DATA PROTECTION

Preamble

With the following data protection declaration, we would like to inform you about the types of personal data (hereinafter also referred to as “data”) that we process, for what purposes and to what extent. The privacy policy applies to all processing of personal data by us, both in the context of the provision of our services and in particular on our websites, in mobile applications and within external online presences such as our social media profiles (hereinafter collectively referred to as “Online Offer”).

The terms used are gender-neutral.

Responsible

Stephan Klose, MD

E-mail address: office(at)amtras.de

Relevant legal bases

Relevant legal bases according to the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection regulations of your or our country of residence or domicile may also apply. If, in addition, more specific legal bases are relevant in individual cases, we will inform you of these in the data protection declaration.

Consent (Art. 6 (1) p. 1 lit. a) DSGVO) – The data subject has given his/her consent to the processing of personal data relating to him/her for a specific purpose or purposes.
Contract performance and pre-contractual requests (Art. 6 (1) p. 1 lit. b) DSGVO) – Processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures taken at the data subject’s request.
Legal obligation (Art. 6 (1) p. 1 lit. c) DSGVO) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
Protection of vital interests (Art. 6(1)(d) GDPR) – Processing is necessary to protect the vital interests of the data subject or another natural person.
Legitimate interests (Art. 6 (1) p. 1 lit. f) DSGVO) – Processing is necessary to protect the legitimate interests of the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
Processing of special categories of personal data Health, occupation and social security (Art. 9(2)(h) GDPR).
Consent to the processing of special categories of personal data (Art. 9(2)(a) GDPR).
Processing of special categories of personal data to protect vital interests (Art. 9(2)(c) GDPR).

National data protection provisions in Germany: In addition to the data protection provisions of the GDPR, national data protection provisions apply in Germany. This includes, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). In particular, the BDSG contains specific provisions on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision-making in individual cases, including profiling. In addition, the data protection laws of the individual federal states may apply.

Note on the applicability of the GDPR and the Swiss Data Protection Act (DPA): This data protection notice serves to provide information in accordance with both the Swiss Federal Data Protection Act (DPA) and the General Data Protection Regulation (GDPR). For this reason, we ask you to note that the terms of the GDPR are used for reasons of broader geographical scope and better comprehensibility. In particular, instead of the terms “processing” of “personal data”, “overriding interest” and “particularly sensitive personal data” used in the FADP, the terms “processing” of “personal data” and “legitimate interest” and “special categories of data” used in the GDPR are used. However, the legal meaning of these terms continues to be governed by the Swiss DPA.

Overview of the processing

The following overview summarizes the types of data processed, the purposes of the processing and the data subjects.

Types of data processed

Inventory data.
Payment details.
Contact details.
Content data.
Contract data.
Usage data.
Meta, communication and process data.

Purpose of processing

Provision of contractual services and fulfillment of contractual obligations.
Contact requests and communication.
Safety measures.
Direct marketing.
Reach measurement.
Office and organizational procedures.
Managing and responding to inquiries.
Feedback.
Marketing.
Profiles with user-related information.
Provision of our online offer and user-friendliness.
IT infrastructure.

Security measures

We take appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the cost of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to, as well as access, entry, disclosure, availability, and segregation of data. In addition, we have established procedures to ensure the exercise of data subjects’ rights, the deletion of data, and the response to data compromise. In addition, we take the protection of personal data into account as early as the development or selection of hardware, software and processes in accordance with the principles of data protection through technology design and data protection-friendly default settings.

Disclosure of personal data

In the course of our processing of personal data, data may be transferred or disclosed to other entities, companies, legally independent organizational units or persons. Recipients of this data may be, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In these cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

International data transmission

Data processing in third countries: Insofar as we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this shall only take place in accordance with the statutory provisions.

Subject to express consent or a contractually or legally required transfer (cf. Art. 49 GDPR), we only process or allow data to be processed in third countries with a recognized level of data protection (Art. 45 GDPR), in the presence of and compliance with contractual obligations through so-called standard data protection clauses of the EU Commission (Art. 46 GDPR) or in the presence of certifications or binding internal data protection regulations (cf. Art. 44 to 49 GDPR, EU Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

EU-US Trans-Atlantic Data Privacy Framework: Within the framework of the so-called “Data Privacy Framework” (DPF), the EU Commission has also recognized the level of data protection for certain companies in the U.S. as secure within the framework of the adequacy decision of 10.07.2023. The list of certified companies and more information on the DPF can be found on the U.S. Department of Commerce’s website at https://www.dataprivacyframework.gov/ (in English). We inform you within the scope of the data protection notice which service providers we use are certified according to the Data Privacy Framework.

Rights of the data subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 para. 1 lit. e or f DSGVO; this also applies to profiling based on these provisions. If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is related to such direct marketing.
Revocation of consents: You have the right to revoke any consent you have given at any time.
Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to request information about this data and further information and a copy of the data in accordance with the legal provisions.
Right of rectification: You have the right to request that data concerning you be completed or that inaccurate data be corrected, in accordance with the provisions of the law.
Right to erasure and restriction of processing: You have the right, in accordance with the law, to request that data concerning you be erased immediately or, alternatively, in accordance with the law, to request that the processing of the data be restricted.
Right to data portability: You have the right to receive the data concerning you that you have provided to us in a structured, common and machine-readable format in accordance with the legal provisions, or to request that it be transferred to another controller.
Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the requirements of the GDPR.

Cookies use

Cookies are small text files or other memory markers that store information on end devices and read information from end devices. For example, to store the login status in a user account, the contents of a shopping cart in an online store, content accessed or functions used in an online offering. In addition, cookies can be used for various purposes, e.g. to ensure the functionality, security and user-friendliness of online offers or to analyze visitor flows.

Consent notices: We use cookies in accordance with the law. We therefore obtain users’ consent in advance, unless consent is not required by law. In particular, consent is not required if the storage and reading of information, i.e. including cookies, is absolutely necessary in order to provide the user with a telemedia service expressly requested by the user (i.e. our online offering). The cookies that are absolutely necessary are usually cookies with functions that serve the presentation and functionality of the online offer, load balancing, security, storage of preferences and choices of the user or similar purposes related to the provision of the main and secondary functions of the online offer desired by the user. The revocable consent is clearly communicated to the user and contains information about the respective use of cookies.

Notes on the legal basis under data protection law: The legal basis under data protection law on which we process users’ personal data using cookies depends on whether we obtain users’ consent. If the user consents, the legal basis for the processing of his data is the declared consent. Otherwise, the processing of data processed with the help of cookies is based on our legitimate interests (e.g. in the economic operation of our online offer and the improvement of its user-friendliness) or, if this is done in the context of the fulfillment of our contractual obligations, if the use of cookies is necessary to fulfill our contractual obligations. We explain the purposes for which we process cookies as part of this privacy policy or as part of our consent and processing procedures.

Storage duration: With regard to the storage duration, the following types of cookies are distinguished:

Temporary cookies (also called session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed his end device (e.g. browser or mobile app).
Permanent cookies: Permanent cookies remain stored even after the terminal device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. Likewise, the user data collected with the help of cookies can be used for range measurement. Unless we explicitly inform users about the type and storage duration of cookies (e.g., in the context of obtaining consent), users must assume that cookies are created permanently and that the storage period can be up to two years.

General information on revocation and objection (“opt-out”): Users may revoke the consents they have given at any time and object to processing in accordance with the legal provisions. This can be done, among other things, by the user restricting the use of cookies in the settings of his browser (this may, however, lead to functional restrictions of our online offer).

Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO). Consent (Art. 6 para. 1 p. 1 lit. a) DSGVO).

More information on processing operations, procedures and services:

Consent-based processing of cookie data: We use a cookie consent management system under which user consent to the use of cookies or to the processing and providers mentioned in the cookie consent management system can be obtained, managed and revoked by users. The declaration of consent is stored so that it does not have to be queried again and so that the consent can be proven in accordance with the legal obligation. The storage can take place on the server side and/or in a cookie (so-called opt-in cookie or with the help of comparable technologies) in order to be able to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following information applies: The duration of the storage of consent can be up to two years. In the process, a pseudonymous user ID is formed and stored together with the time of consent, information on the scope of consent (e.g. which categories of cookies and/or service providers) and the browser, system and end device used; legal basis: consent (Art. 6 para. 1 p. 1 lit. a) DSGVO).

Services

We process data of our contractual and business partners, e.g. customers and interested parties (collectively “contractual partners”) in the context of contractual and comparable legal relationships and related measures as well as in the context of communication with contractual partners (or pre-contractual), e.g. to respond to inquiries.

We process this data to fulfill our contractual obligations. This includes, in particular, the obligation to provide the agreed services, any update obligations and the rectification of warranty and other service disruptions. In addition, we process the data to safeguard our rights and for the purposes of the administrative tasks associated with these duties and the company organization. In addition, we process the data on the basis of our legitimate interests in proper and economic business management and security measures to protect our contractual partners and our business operations from misuse, threats to their data, secrets, information and rights (e.g. to involve telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the scope of applicable law, we will only disclose data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or to fulfill legal obligations. The contractual partners will be informed about further forms of processing, e.g. for marketing purposes, within the scope of this data protection declaration.

We inform the contractual partners which data are required for the aforementioned purposes before or in the course of data collection, e.g. in online forms, by means of special marking (e.g. colors) or symbols (e.g. asterisks or similar) or in person.

We delete the data after the expiry of legal warranty and comparable obligations, i.e. basically after 4 years, unless the data is stored in a customer account, e.g. as long as it must be kept for legal archiving reasons. The statutory retention period for tax-relevant documents as well as for commercial books, inventories, opening balances, annual financial statements, the work instructions and other organizational documents required for their comprehension as well as accounting vouchers is ten years, for received commercial and business letters as well as reproductions of sent commercial and business letters six years. The period begins with the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance sheet, the annual financial statements or the management report was prepared, the commercial or business letter was received or sent, the accounting document was created, the recording was made or the other documents were created.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and data protection notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

Type of data processed: Inventory data (e.g. name, address); payment data (e.g. bank details, invoice, payment history); contact data (e.g. e-mail, telephone number). Contract data (e.g. subject matter of the contract, duration of the contract, customer category).
Special Categories of Personal Data Health data; sex life or sexual orientation data. Religious or philosophical beliefs.
Affected persons: Interested parties; business and contractual partners. Patients.
Purpose of processing: provision of contractual services and fulfillment of contractual obligations; contact requests and communication; office and organizational operations. Managing and responding to inquiries.
Legal basis: contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b) GDPR); Legal obligation (Art. 6 para. 1 p. 1 lit. c) DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO); Protection of vital interests (Art. 6 para. 1 p. 1 lit. d) DSGVO). 1 lit. (d) GDPR); processing of special categories of personal data health, occupation and social security (Art. 9(2)(h) GDPR); consent to the processing of special categories of personal data (Art. 9(2)(a) GDPR). Processing of special categories of personal data for the protection of vital interests (Art. 9 para. 2 lit. (c) GDPR).

Further guidance on processing operations, procedures and services:

Medical and nursing services: We process the data of our patients in order to be able to provide and invoice our treatment services to them. The data processed, the type, scope, purpose and necessity of their processing are determined by the underlying contractual and patient relationship and are communicated to patients in a timely manner. In the course of our activities, we may also process special categories of data, here in particular health data, possibly also in connection with the patient’s sex life or sexual orientation, as well as data revealing racial and ethnic origin, political opinions, religious or ideological beliefs or trade union membership. For this purpose, we obtain the express consent of patients where necessary and otherwise process the special categories of data for health care purposes or to protect the vital interests of patients. Insofar as this is necessary for the fulfillment of the contract, for the protection of vital interests or required by law (e.g. for the fulfillment of obligations under social law and reporting obligations) or if the patient has given his or her consent, we disclose or transfer the patient’s data to third parties or agents, such as authorities, medical institutions, laboratories, billing offices and in the area of IT, office or comparable services, in compliance with professional regulations. Your data will be retained for as long as is necessary to provide our services and any follow-up support. The retention period is usually ten years, but may deviate in individual cases due to special regulations, e.g., the requirements of the Radiation Protection Act; legal bases: contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b) DSGVO), legal obligation (Art. 6 para. 1 p. 1 lit. c) GDPR), protection of vital interests (Art. 6 para. 1 p. 1 lit. d) GDPR), processing of personal data (Art. 6 para. 1 p. 1 lit. e) GDPR), processing of personal data necessary for the performance of the contract (Art. 6 para. 1 p. 1 lit. f) GDPR). (d) GDPR), processing of special categories of personal data health, occupation and social security (Art. 9(2)(h) GDPR), consent to the processing of special categories of personal data (Art. 9(2)(a) GDPR), processing of special categories of personal data to protect vital interests (Art. 9 para. 2 lit. (c) GDPR).

Payment method

Within the scope of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer efficient and secure payment options to the data subjects and use other service providers (together “payment service providers”) in addition to banks and credit institutions for this purpose.

The data processed by payment service providers includes inventory data such as name and address, bank data such as account number or credit card number, passwords, TANs and checksums, as well as contract-, sum- and recipient-related data. These data are necessary for the execution of the transactions. However, the data entered is only processed and stored by the payment service providers. This means that we do not receive account or credit card related information, only information that confirms or denies payment. Under certain circumstances, the data is transmitted by the payment service providers to credit agencies. This transmission takes place for the purpose of checking identity and creditworthiness. In this regard, we refer to the general terms and conditions and data protection information of the payment service providers.

The terms and conditions and data protection notices of the respective payment service providers, which are available within the respective websites or transaction applications, shall apply to the payment transactions. We also refer to these for further information and the assertion of revocation, information and other data subject rights.

Types of data processed: inventory data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contract data (e.g. subject matter of contract, term, customer category); usage data (e.g. websites visited, interest in content, access times). Meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).
Affected persons: Customers. Interested parties.
Purpose of processing: provision of contractual services and fulfillment of contractual obligations.
Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b) DSGVO).

Further notes on processing procedures, methods and services:

Stripe: payment services (technical connection of online payment methods); service provider: Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA; legal basis: contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b) DSGVO); website: https://stripe.com; privacy policy: https://stripe.com/de/privacy. Basis third country transfer: EU-US Data Privacy Framework (DPF).

Provision of the online offer and web hosting

We process user data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or terminal device.

Type of data processed: Usage data (e.g. web pages visited, interest in content, access times). Meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).
Data subjects: Users (e.g. visitors to the website, users of online services).
Purpose of processing: provision of our online offer and user-friendliness; information technology infrastructure (operation and provision of information systems and technical facilities (computers, servers, etc.)). Safety measures.
Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).

Further notes on processing procedures, methods and services:

Collection of access data and log files: Access to our online offer is logged in so-called server log files. These can be: Address and name of the retrieved pages and files, date and time of retrieval, amount of data transferred, notification of successful retrieval, browser type and version, operating system of the user, referrer URL (the previously visited page) and usually the IP address and the requesting provider. The server log files may be used on the one hand for security purposes, e.g. to prevent server overloads (especially in the case of abusive attacks, so-called DDoS attacks) and on the other hand to ensure the utilization and stability of the servers; legal basis: legitimate interest (Art. 6 para. 1 p. 1 lit. f) DSGVO). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is exempt from deletion until final clarification of the respective incident.

Management of contacts and requests

When contacting us (e.g. by mail, contact form, e-mail, telephone or via social media) as well as in the context of existing user and business relationships, the data of the inquiring persons are processed to the extent necessary to respond to the contact requests and to carry out the requested actions.

Types of data processed: Contact data (e.g. e-mail addresses, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times). Meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).
Affected persons: Communication partners.
Purpose of processing: contact requests and communication; managing and responding to requests; feedback (e.g., soliciting feedback via online forms). Provision of our online offer and user-friendliness.
Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).

Communication via messenger

We use messengers for communication and therefore ask you to observe the following instructions on how the messengers work, on encryption, on the use of metadata of the communication and on your options to object.

You can also reach us in other ways, e.g. by phone or e-mail. Please use the contact options communicated to you or indicated in our online offer.

In case of end-to-end encryption of the content (i.e. the content of your message and the attachments), we point out that the communication content (i.e. the content of the message and the attached images) will be encrypted end-to-end. This means that the content of the messages cannot be viewed, not even by the messenger providers themselves. You should always use an up-to-date version of Messenger with encryption enabled to ensure that the message content is encrypted.

However, we additionally point out to our communication partners that although the messenger providers cannot view any content, they can learn that and when the communication partners communicate with us and that technical information about the devices used by the communication partners and, depending on the settings of the devices, also location information (so-called metadata) is processed.

Notes on the legal basis: If we ask our communication partners for consent before communicating with them via Messenger, the legal basis for processing their data is their consent. For the rest, we use messengers, unless we obtain consent and they contact us, for example, on their own initiative, in the relationship with our contractual partners as well as in the context of contract initiation as a contractual measure and in the relationship with other interested parties and communication partners based on our legitimate interests in fast and efficient communication and the fulfillment of our communication partners’ needs for communication via messenger. We would also like to point out that we do not pass on the contact data provided to us to Messenger without your consent.

Revocation, objection and deletion: You can revoke a given consent at any time

Type of data processed: Contact data (e.g. e-mail, telephone numbers); Usage data (e.g. web pages visited, interest in content, – This text area must be activated with a premium license. – Premium text Premium text Premium text ). Meta, communication and process data (e.g. IP addresses, time information, identification numbers, – This text area must be unlocked with a premium license. – Premium text Premium text Premium text ).
Affected persons: Communication partners.
Purpose of processing: contact requests and communication. Direct marketing (e.g. by e-mail or post).
Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a) DSGVO). Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).

Web analysis, monitoring and optimization

Web analytics (also called “reach measurement”) is used to evaluate the flow of visitors to our online offering and may include behavior, interests or demographic information of visitors such as age or gender as pseudonymous values. With the help of reach analysis, we can, for example, identify the times at which our online offering or its functions or content are most frequently used or invite re-use. Likewise, we can understand in which areas there is a need for optimization.

In addition to web analytics, we may also use testing procedures, for example, to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e. data summarized about a usage process, can be created for these purposes and information can be stored and read in a browser or in a terminal device. The data collected includes, in particular, the websites visited and the elements used there, as well as technical data such as the browser used, the computer system used and information on usage times. Insofar as users have given us or the providers of the services we use their consent to the collection of their location data, location data may also be processed.

The IP addresses of the users are also stored. However, to protect users, we use an IP masking method (i.e. pseudonymization by shortening the IP address). In general, no clear user data (such as e-mail addresses or names) is stored as part of web analysis, A/B testing and optimization, but pseudonyms are. This means that both we and the providers of the software used do not know the actual identity of the users, but only the data stored in the user profiles for the purposes of the respective processes.

Type of data processed: Usage data (e.g. web pages visited, interest in content, access times). Meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).
Data subjects: Users (e.g. visitors to the website, users of online services).
Purpose of processing: Reach measurement (e.g. access statistics, recognition of returning visitors). Profiles with user-related information (creation of user profiles).
Security measures: IP masking (pseudonymization of the IP address).

Presence in social networks (social media)

We maintain online presences in social networks and process user data in this context in order to communicate with users active there or to offer information about us.

We would like to point out that the users’ data may be processed outside the territory of the European Union in the process. This may result in risks for users, as it may be more difficult to enforce user rights, for example.

In addition, user data within social networks is usually processed for market research and advertising purposes. For example, usage profiles can be created based on the usage behavior and the resulting interests of the users. The usage profiles can in turn be used, for example, to place advertisements within and outside the networks that are intended to match the interests of the users. For these purposes, cookies are usually stored on the users’ computers, in which the usage behavior and interests of the users are recorded. In addition, device-independent data may also be stored in the usage profiles (especially if the users are members of the respective platforms and log in there).

For a detailed presentation of the respective forms of processing and opt-out options, please refer to the privacy statements and notices of the respective network operators.

Also in the case of requests for information and the assertion of data subject rights, we point out that these can be asserted most effectively against the providers. Only the providers have access to the users’ data and can directly take appropriate measures and provide information. If you still need help, please contact us.

Types of data processed: Contact data (e.g. e-mail addresses, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times). Meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).
Data subjects: Users (e.g. visitors to the website, users of online services).
Purposes of processing: contact requests and communication; feedback (e.g., soliciting feedback via online forms). Marketing.
Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).

Further notes on processing procedures, methods and services:

LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate Interests (Art. 6 para. 1 p. 1 lit. f) DSGVO)

Plugins, embedded functions and content

We incorporate into our online offering functional and content elements that are obtained from the servers of their respective providers (hereinafter “third-party providers”). This may include, for example, graphics, videos or city maps (hereinafter uniformly referred to as “Content”).

The integration always requires that the third-party providers of this content process the user’s IP address, since without the IP address they would not be able to send the content to the user’s browser. The IP address is thus required for the display of this content or function. We endeavor to use only such content whose respective providers use the IP address exclusively for the delivery of the content. In addition, third-party providers may use so-called pixel tags (invisible graphics, also called “web beacons”) for statistical or marketing purposes. With the help of the “pixel tags”, information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, dwell time, and other information about the use of our online services and may be merged with such information from other sources.

Type of data processed: Usage data (e.g. web pages visited, interest in content, access times). Meta, communication and process data (e.g. IP addresses, time data, identification numbers, consent status).
Data subjects: Users (e.g. visitors to the website, users of online services).
Purpose of processing: Provision of our online offer and user-friendliness.
Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f) DSGVO).

Further notes on processing procedures, methods and services:

Google Fonts (sourcing from Google server): Obtaining fonts (and symbols) with the aim of technically secure, maintenance-free and efficient use of fonts and symbols in terms of timeliness and loading times, their uniform presentation and consideration of possible restrictions under licensing law. The user’s IP address is transmitted to the font provider so that the fonts can be made available in the user’s browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) are transmitted that are necessary for the provision of the fonts depending on the devices used and the technical environment. This data may be processed on a server of the font provider in the USA – When visiting our online offer, the user’s browser sends HTTP requests to the Google Fonts Web API (i.e. a software interface for retrieving fonts). The Google Fonts Web API provides users with Google Fonts’ Cascading Style Sheets (CSS) and then the fonts specified in the CCS. These HTTP requests contain (1) the IP address through which the user is accessing the Internet, (2) the requested URL on the Google server, and (3) the HTTP headers, including the user agent describing the browser and operating system version of the website visitor, and the referrer URL (i.e., the website where the Google script should be displayed). IP addresses are neither logged nor stored on Google’s servers and are not analyzed. The Google Fonts Web API logs details of HTTP requests (requested URL, user agent, and referrer URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wants to load fonts. This data is logged so that Google can determine how many times a particular font family has been requested. With the Google Fonts Web API, the user agent must match the font that is generated for the particular browser type. The user agent is logged primarily for debugging purposes and is used to generate aggregate usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the Google Fonts analytics page. Finally, the referral URL is logged so that the data can be used for production maintenance and an aggregate report of top integrations can be generated based on the number of font requests. Google declares that the information collected by Google Fonts will not be used to profile end users or serve targeted ads: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: legitimate interests (Art. 6 (1) p. 1 lit. f) DSGVO); Website: https://fonts.google.com/; Privacy policy: https://policies.google.com/privacy; Basis for transfer to third countries: EU-US Data Privacy Framework (DPF). Further information: https://developers.google.com/fonts/faq/privacy?hl=de.

Created according to the data protection generator by DrThomasSchwenke