II. General information on the processing of data

We will only be collecting personal data about yourself when you visit our website if this is required to provide you with a correct display of our website or to enable you to make use of our content and services. We will only process your data after you have given us your permission or when this is permitted by legal regulations.
Your personal data will be deleted as soon as they are no longer needed for the purpose for which they are being stored unless legal regulations require us to save these data for a longer period of time or when you have given us permission to use your personal data for a longer period.

III. Provision of the website and the creation of logfiles

1. Description and extent of the processing of data

Whenever you call up our website either we or our hosting provider will automatically collect data by accessing the server on which our website is being stored. The following data will be collected in this manner:

• Name of the file that was called up,
• Date and time of the access,
• The access status (file transferred/file could not be found),
• Amount of data transferred,
• Information on the type of browser used and the version of your system,
• Information on the operating system of your system,
• IP address of the internet connection used by your system, and the
• Website from which your system accessed our website (referrer URL)

These data will also be automatically stored in the log files of our system. The data will not be stored together with other personal data about yourself. The use of your data to create personal user profiles is thus excluded.

2. Purpose for processing the data, legal basis

Our system must store your IP address during your visit to our website to enable our website to be transferred to the computer system you are using. That is why your IP address must remain stored during the complete time of the internet session.

Data are stored in log files to secure the functionality of the website. We also use the data to optimise the website and to ensure the security of our technical information systems (e.g. to solve cases of misuse or fraud).

The legal basis for the temporary storage of data is given in Art. 6(1f) of the GDPR. Our legitimate interest in processing the data lies in our ability to provide a functioning website and in ensuring the security of our systems.

3. Storage period

Log file information containing the complete IP address will be stored for one day. After one day the IP addresses in the log files will be anonymised and stored for a maximum of 10 days. After the 10 day period the log files will be deleted. Data which must be kept for use as evidence will be exempt from being deleted until the respective incident has been completely resolved.

4. Options for objecting and having data removed

We must be able to collect data in order to operate our website, and we must be able to store data in log files to ensure a secure operation of the website. This is why you may not choose to object to having your data collected and stored.

IV. Use of cookies

1. Description and extent of processing the data

Our website uses individual cookies. These are files that are transferred to the user’s terminal equipment when the website using them is called up and which are stored there. When you visit a website which uses a cookie this will be transferred to your equipment and stored on your browser. The cookie contains an individual identifier. This makes your system and the browser it uses clearly identifiable for the provider of the cookies. Various data and information about you and your system can be collected and stored inside the cookie.

If data are only stored during the time of your visit or during your browser session, then so-called temporary cookies will be used. These are also known as session cookies or transient cookies. Such a cookie can be used for example to store the basket of an online shop or the login status for a closed user area. Temporary cookies will be deleted when you leave the website you have visited and close your browser. By contrast, permanent cookies (also known as persistent cookies) will remain stored in your system after you have closed the browser. The stored data will thus also remain available for new browser sessions at a later time. Such cookies can, for example, be used for marketing purposes in order to record actual interests and individual user behaviour and to display customised advertisements. Finally, third party cookies are cookies (to distinguish them from first party cookies) that have not been created by the controller of the website, but which originate from third parties.

We use both our own cookies on our website as well as cookies from third parties. Cookies we use will store a session ID, the language settings and, if necessary, your log-in data as well as a confirmation of our cookie banner.

2. Purpose for processing the data, legal basis

We use cookies to ensure the effective use of our website and its functionalities. The session ID must be recorded to maintain the connection when changing the individual pages. Language settings are recorded to present our website in the correct language. Log-in data must be stored to enable you, as the case may be, to remain logged in to your user account when you visit our website. Lastly, your confirmation of our cookie banner is stored so that the banner will not have to be displayed each time that you call up a new page.

By using cookies to store data we are thus protecting our legitimate interest to provide you with the best possible functionality of the website and a customer friendly and effective use of the website during your visit. This is based on Art. 6(1f) GDPR. The user data collected by our cookies will not be used to create personal user profiles.

3. Storage period

Temporary cookies will only be stored temporarily on your computer. They will be deleted as soon as you close your browser. Permanent cookies will continue to remain in your system after you have ended a browser session until they are deleted. Since cookies are generally stored in your system and the information stored in them is then transferred from there to our site, you will continue to have the complete control over the use of the cookies.

4. Options for objecting and having data removed

Since cookies are stored on your computer for the browser that you are using, as a user you can actively influence how the data are being processed. You can always either restrict the use of cookies with effect for the future or completely stop them from being used. If you generally do not want to have cookies stored on your computer you must deactivate the corresponding option in the system settings of your browser. You can delete any cookies that have already been stored there at any time. Insofar as you only want to change the cookie settings for our website or if you wish to withdraw your permission with effect for the future, you can call up

and change your selection mode there accordingly. Please note that you will possibly no longer be able to use all the functions on our website completely if you generally prevent the storage of cookies in your system.

Further information on cookies and user-based online marketing is available for example at the EU site http://www.youronlinechoices.com/. This is where you may object to the use of cookies for user-based online marketing either completely or for individual providers.

V. Contact form and email contact

1. Description and extent of the processing of data

Our website contains contact forms for contacting us electronically.

You may also contact us by email through the prepared email addresses.

Contact forms

When you contact us by using a contact form, your data provided on the form and any possibly included attachments will be transmitted to us and stored. The data will be transferred using a coded connection. When you send the message the IP address of the internet connection you are using and the date and the time when you sent the message will also be stored.
We will store the data you transfer when you contact us and use it as necessary to process your request. We will not pass your data on to a third party.

Email contact

You can also contact us through the email address provided for this purpose. When you use this option, we will also store the personal data about yourself provided with the email and use it to process your enquiry. We will not pass on the data you provide us with to a third party when you contact us.

2. Purpose for processing the data, legal basis

The only purpose for processing personal data contained in enquiries received through our contact forms or by email is to process the request for which you have contacted us.

The legal basis for processing the data you have provided is Art. 6 (1f) GDPR. Our legitimate interest in processing these data is to be able process your request. If you contact us to conclude an agreement, Art. 6(1b) GDPR will constitute the legal basis for processing the data.

3. Storage period

The data you have sent us will be deleted as soon as they are no longer required for the purpose for which they were collected. This is usually the case for the personal data transferred in the contact form or by email when the matter at hand has been finally clarified and the communication with you has been ended.

4. Options for objecting and having data removed

You may at any time demand to have the personal data you have given us in connection with a request deleted. In this case all affected data will be deleted insofar as they are not required to fulfil an agreement or to carry out contractual measures and when no contractual or legal obligations prevent the data from being deleted.

VI. Registration / User account

1. Description and extent of the processing of data

On our website we enable you to open a user account by providing your personal data. The data are entered in a form and sent to us where they are stored. The data will not be passed on to a third party. The following data will be collected during the registration process:

• your first and last name,
• your email address

When you register the following data will also be stored:

• the IP address of the internet connection used by your system and
• the date and time when you register

2. Purpose for processing the data, legal basis

The transfer of data on our website when you register allows you to use our other services direct through our website. The legal basis for processing the data is Art. 6(1b) GDPR.

3. Storage period

The data will be stored for as long as they are required for the purpose for which they are being collected. For the data collected when you register this will always be the case for the time during which you are registered on our website with a user account.

4. Options for objecting and having data removed

You may close your user account at any time. Should you choose to use this option, we will immediately delete your data unless they are still needed to completely settle the agreement with you. After all agreements have been completely settled and your user account has been closed, we will process data about yourself only insofar as this is necessary to fulfil our legal obligations, for example with regard to retention periods according to fiscal and commercial law. Your data will be blocked for further processing and deleted after the retention period has lapsed unless you have not explicitly agreed to their further use or unless their further use is legally permitted for other reasons.

VII. Use of font libraries (Google Fonts)

To enable us to present the content of our website browser correctly and in a visually attractive manner we use Google Fonts, a font library from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, (Google). The provider of Google services on the territory of the European Union and Switzerland is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google). Further information on Google Fonts is available at https://fonts.google.com/.

When you call up our website, a connection to the Google server will be made where the font library is being operated. At the same time various user settings and data will be processed by Google. Here Google will in particular be able to see that your enquiry has been sent from our website and that the display of the font is being sent to the IP address which has been assigned to the internet connection you are using.

To avoid repeated uploads the fonts from the Google Fonts library used on our website will be transferred to the cache (temporary storage unit) of your browser. In the event that your browser does not support the Google fonts or if it prevents an access to the fonts, our content will be displayed by your browser as a standard font.

The legal basis for using Google Fonts is Art. 6(1f) GDPR. Our legitimate interest here lies in optimising the functionality of our website and in presenting it in a visually attractive manner and thereby enabling you to comfortably use our website.

Should you not wish to use Google Fonts and the associated data processing described above, you can adjust your browser so that the fonts will not be downloaded from the Google servers (for example by installing add-ons such as NoScript or Ghostery for Firefox). When you prevent the downloading of Google Fonts, the text will be shown in the standard font of your system.

We cannot exclude the possibility that Google uses servers from outside the territory of the European Union, in particular from the USA, to provide Google Fonts. Through the certification according to the EU-US data protection treaty (“EU-US Privacy Shield” see www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active), Google however guarantees that the data protection regulations of the EU will also be observed when data are being processed in the USA. The use of Google Fonts and the processing of the data collected in the process by Google take place on the basis of the corresponding Google site policy (https://policies.google.com/terms?gl=DE&hl=de). Further information on the topic, especially on the options available for preventing the use of the data, is available through Google at https://adssettings.google.com/authenticated and https://policies.google.com/privacy.

VIII. Use of Google Maps

To depict geographic information visually we use Google Maps API on our website. The API (Application Programming Interface) is an interface with which we incorporate maps from Google Maps on our website. The provider of Google Maps is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA. The provider of the Google services on the territory of the European Union and Switzerland is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google).

To ensure the protection of the data on the website, Google Maps is deactivated when you first call up this website. When you agree to the use of Google Maps and their cookies the service will be activated to ensure that the maps from Google Maps are shown correctly on our website. When you call up the subsite of the Google Maps functionality, Google will store a cookie on your system through your internet browser and establish a connection to a Google server.

The connection to a Google server enables Google to recognise that your enquiry has been sent from our website. Google can also see that the geographic information is being transferred to the IP address which is assigned to the internet connection being used by you. The legal basis for using Google Maps is Art. 6(1a) GDPR.

We cannot exclude that Google may be using the functions of servers from outside the territory of the European Union, in particular from the USA, to provide the Google Maps functionality. Through the certification according to the EU-US data protection agreement (“EU-US Privacy Shield”) https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active , Google however guarantees that the data protection regulations of the EU will also be maintained when data are processed in the USA. The use of Google Maps and the processing of the data collected in the process by Google takes place on the basis of the corresponding Google site policy (https://policies.google.com/terms?gl=DE&hl=de) and the terms of business applying to Google Maps https://www.google.com/intl/de_de/help/terms_maps.html. Further information from Google is available at https://adssettings.google.de/ or at https://policies.google.com/privacy.

Insofar as you do not agree to have your data processed in this manner by Google, you may prevent having the cookies installed by adjusting your internet browser accordingly. Further details are available above under item V “Cookies”.

IX. Links to social media

You can find us online on the social media portals Facebook, Instagram and YouTube. We are using these platforms to contact customers and attract new prospects who are active on these platforms and to inform them about our offers. Our website contains control buttons that are linked to these platforms.

When you use one of these control buttons you will be redirected to our site within the respective portal. When you contact us there we will process the data you send us in answer to your enquiry. Please note in this context that the processing of your data within the social media portals will be subject to the terms of use and the data processing regulations of the respective provider and that we therefore only have a limited influence on how your personal data that you sent us on these platforms are being processed.

Further information on the collection and use of data including your respective rights and protection options are available for you in the data protection information of the operators of the portals. We would also like to refer to our data protection statements on the social media platforms.

X. Your rights as the data subject

Whenever personal data about yourself are being processed by us within the scope of the use of our website or within another context, you will be considered as being the data subject within the meaning of the GDPR regulations. This status will give you the following rights towards us as the controller:

1. Your right of access, Art. 15 GDPR

You may at any time request information from us about whether the personal data relating to you are being processed by us. When we are actually processing such data you may ask for additional information concerning:

• the purposes of the processing of personal data relating to you;
• the categories of personal data concerned;
• the recipients or categories to whom the personal data have been or will be disclosed;
• where possible, the envisaged period for which the personal data relating to you will be stored, or, if not possible, the criteria used to determine that period;
• the existence of the right to request the rectification or deletion of personal data relating to you, the existence of the right to limit the processing of these data by us, or to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data have not been collected from you, any available information as to their source;
• the existence of an automated decision making procedure including profiling according to Art. 22(1) and (4) GDPR and, at least in these cases, meaningful information about the logic involved as well as about the significance and the envisaged consequences of such processing for you.

Where personal data relating to you are transferred to a third country or to an international organisation, you have the right pursuant to Art. 46 GDPR to be informed of the appropriate safeguards relating to the transfer.

2. Your right to rectification, Art.16 GDPR

You may demand that we correct and/or complete data insofar as the personal data that are being processed by us concerning you are incorrect or incomplete. When you make use of this right, we will immediately correct the data accordingly.

3. Your right to restrict processing, Art. 18 GDPR

You may limit the personal data being processed by us concerning you when:

• you contest the correctness of the personal data relating to you – here for the time it takes us to verify the correctness of the personal data;
• the processing is unlawful, whereby you oppose the deletion of the personal data and instead request the restriction of their use;
• we no longer need the personal data for the purposes of the processing, but you still require them to assert, exercise or defend legal rights, or
• you have objected to the processing pursuant to Art. 21(1) GDPR pending the verification whether the legitimate grounds we have given override yours.

When we have restricted the processing of personal data relating to you at your request, with the exception of storage such personal data shall only be processed with your consent or to assert, exercise or defend legal rights or to protect the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If you have asserted the restriction of the processing of the data against us according to the conditions given above, we will inform you accordingly before we lift the restriction.

4. Your right to have data deleted (the ‘right to be forgotten’), Art. 17 GDPR

You may ask us to delete the personal data relating to you immediately. We are obligated to immediately delete these data insofar as

• the personal data are no longer necessary for the purpose for which they were collected or otherwise processed;
• you have withdrawn your consent to have the data processed pursuant to Art. 6(1a) or Art. 9(2a) GDPR and there are no other legal grounds for the processing;
• you have objected to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing;
• you object to the processing in accordance with Art. 21(2) GDPR;
• the personal data relating to you have been unlawfully processed;
• the personal data relating to you have to be deleted to comply with a legal obligation according to Union or Member State law to which we are bound, or
• the personal data relating to you have been collected in relation to the offer of information society services pursuant to Art. 8(1) GDPR.

Where we have made the personal data relating to you public and we are obliged to delete them according to Art. 17(1) GDPR, while accounting for the available technology and implementation costs, we will take reasonable steps, including technical measures, to inform controllers who are processing the data that you as the data subject have requested the deletion by such controllers of any links to or copies or replications of those personal data.

Data may not be legally deleted insofar as they must be processed

• to exercise the right to freedom of expression and information;
• to comply with a legal obligation requiring processing by Union or Member State law which we are subject to or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
• for reasons of public interest in the area of public health in accordance with Art. 9(2h) and (2i) as well as Art. 9(3) GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes in accordance with Art. 89(1) GDPR insofar as the right referred to in item a) is likely to render impossible or seriously impair the achievement of the objectives of the processing, or
• to assert, exercise or defend legal rights.

5. Notification obligation regarding the rectification or deletion of personal data or a restriction of the processing, Art. 19 GDPR

Where you have asserted the right to correct, delete or limit the processing of data against us, we shall communicate this to each recipient to whom the personal data have been disclosed unless this proves impossible or involves a disproportionate effort. We shall however inform you about those recipients if you request this.

6. Your right to data portability, Art. 20 GDPR

You have the right to receive the personal data concerning yourself which you have provided us with in a structured, commonly used and machine-readable format. In addition, you have the right to transmit those data to another controller without hindrance where

• the processing is based on consent pursuant to Art. 6(1a) GDPR or Art. 9(2a) GDPR or on a contract pursuant to Art. 6(1b) GDPR, and
• the processing is carried out by automated means.

In exercising this right you also have the right to have the personal data relating to you transmitted directly by us to another controller where this is technically feasible, while the liberties and rights of other persons may not be impaired by this data transferral.

The right to data portability does not apply to the processing of personal data required to perform a task carried out in the public interest or in the exercise of official authority vested in us.

7. Your right to object, Art. 21 GDPR

You may at any time on grounds relating to your particular situation object to the processing of personal data relating to you based on Art. 6(1e) or (1f) GDPR including profiling measures based on these provisions.

We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for asserting, exercising or defending legal rights.

Where personal data relating to you are processed for direct marketing purposes, you may at any time object to the processing of personal data relating to you for such marketing which includes profiling to the extent that it is related to such direct marketing.

When you object to processing for direct marketing purposes, the personal data relating to you will then no longer be processed for such purposes.

In the context of the use of information society services, and not withstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Your right to withdraw consent, Art. 7(3) GDPR

When we process personal data about yourself on the basis of a corresponding consent, you may at any time withdraw your declaration of consent. The withdrawal of consent will not affect the lawfulness based on this consent before its withdrawal.

9. Your right to lodge a complaint with a supervisory authority, Art. 77 GDPR

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual place of residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes this regulation of the GDPR.

When you have lodged a complaint, the supervisory board will inform you about the status and the results of the complaint and the options for a judicial remedy according to Art. 78 GDPR.