Introduction

With the following data protection declaration, we would like to inform you about the types of your personal data (hereinafter also referred to as “data”) that we process, for what purposes and to what extent. The data protection declaration applies to all processing of personal data carried out by us, both in the context of the provision of our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “Online Offer”).

The terms used are not gender specific.

Status: February 23, 2022


Responsible

Eduardo Dohrmann
Idsteinerstrasse, 20
Frankfurt – 60326
Germany
Authorized representatives:

Pascal Marquigny
E-mail address:

sales@cityclass.de


Contact data protection officer

cityclassdigital@gmail.com


Processing overview

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.


Types of data processed

  • Inventory data.
  • Payment details.
  • Contact details.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta/communication data.
  • Applicant Data.
  • Contact Information (Facebook).
  • Event Data (Facebook).


Special categories of data

  • Health data.
  • Religious or ideological beliefs.


Categories of persons concerned

  • Customers.
  • Employees.
  • Interested parties.
  • Communication partner.
  • Users.
  • Applicants.
  • Business and Contractual Partners.


Processing purposes

  • Provision of contractual services and customer service.
  • Contact requests and communication.
  • Safety measures.
  • Direct marketing.
  • Reach measurement.
  • Office and organizational procedures.
  • Remarketing.
  • Conversion measurement.
  • Target group formation.
  • Managing and responding to inquiries.
  • Application Procedure.
  • Content Delivery Network (CDN).
  • Feedback.
  • Marketing.
  • Profiles with user-related information.
  • Target group formation.
  • Provision of our online offer and user-friendliness.


Relevant legal bases

Below you will find an overview of the legal basis of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. If, in addition, more specific legal bases are relevant in individual cases, we will inform you of these in the data protection declaration.

  • Consent (Art. 6 (1) p. 1 lit. a. DSGVO) – The data subject has given his/her consent to the processing of personal data concerning him/her for a specific purpose or purposes.
  • Contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO) – Processing is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures which are carried out at the request of the data subject.
  • Legal obligation (Art. 6 para. 1 p. 1 lit. c. DSGVO) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6 (1) p. 1 lit. f. DSGVO) – Processing is necessary to protect the legitimate interests of the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
  • Application procedure as a pre-contractual or contractual relationship (Art. 9 para. 2 lit. b DSGVO) – Insofar as special categories of personal data within the meaning of Art. 9 para. 1 GDPR (e.g. health data, such as severely disabled status or ethnic origin) are requested from job applicants in order for the controller or the data subject to exercise his or her rights under employment law and social security and social protection law and to comply with his or her obligations in this regard, their processing is carried out in accordance with Art. 9 (1) GDPR. 2 lit. b. DSGVO, in the case of the protection of vital interests of the applicants or other persons pursuant to. Art. 9 par. 2 lit. c. GDPR or for the purposes of preventive health care or occupational medicine, for the assessment of the employee’s fitness for work, for medical diagnostics, care or treatment in the health or social sector or for the management of systems and services in the health or social sector pursuant to. Art. 9 par. 2 lit. h. GDPR. In the case of a communication of special categories of data based on voluntary consent, their processing is carried out on the basis of Art. 9 para. 2 lit. a. GDPR.

In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection apply in Germany. This includes, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). In particular, the BDSG contains special provisions on the right to information, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision-making in individual cases, including profiling. Furthermore, it regulates data processing for purposes of the employment relationship (Section 26 BDSG), in particular with regard to the establishment, implementation or termination of employment relationships as well as the consent of employees. Furthermore, state data protection laws of the individual federal states may apply.


Cookies use

Cookies are small text files, or other memory tags, that store information on end devices and read information from the end devices. For example, to store the login status in a user account, a shopping cart content in an e-shop, the content accessed or functions used of an online offer. Cookies can further be used for various purposes, e.g. for the purposes of functionality, security and comfort of online offers as well as the creation of analyses of visitor flows.

Consent notices: We use cookies in accordance with the law. Therefore, we obtain prior consent from users except where it is not required by law. In particular, consent is not required if the storage and reading of the information, i.e. including cookies, are absolutely necessary in order to provide the user with a telemedia service expressly requested by the user (i.e. our online offering). The revocable consent is clearly communicated to the users and contains the information about the respective cookie usage.

Notes on legal bases under data protection law: The legal basis under data protection law on which we process users’ personal data with the aid of cookies depends on whether we ask users for consent. If the users consent, the legal basis of the processing of your data is the declared consent. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g. in the business management of our online offer and improvement of its usability) or, if this is done in the context of the fulfillment of our contractual obligations, if the use of cookies is necessary to fulfill our contractual obligations. We explain the purposes for which we process cookies in the course of this privacy policy or as part of our consent and processing procedures.

Storage duration: In terms of storage duration, the following types of cookies are distinguished:

  • Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed his end device (e.g. browser or mobile app).
  • Permanent cookies: Permanent cookies remain stored even after the terminal device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. Likewise, user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information about the type and storage duration of cookies (e.g., as part of obtaining consent), users should assume that cookies are permanent and that the storage period can be up to two years.

General information on revocation and objection (opt-out): Users can revoke the consents they have given at any time and also file an objection to processing in accordance with the legal requirements in Art. 21 DSGVO (further information on the objection is provided within the scope of this privacy policy). Users can also declare their objection by means of the settings of their browser.

Cookie settings/opposition:

Further guidance on processing operations, procedures and services:

  • Processing of cookie data on the basis of consent: We use a cookie consent management procedure under which users’ consents to the use of cookies, or to the processing operations and providers mentioned in the cookie consent management procedure, can be obtained and managed and revoked by users. The declaration of consent is stored so that it does not have to be repeated and the consent can be proven in accordance with the legal obligation. The storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or with the help of comparable technologies), in order to be able to assign the consent to a user or their device. Subject to individual information on the providers of cookie management services, the following information applies: The duration of the storage of consent can be up to two years. Here, a pseudonymous user identifier is formed and stored with the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers), as well as the browser, system, and end device used.


Business services

We process data of our contractual and business partners, e.g. customers and interested parties (collectively referred to as “contractual partners”) in the context of contractual and comparable legal relationships as well as related measures and in the context of communication with contractual partners (or pre-contractual), e.g. to answer inquiries.

We process this data to fulfill our contractual obligations. This includes, in particular, the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other service disruptions. In addition, we process the data to safeguard our rights and for the purposes of the administrative tasks associated with these duties and the company organization. In addition, we process the data on the basis of our legitimate interests in proper and business management as well as security measures to protect our contractual partners and our business operations from misuse, endangerment of their data, secrets, information and rights (e.g. for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the scope of applicable law, we only disclose the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or to fulfill legal obligations. The contractual partners will be informed about further forms of processing, e.g. for marketing purposes, within the scope of this data protection declaration.

We inform the contractual partners which data is required for the aforementioned purposes before or in the course of data collection, e.g. in online forms, by special marking (e.g. colors) or symbols (e.g. asterisks or similar), or in person.

We delete the data after the expiry of legal warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., as long as it must be retained for legal archiving reasons (e.g., for tax purposes generally 10 years). We delete data disclosed to us by the contractual partner within the scope of an order in accordance with the specifications of the order, in principle after the end of the order.

Insofar as we use third-party providers or platforms to provide our services, the terms and conditions and data protection notices of the respective third-party providers or platforms shall apply in the relationship between the users and the providers.

Customer account

Contractual partners can create an account within our online offer (e.g. customer or user account, in short “customer account”). If registration of a customer account is required, contractual partners will be informed of this as well as of the information required for registration. Customer accounts are not public and cannot be indexed by search engines. Within the scope of registration and subsequent logins and uses of the customer account, we store the IP addresses of the customers along with the access times in order to be able to prove registration and prevent any misuse of the customer account.

If customers have terminated their customer account, the data relating to the customer account will be deleted, unless their retention is required for legal reasons. It is the customer’s responsibility to back up their data upon termination of the customer’s account.

Customer loyalty program/ customer card

We process the data of customers under our Customer Loyalty Program for the purpose of fulfilling the services provided to participating customers under the Customer Loyalty Program. For this purpose, the information collected from customers and, where necessary, marked as such, is stored in a profile of customers. In the profile, information about the use of the customer loyalty program and about the use of the associated services and benefits is also processed and, only if necessary for the aforementioned purposes, passed on to third parties (e.g. executing service providers). The customer profiles are deleted after termination of participation and archived with the respective data only to the extent that this may be necessary for legal retention purposes or the fulfillment of legal (up to 11 years in the case of tax information from the end of the year in which it arose) or contractual claims (up to three years from the end of the year of termination).

Economic analysis and market research

For business reasons and in order to be able to identify market trends, wishes of contractual partners and users, we analyze the data we have on business transactions, contracts, inquiries, etc., whereby the group of data subjects may include contractual partners, interested parties, customers, visitors and users of our online offering.

The analyses are carried out for the purpose of business evaluations, marketing and market research (e.g. to determine customer groups with different characteristics). In doing so, we can take into account the profiles of registered users, if available, together with their details, e.g. on services used. The analyses serve us alone and are not disclosed externally, unless they are anonymous analyses with summarized, i.e. anonymized values. Furthermore, we take into account the privacy of users and process the data for analysis purposes as pseudonymously as possible and, if feasible, anonymously (e.g., as aggregated data).

Store and e-commerce

We process the data of our customers to enable them to select, purchase or order the selected products, goods and related services, as well as their payment and delivery or execution. If necessary for the execution of an order, we use service providers, in particular postal, forwarding and shipping companies, to carry out the delivery or execution to our customers. For the processing of payment transactions, we use the services of banks and payment service providers. The required information is marked as such in the context of the order or comparable purchase process and includes the information required for delivery or provision and billing as well as contact information in order to be able to contact you.

Hotel and accommodation services

We process the data of our guests, visitors and interested parties (uniformly referred to as “guests”) in order to provide our accommodation and related services of a tourist or gastronomic nature and to bill for the services provided.

Within the scope of our assignment, it may be necessary for us to process special categories of data within the meaning of Art. 9 para. 1 GDPR, in particular information about a person’s health or information relating to his or her religious beliefs. The processing is carried out in order to protect the health interests of the visitors (for example, in the case of information on allergies) or otherwise to meet their physical or mental needs at their request and with their consent.

If required for the fulfillment of the contract or required by law, or consented to by guests or it is based on our legitimate interests, we disclose or transmit the data of guests, for example, to the service providers involved in the fulfillment of our services or from authorities, accounting offices and in the field of IT, office or comparable services.

Recruiting services

We process the data of job candidates and the personal data of potential employers or their employees within the scope of our services, which include in particular the search for potential job candidates, contacting them and placing them.

We process the information and contact data provided by job candidates for the purposes of establishing, implementing and, if necessary, terminating a contract for job placement. In addition, we can ask interested parties questions about the success of our brokerage services at a later date, in accordance with legal requirements.

We process the data of job candidates as well as employers for the fulfillment of our contractual obligations, in order to be able to process the job placement requests submitted to us to the satisfaction of the parties involved.

We may log the mediation processes in order to be able to prove the existence of the contractual relationship and consents of the interested parties in accordance with the legal accountability obligations (Art. 5 para. 2 DSGVO). This information is stored for a period of three to four years in case we need to prove the original request (e.g., to prove authorization to contact job candidates).

Events and functions

We process the data of the participants of the events, functions and similar activities offered or hosted by us (hereinafter uniformly referred to as “Participants” and “Events”) in order to enable them to participate in the Events and take advantage of the services or promotions associated with participation.

If we process health-related data, religious, political or other special categories of data in this context, then this is done within the scope of disclosure (e.g. for thematically oriented events or serves health care, security or is done with the consent of the data subjects).

The required information is identified as such in the context of the order, purchase order or comparable contract conclusion and includes the information required for the provision of services and billing as well as contact information in order to be able to hold any consultations. To the extent that we obtain access to information of end customers, employees or others, we process it in accordance with legal and contractual requirements.

Rental services

We process the data of our tenants and of prospective tenants in accordance with the underlying rental agreement. We may also process the information on the characteristics and circumstances of persons or things belonging to them, if this is necessary in the context of the lease. This may include, for example, information on personal circumstances, movable or immovable tangible assets, and financial situation, as well as the use of ancillary services (such as water or energy supply).

Within the scope of our assignment, it may be necessary for us to process special categories of data within the meaning of Art. 9 para. 1 DSGVO, in particular information about the health of a person. The processing is done in order to be able to protect the health interests of the tenants and otherwise only with the consent of the tenants.

If required for the fulfillment of the contract or required by law or approved by the tenants or based on our legitimate interests, we disclose or transmit the data of the tenants in the context of coverage requests, conclusions and processing of contracts, e.g. to financial service providers, credit institutions, utilities (e.g. electricity) or authorities.

Furthermore, we process tenants’ data if this is necessary to fulfill legal obligations (e.g. in the case of information obligations in connection with ancillary services as well as the ancillary costs).

  • Types of data processed: Inventory data (e.g., names, addresses); Payment data (e.g., bank details, invoices, payment history); Contact data (e.g., e-mail, telephone numbers); Contractual data (e.g., subject matter of contract, term, customer category); Usage data (e.g., websites visited, interest in content, access times); Meta/communications data (e.g. device information, IP addresses); applicant data (e.g. personal details, postal and contact addresses, the documents belonging to the application and the information contained therein, such as cover letter, curriculum vitae, certificates, as well as other information provided with regard to a specific position or voluntarily by applicants regarding their person or qualifications).
  • Special categories of personal data: Health data (Art. 9(1) DGSVO); Religious or philosophical beliefs (Art. 9(1) DGSVO).
  • Data subjects: Customers; prospective customers; business and contractual partners; applicants.
  • Purposes of processing: providing contractual services and customer service; security measures; contact requests and communications; office and organizational procedures; managing and responding to requests; conversion measurement (measuring the effectiveness of marketing activities); profiles with user-related information (creating user profiles).
  • Legal basis: contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO); Legal obligation (Art. 6 para. 1 p. 1 lit. c. DSGVO).


Payment method

In the context of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and use other service providers in addition to banks and credit institutions for this purpose (collectively, “payment service providers”).

The data processed by the payment service providers includes inventory data, such as the name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as the contract, total and recipient-related information. The information is necessary to carry out the transactions. However, the data entered is only processed by the payment service providers and stored with them. I.e., we do not receive any account or credit card related information, but only information with confirmation or negative information of the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit agencies. The purpose of this transmission is to check identity and creditworthiness. In this regard, we refer to the GTC and the data protection information of the payment service providers.

The terms and conditions and the data protection notices of the respective payment service providers, which can be accessed within the respective websites or transaction applications, shall apply to the payment transactions. We also refer to these for further information and assertion of revocation, information and other data subject rights.

  • Types of data processed: inventory data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contract data (e.g. subject matter of contract, term, customer category); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); contact data (e.g. e-mail, telephone numbers).
  • Affected persons: Customers; Interested parties.
  • Purposes of processing: provision of contractual services and customer service.
  • Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further guidance on processing operations, procedures and services:


Provision of the online offer and web hosting

In order to provide our online offer securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security services and technical maintenance services.

The data processed in the course of providing the hosting service may include all information concerning the users of our online service that is generated in the course of use and communication. This regularly includes the IP address, which is necessary to be able to deliver the contents of online offers to browsers, and all entries made within our online offer or from websites.

  • Types of data processed: Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: provision of our online offer and user experience; content delivery network (CDN); provision of contractual services and customer service.
  • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further guidance on processing operations, procedures and services:

  • Collection of access data and log files: We ourselves (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files may be used, on the one hand, for security purposes, e.g., to prevent server overload (especially in the case of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the utilization of the servers and their stability; Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is exempt from deletion until final clarification of the respective incident.
  • IONOS by 1&1: Hosting platform for e-commerce / websites; Service provider: 1&1 IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; Website: https://www.ionos.de; Privacy policy: https: //www.ionos.de/terms-gtc/terms-privacy; Order processing contract: https: //www.ionos.de/hilfe/datenschutz/allgemeine-informationen-zur-datenschutz-grundverordnung-dsgvo/auftragsverarbeitung/?utm_source=search&utm_medium=global&utm_term=Auft&utm_campaign=HELP_CENTER&utm_content=/hilfe/.
  • Cloudflare: Content delivery network (CDN) – service with the help of which the content of an online offering, in particular large media files such as graphics or program scripts, can be delivered faster and more securely with the help of regionally distributed servers connected via the Internet; Service provider: Cloudflare, Inc, 101 Townsend St, San Francisco, CA 94107, USA; Website: https://www.cloudflare.com; Privacy policy: https://www.cloudflare.com/privacypolicy/; Standard contractual clauses (ensuring level of data protection for processing in third countries): https://www.cloudflare.com/cloudflare-customer-scc; Order processing contract: https://www.cloudflare.com/cloudflare-customer-dpa.


Registration, login and user account

Users can create a user account. In the course of registration, users are provided with the required mandatory data and processed for the purpose of providing the user account on the basis of contractual obligation fulfillment. The processed data includes in particular the login information (username, password as well as an e-mail address).

Within the scope of using our registration and login functions as well as the use of the user account, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests as well as those of the users in protection against misuse and other unauthorized use. As a matter of principle, this data will not be passed on to third parties unless it is necessary for the prosecution of our claims or there is a legal obligation to do so.

Users may be informed by e-mail about events relevant to their user account, such as technical changes.

  • Types of data processed: inventory data (e.g. names, addresses); contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: provision of contractual services and customer service; security measures; management and response to requests.
  • Legal basis: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further guidance on processing operations, procedures and services:

  • Deletion of data after termination: If users have terminated their user account, their data with regard to the user account will be deleted, subject to any legal permission, obligation or consent of the users.
  • No obligation to retain data: It is the responsibility of users to back up their data upon termination before the end of the contract. We are entitled to irretrievably delete all user data stored during the term of the contract.


Contact and request management

When contacting us (e.g. by contact form, e-mail, telephone or via social media) as well as in the context of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to respond to the contact requests and any requested measures.

The answering of contact inquiries as well as the administration of contact and inquiry data in the context of contractual or pre-contractual relationships is carried out to fulfill our contractual obligations or to answer (pre)contractual inquiries and otherwise on the basis of legitimate interests in answering inquiries and maintaining user or business relationships.

  • Types of data processed: inventory data (e.g. names, addresses); contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms).
  • Affected persons: Communication partners.
  • Purposes of processing: contact requests and communication; provision of contractual services and customer service.
  • Legal basis: contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO); Legal obligation (Art. 6 para. 1 p. 1 lit. c. DSGVO).

Further guidance on processing operations, procedures and services:

  • Contact form: If users contact us via our contact form, e-mail or other communication channels, we process the data communicated to us in this context for the purpose of processing the communicated request. For this purpose, we process personal data in the context of pre-contractual and contractual business relationships, insofar as this is necessary for their fulfillment, and otherwise on the basis of our legitimate interests as well as the interests of the communication partners in responding to the requests and our statutory retention obligations.
  • HubSpot: Software for customer management, process and sales support (multi-channel communication, i.e. management of customer inquiries from different channels, sales, process management, analyses, feedback and survey functions); Service provider: HubSpot, Inc, 25 First St., 2nd floor, Cambridge, Massachusetts 02141, USA; Website: https://www.hubspot.de; Privacy policy: https://legal.hubspot.com/de/privacy-policy; Standard contractual clauses (ensuring level of data protection in case of processing in third countries): https://legal.hubspot.com/dpa; Order processing contract: https://legal.hubspot.com/dpa.


Communication via messenger

We use messengers for communication purposes and therefore ask you to observe the following information on the functionality of the messengers, on encryption, on the use of the metadata of the communication and on your objection options.

You can also contact us by alternative means, e.g. via telephone or e-mail. Please use the contact options provided to you or the contact options specified within our online offer.

In the case of end-to-end encryption of content (i.e., the content of your message and attachments), please note that the communication content (i.e., the content of the message and attached images) is encrypted from end to end. This means that the content of the messages is not viewable, not even by the messenger providers themselves. You should always use an up-to-date version of messengers with encryption enabled to ensure that message content is encrypted.

However, we additionally point out to our communication partners that the providers of the messengers cannot view the content, but can learn that and when communication partners communicate with us as well as technical information about the device used by the communication partners and, depending on the settings of their device, also location information (so-called metadata) is processed.

Notes on legal bases: If we ask communication partners for permission before communicating with them via Messenger, the legal basis for our processing of their data is their consent. Otherwise, if we do not ask for consent and they contact us, for example, on their own initiative, we use Messenger in relation to our contractual partners and in the context of contract initiation as a contractual measure and, in the case of other interested parties and communication partners, on the basis of our legitimate interests in fast and efficient communication and meeting the needs of our communication partners in communication via Messenger. Furthermore, we would like to point out that we do not transmit the contact data provided to us to the messengers for the first time without your consent.

Revocation, objection and deletion: You can revoke a given consent at any time and object to communication with us via Messenger at any time. In the case of communication via Messenger, we delete the messages in accordance with our general deletion guidelines (i.e., e.g., as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise as soon as we can assume that we have answered any information provided by the communication partners, if no reference to a previous conversation is to be expected and the deletion does not conflict with any legal retention obligations.

Reservation of reference to other communication channels: Finally, we would like to point out that, for reasons of your security, we reserve the right not to answer requests via Messenger. This is the case if, for example, contractual internals require special secrecy or a reply via Messenger does not meet formal requirements. In such cases, we refer you to more adequate communication channels.

  • Types of data processed: contact data (e.g. e-mail, telephone numbers); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Affected persons: Communication partners.
  • Purposes of processing: contact requests and communication; direct marketing (e.g. by e-mail or postal mail).
  • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further guidance on processing operations, procedures and services:


Chatbots and chat functions

We offer online chats and chatbot features (collectively, “Chat Services”) as a communication option. A chat is an online conversation conducted with a certain degree of timeliness. A chatbot is a software that answers users’ questions or informs them about messages. When you use our chat features, we may process your personal data.

If you use our chat services within an online platform, your identification number will also be stored within the respective platform. We may also collect information about which users interact with our chat services and when. Furthermore, we store the content of your conversations via the chat services and log registration and consent processes in order to be able to prove them in accordance with legal requirements.

We would like to point out to users that the respective platform provider may learn that and when users communicate with our chat services as well as collect technical information about the device used by the users and, depending on the settings of their device, also location information (so-called metadata) for the purpose of optimizing the respective services and for security purposes. Likewise, the metadata of communication via chat services (i.e., e.g., information about who communicated with whom) may be used by the respective platform providers for marketing purposes or to display advertising tailored to users in accordance with their terms and conditions, to which we refer for further information.

If users agree to a chatbot to activate information with regular messages, they have the option to unsubscribe from the information at any time in the future. The chatbot instructs users how and with which terms they can unsubscribe from messages. Unsubscribing from chatbot messages deletes user data from the list of message recipients.

We use the aforementioned information to operate our chat services, e.g., to personally address users, to respond to their inquiries, to deliver any requested content, and also to improve our chat services (e.g., to “teach” chatbots answers to frequently asked questions or to recognize unanswered inquiries).

Notes on legal bases: We use chat services on the basis of consent if we have previously obtained users’ permission to process their data as part of our chat services (this applies to cases where users are asked for consent, e.g., for a chatbot to send them messages on a regular basis). If we use chat services to answer users’ inquiries about our services or our company, this is done for contractual and pre-contractual communication. Otherwise, we use chat services based on our legitimate interests in optimizing the chat services, their operational efficiency, and enhancing the positive user experience.

Revocation, objection and deletion: You can revoke a given consent or object to the processing of your data within the scope of our chat services at any time.

  • Types of data processed: contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Affected persons: Communication partners.
  • Purposes of processing: contact requests and communication; direct marketing (e.g. by e-mail or postal mail).
  • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO); contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO); Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further guidance on processing operations, procedures and services:


Application procedure

The application process requires that applicants provide us with the data necessary for their assessment and selection. The information required can be found in the job description or, in the case of online forms, in the information provided there.

Basically, the required information includes personal information, such as the name, address, a way to contact you, as well as evidence of the qualifications required for a position. Upon request, we will be happy to provide additional information on which details are required.

If provided, applicants may submit their applications to us using an online form. The data is transmitted to us encrypted according to the state of the art. Applicants can also send us their applications by e-mail. However, please note that e-mails on the Internet are generally not sent in encrypted form. As a rule, e-mails are encrypted in transit, but not on the servers from which they are sent and received. Therefore, we cannot take responsibility for the transmission path of the application between the sender and the reception on our server.

For the purposes of applicant search, submission of applications and selection of applicants, we may use applicant management or recruitment software and platforms and services of third-party providers in compliance with legal requirements.

Applicants are welcome to contact us regarding the method of application submission or to send us the application by mail.

Processing of special categories of data: Insofar as special categories of personal data within the meaning of Art. 9 para. 1 GDPR (e.g. health data, such as severely disabled status or ethnic origin) are requested from job applicants in order for the data controller or the data subject to exercise his or her rights under labor law and social security and social protection law and to comply with his or her obligations in this regard, their processing is carried out in accordance with Art. 9 para. 2 lit. b. DSGVO, in the case of the protection of vital interests of the applicants or other persons pursuant to. Art. 9 par. 2 lit. c. GDPR or for the purposes of preventive health care or occupational medicine, for the assessment of the employee’s fitness for work, for medical diagnostics, for health or social care or treatment or for the management of health or social care systems and services pursuant to. Art. 9 par. 2 lit. h. GDPR. In the case of communication of the special categories of data based on voluntary consent, their processing is carried out on the basis of Art. 9 para. 2 lit. a. GDPR.

Deletion of data: The data provided by applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if the application for a job offer is not successful, the applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Subject to a justified revocation by the applicants, the deletion takes place at the latest after the expiry of a period of six months so that we can answer any follow-up questions about the application and fulfill our obligations to provide evidence under the regulations on equal treatment of applicants. Invoices for any reimbursement of travel expenses are archived in accordance with tax law requirements.

Inclusion in an applicant pool: Inclusion in an applicant pool, if offered, is based on consent. Applicants are informed that their consent to be included in the talent pool is voluntary, has no influence on the current application process and that they can revoke their consent at any time for the future.

  • Types of data processed: Applicant data (e.g. personal details, postal and contact addresses, the documents belonging to the application and the information contained therein, such as cover letter, curriculum vitae, certificates, as well as other information provided with regard to a specific position or voluntarily by applicants regarding their person or qualifications).
  • Affected Persons: Applicants.
  • Purposes of the processing: application procedure (establishment and possible subsequent implementation as well as possible subsequent termination of the employment relationship).
  • Legal basis: Application procedure as a pre-contractual or contractual relationship (Art. 9 (2) lit. b DSGVO).

Further guidance on processing operations, procedures and services:


Cloud services

We use software services accessible via the Internet and running on the servers of their providers (so-called “cloud services”, also referred to as “software as a service”) for the following purposes: document storage and management, calendar management, emailing, spreadsheets and presentations, sharing documents, content and information with specific recipients or publishing web pages, forms or other content and information, as well as chats and participation in audio and video conferences.

In this context, personal data may be processed and stored on the servers of the providers insofar as these are part of communication processes with us or are otherwise processed by us as set out in the context of this privacy policy. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes and their contents. The cloud service providers also process usage data and metadata, which they use for security purposes and service optimization.

If we use cloud services to provide forms or other documents and content to other users or publicly accessible websites, the providers may store cookies on users’ devices for the purposes of web analytics or to remember users’ settings (e.g., in the case of media control).

Notes on legal bases: If we ask for consent to use the cloud services, the legal basis of the processing is consent. Furthermore, their use may be a component of our (pre)contractual services, provided that the use of the cloud services has been agreed within this framework. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient and secure management and collaboration processes)

  • Types of data processed: inventory data (e.g. names, addresses); contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Affected persons: Customers; employees (e.g., employees, applicants, former employees); prospective customers; communication partners.
  • Purposes of processing: office and organizational procedures.
  • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO); contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO); Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further guidance on processing operations, procedures and services:


Web analysis, monitoring and optimization

Web analytics (also referred to as “reach measurement”) is used to evaluate the flow of visitors to our online offering and may include behavior, interests, or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, identify at what time our online offer or its functions or content are most frequently used or invite re-use. Likewise, we can understand which areas need optimization.

In addition to web analytics, we may also use testing procedures, for example, to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e. data summarized for a usage process, can be created for these purposes and information can be stored in a browser or in a terminal device and read from it. The information collected includes, in particular, websites visited and elements used there, as well as technical information such as the browser used, the computer system used, and information on usage times. If users have agreed to the collection of their location data from us or from the providers of the services we use, location data may also be processed.

The IP addresses of the users are also stored. However, we use an IP masking method (i.e., pseudonymization by shortening the IP address) to protect users. In general, the data stored in the context of web analytics, A/B testing and optimization is not clear user data (such as e-mail addresses or names), but pseudonyms. This means that we, as well as the providers of the software used, do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: If we ask users for their consent to use the third-party providers, the legal basis for processing data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

  • Types of data processed: Usage data (e.g. web pages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: remarketing; reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further guidance on processing operations, procedures and services:

  • Google Universal Analytics: Reach Measurement and Web Analytics – We use Universal Analytics, a version of Google Analytics, to perform user analysis based on a pseudonymous user identification number. This identification number does not contain any clear data, such as names or e-mail addresses. It is used to assign analysis information to a user, e.g. in order to recognize which content users have called up within a usage or whether they call up our online offering again. This involves creating pseudonymous profiles of users with information from the use of various devices; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com; T&C: https://business.safety.google/adsprocessorterms/; Privacy policy: https://policies.google.com/privacy; Further information: Types of processing as well as data processed: https://privacy.google.com/businesses/adsservices; Data processing terms for Google advertising products and standard contractual clauses for third country transfers of data: https://business.safety.google/adsprocessorterms.
  • Google Analytics 4: Reach Measurement and Web Analytics – We use Google Analytics 4, a version of Google Analytics, to perform user analysis based on a pseudonymous user identification number. This identification number does not contain any clear data, such as names or e-mail addresses. It is used to assign analysis information to a user, e.g. in order to recognize which content users have called up within a usage or whether they call up our online offering again. This involves creating pseudonymous profiles of users with information from the use of various devices. The IP address of the users is shortened by the last two digits by default; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy Policy: https://policies.google.com/privacy; Opt-Out: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://adssettings.google.com/authenticated; Order processing contract: https://business.safety.google/adsprocessorterms/; Further information: Types of processing as well as data processed: https://privacy.google.com/businesses/adsservices; Data processing conditions for Google advertising products and standard contractual clauses for third country transfers of data: https://business.safety.google/adsprocessorterms.
  • Google Tag Manager: Google Tag Manager is a solution with which we can manage so-called website tags via an interface and thus integrate other services into our online offering (please refer to further details in this privacy policy). The Tag Manager itself (which implements the tags) therefore does not yet create user profiles or store cookies, for example. Google only learns the IP address of the user, which is necessary to run the Google Tag Manager; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Order processing contract: https://business.safety.google/adsprocessorterms; Further information: Types of processing as well as data processed: https://privacy.google.com/businesses/adsservices; Data processing conditions for Google advertising products and standard contractual clauses for third country transfers of data: https://business.safety.google/adsprocessorterms.
  • Yandex-Metrica: analytics, click tracking and website optimization; service provider: Yandex Oy, Moreenikatu 6, 04600 Mantsala, Finland; website: https://yandex.com; privacy policy: https: //yandex.com/legal/privacy/; standard contractual clauses (ensuring level of data protection in case of processing in third countries): Agreed between Yandex Oy and, the data controller, YANDEX LLC, 16 Lva Tolstogo st., Moscow, 11 902 1, Russia.


Online marketing

We process personal data for online marketing purposes, which may include, in particular, marketing advertising space or displaying promotional and other content (collectively, “Content”) based on users’ potential interests and measuring its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (so-called “cookie”) or similar procedures are used, by means of which the user data relevant to the presentation of the aforementioned content is stored. This information may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information, such as the browser used, the computer system used, and information on usage times and functions used. If users have consented to the collection of their location data, this can also be processed.

The IP addresses of the users are also stored. However, we use available IP masking methods (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear data of the users (such as e-mail addresses or names) are stored in the online marketing process, but pseudonyms. This means that we, as well as the providers of the online marketing methods, do not know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is usually stored in the cookies or by means of similar procedures. These cookies can later generally be read on other websites that use the same online marketing method and analyzed for the purpose of displaying content as well as supplemented with further data and stored on the server of the online marketing method provider.

Exceptionally, clear data can be assigned to profiles. This is the case if, for example, the users are members of a social network whose online marketing methods we use and the network links the users’ profiles with the aforementioned information. We ask you to note that users can make additional agreements with the providers, e.g. by giving their consent as part of the registration process.

We generally only receive access to aggregate information about the success of our advertisements. However, in the context of so-called conversion measurements, we can check which of our online marketing processes have led to a so-called conversion, i.e., for example, to a contract being concluded with us. Conversion measurement is used solely to analyze the success of our marketing efforts.

Unless otherwise stated, we ask you to assume that cookies used will be stored for a period of two years.

Notes on legal bases: If we ask users for their consent to use the third-party providers, the legal basis for processing data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

  • Types of data processed: Event Data (Facebook) (“Event Data” is data that may be transmitted by us to Facebook, e.g. via Facebook Pixel (via apps or other means), and relates to individuals or their actions; the data includes, for example, information about visits to websites, interactions with content, functions, app installations, product purchases, etc.; the Event Data is processed for the purpose of creating target groups for content and advertising information (Custom Audiences).Event data is processed for the purpose of creating target groups for content and advertising information (Custom Audiences); Event data does not include the actual content (such as written comments), no login information and no contact information (i.e. no names, email addresses and phone numbers). Event data will be deleted by Facebook after a maximum of two years, the target groups formed from them with the deletion of our Facebook account); Contact information (Facebook) (“Contact information” is data that (clearly) identifies data subjects, such as names, email addresses, and phone numbers, that is sent to Facebook, e.g. via Facebook pixel or upload for matching purposes for the creation of Custom Audiences; After matching for the creation of target groups, the contact information is deleted); Usage data (e.g. web pages visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: remarketing; conversion measurement (measuring the effectiveness of marketing measures); targeting; targeting (determining target groups relevant for marketing purposes or otherwise outputting content); marketing; profiling with user-related information (creating user profiles).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).
  • Possibility of objection (opt-out): We refer to the data protection notices of the respective providers and the objection options (so-called “opt-out”) given to the providers. If no explicit opt-out option has been specified, you have the option of disabling cookies in your browser settings. However, this may restrict functions of our online offer. We therefore additionally recommend the following opt-out options, which are offered in summary form directed at respective territories: a) Europe: https://www.youronlinechoices.eu. (b) Canada: https://www.youradchoices.ca/choices. c) USA: https://www.aboutads.info/choices. d) Inter-area: https://optout.aboutads.info.

Further guidance on processing operations, procedures and services:

  • AdRoll: Online marketing service; Service provider: AdRoll, Inc., 2300 Harrison Street, Floor 2, San Francisco, CA 94110, USA; Website: https://www.adrollgroup.com/de-DE; Privacy policy: https: //www.adrollgroup.com/de-DE/privacy; Opt-out: https: //www.adrollgroup.com/de-DE/privacy.
  • Facebook pixel and targeting (Custom Audiences): With the help of the Facebook pixel (or comparable functions, for the transmission of event data or contact information by means of interfaces in apps), it is possible for Facebook, on the one hand, to determine the visitors to our online offer as a target group for the display of advertisements (so-called “Facebook ads”). Accordingly, we use the Facebook pixel in order to display the Facebook ads placed by us only to such users on Facebook and within the services of the partners cooperating with Facebook (so-called “Audience Network”). https://www.facebook.com/audiencenetwork/ ) who have also shown an interest in our online offer or who have certain characteristics (e.g. interest in certain topics or products that are evident from the web pages visited) that we transmit to Facebook (so-called “Custom Audiences”). With the help of the Facebook pixel, we also want to ensure that our Facebook ads correspond to the potential interest of the users and do not have a harassing effect. With the help of the Facebook pixel, we can further track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad (so-called “conversion measurement”); Service Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Standard contractual clauses (guarantee level of data protection for processing in third countries): The “Facebook EU Data Transfer Supplement” (https://www.facebook.com/legal/EU_data_transfer_addendum) in the case of commissioned processing by Facebook as the basis for the processing of event data of EU citizens in the USA and the inclusion in the “Platform Terms of Use of Facebook” (https://developers.facebook.com/terms) with regard to the autonomous processing of event data by Facebook in the context of ad placement; Further information: The “Data Processing Conditions” (https://www.facebook.com/legal/terms/dataprocessing/update) with respect to Event Data that Facebook processes on behalf to provide reporting and analytics to companies; Furthermore, the “Controller Addendum” is deemed to be a joint responsibility agreement (Article 26 (1) sentence 3 of the GDPR), which is relevant in the case of Facebook’s own processing of Event Data for purposes of targeting and improving and securing Facebook’s products.
  • Facebook – Audience creation via data upload: Creation of target groups for marketing purposes – We transmit contact information (names, e-mail addresses and telephone numbers) in list form to Facebook for the purpose of creating target groups (so-called “Custom Audiences”) for the display of content and advertising information based on the presumed interests of the users. Transmission and matching with data available at Facebook are not carried out in plain text, but as so-called “hash values”, i.e. mathematical images of the data (this method is used, for example, when storing passwords). After matching for the purpose of creating target groups, the contact information is deleted. Contact information is processed on the basis of an order processing agreement withMeta Platforms Ireland Limited (“Data Processing Terms “, https://www.facebook.com/legal/terms/dataprocessing), the “Data Security Terms”(https://www.facebook.com/legal/terms/data_security_terms) and, with regard to processing in the USA, on the basis of standard contractual clauses (“Facebook EU Data Transfer Addendum, https://www.facebook.com/legal/EU_data_transfer_addendum). Further information on the processing of contact information can be found in the “Terms of Use for Custom Audiences with Customer List”, https://www.facebook.com/legal/terms/customaudience; Service Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Standard contractual clauses (ensuring level of data protection for processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Order processing contract: https://www.facebook.com/legal/terms/dataprocessing.
  • Google Ad Manager: We use the “Google Marketing Platform” (and services such as “Google Ad Manager”) to place ads on the Google advertising network (e.g., in search results, in videos, on web pages, etc.). The Google Marketing Platform is characterized by the fact that ads are displayed in real time based on presumed user interests. This allows us to display ads for and within our online offering in a more targeted manner in order to present users only with ads that potentially match their interests. If, for example, a user is shown ads for products he or she was interested in on other online offers, this is referred to as “remarketing”; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; More information: Types of processing as well as the data processed: https://privacy.google.com/businesses/adsservices; Data processing conditions for Google advertising products: Information on services Data processing conditions between data controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms; where Google acts as a processor, data processing terms and conditions for Google advertising products and standard contractual clauses for third country transfers of data: https://business.safety.google/adsprocessorterms.
  • Google Ads and conversion measurement: We use the online marketing method “Google Ads” to place ads in the Google advertising network (e.g., in search results, in videos, on web pages, etc.) so that they are displayed to users who have a presumed interest in the ads (so-called “conversion”). Furthermore, we measure the conversion of the ads. However, we only learn the anonymous total number of users who clicked on our ad and were redirected to a page tagged with a so-called “conversion tracking tag”. However, we ourselves do not receive any information with which users can be identified; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Other information: Types of processing as well as data processed: https://privacy.google.com/businesses/adsservices; Google Advertising Products Data Processing Terms: Information on services Data processing terms and conditions between data controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms.
  • Google Analytics in Consent Mode: When customers click on our Google ads and subsequently use the advertised service (so-called “conversion”), the data entered by the user, such as the e-mail address, name, home address or telephone number, may be transmitted to Google. The hash values are then matched with users’ existing Google accounts to better evaluate and improve users’ interaction with ads (e.g., clicks or views) and thus their performance; website: https://support.google.com/google-ads/answer/9888656.


Customer reviews and evaluation process

We participate in review and rating processes to evaluate, optimize and promote our services. If users rate us or otherwise provide feedback via the participating rating platforms or processes, the General Terms and Conditions of Business or Use and the data protection notices of the providers also apply. As a rule, the evaluation also requires registration with the respective providers.

In order to ensure that the persons rating have actually used our services, we transmit, with the consent of the customers, the data required for this purpose with regard to the customer and the service used to the respective rating platform (including name, e-mail address and order number or item number). This data is used solely to verify the authenticity of the user.

  • Types of data processed: contract data (e.g. subject matter of contract, term, customer category); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Customers; Users (e.g., website visitors, users of online services).
  • Purposes of processing: feedback (e.g. collecting feedback via online form); marketing.
  • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO); Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further guidance on processing operations, procedures and services:

  • Rating widget: We integrate so-called “rating widgets” into our online offer. A widget is a functional and content element integrated into our online offer that displays variable information. It can be displayed, for example, in the form of a seal or comparable element, sometimes also called a “badge”. In doing so, the corresponding content of the widget is displayed within our online offer, but it is retrieved at that moment from the servers of the respective widget provider. This is the only way to always show the current content, especially the current rating. For this purpose, a data connection must be established from the website accessed within our online offer to the widget provider’s server and the widget provider receives certain technical data (access data, including IP address) that are necessary so that the widget’s content can be delivered to the user’s browser. Furthermore, the widget provider receives information that users have visited our online offer. This information may be stored in a cookie and used by the widget provider to identify which online offers participating in the evaluation process have been visited by the user. The information may be stored in a user profile and used for advertising or market research purposes.
  • Customer Alliance: rating platform; service provider: CA Customer Alliance GmbH, Ullsteinstr. 130 l Tower B, 12109 Berlin, Germany; Website: https://www.customer-alliance.com/de; Privacy Policy: https: //www.customer-alliance.com/de/datenschutzbestimmungen/.
  • Google Customer Reviews: Service for obtaining and/or displaying customer satisfaction and customer opinions; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; T&C: https://support.google.com/merchants/topic/7259129?hl=de&ref_topic=7257954; Privacy Policy: https://policies.google.com/privacy; More information: Within the scope of obtaining customer reviews, an identification number as well as time for the business transaction to be evaluated, in the case of review requests sent directly to customers, the customer’s e-mail address as well as their country of residence information as well as the review information itself are processed; Further information on the types of processing as well as the processed data: https://privacy.google.com/businesses/adsservices; Data processing conditions for Google advertising products: Information on services Data processing conditions between data controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms.


Presence in social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with users active there or to offer information about us.

We would like to point out that in the process, user data may be processed outside the area of the European Union. This may give rise to risks for users because, for example, it could make it more difficult to enforce users’ rights.

Furthermore, user data within social networks is usually processed for market research and advertising purposes. For example, usage profiles can be created based on the usage behavior and resulting interests of the users. The usage profiles can in turn be used, for example, to display advertisements within and outside the networks that presumably correspond to the users’ interests. For these purposes, cookies are usually stored on the users’ computers, in which the usage behavior and interests of the users are stored. Furthermore, data may also be stored in the usage profiles regardless of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

For a detailed presentation of the respective forms of processing and the options to object (opt-out), we refer to the privacy statements and information provided by the operators of the respective networks.

Also in the case of requests for information and the assertion of data subject rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the users’ data in each case and can take appropriate measures and provide information directly. If you still need help, then you can contact us.

  • Types of data processed: contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: contact requests and communication; feedback (e.g. collecting feedback via online form); marketing.
  • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further guidance on processing operations, procedures and services:


Plugins and embedded functions and content

We incorporate into our online offering functional and content elements that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). This may include, for example, graphics, videos or city maps (hereinafter uniformly referred to as “Content”).

The integration always requires that the third-party providers of this content process the IP address of the user, since without the IP address they could not send the content to their browser. The IP address is thus required for the display of these contents or functions. We endeavor to use only such content whose respective providers use the IP address only for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit, and other information about the use of our online offering, as well as being linked to such information from other sources.

Notes on legal bases: If we ask users for their consent to use the third-party providers, the legal basis for processing data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

  • Types of data processed: Usage data (e.g. web pages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g., website visitors, users of online services).
  • Purposes of processing: provision of our online offer and user-friendliness; provision of contractual services and customer service.
  • Legal basis: Legitimate interests (Art. 6 para. 1 p. 1 lit. f. DSGVO); Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO); contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. GDPR).

Further guidance on processing operations, procedures and services:

  • Google Fonts: We integrate the fonts (“Google Fonts”) of the provider Google, whereby the user’s data is used solely for the purpose of displaying the fonts in the user’s browser. The integration is based on our legitimate interests in a technically secure, maintenance-free and efficient use of fonts, their uniform display and taking into account possible licensing restrictions for their integration; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://fonts.google.com/; privacy policy: https: //policies.google.com/privacy.
  • Google Maps APIs and SDKs: Interfaces to Google’s map and location services that allow, for example, the addition of address input, location determination, distance calculations, or the provision of supplementary information on stand and other locations; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://cloud.google.com/maps-platform; privacy policy: https: //policies.google.com/privacy.
  • YouTube videos: Video content; YouTube videos are embedded via a special domain (recognizable by the component “youtube-nocookie”) in the so-called “Extended Privacy Mode”, whereby no cookies are collected on user activities in order to personalize video playback. Nevertheless, information about the user’s interaction with the video (e.g. remembering the last playback point), may be stored; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.youtube.com; privacy policy: https: //policies.google.com/privacy.


Management, organization and auxiliary tools

We use services, platforms and software of other providers (hereinafter referred to as “Third Party Providers”) for the purpose of organizing, managing, planning as well as providing our services. When selecting third-party providers and their services, we observe the legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. This may involve various data that we process in accordance with this privacy policy. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes and their contents.

If users are referred to the third-party providers or their software or platforms in the course of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security, service optimization or marketing purposes. We therefore ask you to observe the data protection notices of the respective third-party providers.

Notes on legal bases: If we ask users for their consent to use the third-party providers, the legal basis for processing data is consent. Furthermore, their use may be a component of our (pre)contractual services, provided that the use of the third-party providers has been agreed within this framework. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

  • Types of data processed: Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses); Inventory data (e.g. names, addresses); Contact data (e.g. e-mail, telephone numbers).
  • Data subjects: Communication partners; users (e.g., website visitors, users of online services).
  • Purposes of processing: contact requests and communication; reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles); office and organizational procedures.
  • Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. DSGVO); contract performance and pre-contractual requests (Art. 6 para. 1 p. 1 lit. b. DSGVO); Legitimate Interests (Art. 6 para. 1 p. 1 lit. f. DSGVO).

Further guidance on processing operations, procedures and services:


Modification and update of the privacy policy

We ask you to regularly inform yourself about the content of our privacy policy. We will adapt the privacy policy as soon as the changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy statement, please note that the addresses may change over time and please check the information before contacting us.


Definitions

This section provides you with an overview of the terms used in this privacy statement. Many of the terms are taken from the law and defined especially in Art. 4 GDPR. The legal definitions are binding. The following explanations, on the other hand, are intended primarily to aid understanding. The terms are sorted alphabetically.

  • Content Delivery Network (CDN): A “Content Delivery Network” (CDN) is a service that can be used to deliver the content of an online offering, in particular large media files such as graphics or program scripts, more quickly and securely with the help of regionally distributed servers connected via the Internet.
  • Conversion measurement: Conversion measurement (also known as “visit action evaluation”) is a method used to determine the effectiveness of marketing measures. For this purpose, a cookie is usually stored on the users’ devices within the websites on which the marketing activities take place and then retrieved again on the target website. For example, we can track whether the ads we have placed on other websites have been successful.
  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Profiles with user-related information: The processing of “profiles with user-related information”, or “profiles” for short, includes any type of automated processing of personal data that consists in using such personal data to analyze, evaluate or to predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include different information concerning demographics, behavior and interests, such as interaction with websites and their content, etc.) (e.g. interests in certain content or products, click behavior on a website or location). Cookies and web beacons are often used for profiling purposes.
  • Reach measurement: Reach measurement (also known as web analytics) is used to evaluate the flow of visitors to an online offering and may include visitors’ behavior or interests in certain information, such as web page content. With the help of reach analysis, website owners can see, for example, at what time visitors visit their website and what content they are interested in. This allows them, for example, to better adapt the content of the website to the needs of their visitors. For reach analysis purposes, pseudonymous cookies and web beacons are often used to recognize returning visitors and thus obtain more precise analyses of the use of an online offer.
  • Remarketing: “Remarketing” or “retargeting” is when, for example, for advertising purposes, a note is made of which products a user was interested in on a website in order to remind the user of these products on other websites, e.g. in advertisements.
  • Controller: a “controller” is the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.
  • Processing: “Processing” means any operation or set of operations which is performed upon personal data, whether or not by automatic means. The term is wide-ranging and encompasses practically every handling of data, be it collection, evaluation, storage, transmission or deletion.
  • Targeting: Targeting (or “custom audiences”) is when target groups are determined for advertising purposes, e.g., display of advertisements. For example, based on a user’s interest in certain products or topics on the Internet, it can be inferred that this user is interested in advertisements for similar products or the online store where he viewed the products. In turn, we speak of “lookalike audiences” (or similar target groups) when the content deemed suitable is displayed to users whose profiles or interests presumably correspond to the users for whom the profiles were formed. Cookies and web beacons are generally used for the purpose of creating Custom Audiences and Lookalike Audiences.

 

info

Your booking advantages
Direct bookings are worth it!

  • Cheapest price (€ 5.00 immediate discount)
  • Breakfast for € 10.00 p. P. (instead of € 18.90)
  • Free WIFI
  • 1 bottle of mineral water for free
  • Discounted parking options
  • CityClass & Friends advantage program
  • Various extras can be booked
arrow_upward
This site is registered on wpml.org as a development site.