Privacy Policy

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offering").

The terms used are not gender-specific.

Status: October 1, 2025

Table of Contents

• Preamble
• Controller
• Overview of Processing
• Relevant Legal Bases
• Security Measures
• Transfer of Personal Data
• International Data Transfers
• General Information on Data Storage and Deletion
• Rights of Data Subjects
• Business Services
• Business Processes and Procedures
• Provision of Online Offering and Web Hosting
• Use of Cookies
• Registration, Login and User Account
• Contact and Inquiry Management
• Newsletter and Electronic Notifications
• Promotional Communication via Email, Mail, Fax or Telephone
• Web Analytics, Monitoring and Optimization
• Online Marketing
• Social Media Presence

Controller

Kauling, Stefan Werner / aratall GmbH
Albert-Einstein-Str. 1
49076, Osnabrück, Germany

Authorized representatives: Stefan Werner Kauling

Email address: s.kauling@aratall.com

Phone: +4954193133910

Imprint: www.aratall.com/imprint/

Overview of Processing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of Data Processed

• Inventory data.
• Payment data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication and procedural data.
• Log data.

Categories of Data Subjects

• Service recipients and clients.
• Interested parties.
• Communication partners.
• Users.
• Business and contractual partners.
• Customers.

Purposes of Processing

• Provision of contractual services and fulfillment of contractual obligations.
• Communication.
• Security measures.
• Direct marketing.
• Reach measurement.
• Tracking.
• Office and organizational procedures.
• Target group formation.
• Organizational and administrative procedures.
• Feedback.
• Marketing.
• Profiles with user-related information.
• Provision of our online offering and user-friendliness.
• Information technology infrastructure.
• Public relations.
• Sales promotion.
• Business processes and business management procedures.

Relevant Legal Bases

Relevant legal bases according to the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the GDPR regulations, national data protection regulations may apply in your or our country of residence or domicile. If more specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6(1)(1)(a) GDPR) - The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Contract performance and pre-contractual inquiries (Art. 6(1)(1)(b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6(1)(1)(c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1)(1)(f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the GDPR data protection regulations, national data protection regulations apply in Germany. This includes in particular the Federal Data Protection Act (BDSG). The BDSG contains special regulations on the right to information, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision-making in individual cases including profiling. Furthermore, state data protection laws of the individual federal states may apply.

Note on applicability of GDPR and Swiss DPA: These privacy notices serve both to provide information under the Swiss DPA and under the General Data Protection Regulation (GDPR). For this reason, we ask you to note that due to the broader spatial application and comprehensibility, the terms of the GDPR are used. In particular, instead of the terms "processing" of "personal data", "overriding interest" and "particularly sensitive personal data" used in the Swiss DPA, the terms "processing" of "personal data" as well as "legitimate interest" and "special categories of data" used in the GDPR are used. However, the legal meaning of the terms will continue to be determined according to the Swiss DPA within the scope of application of the Swiss DPA.

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing as well as the different likelihood and severity of risks to the rights and freedoms of natural persons, to ensure a level of security appropriate to the risk.

The measures include in particular ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input, disclosure, ensuring availability and separation of the data. Furthermore, we have established procedures that ensure the exercise of data subject rights, deletion of data and responses to data threats. Furthermore, we take data protection into account in the development or selection of hardware, software and procedures in accordance with the principle of data protection by design and through privacy-friendly default settings.

Transfer of Personal Data

As part of our processing of personal data, it may happen that data is transferred to other bodies, companies, legally independent organizational units or persons or disclosed to them. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with legal requirements and in particular conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

International Data Transfers

Data processing in third countries: If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs as part of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies (which can be identified by the postal address of the respective provider or when the privacy policy explicitly refers to data transfer to third countries), this always takes place in accordance with legal requirements.

For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by an adequacy decision of the EU Commission on July 10, 2023. Additionally, we have concluded standard contractual clauses with the respective providers that comply with the requirements of the EU Commission and establish contractual obligations to protect your data.

This dual protection ensures comprehensive protection of your data: The DPF forms the primary protection level, while the standard contractual clauses serve as additional security. Should changes occur within the DPF framework, the standard contractual clauses act as a reliable fallback option. This ensures that your data always remains adequately protected, even in the event of political or legal changes.

For individual service providers, we inform you whether they are certified under the DPF and whether standard contractual clauses are in place. Further information about the DPF and a list of certified companies can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English).

For data transfers to other third countries, corresponding security measures apply, in particular standard contractual clauses, explicit consent or legally required transfers. Information on third country transfers and applicable adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with legal provisions as soon as the underlying consents are revoked or no further legal bases for processing exist. This applies to cases where the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule exist when legal obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax reasons or whose storage is necessary for legal prosecution or for the protection of the rights of other natural or legal persons must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that apply specifically to certain processing procedures.

If there are multiple statements on retention periods or deletion deadlines for data, the longest period always applies. Data that is no longer retained for the originally intended purpose but due to legal requirements or other reasons is processed exclusively for the reasons that justify its retention.

Retention and deletion of data: The following general periods apply for retention and archiving under German law:

• 10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheet and the work instructions and other organizational documents necessary for their understanding (§ 147(1) No. 1 in conjunction with (3) AO, § 14b(1) UStG, § 257(1) No. 1 in conjunction with (4) HGB).
• 8 years - Accounting documents such as invoices and expense receipts (§ 147(1) No. 4 and 4a in conjunction with (3) sentence 1 AO and § 257(1) No. 4 in conjunction with (4) HGB).
• 6 years - Other business documents: received commercial or business letters, copies of sent commercial or business letters, other documents insofar as they are relevant for taxation, e.g. hourly wage slips, operating settlement sheets, calculation documents, price markings, but also payroll documents, insofar as they are not already accounting documents and cash register receipts (§ 147(1) No. 2, 3, 5 in conjunction with (3) AO, § 257(1) No. 2 and 3 in conjunction with (4) HGB).
• 3 years - Data necessary to consider potential warranty and damage claims or similar contractual claims and rights as well as to process related inquiries, based on previous business experience and usual industry practices, is stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB).

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this applies also to profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw consent at any time.
• Right of access: You have the right to obtain confirmation as to whether or not data concerning you is being processed and to access this data as well as further information and a copy of the data in accordance with legal requirements.
• Right to rectification: You have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you in accordance with legal requirements.
• Right to erasure and restriction of processing: You have the right, in accordance with legal requirements, to request that data concerning you be erased immediately, or alternatively, in accordance with legal requirements, to request restriction of the processing of the data.
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with legal requirements or to request its transmission to another controller.
• Complaint to supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

Business Services

We process data of our contractual and business partners, e.g. customers and interested parties (collectively referred to as "contractual partners") within the framework of contractual and comparable legal relationships as well as associated measures and with regard to communication with contractual partners (or pre-contractual), e.g. to answer inquiries.

We use this data to fulfill our contractual obligations. This includes in particular the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other service disruptions. In addition, we use the data to protect our rights and for the purposes of administrative tasks associated with these obligations as well as company organization. Furthermore, we process the data on the basis of our legitimate interests both in proper and economical business management and in security measures to protect our contractual partners and our business operations from misuse, endangerment of their data, secrets, information and rights (e.g. for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of applicable law, we only disclose the data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners will be informed about further forms of processing, e.g. for marketing purposes, within the framework of this privacy policy.

We inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g. in online forms, through special marking (e.g. colors) or symbols (e.g. asterisks or similar), or personally.

We delete the data after expiry of statutory warranty and comparable obligations, i.e. generally after four years, unless the data is stored in a customer account, e.g. as long as it must be retained for legal archiving reasons (e.g. for tax purposes, usually ten years). We delete data disclosed to us by the contractual partner as part of an order in accordance with the specifications and generally after the end of the order.

• Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers). Contract data (e.g. subject matter of contract, duration, customer category).
• Data subjects: Service recipients and clients; interested parties. Business and contractual partners.
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; communication; office and organizational procedures; organizational and administrative procedures. Business processes and business management procedures.
• Storage and deletion: Deletion in accordance with information in the section "General information on data storage and deletion".
• Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(1)(b) GDPR); Legal obligation (Art. 6(1)(1)(c) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing procedures, methods and services:

• Project and development services: We process the data of our customers and clients (hereinafter uniformly referred to as "customers") to enable them to select, purchase or commission the selected services or works and associated activities as well as their payment and provision or execution or performance.
  
  The required information is marked as such in the context of the order, purchase order or comparable contract conclusion and includes the information required for service provision and billing as well as contact information to be able to hold any consultations. If we receive access to information of end customers, employees or other persons, we process this in accordance with legal and contractual requirements; Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(1)(b) GDPR).
• Provision of software and platform services: We process the data of our users, registered users and any test users (hereinafter uniformly referred to as "users") in order to be able to provide our contractual services to them and on the basis of legitimate interests to be able to ensure the security of our offering and to be able to develop it further. The required information is marked as such in the context of the order, purchase order or comparable contract conclusion and includes the information required for service provision and billing as well as contact information to be able to hold any consultations; Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(1)(b) GDPR).

Business Processes and Procedures

Personal data of service recipients and clients - including customers, clients or in special cases clients, patients or business partners as well as other third parties - is processed within the framework of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates business processes in areas such as customer management, sales, payment processing, accounting and project management.

The collected data serves to fulfill contractual obligations and to efficiently design business processes. This includes the processing of business transactions, the management of customer relationships, the optimization of sales strategies and ensuring internal accounting and financial processes. In addition, the data supports the protection of the controller's rights and promotes administrative tasks as well as the organization of the company.

Personal data may be disclosed to third parties if this is necessary

• Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses); content data (e.g. text or image messages and posts and the information relating to them, such as information about authorship); contract data (e.g. subject matter of contract, duration, customer category); usage data (e.g. page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with). Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, involved).
• Data subjects: Service recipients and clients; interested parties; communication partners; business and contractual partners. Customers.
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and business management procedures; security measures. Provision of our online offering and user-friendliness.
• Storage and deletion: Deletion in accordance with information in the section "General information on data storage and deletion".
• Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(1)(b) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing procedures, methods and services:

• Customer account: Customers can create an account within our online offering (e.g. customer or user account, "customer account" for short). If the registration of a customer account is required, customers are informed of this as well as the information required for registration. Customer accounts are not public and cannot be indexed by search engines. As part of registration and subsequent logins and use of the customer account, we store the IP addresses of customers along with the access times in order to be able to prove registration and prevent any misuse of the customer account. If the customer account has been terminated, the customer account data will be deleted after the termination date, unless it is retained for purposes other than provision in the customer account or must be retained for legal reasons (e.g. internal storage of customer data, order processes or invoices). It is the customer's responsibility to secure their data upon termination of the customer account; Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(1)(b) GDPR), Legitimate interests (Art. 6(1)(1)(f) GDPR).

Provision of Online Offering and Web Hosting

We process users' data in order to be able to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or terminal device.

• Types of data processed: Usage data (e.g. page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, persons involved). Log data (e.g. log files concerning logins or data retrieval or access times.).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)). Security measures.
• Storage and deletion: Deletion in accordance with information in the section "General information on data storage and deletion".
• Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing procedures, methods and services:

• Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files". Server log files may include the address and name of the web pages and files accessed, date and time of access, data volumes transferred, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page) and usually IP addresses and the requesting provider. The server log files can be used for security purposes, e.g. to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks), and to ensure the utilization of the servers and their stability; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR). Data deletion: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is necessary for evidentiary purposes is excluded from deletion until the final clarification of the respective incident.

Use of Cookies

The term "cookies" refers to functions that store and read information on users' devices. Cookies can be used for different purposes, such as for functionality, security and comfort purposes of online offerings as well as the creation of analyses of visitor flows. We use cookies in accordance with legal regulations. For this purpose, we obtain users' consent in advance if required. If consent is not necessary, we rely on our legitimate interests. This applies if the storage and reading of information is essential to be able to provide explicitly requested content and functions. This includes, for example, the storage of settings and ensuring the functionality and security of our online offering. Consent can be revoked at any time. We provide clear information about their scope and which cookies are used.

Notes on data protection legal bases: Whether we process personal data using cookies depends on consent. If consent is given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage duration: With regard to the storage duration, the following types of cookies are distinguished:

• Temporary cookies (also: session or session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their device (e.g. browser or mobile application).
• Permanent cookies: Permanent cookies remain stored even after the device is closed. For example, the login status can be saved and preferred content can be displayed directly when the user visits a website again. Likewise, user data collected using cookies can be used for reach measurement. Unless we provide users with explicit information about the type and storage duration of cookies (e.g. when obtaining consent), they should assume that these are permanent and that the storage period can be up to two years.

General information on revocation and objection (opt-out): Users can revoke the consent they have given at any time and also file an objection to processing in accordance with legal requirements, including by means of the privacy settings of their browser.

• Types of data processed: Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR). Consent (Art. 6(1)(1)(a) GDPR).

Further information on processing procedures, methods and services:

• Processing of cookie data based on consent: We use a consent management solution in which users' consent to the use of cookies or to the procedures and providers mentioned in the consent management solution is obtained. This procedure serves to obtain, log, manage and revoke consent, in particular with regard to the use of cookies and comparable technologies that are used to store, read and process information on users' devices. As part of this procedure, users' consent is obtained for the use of cookies and the associated processing of information, including the specific processing and providers mentioned in the consent management procedure. Users also have the option to manage and revoke their consent. Consent declarations are stored in order to avoid repeated queries and to be able to provide proof of consent in accordance with legal requirements. Storage takes place on the server side and/or in a cookie (so-called opt-in cookie) or by means of comparable technologies in order to be able to assign consent to a specific user or their device. Unless specific information about the providers of consent management services is available, the following general information applies: The duration of storage of consent is up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of consent (e.g. concerning categories of cookies and/or service providers) and information about the browser, system and device used; Legal bases: Consent (Art. 6(1)(1)(a) GDPR).

Registration, Login and User Account

Users can create a user account. As part of registration, users are informed of the required mandatory information and processed for the purposes of providing the user account based on contractual obligation fulfillment. The processed data includes in particular the login information (username, password and an email address).

As part of the use of our registration and login functions as well as the use of the user account, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests as well as those of users in protection against misuse and other unauthorized use. This data is generally not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so.

Users can be informed via email about processes that are relevant to their user account, such as technical changes.

• Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts and the information relating to them, such as information about authorship or time of creation); usage data (e.g. page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Log data (e.g. log files concerning logins or data retrieval or access times.).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; security measures; organizational and administrative procedures. Provision of our online offering and user-friendliness.
• Storage and deletion: Deletion in accordance with information in the section "General information on data storage and deletion". Deletion after termination.
• Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(1)(b) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing procedures, methods and services:

• Registration with real names: Due to the nature of our community, we ask users to use our offering only using real names. This means that the use of pseudonyms is not permitted; Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(1)(b) GDPR).

Contact and Inquiry Management

When contacting us (e.g. by mail, contact form, email, telephone or via social media) and within the framework of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to respond to the contact requests and any requested measures.

• Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts and the information relating to them, such as information about authorship or time of creation); usage data (e.g. page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, persons involved).
• Data subjects: Communication partners.
• Purposes of processing: Communication; organizational and administrative procedures; feedback (e.g. collecting feedback via online form). Provision of our online offering and user-friendliness.
• Storage and deletion: Deletion in accordance with information in the section "General information on data storage and deletion".
• Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR). Contract performance and pre-contractual inquiries (Art. 6(1)(1)(b) GDPR).

Further information on processing procedures, methods and services:

• Contact form: When contacting us via our contact form, email or other communication channels, we process the personal data transmitted to us to respond to and process the respective request. This typically includes information such as name, contact information and, if applicable, other information that is communicated to us and is necessary for appropriate processing. We use this data exclusively for the stated purpose of contact and communication; Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(1)(b) GDPR), Legitimate interests (Art. 6(1)(1)(f) GDPR).

Newsletter and Electronic Notifications

We send newsletters, emails and other electronic notifications (hereinafter "newsletter") only with the consent of the recipients or on a legal basis. If the contents of the newsletter are specifically described as part of a subscription, they are decisive for users' consent. For subscription to our newsletter, it is usually sufficient to provide your email address. In order to be able to offer you a personalized service, we may ask for your name for personal address in the newsletter or for further information if this is necessary for the purpose of the newsletter.

Deletion and restriction of processing: We may store the unsubscribed email addresses for up to three years based on our legitimate interests before we delete them in order to be able to prove consent previously given. The processing of this data is limited to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a block list (so-called "blocklist").

The logging of the registration process is based on our legitimate interests for the purpose of proving its proper course. If we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure dispatch system.

Information about us, our services, campaigns and offers.

• Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, persons involved). Usage data (e.g. page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions).
• Data subjects: Communication partners.
• Purposes of processing: Direct marketing (e.g. by email or postal mail).
• Legal bases: Consent (Art. 6(1)(1)(a) GDPR).
• Possibility of objection (opt-out): You can cancel the receipt of our newsletter at any time, i.e. revoke your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter or you can use one of the contact options given above, preferably email, for this purpose.

Further information on processing procedures, methods and services:

• Measurement of opening and click rates: The newsletters contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved from our server or, if we use a dispatch service provider, from its server when the newsletter is opened. As part of this retrieval, technical information such as information about the browser and your system as well as your IP address and the time of retrieval are initially collected. This information is used to technically improve our newsletter based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times. This analysis also includes determining whether and when newsletters are opened and which links are clicked. The information is assigned to the individual newsletter recipients and stored in their profiles until deletion. The evaluations serve us to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. The measurement of opening and click rates as well as the storage of measurement results in user profiles; Legal bases: Consent (Art. 6(1)(1)(a) GDPR).

Promotional Communication via Email, Mail, Fax or Telephone

We process personal data for the purposes of promotional communication, which may take place via various channels, such as email, telephone, mail or fax, in accordance with legal requirements.

Recipients have the right to revoke consent given at any time or to object to promotional communication at any time.

After revocation or objection, we store the data required to prove previous authorization for contact or dispatch for up to three years after the end of the year of revocation or objection based on our legitimate interests. The processing of this data is limited to the purpose of a possible defense against claims. Based on the legitimate interest to permanently observe the revocation or objection of users, we also store the data necessary to avoid renewed contact (e.g. depending on the communication channel, the email address, telephone number, name).

• Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers). Content data (e.g. text or image messages and posts and the information relating to them, such as information about authorship or time of creation).
• Data subjects: Communication partners.
• Purposes of processing: Direct marketing (e.g. by email or postal mail); marketing. Sales promotion.
• Storage and deletion: Deletion in accordance with information in the section "General information on data storage and deletion".
• Legal bases: Consent (Art. 6(1)(1)(a) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

Web Analytics, Monitoring and Optimization

Web analytics (also referred to as "reach measurement") serves to evaluate the visitor flows of our online offering and may include behavior, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognize at what time our online offering or its functions or content are most frequently used or invite re-use. We can also understand which areas require optimization.

In addition to web analytics, we may also use test procedures to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e. data aggregated for a usage process, may be created for these purposes and information may be stored in a browser or in a device and then read from it. The information collected includes in particular websites visited and elements used there as well as technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data from us or from the providers of the services we use, location data may also be processed.

The IP addresses of users are also stored. However, we use an IP masking procedure (i.e. pseudonymization by shortening the IP address) to protect users. In general, no clear data of users (such as email addresses or names) is stored in the context of web analysis, A/B testing and optimization, but pseudonyms. This means that we as well as the providers of the software used do not know the actual identity of users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: Where we ask users for their consent to use third-party providers, the legal basis for data processing is consent. Otherwise, users' data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

• Types of data processed: Usage data (e.g. page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles). Provision of our online offering and user-friendliness.
• Storage and deletion: Deletion in accordance with information in the section "General information on data storage and deletion". Storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years.).
• Security measures: IP masking (pseudonymization of IP address).
• Legal bases: Consent (Art. 6(1)(1)(a) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing procedures, methods and services:

• Google Analytics: We use Google Analytics to measure and analyze the use of our online offering based on a pseudonymous user identification number. This identification number does not contain any unique data such as names or email addresses. It serves to assign analysis information to a device in order to recognize which content users have accessed within one or more usage processes, which search terms they have used, have accessed again or have interacted with our online offering. The time of use and its duration are also stored, as are the sources of users that refer to our online offering and technical aspects of their devices and browsers.
  Pseudonymous profiles of users are created with information from the use of various devices, whereby cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. Analytics does, however, provide rough geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). For EU traffic, IP address data is used exclusively for this derivation of geolocation data before being immediately deleted. They are not logged, are not accessible and are not used for further purposes. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers before traffic is forwarded to Analytics servers for processing; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6(1)(1)(a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking (pseudonymization of IP address); Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://business.safety.google/adsprocessorterms); Possibility to object (Opt-Out): Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of advertisements: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (Types of processing and data processed).

Online Marketing

We process personal data for online marketing purposes, which may include in particular the marketing of advertising space or the presentation of advertising and other content (collectively referred to as "content") based on users' potential interests and the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (so-called "cookie") or similar procedures are used, by means of which the information about the user relevant for the presentation of the aforementioned content is stored. This information may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information such as the browser used, the computer system used and information on usage times and functions used. If users have consented to the collection of their location data, this may also be processed.

The IP addresses of users are also stored. However, we use available IP masking procedures (i.e. pseudonymization by shortening the IP address) for user protection. In general, no clear user data (such as email addresses or names) is stored as part of the online marketing process, but pseudonyms. This means that we as well as the providers of online marketing procedures do not know the actual user identity, but only the information stored in their profiles.

The information in the profiles is usually stored in cookies or by means of similar procedures. These cookies can later generally also be read on other websites that use the same online marketing procedure and analyzed for the purpose of displaying content and supplemented with further data and stored on the server of the online marketing procedure provider.

Exceptionally, it is possible to assign clear data to the profiles, primarily when users are, for example, members of a social network whose online marketing procedures we use and the network links users' profiles with the aforementioned information. We ask you to note that users can make additional agreements with the providers, for example through consent as part of registration.

We generally only receive access to aggregated information about the success of our advertisements. However, we can check which of our online marketing procedures have led to a so-called conversion as part of so-called conversion measurements, i.e., for example, to a contract conclusion with us. The conversion measurement is used solely to analyze the success of our marketing measures.

Unless otherwise stated, we ask you to assume that cookies used are stored for a period of two years.

Notes on legal bases: Where we ask users for their consent to use third-party providers, the legal basis for data processing is permission. Otherwise, users' data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Notes on revocation and objection:

We refer to the privacy notices of the respective providers and the objection options given for the providers (so-called "opt-out"). If no explicit opt-out option has been specified, there is the option to switch off cookies in your browser settings. However, this may restrict functions of our online offering. We therefore recommend the following additional opt-out options, which are offered in summary for respective areas:

a) Europe: https://www.youronlinechoices.eu.

b) Canada: https://youradchoices.ca/.

c) USA: https://optout.aboutads.info/.

d) Cross-regional: https://optout.aboutads.info.

• Types of data processed: Usage data (e.g. page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); tracking (e.g. interest/behavior-based profiling, use of cookies); target group formation; marketing. Profiles with user-related information (creation of user profiles).
• Storage and deletion: Deletion in accordance with information in the section "General information on data storage and deletion". Storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years.).
• Security measures: IP masking (pseudonymization of IP address).

Social Media Presence

We maintain online presences within social networks and process user data in this context to communicate with users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may result in risks for users because, for example, the enforcement of users' rights could be made more difficult.

Furthermore, user data within social networks is usually processed for market research and advertising purposes. For example, usage profiles can be created based on usage behavior and resulting interests of users. The latter may in turn be used to place advertisements within and outside the networks that presumably correspond to the interests of users. For these purposes, cookies are usually stored on users' computers, in which the usage behavior and interests of users are stored. Furthermore, data may also be stored in the usage profiles independently of the devices used by users (especially if they are members of the respective platforms and are logged in to them).

For a detailed presentation of the respective forms of processing and the objection options (opt-out), we refer to the privacy policies and information provided by the operators of the respective networks.

Also in the case of requests for information and the assertion of data subject rights, we point out that these can be asserted most effectively with the providers. Only the latter have access to users' data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

• Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts and the information relating to them, such as information about authorship or time of creation). Usage data (e.g. page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Communication; feedback (e.g. collecting feedback via online form). Public relations.
• Storage and deletion: Deletion in accordance with information in the section "General information on data storage and deletion".
• Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing procedures, methods and services:

• Instagram: Social network, enables sharing of photos and videos, commenting and favoriting posts, messaging, subscribing to profiles and pages; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); Website: https://www.instagram.com; Privacy policy: https://privacycenter.instagram.com/policy/. Basis for third country transfers: Data Privacy Framework (DPF).
• Facebook Pages: Profiles within the social network Facebook - The controller is jointly responsible with Meta Platforms Ireland Limited for the collection and transmission of data from visitors to our Facebook page ("fan page"). This includes in particular information about user behavior (e.g. content viewed or interacted with, actions taken) as well as device information (e.g. IP address, operating system, browser type, language settings, cookie data). More information can be found in the Facebook Data Policy: https://www.facebook.com/privacy/policy/. Facebook also uses this data to provide us with statistical evaluations via the "Page Insights" service, which provide insight into how people interact with our page and its content. The basis for this is an agreement with Facebook ("Page Insights Information": https://www.facebook.com/legal/terms/page_controller_addendum), which regulates, among other things, security measures and the exercise of data subject rights. Further information can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data. Users can therefore address requests for information or deletion directly to Facebook. Users' rights (in particular access, deletion, objection, complaint to a supervisory authority) remain unaffected. The joint controllership is limited exclusively to the collection of data by Meta Platforms Ireland Limited (EU). Meta Platforms Ireland Limited is solely responsible for further processing, including any transmission to Meta Platforms Inc. in the USA; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/privacy/policy/. Basis for third country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
• LinkedIn: Social network - We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not further processing) of visitor data used to create the "Page Insights" (statistics) of our LinkedIn profiles. This data includes information about the types of content users view or interact with, and the actions they take. It also includes details about the devices used, such as IP addresses, operating system, browser type, language settings and cookie data, as well as information from user profiles such as job function, country, industry, seniority, company size and employment status. Privacy information on the processing of user data by LinkedIn can be found in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.
  We have entered into a special agreement with LinkedIn Ireland ("Page Insights Joint Controller Addendum", https://legal.linkedin.com/pages-joint-controller-addendum), which specifically regulates which security measures LinkedIn must observe and in which LinkedIn has agreed to fulfill the rights of data subjects (i.e. users can, for example, address requests for information or deletion directly to LinkedIn). Users' rights (in particular the right to information, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. The joint controllership is limited to the collection and transmission of data to LinkedIn Ireland Unlimited Company, a company based in the EU. Further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, especially with regard to the transmission of data to the parent company LinkedIn Corporation in the USA; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Basis for third country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa). Possibility to object (Opt-Out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Pinterest: Social network, enables sharing of photos, commenting, favoriting and curating posts, messaging, subscribing to profiles; Service provider: Pinterest Europe Limited, 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); Website: https://www.pinterest.com. Privacy policy: https://policy.pinterest.com/de/privacy-policy.
• X: Social network; Service provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); Website: https://x.com. Privacy policy: https://x.com/de/privacy.
• Xing: Social network; Service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany; Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); Website: https://www.xing.com/. Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.