Contact management and contact maintenance: procedures required for the organization, maintenance and safeguarding of contact information, such as the establishment and maintenance of a central contact database, regular updates of contact information, monitoring of data integrity, implementation of data protection measures, ensuring access controls, performing backups and restoring contact data, training employees in the effective use of contact management software, regular review of communication history and adjustment of contact strategies; legal bases: performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR; legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR.
• General payment transactions: procedures required for carrying out payment processes, monitoring bank accounts and controlling payment flows, such as creation and review of bank transfers, processing of direct debits, checking account statements, monitoring incoming and outgoing payments, chargeback management, account reconciliation and cash management; legal bases: performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR; legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR.
• Accounting, accounts payable and accounts receivable: procedures required for recording, processing and monitoring business transactions in the area of accounts payable and accounts receivable, such as creation and review of incoming and outgoing invoices, monitoring and management of outstanding items, carrying out payment transactions, processing reminders, account reconciliation in relation to receivables and liabilities, accounts payable and accounts receivable; legal bases: performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR; legal obligation, Art. 6 para. 1 sentence 1 lit. c GDPR; legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR.
• Financial accounting and taxes: procedures required for recording, managing and monitoring finance-related business transactions as well as calculating, reporting and paying taxes, such as account assignment and posting of business transactions, preparation of quarterly and annual financial statements, carrying out payment transactions, processing reminders, account reconciliation, tax advice, preparation and submission of tax returns and tax administration; legal bases: performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR; legal obligation, Art. 6 para. 1 sentence 1 lit. c GDPR; legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR.
• Marketing, advertising and sales promotion: procedures required within the framework of marketing, advertising and sales promotion, such as market analysis and target group determination, development of marketing strategies, planning and implementation of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade fair participation, customer loyalty programs, sales promotion measures, performance measurement and optimization of marketing activities, budget management and cost control; legal bases: legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR.
• Public relations: procedures required within the framework of public relations and PR, such as development and implementation of communication strategies, planning and execution of PR campaigns, creation and distribution of press releases, maintenance of media contacts, monitoring and analysis of media response, organization of press conferences and public events, crisis communication, creation of content for social media and company websites, and corporate branding support; legal bases: legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR.
Payment Procedures
Within the framework of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer the data subjects efficient and secure payment options and use, in addition to banks and credit institutions, other service providers for this purpose, collectively referred to as «payment service providers». Payment transactions are carried out in accordance with the state of the art exclusively via encrypted connections, so that the data entered is protected against unauthorized access during transmission.
The data processed by payment service providers includes master data, such as name and address; bank data, such as account numbers or credit card numbers; passwords, TANs and checksums; as well as contract-related, amount-related and recipient-related information. This information is required in order to carry out the transactions. However, the data entered is processed and stored only by the payment service providers. This means that we do not receive any account-related or credit-card-related information, but only information confirming or denying the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit agencies. This transmission serves the purpose of identity and credit checks. For this purpose, we refer to the terms and conditions and privacy notices of the payment service providers.
The terms and conditions and privacy notices of the respective payment service providers apply to payment transactions and are available on the respective websites or transaction applications. We also refer to these for further information and for asserting rights of withdrawal, access and other data subject rights.
• Types of data processed: master data, such as full name, residential address, contact information, customer number, etc.; payment data, such as bank details, invoices, payment history; contract data, such as subject matter of the contract, duration, customer category; usage data, such as page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions; meta, communication and procedural data, such as IP addresses, time information, identification numbers and involved persons.
• Data subjects: service recipients and clients; business and contractual partners; prospective customers.
• Purposes of processing and legitimate interests: provision of contractual services and fulfillment of contractual obligations; business processes and commercial procedures.
• Retention and deletion: deletion in accordance with the information provided in the section «General Information on Data Storage and Deletion».
• Legal bases: performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR; legitimate interests, Art. 6 para. 1 sentence 1 lit. f GDPR.
Further information on processing activities, procedures and services:
• PayPal: payment services, technical integration of online payment methods, such as PayPal, PayPal Plus, Braintree; service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg; legal bases: performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR; website: https://www.paypal.com/de. privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full.• Stripe: payment services, technical integration of online payment methods; service provider: Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA; legal bases: performance of a contract and pre-contractual inquiries, Art. 6 para. 1 sentence 1 lit. b GDPR; website: https://stripe.com; privacy policy: https://stripe.com/de/privacy. basis for third-country transfers: Data Privacy Framework, DPF.
Provision of the Online Offering and Web Hosting
We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or end device.
Processed data types: Usage data, e.g. page views and duration of visit, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions; meta, communication and procedural data, e.g. IP addresses, time information, identification numbers, involved persons; protocol data, e.g. log files concerning logins or access to data or access times.
Affected persons: Users, e.g. website visitors and users of online services.
Purposes of processing and legitimate interests: Provision of our online offering and user-friendliness; information technology infrastructure, operation and provision of information systems and technical devices such as computers, servers, etc.; security measures.
Storage and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”.
Legal basis: Legitimate interests according to Art. 6 para. 1 sentence 1 lit. f GDPR.
Further information on processing operations, procedures and services:
Provision of online offering on rented storage space: For the provision of our online offering, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider, also called a “web host”. Legal basis: Legitimate interests according to Art. 6 para. 1 sentence 1 lit. f GDPR.
Collection of access data and log files: Access to our online offering is recorded in the form of so-called “server log files”. Server log files may include the address and name of accessed websites and files, date and time of access, transferred data volumes, notification of successful access, browser type and version, the user’s operating system, referrer URL, i.e. the previously visited page, and usually IP addresses and the requesting provider.
Server log files may be used for security purposes, for example to avoid server overload, especially in the event of abusive attacks, so-called DDoS attacks, and also to ensure server load and stability.
Legal basis: Legitimate interests according to Art. 6 para. 1 sentence 1 lit. f GDPR.
Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further storage is required for evidence purposes is excluded from deletion until the relevant incident has been finally clarified.
Use of Cookies
The term “cookies” refers to functions that store information on users’ end devices and read information from them. Cookies may also be used for various purposes, for example for the functionality, security and convenience of online offerings as well as for creating analyses of visitor flows.
We use cookies in accordance with legal requirements. Where necessary, we obtain users’ consent in advance. If consent is not required, we rely on our legitimate interests. This applies when the storage and reading of information is essential in order to provide expressly requested content and functions. This includes, for example, storing settings and ensuring the functionality and security of our online offering.
Consent can be withdrawn at any time. We provide clear information about its scope and which cookies are used.
Information on legal bases under data protection law: Whether we process personal data using cookies depends on consent. If consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.
Storage duration: With regard to storage duration, the following types of cookies are distinguishe.
Temporary cookies, also called session cookies: Temporary cookies are deleted at the latest after a user leaves an online offering and closes their end device, for example a browser or mobile application.
Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, login status can be stored and preferred content can be displayed directly when the user visits a website again. Likewise, user data collected with the help of cookies may be used for reach measurement. Unless we provide users with explicit information about the type and storage duration of cookies, for example when obtaining consent, users should assume that these cookies are permanent and that the storage duration may be up to two years.
Processed data types: Meta, communication and procedural data, e.g. IP addresses, time information, identification numbers, involved persons.
Affected persons: Users, e.g. website visitors and users of online services.
Legal bases: Legitimate interests according to Art. 6 para. 1 sentence 1 lit. f GDPR; consent according to Art. 6 para. 1 sentence 1 lit. a GDPR.
Further information on processing operations, procedures and services:
Processing of cookie data based on consent: We use a consent management solution through which users’ consent to the use of cookies or to the procedures and providers named within the consent management solution is obtained.
This procedure serves to obtain, record, manage and revoke consent, especially in relation to the use of cookies and comparable technologies that are used to store, read and process information on users’ end devices.
As part of this procedure, users’ consent is obtained for the use of cookies and the associated processing of information, including the specific processing operations and providers named in the consent management procedure. Users also have the option to manage and withdraw their consent.
Consent declarations are stored in order to avoid renewed requests and to be able to prove consent in accordance with legal requirements. Storage takes place server-side and/or in a cookie, a so-called opt-in cookie, or by means of comparable technologies in order to assign the consent to a specific user or their device.
Unless specific information is available about providers of consent management services, the following general information applies: The duration of storage of consent is up to two years. A pseudonymous user identifier is created, which is stored together with the time of consent, information on the scope of consent, for example concerning categories of cookies and/or service providers, as well as information about the browser, system and end device used.
Legal basis: Consent according to Art. 6 para. 1 sentence 1 lit. a GDPR.
• Cookiebot: Storage and management of consent, consent to cookies and data processing, logging of user decisions, display of privacy and cookie notices, enabling withdrawal or adjustment of consent by users. Service provider: Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Website: https://www.cookiebot.com/de; Privacy policy: https://www.cookiebot.com/de/privacy-policy/; Data processing agreement: Provided by the service provider.Further information: Stored data on the service provider's server: the user's IP number in anonymized form, where the last three digits are set to 0, date and time of consent, browser information, the URL from which consent was sent, a random encrypted key value, and the user's consent status.
Contact and Inquiry Management
When contacting us, for example by post, contact form, email, telephone or via social media, as well as within the framework of existing user and business relationships, the information provided by the requesting persons is processed insofar as this is necessary to answer contact requests and any requested measures.
Processed data types: Contact data, e.g. postal and email addresses or telephone numbers; content data, e.g. text or image messages and posts as well as information relating to them, such as authorship details or time of creation; meta, communication and procedural data, e.g. IP addresses, time information, identification numbers, involved persons.
Affected persons: Communication partners.
Purposes of processing and legitimate interests: Communication; organizational and administrative procedures; feedback, e.g. collecting feedback via online forms; provision of our online offering and user-friendliness.
Storage and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”.
Legal bases: Legitimate interests according to Art. 6 para. 1 sentence 1 lit. f GDPR; performance of a contract and pre-contractual inquiries according to Art. 6 para. 1 sentence 1 lit. b GDPR.
Further information on processing operations, procedures and services:
Contact form: When contacting us via our contact form, by email or through other communication channels, we process the personal data transmitted to us in order to respond to and process the respective request.
This usually includes information such as name, contact information and, where applicable, additional information provided to us that is necessary for appropriate processing. We use this data exclusively for the stated purpose of contact and communication.
Legal bases: Performance of a contract and pre-contractual inquiries according to Art. 6 para. 1 sentence 1 lit. b GDPR; legitimate interests according to Art. 6 para. 1 sentence 1 lit. f GDPR.
Communication via Messenger
We use messengers for communication purposes and therefore ask you to observe the following information regarding the functionality of messengers, encryption, the use of communication metadata and your options to object.
You may also contact us through alternative channels, for example by telephone or email. Please use the contact details provided to you or the contact options listed within our online offering.
In the case of end-to-end encryption of content, meaning the content of your message and attachments, we point out that the communication content, meaning the content of the message and attached images, is encrypted end-to-end. This means that the content of messages cannot be viewed, not even by the messenger providers themselves.
You should always use an up-to-date version of the messenger with activated encryption so that encryption of message content is ensured.
However, we also inform our communication partners that while messenger providers cannot view the content, they may learn that and when communication partners communicate with us, as well as process technical information about the communication partner’s device and, depending on the settings of their device, location information, so-called metadata.
Information on legal bases: If we ask communication partners for permission before communicating with them via messenger, the legal basis for processing their data is their consent.
Otherwise, if we do not request consent and users contact us on their own initiative, for example, we use messengers in relation to our contractual partners and within the framework of contract initiation as a contractual measure. In the case of other interested parties and communication partners, we process data on the basis of our legitimate interests in fast and efficient communication and in meeting the needs of our communication partners for communication via messenger.
We also point out that we do not transfer the contact data provided to us to messengers for the first time without your consent.
Withdrawal, objection and deletion: You may withdraw consent you have given at any time and object to communication with us via messenger at any time.
In the case of communication via messenger, we delete messages in accordance with our general deletion guidelines, for example as described above, after the end of contractual relationships, in the context of archiving requirements, etc., and otherwise as soon as we can assume that we have answered any information provided by the communication partner, if no reference to a previous conversation is expected and no legal retention obligations prevent deletion.
Reservation of reference to other communication channels: In order to ensure your security, we ask for your understanding that, for certain reasons, we may not be able to answer inquiries via messenger. This applies to situations in which, for example, contract details must be treated particularly confidentially or a response via messenger does not meet formal requirements. In such cases, we recommend using more suitable communication channels.
Processed data types: Contact data, e.g. postal and email addresses or telephone numbers; content data, e.g. text or image messages and posts as well as related information, such as authorship details or time of creation; usage data, e.g. page views and duration of visit, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions; meta, communication and procedural data, e.g. IP addresses, time information, identification numbers, involved persons.
Affected persons: Communication partners.
Purposes of processing and legitimate interests: Communication; direct marketing, e.g. by email or post.
Storage and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”.
Legal bases: Consent according to Art. 6 para. 1 sentence 1 lit. a GDPR; performance of a contract and pre-contractual inquiries according to Art. 6 para. 1 sentence 1 lit. b GDPR; legitimate interests according to Art. 6 para. 1 sentence 1 lit. f GDPR.
Further information on processing operations, procedures and services:
• WhatsApp: A communication service that enables the sending and receiving of text messages, voice messages, images, videos, documents as well as voice and video calls via the internet. Communication takes place through end-to-end encryption, which means content is accessible only to the communication partners involved. To provide the service, the platform processes metadata, e.g. telephone numbers, times and device information, and may use this data to improve functionality, security and service optimization. Service provider: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Legal bases: Legitimate interests according to Art. 6 para. 1 sentence 1 lit. f GDPR. Website: https://www.whatsapp.com/. Privacy Policy: https://www.whatsapp.com/legal/privacy-policy-eea.
Presence in Social Networks / Social Media
We maintain online presences within social networks and process user data in this context in order to communicate with users active there or to provide information about us.
We point out that user data may be processed outside the European Union. This may create risks for users, for example because the enforcement of users’ rights could be made more difficult.
Furthermore, users’ data within social networks is usually processed for market research and advertising purposes. For example, user profiles can be created based on usage behavior and the resulting interests of users. These profiles may in turn be used to display advertisements within and outside the networks that presumably correspond to users’ interests.
For these purposes, cookies are usually stored on users’ computers, in which users’ usage behavior and interests are stored. In addition, data may also be stored in usage profiles independently of the devices used by users, especially if users are members of the respective platforms and are logged in there.
For a detailed presentation of the respective forms of processing and the options to object, opt-out, we refer to the privacy policies and information provided by the operators of the respective networks.
Also in the case of requests for information and the assertion of data subject rights, we point out that these can be most effectively asserted with the providers. Only the providers have access to the users’ data and can directly take appropriate measures and provide information. Should you still require assistance, you may contact us.
Processed data types: Contact data, e.g. postal and email addresses or telephone numbers; content data, e.g. text or image messages and posts as well as related information, such as authorship details or time of creation; usage data, e.g. page views and duration of visit, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions.
Affected persons: Users, e.g. website visitors and users of online services.
Purposes of processing and legitimate interests: Communication; feedback, e.g. collecting feedback via online forms; public relations.
Storage and deletion: Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”.
Legal bases: Legitimate interests according to Art. 6 para. 1 sentence 1 lit. f GDPR.
Further information on processing operations, procedures and services:
• Instagram: Social network that enables sharing photos and videos, commenting on and favoriting posts, messaging, subscribing to profiles and pages. Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Legal bases: Legitimate interests according to Art. 6 para. 1 sentence 1 lit. f GDPR. Website: https://www.instagram.com; Privacy Policy: https://privacycenter.instagram.com/policy/. Basis for third-country transfers: Data Privacy Framework, DPF.
Changes and Updates
We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing carried out by us make this necessary.
We will inform you as soon as the changes require an action on your part, for example consent, or another individual notification.
If we provide addresses and contact information of companies and organizations in this privacy policy, please note that addresses may change over time and we ask you to check the information before contacting them.
Definitions of Terms
In this section, you will receive an overview of the terms used in this privacy policy. Where the terms are legally defined, their legal definitions apply. The following explanations are primarily intended to aid understanding.
Employees: Employees are persons who are in an employment relationship, whether as workers, salaried employees or in similar positions.
An employment relationship is a legal relationship between an employer and an employee, established by an employment contract or agreement. It includes the employer’s obligation to pay the employee remuneration, while the employee provides their work performance.
The employment relationship includes various phases, including the establishment phase in which the employment contract is concluded, the performance phase in which the employee carries out their work, and termination when the employment relationship ends, whether by dismissal, termination agreement or otherwise.
Employee data includes all information relating to these persons and connected to their employment. This includes aspects such as personal identification data, identification numbers, salary and bank data, working hours, holiday entitlements, health data and performance evaluations.
Master data: Master data includes essential information necessary for the identification and administration of contractual partners, user accounts, profiles and similar assignments.
This data may include, among other things, personal and demographic information such as names, contact information, addresses, telephone numbers, email addresses, dates of birth and specific identifiers such as user IDs.
Master data forms the basis for any formal interaction between persons and services, institutions or systems by enabling clear assignment and communication.
Content data: Content data includes information generated in the course of creating, editing and publishing content of all kinds.
This category of data may include texts, images, videos, audio files and other multimedia content published on various platforms and media.
Content data is not limited only to the actual content, but also includes metadata that provides information about the content itself, such as tags, descriptions, author information and publication dates.
Contact data: Contact data is essential information that enables communication with persons or organizations. It includes, among other things, telephone numbers, postal addresses and email addresses, as well as means of communication such as social media handles and instant messaging identifiers.
Meta, communication and procedural data: Meta, communication and procedural data are categories containing information about the manner in which data is processed, transmitted and managed.
Metadata, also known as data about data, includes information describing the context, origin and structure of other data. It may include details about file size, creation date, author of a document and change history.
Communication data records the exchange of information between users across different channels, such as email traffic, call logs, messages in social networks and chat histories, including the persons involved, timestamps and transmission paths.
Procedural data describes processes and workflows within systems or organizations, including workflow documentation, transaction and activity logs, as well as audit logs used for tracking and verifying processes.
Usage data: Usage data refers to information that records how users interact with digital products, services or platforms.
This data includes a wide range of information showing how users use applications, which functions they prefer, how long they stay on certain pages and which paths they follow through an application.
Usage data may also include frequency of use, timestamps of activities, IP addresses, device information and location data.
It is particularly valuable for analyzing user behavior, optimizing user experiences, personalizing content and improving products or services. In addition, usage data plays an important role in identifying trends, preferences and possible problem areas within digital offerings.
Personal data: “Personal data” means any information relating to an identified or identifiable natural person, hereinafter referred to as the “data subject”.
A natural person is considered identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier such as a cookie, or to one or more specific characteristics expressing the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.