This privacy policy explains what personal data we process when you visit this website, for what purposes and on what legal basis, and what rights you have under the General Data Protection Regulation (GDPR). The German version of this policy is the legally binding one.
1. Controller
The controller for data processing on this website is:
[Full company name including legal form] [Street and number] [Postal code and city] Email: [email address]
You can reach our data protection officer at [data protection officer's email address]. [Delete this sentence if no appointment is required under Article 37 GDPR.]
2. Principles and legal bases
We process personal data only where this is necessary to provide this website and the functions offered through it, or where you have given your consent. Depending on the processing, we rely on the following legal bases:
- Article 6(1)(a) GDPR, where you have consented to a processing operation, for example when signing up for our updates.
- Article 6(1)(b) GDPR, where processing is necessary to perform a contract or to take steps prior to entering into one.
- Article 6(1)(c) GDPR, where we are subject to a legal obligation, such as commercial or tax retention duties.
- Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests and your interests do not override them, such as operating this website securely.
3. Hosting
This website is hosted by an external service provider: [name and address of the hosting provider].
The provider processes the data collected through this website solely on our behalf and on our instructions. We have concluded a data processing agreement with them under Article 28 GDPR. The legal basis is our legitimate interest in providing this website securely and reliably, pursuant to Article 6(1)(f) GDPR.
4. Server log files
When you access this website, our hosting provider automatically collects and stores information in what are known as server log files, which your browser transmits. These are:
- browser type and version
- operating system used
- referrer URL, that is, the page visited previously
- host name of the accessing device
- time of the server request
- IP address
5. Cookies
This website uses cookies and comparable technologies. We set strictly necessary cookies without your consent on the basis of section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). We set all other cookies only where you have consented under section 25(1) TDDDG; the associated processing is then based on Article 6(1)(a) GDPR.
Our Cookie Policy describes which cookies we use in detail, how long they are stored, and how you can change your decision.
6. Contact form
When you write to us through the contact form, we process the data you provide — your name, email address and the content of your message — solely to handle your enquiry and any follow-up questions.
The legal basis is Article 6(1)(b) GDPR where your enquiry is aimed at entering into a contract, and otherwise our legitimate interest in responding to enquiries under Article 6(1)(f) GDPR.
7. Signing up for updates
When you sign up for our Germany updates, we process the data you provide — first name, email address, city or postal code, and your areas of interest — in order to send you the information you asked for.
The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw this consent at any time with effect for the future, for example via the unsubscribe link in every email or informally to the email address given above. The lawfulness of processing carried out before withdrawal is unaffected.
8. Meta Pixel
[Delete this section if no pixel is in use.] Where you have consented, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. It allows us to follow the behaviour of visitors who reached our website through an advertisement, and to evaluate the effectiveness of our ads.
The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. We assume that Meta also processes the data collected for its own purposes; to that extent there is joint controllership under Article 26 GDPR.
9. Recipients and processors
We disclose personal data only where this is necessary for the purposes described or where you have consented. Recipients may include our hosting provider, our email delivery provider, and IT service providers who support us with operation and maintenance.
We have concluded agreements under Article 28 GDPR with every provider that processes data on our behalf. We disclose data to public authorities only where we are legally obliged to do so.
10. Transfers to third countries
Where we use providers that process data outside the European Union and the European Economic Area, we do so only where an adequacy decision of the European Commission exists or appropriate safeguards under Article 46 GDPR are in place, in particular the European Commission's standard contractual clauses.
You can obtain a copy of these safeguards on request at the email address given above. [Name the specific third-country transfers here.]
11. Retention periods
We store personal data only for as long as it is needed for the respective purposes. We then delete it, unless statutory retention obligations apply — such as the six and ten year periods under German commercial and tax law.
We delete enquiries received through the contact form once they have been dealt with conclusively and no retention obligations apply. We store your update signup data until you withdraw your consent.
12. Your rights
As a data subject you have the following rights. An informal message to the email address given above is enough to exercise them:
- access to the data stored about you, under Article 15 GDPR
- rectification of inaccurate data, under Article 16 GDPR
- erasure, under Article 17 GDPR
- restriction of processing, under Article 18 GDPR
- data portability, under Article 20 GDPR
- objection to processing, under Article 21 GDPR
- withdrawal of consent with effect for the future, under Article 7(3) GDPR
- complaint to a supervisory authority, under Article 77 GDPR, in particular in the member state of your residence or of the alleged infringement
13. Right to object
Where we process data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.
We will then no longer process the data concerned, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
14. Data security
This website uses TLS encryption, which you can recognise in your browser's address bar. It protects the content you send us from being read by third parties in transit.
We also take technical and organisational measures under Article 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access. We keep these measures aligned with the state of the art.
15. Changes to this privacy policy
We update this privacy policy whenever our processing changes or a change becomes legally necessary. The version published on this page applies; the date of the last change is given above.