Schedule a call

Scroll up

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as “data”) we process, for what purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”).

The terms used are not gender-specific.

Last updated: April 24, 2026

Table of Contents

Controller

First name, Last name / Company
Street, House No.
Postal Code, City, Country

Email address: firstname.lastname@example.eu

Overview of Processing Activities

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of Data Processed

Categories of Data Subjects

Purposes of Processing

Applicable Legal Bases

Applicable legal bases under the GDPR: The following provides an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. Should more specific legal bases also be applicable in individual cases, we will inform you of these in this privacy policy.

National data protection regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains specific provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and automated individual decision-making including profiling. The data protection laws of individual German federal states may also apply.

Security Measures

We implement appropriate technical and organisational measures in accordance with legal requirements, taking into account the state of the art, the costs of implementation, and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access to, input of, disclosure of, ensuring availability of, and separation of such data. Furthermore, we have established procedures to ensure the exercise of data subjects’ rights, the deletion of data and responses to data breaches. We also take the protection of personal data into account when developing or selecting hardware, software and processes, in accordance with the principle of privacy by design and by default.

Securing online connections via TLS/SSL encryption technology (HTTPS): To protect user data transmitted via our online services from unauthorised access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby protecting the data from unauthorised access. TLS, as the more advanced and more secure version of SSL, ensures that all data transmissions comply with the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is being transmitted securely and in encrypted form.

Transmission of Personal Data

In the course of our processing of personal data, it may be transmitted to or disclosed to other entities, companies, legally independent organisational units or individuals. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content integrated into a website. In such cases, we comply with the legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

International Data Transfers

Data processing in third countries: If we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in the context of using third-party services or the disclosure or transfer of data to other persons, entities or companies (which is identifiable by the respective provider’s postal address or if the privacy policy expressly refers to data transfers to third countries), this is always done in accordance with legal requirements.

For data transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of the EU Commission on 10 July 2023. In addition, we have concluded Standard Contractual Clauses with the respective providers that comply with the requirements of the EU Commission and establish contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the Standard Contractual Clauses serve as an additional safeguard. Should changes occur within the framework of the DPF, the Standard Contractual Clauses will serve as a reliable fallback option. In this way, we ensure that your data remains adequately protected even in the event of political or legal changes.

For individual service providers, we inform you whether they are certified under the DPF and whether Standard Contractual Clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/.

For data transfers to other third countries, corresponding safeguards apply, in particular Standard Contractual Clauses, explicit consent or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be obtained from the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consents are revoked or no further legal grounds for processing exist. This applies to cases where the original processing purpose no longer applies or the data is no longer needed. Exceptions to this rule apply where statutory obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for the pursuit of legal claims or for the protection of the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing activities.

Where multiple retention periods or deletion deadlines are specified for a piece of data, the longest period always applies. Data that is no longer retained for its originally intended purpose but is kept due to legal requirements or other reasons is processed exclusively for the reasons justifying its retention.

Retention and deletion of data: The following general retention and archiving periods apply under German law:

Period commences at the end of the year: Where a period does not expressly start on a specific date and is at least one year in length, it automatically begins at the end of the calendar year in which the triggering event occurred. In the case of ongoing contractual relationships in the context of which data is stored, the triggering event is the point in time at which the termination or other ending of the legal relationship becomes effective.

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:

Business Services

We process personal data of our contractual and business partners, such as customers, clients, prospective customers, suppliers and other cooperation partners (collectively referred to as “contractual partners”), for the purpose of initiating, performing and executing contractual relationships and comparable legal relationships. This also includes pre-contractual measures taken at request, as well as communication in connection with the respective contractual relationship.

The processing serves in particular the fulfilment of our primary and ancillary contractual obligations. These include the provision of agreed services, any update and information obligations, the handling of warranty claims and other service disruptions, the processing of cancellations, terminations of continuing obligations, reversals, refunds and the handling of other contract-related declarations and inquiries. Both one-off contracts and ongoing contractual relationships are covered.

Data processed includes in particular master data such as name, address and, where applicable, company name, contact data such as email address and telephone number, contract and service data such as the subject matter of the contract, contract duration, order or reference number, usage and service data, payment and billing data, as well as communication content and histories. Where necessary, we also process data disclosed or provided to us in the course of carrying out an order.

In addition, we process the data to safeguard our rights and to fulfil legal obligations. This includes in particular commercial and tax retention obligations, documentation obligations and, where applicable, proof and accountability obligations. We also process data on the basis of our legitimate interests in proper business management, internal administration, risk management and IT security, and in protecting our business operations and contractual partners against misuse, threats to data, trade secrets and other legal interests. This may also include the involvement of external service providers such as IT and telecommunications providers, transport and logistics companies, payment service providers, banks, tax and legal advisors or other auxiliary persons, insofar as this is necessary for the performance of the contract or the fulfilment of statutory obligations.

Personal data is only passed on to third parties insofar as this is necessary for the performance of the contract, the implementation of pre-contractual measures, the safeguarding of legitimate interests or the fulfilment of statutory obligations. We provide separate information on any processing beyond this, in particular for marketing purposes, within the framework of this privacy policy.

We inform contractual partners which data is required in individual cases during data collection, for example in online forms by means of appropriate labelling or in personal contact.

Data is deleted once it is no longer required for the aforementioned purposes and no statutory retention obligations preclude deletion. Statutory retention periods, in particular under commercial and tax law, may require longer storage. Data transmitted in connection with a specific order is deleted after completion of the order and expiry of any applicable retention periods, unless there are further statutory or contractual storage obligations.

The legal basis for processing is Art. 6 para. 1 lit. b GDPR for the implementation of pre-contractual measures and the performance of the respective contractual relationship, and Art. 6 para. 1 lit. c GDPR for compliance with legal obligations. Where processing is based on legitimate interests, it is carried out on the basis of Art. 6 para. 1 lit. f GDPR, namely to safeguard our legitimate interests in proper and efficient business organisation, internal administration and documentation of business transactions, the assertion and defence of legal claims, ensuring IT and data security, prevention of misuse and fraud, and the economic management and further development of our business operations.

Provision of the Online Offering and Web Hosting

We process users’ data in order to be able to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

Further information on processing activities, procedures and services:

Use of Cookies

The term “cookies” refers to functions that store and read information on users’ devices. Cookies can also be used for different purposes, such as to ensure the functionality, security and convenience of online offerings and to create analyses of visitor flows. We use cookies in accordance with statutory regulations. Where necessary, we obtain users’ prior consent. If consent is not required, we rely on our legitimate interests. This applies where storing and reading information is essential in order to provide expressly requested content and functions. This includes, for example, saving settings and ensuring the functionality and security of our online offering. Consent may be withdrawn at any time. We provide clear information about the scope of consent and which cookies are used.

Notes on data protection legal bases: Whether we process personal data using cookies depends on whether consent has been given. If consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, as explained above in this section and in the context of the respective services and procedures.

Storage duration: With regard to storage duration, the following types of cookies are distinguished:

General information on withdrawal and objection (opt-out): Users may withdraw the consents they have given at any time and may also object to processing in accordance with statutory regulations, including by means of the privacy settings of their browser.

Further information on processing activities, procedures and services:

Contact and Inquiry Management

When contacting us (e.g. by post, contact form, email, telephone or via social media) and in the context of existing user and business relationships, the information provided by the enquiring persons is processed insofar as this is necessary to respond to the contact enquiries and any requested measures.

Further information on processing activities, procedures and services:

Newsletters and Electronic Notifications

We send newsletters, emails and other electronic notifications (hereinafter “newsletters”) exclusively with the consent of the recipients or on a statutory basis. Where the contents of a newsletter are specifically described in the course of registration, they are decisive for users’ consent. To subscribe to our newsletter, it is normally sufficient to provide your email address. To offer you a personalised service, however, we may ask for your name for a personal salutation in the newsletter, or for additional information if this is necessary for the purposes of the newsletter.

Deletion and restriction of processing: We may retain unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to provide evidence of previously given consent. The processing of this data is restricted to the purpose of potential defence against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. In the event of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a blocklist.

The registration process is logged on the basis of our legitimate interests for the purpose of demonstrating that it has been carried out properly. Where we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure sending system.

Contents:

Information about us, our services, promotions and offers.

Further information on processing activities, procedures and services:

Web Analytics, Monitoring and Optimisation

Web analytics (also referred to as “reach measurement”) serves to evaluate the flow of visitors to our online offering and may include behaviour, interests or demographic information about visitors, such as age or gender, as pseudonymous values. By means of reach analysis, we can, for example, identify at what time our online offering or its functions or content are most frequently used, or are used repeatedly. We can also identify which areas need optimisation.

In addition to web analytics, we may also use testing procedures to test, for example, different versions of our online offering or its components in order to optimise them.

Unless stated otherwise below, profiles — i.e. data aggregated into a single usage process — may be created for these purposes and information may be stored in and read from a browser or device. The information collected includes in particular websites visited and elements used thereon, as well as technical information such as the browser used, the computer system used and information on usage times. Where users have consented to the collection of their location data from us or from the providers of services we use, location data may also be processed.

Furthermore, users’ IP addresses are stored. However, we use an IP masking procedure (i.e. pseudonymisation by shortening the IP address) to protect users. In general, no clear data of users (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimisation, but pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: Where we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we also refer you to the information on the use of cookies in this privacy policy.

Further information on processing activities, procedures and services:

Presences on Social Networks (Social Media)

We maintain online presences within social networks and process user data in this context in order to communicate with users active there or to offer information about us.

We draw attention to the fact that user data may be processed outside the European Union in this context. This may entail risks for users, as it could, for example, make it more difficult to enforce users’ rights.

Furthermore, user data within social networks is usually processed for market research and advertising purposes. For example, usage profiles may be created based on users’ usage behaviour and the interests derived therefrom. These profiles may in turn be used to place advertisements inside and outside the networks that are presumed to match users’ interests. For this purpose, cookies are generally stored on users’ computers, in which users’ usage behaviour and interests are stored. In addition, data may also be stored in users’ profiles regardless of the devices they use (particularly if they are members of the respective platforms and are logged in to them).

For a detailed description of the respective processing forms and opt-out options, we refer you to the privacy policies and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we also point out that these can most effectively be asserted with the providers. Only the latter have access to users’ data and can take appropriate measures and provide information directly. If you still need assistance, please do not hesitate to contact us.

Further information on processing activities, procedures and services:

Plug-ins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may be, for example, graphics, videos or city maps (hereinafter uniformly referred to as “content”).

The integration always requires the third-party providers of this content to process users’ IP addresses, as without the IP address they would not be able to send the content to users’ browsers. The IP address is therefore necessary for the display of this content or functions. We endeavour to only use content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may furthermore be stored in cookies on users’ devices and may contain, among other things, technical information about the browser and operating system, referring websites, the time of visit and other details about the use of our online offering, but may also be linked to such information from other sources.

Notes on legal bases: Where we ask users for their consent to the use of third-party providers, the legal basis for data processing is the permission given. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we also refer you to the information on the use of cookies in this privacy policy.

Further information on processing activities, procedures and services:

Amendment and Update

We ask you to regularly review the content of our privacy policy. We update the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an action on your part (e.g. consent) or any other individual notification.

Where we provide addresses and contact information of companies and organisations in this privacy policy, please be aware that addresses may change over time and we ask you to verify the details before making contact.

Definitions

This section provides an overview of the terms used in this privacy policy. Where terms are legally defined, their legal definitions apply. The following explanations are primarily intended to aid understanding.

Created with the free privacy policy generator by Dr. Thomas Schwenke