Privacy policy

We are pleased that you are visiting our websites. The protection and security of your personal information when using our website and the services we provide is very important to us. Therefore, we would like to inform you at this point about which of your personal data we process and for what purposes it is used.

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data refers to any data that can be used to personally identify you. For detailed information on data protection, please refer to our Privacy Policy listed below this text.

Data Collection on This Website

Who Is Responsible for Data Collection on This Website?

Data processing on this website is carried out by the website operator. You can find the operator’s contact information in the “Information on the Responsible Party” section of this privacy policy.

How do we collect your data?

Your data is collected, on the one hand, when you provide it to us. This may include, for example, data you enter into a contact form.

Other data is collected automatically or with your consent when you visit the website via our IT systems. This primarily consists of technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you access this website.

How do we use your data?

Some of the data is collected to ensure the website functions properly. Other data may be used to analyze your user behavior. If contracts can be concluded or initiated via the website, the data transmitted is also processed for contract offers, orders, or other order inquiries.

What rights do you have regarding your data?

You have the right at any time to receive, free of charge, information about the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you may revoke this consent at any time with future effect. In addition, you have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to file a complaint with the competent supervisory authority.

You can contact us at any time regarding this matter or any other questions about data protection.

Analytics Tools and Third-Party Tools

When you visit this website, your browsing behavior may be statistically analyzed. This is primarily done using so-called analytics programs.

Detailed information about these analytics programs can be found in the following privacy policy.

2. Hosting and Content Delivery Networks (CDN)

We host the content of our website with the following provider:

External Hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the hosting provider(s). This may primarily include IP addresses, contact requests, metadata and communication data, contractual data, contact information, names, website visits, and other data generated through a website.

External hosting is carried out for the purpose of fulfilling our contractual obligations to our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of ensuring the secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1) (f) GDPR). If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) as defined by the TDDDG. Consent may be revoked at any time.

Our hosting provider(s) will process your data only to the extent necessary to fulfill its service obligations and will follow our instructions regarding this data.

We use the following hosting provider(s):

one4vision GmbH
Talstraße 34
66119 Saarbrücken

Data Processing

We have entered into a Data Processing Agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law that ensures the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Cloudflare

We use the “Cloudflare” service. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter “Cloudflare”).

Cloudflare offers a globally distributed content delivery network with DNS. Technically, this means that the transfer of information between your browser and our website is routed through Cloudflare’s network. This enables Cloudflare to analyze the data traffic between your browser and our website and to act as a filter between our servers and potentially malicious traffic from the Internet. In doing so, Cloudflare may also use cookies or other technologies to recognize Internet users; however, these are used solely for the purpose described here.

Our use of Cloudflare is based on our legitimate interest in providing our website as error-free and secure as possible (Art. 6(1)(f) GDPR).

Data transfers to the U.S. are based on the European Commission’s Standard Contractual Clauses. Details and further information on security and data protection at Cloudflare can be found here: https://www.cloudflare.com/privacypolicy/.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information on this, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5666.

3. General Information and Mandatory Disclosures

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations as well as this Privacy Policy.

When you use this website, various types of personal data are collected. Personal data is data that can be used to personally identify you. This privacy policy explains what data we collect and how we use it. It also explains how and for what purpose this is done.

Please note that data transmission over the Internet (e.g., when communicating via email) may involve security vulnerabilities. It is not possible to completely protect data from access by third parties.

Information on the Data Controller

The entity responsible for data processing on this website is:

edoc solutions gmbh
Metternicher Str. 4
53919 Weilerswist

Phone: +49 2254 9643 0
Email: datenschutz(at)edoc.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g., names, email addresses, etc.).

Retention Period

Unless a more specific retention period is stated in this Privacy Policy, we will retain your personal data until the purpose for which it was collected no longer applies. If you submit a valid request for erasure or revoke your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing your personal data (e.g., retention periods under tax or commercial law); in the latter case, the data will be erased once these grounds no longer apply.

General Information on the Legal Bases for Data Processing on This Website

If you have consented to data processing, we process your personal data on the basis of Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, provided that special categories of data as defined in Article 9(1) of the GDPR are being processed. In the event of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Article 49(1)(a) of the GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g., via device fingerprinting), data processing is additionally based on Section 25(1) of the German Telemedia Act (TDDDG). You may revoke your consent at any time. If your data is necessary for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Article 6(1)(b) of the GDPR. Furthermore, we process your data, to the extent that it is necessary to comply with a legal obligation, on the basis of Article 6(1)(c) of the GDPR. Data processing may also be based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR. The following sections of this Privacy Policy provide information on the specific legal bases applicable in each individual case.

Data Protection Officer

We have appointed a Data Protection Officer who can be reached via the email address datenschutz@edoc.de or using the contact information provided above. Please mark any postal correspondence addressed to the Data Protection Officer with the note “Data Protection – Personal / Confidential.”

Email: datenschutz@edoc.de

Recipients of Personal Data

As part of our business operations, we collaborate with various external parties. In some cases, this requires the transfer of personal data to these external parties. We only disclose personal data to external parties if this is necessary for the performance of a contract, if we are legally obligated to do so (e.g., disclosure of data to tax authorities), if we have a legitimate interest in the disclosure pursuant to Art. 6(1)(f) of the GDPR, or if another legal basis permits the disclosure of data. When using data processors, we only disclose our customers’ personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You may withdraw any consent you have already given at any time. The lawfulness of the data processing carried out prior to the withdrawal remains unaffected by the withdrawal.

Right to Object to Data Collection in Specific Cases and to Direct Marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) E OR F OF THE GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR SPECIFIC SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. YOU CAN FIND THE SPECIFIC LEGAL BASIS ON WHICH PROCESSING IS BASED IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, exercise, or defense of legal claims (objection under Art. 21(1) of the GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING PURPOSES; THIS ALSO APPLIES TO PROFILING, TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) OF THE GDPR).

Right to File a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the location of the alleged violation. This right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Right to Data Portability

You have the right to have data that we process automatically based on your consent or in fulfillment of a contract provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place to the extent that it is technically feasible.

Access, Rectification, and Erasure

Subject to applicable legal provisions, you have the right at any time to receive, free of charge, information about your stored personal data, its origin and recipients, and the purpose of the data processing, as well as the right to have this data corrected or deleted, if applicable. You may contact us at any time regarding this matter or any other questions about personal data.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data. You may contact us at any time regarding this matter. The right to restriction of processing applies in the following cases:

If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.

If the processing of your personal data was or is unlawful, you may request the restriction of data processing instead of erasure.

If we no longer need your personal data, but you need it to exercise, defend, or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.

If you have lodged an objection under Article 21(1) of the GDPR, a balancing of your interests against ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, such data—apart from its storage—may be processed only with your consent or for the purpose of asserting, exercising , or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the European Union or a Member State.

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content—such as orders or inquiries you send to us as the website operator—this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address bar of your browser changes from “http://” to “https://” and by the lock icon in your browser’s address bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Objection to Promotional Emails

We hereby object to the use of contact information published in accordance with the legal notice requirement for the purpose of sending unsolicited advertising and informational materials. The operators of this website expressly reserve the right to take legal action in the event of the unsolicited transmission of advertising information, such as via spam emails.

4. Data Collection on This Website

Cookies

Our website uses so-called “cookies.” Cookies are small data packets that do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically.

Cookies may originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain third-party services within websites (e.g., cookies for processing payment services).

Cookies serve various functions. Many cookies are technically necessary, as certain website features would not work without them (e.g., the shopping cart feature or the display of videos). Other cookies may be used to analyze user behavior or for advertising purposes.

Cookies that are necessary for the electronic communication process, for providing certain functions you have requested (e.g., the shopping cart feature), or for optimizing the website (e.g., cookies for measuring website traffic) are stored on the basis of Article 6(1)(f) of the GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure the technically error-free and optimized provision of its services. If consent to the storage of cookies and similar recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG); consent may be revoked at any time.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block the acceptance of cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.

If additional cookies and services are used on this website, you can find this information in this Privacy Policy.

CookieFirst

Our website uses CookieFirst to obtain your consent to the storage of certain cookies on your device or to the use of certain technologies, and to document this in compliance with data protection regulations at . The provider of this technology is Digital Data Solutions B.V. (CookieFirst), Plantage Middenlaan 42A, 1018 DH Amsterdam, Netherlands (hereinafter “CookieFirst”).

When you visit our website, a connection is established with CookieFirst’s servers to obtain your consents and other statements regarding cookie usage. CookieFirst then stores a cookie in your browser to associate the consents you have granted—or their revocation—with your session. In this process, the IP address (anonymized), the browser’s user agent and operating system, and the URL from which consent was granted are processed and integrated into CookieFirst. The data collected in this manner is stored until you request that we delete it, delete the CookieFirst cookie yourself, or the purpose for storing the data no longer applies. Mandatory legal retention requirements remain unaffected.

CookieFirst transfers personal data to third-party providers. These include a CDN based in Slovenia, an IP geolocation service based in Romania, and hosting services provided by OHV in Germany and France. CookieFirst is headquartered in Amsterdam, the Netherlands.

CookieFirst is used to obtain the legally required consents for the use of cookies. The legal basis for this is Article 6(1)(c) of the GDPR.

CookieFirst can be used as part of a multi-domain configuration. This allows users’ consent decisions to be taken into account and documented across multiple websites operated by the same controller, thereby avoiding repeated consent requests. To this end, CookieFirst processes the necessary technical information and consent status data.

Data Processing

We have entered into a Data Processing Agreement (DPA) for the use of the aforementioned service. This is a contract required under data protection law that ensures the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Consent Management

The following information is provided and updated by Consent Management - CookieFirst:

Server Log Files

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. This information includes:

Browser type and browser version

Operating system used

Referrer URL

Hostname of the accessing computer

Time of the server request

IP address

This data is not combined with other data sources.

This data is collected on the basis of Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in ensuring the technically error-free display and optimization of its website—to this end, the server log files must be collected.

Contact Form

If you submit inquiries to us via the contact form, the information you provide in the form—including the contact details you enter there—will be stored by us for the purpose of processing your inquiry and in case of follow-up questions. We will not disclose this data without your consent.

The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your inquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries directed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR) if such consent was requested; consent may be revoked at any time.

The data you enter in the contact form will remain with us until you request that we delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your inquiry has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Inquiries via Email, Phone, or Fax

If you contact us via email, phone, or fax, your inquiry—including all personal data contained therein (name, inquiry)—will be stored and processed by us for the purpose of handling your request. We will not disclose this data without your consent.

The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries directed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR) if such consent was requested; consent may be revoked at any time.

The data you send us via contact requests will remain with us until you request that we delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been fully processed). Mandatory legal provisions—in particular statutory retention periods—remain unaffected.

Atlassian for docs.edoc.de

This website uses services from the Atlassian Cloud for organization, documentation, collaboration, and the management of projects and support requests. The provider is Atlassian Pty Ltd, Level 6, 341 George Street, Sydney NSW 2000, Australia.

Atlassian provides various cloud-based applications, in particular Jira, Confluence, Jira Service Management, and other collaboration and project management solutions. When using these services, personal data may be processed, such as user master data, contact information, communication content, project information, ticket content, log data, IP addresses, and usage data.

This processing is carried out for the purposes of planning, managing, and documenting business processes; facilitating internal collaboration; handling support requests; and providing and optimizing workflows. The data may be stored and processed on servers operated by Atlassian or its subprocessors.

To the extent that personal data is transferred to third countries, in particular to Australia or the United States, this is done in compliance with the legal requirements of the GDPR. For international data transfers, Atlassian uses, in particular, the Standard Contractual Clauses (SCCs) approved by the European Commission, as well as other appropriate safeguards in accordance with Article 46 of the GDPR.

Legal Basis

The use of Atlassian is based on Article 6(1)(f) of the GDPR, provided there is a legitimate interest in the efficient organization of business processes, project management, and collaboration workflows.

To the extent that use is necessary to fulfill a contract or to take steps prior to entering into a contract, processing is based on Article 6(1)(b) of the GDPR.

If Atlassian technologies are used that store information on or access end devices, this is additionally based on the relevant provisions of the TDDDG. Consent is obtained if required by law.

For data transfers to countries outside the European Union or the European Economic Area, Atlassian uses the European Commission’s Standard Contractual Clauses as well as other appropriate safeguards within the meaning of Article 46 of the GDPR.

Data Processing

We have entered into a data processing agreement (Data Processing Addendum) with Atlassian and fully comply with the strict requirements of the German data protection authorities when using Atlassian. In doing so, we require Atlassian to process personal data exclusively in accordance with our instructions and in compliance with applicable data protection requirements.

Microsoft Bookings

On our website, you have the option to schedule appointments with us. We use Microsoft Bookings for appointment scheduling. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, https://learn.microsoft.com/de-de/microsoft-365/bookings/?view=o365-worldwide.

To book an appointment, please enter the requested information and your preferred date and time in the form provided. The information you provide will be used for planning, conducting, and, if necessary, following up on the appointment. The appointment data is stored on Microsoft Bookings’ servers on our behalf; you can view their privacy policy here: https://privacy.microsoft.com/de-de/privacystatement.

The data you enter will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies. Mandatory legal provisions—in particular retention periods—remain unaffected.

The legal basis for data processing is Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in making the appointment scheduling process as straightforward as possible for prospective clients and customers. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., for device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

Data transfers to the U.S. are based on the European Commission’s Standard Contractual Clauses. Details can be found here: https://learn.microsoft.com/de-de/compliance/regulatory/offering-eu-model-clauses.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/6474.

Retention Period

The data processed using Microsoft Bookings will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Conclusion of a Data Processing Agreement

We have entered into a data processing agreement with Microsoft and fully comply with the strict requirements of the German data protection authorities when using Microsoft.

Data Transfer

Data may be transferred to entities in countries outside the EU or the European Economic Area (EEA)—so-called third countries—if such a transfer is necessary to fulfill an order or contract, is required by law, is based on a legitimate interest under the General Data Protection Regulation ( ), or if consent has been granted. In this context, the processing of personal data in a third country may also occur in connection with the engagement of service providers within the framework of data processing on behalf of the controller. If the European Commission has not issued a decision recognizing an adequate level of data protection in the country in question, appropriate contracts will be used in accordance with EU data protection regulations to ensure that the rights and freedoms of business partners and prospective customers are adequately protected and guaranteed.

Cookies

The Microsoft Bookings website uses certain so-called cookies. These cookies include:

Name	Cookie Expiration Date	Recipient
MC1	1 year	.microsoft.com
OIDC	6 months	outlook.office365.com
MS0	Session	.microsoft.com
ClientId	1 year	outlook.office365.com

Microsoft FindTime

We use Microsoft FindTime for scheduling and managing appointments. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Microsoft FindTime is a service that enables scheduling. The data you enter for the purpose of scheduling (preference, confirmation, and/or rejection of proposed times, as well as suggestions for other times), as well as the personal data (email address, first and last name, and possibly the subject and location of the appointment) provided by us, are stored on servers operated by Microsoft in the U.S. or Microsoft in Ireland. The survey data is stored in the organizers’ mailboxes and encrypted by Microsoft.

The “Show Availability” feature may allow you to display your own appointments in FindTime; by using this feature, you log in with your Microsoft account, and we are not responsible for this processing.

The use of this tool is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in scheduling and managing appointments to optimize our processes. Data processing may also be based on Article 6(1)(b) of the GDPR, provided that your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device within the meaning of the TDDDG. Consent may be revoked at any time.

For more details, please refer to Microsoft’s privacy policy at:privacy.microsoft.com/de-de/privacystatement orsupport.microsoft.com/de-de/office/datenschutz-und-schutz-pers%C3%B6nlicher-daten-in-uhrzeit-finden-7dbbeb41-245c-4573-97ea-50fcb8610cde .

Note on Data Transfer to the U.S.

Your personal data may be transferred to Microsoft’s servers in the U.S. Please note that the U.S. is not a “safe third country” within the meaning of EU data protection law. U.S. companies are required to disclose personal data to law enforcement agencies without you, as the data subject, having the right to challenge this in court. It therefore cannot be ruled out that U.S. authorities (e.g., intelligence agencies) may process, analyze, and permanently store your data located on U.S. servers for surveillance purposes. We have no influence over these processing activities. Data transfers to the U.S. are based on the European Commission’s Standard Contractual Clauses. Furthermore, Microsoft is certified under the EU-U.S. Data Privacy Framework (EU-US DPF) (https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000KzNaAAK&status=Active).

Retention Period

The data processed using Microsoft FindTime remains with us until you request that we delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Conclusion of a Data Processing Agreement

We have entered into a data processing agreement with Microsoft and fully comply with the strict requirements of the German data protection authorities regarding the use of Microsoft.

Data Transfer

Data may be transferred to entities in countries outside the EU or the European Economic Area (EEA)—so-called third countries—if such a transfer is necessary to fulfill an order or contract, is required by law, is based on a legitimate interest, or consent has been granted. In this context, the processing of personal data in a third country may also occur in connection with the engagement of service providers within the framework of data processing on behalf of the controller. If the European Commission has not issued a decision recognizing an adequate level of data protection in the country in question, appropriate contracts will be used in accordance with EU data protection regulations to ensure that the rights and freedoms of business partners and interested parties are adequately protected and guaranteed.

Cookies

Some of the Microsoft FindTime pages use so-called cookies. These cookies include:

Name	Cookie Expiration Date	Recipient
OutlookSession	Session	outlook.office.com
ShCLSessionID	Session	outlook.office.com
OpenIdConnect.nonce.v3	1 day	outlook.office.com
OIDC	173 days	outlook.office.com
X-OWA-RedirectHistory	2 days	outlook.office.com
ClientId	357 days	outlook.office.com

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website. Cookies that are necessary for carrying out the electronic communication process or for providing specific functions you have requested are stored based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in storing cookies to ensure the technically error-free and optimized provision of its services

PowerAutomate

We use Microsoft PowerAutomate to optimize business processes. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

PowerAutomate is a platform that enables us to create automated workflows that connect various applications and services. We use PowerAutomate to optimize our business processes, increase our productivity, and better serve our customers. With PowerAutomate, we can, for example, send emails, update databases, generate documents, receive notifications, and much more. PowerAutomate offers us a simple and flexible way to get our work done without requiring any programming knowledge. The use of this tool is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in optimizing business processes. Data processing may also be based on Article 6(1)(b) of the GDPR, provided that your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user’s device as defined by the TDDDG. Consent may be revoked at any time.

Note on Data Transfer to the U.S.

Your personal data may be transferred to Microsoft’s servers in the U.S. Please note that the U.S. is not a “safe third country” within the meaning of EU data protection law. U.S. companies are required to disclose personal data to law enforcement agencies without you, as the data subject, having the right to challenge this in court. It therefore cannot be ruled out that U.S. authorities (e.g., intelligence agencies) may process, analyze, and permanently store your data located on U.S. servers for surveillance purposes. We have no influence over these processing activities. The transfer of data to the U.S. is based on the European Commission’s Standard Contractual Clauses. Furthermore, Microsoft is certified under the EU-U.S. Data Privacy Framework (EU-US DPF) (https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000KzNaAAK&status=Active).

Retention Period

The data processed with PowerAutomate remains with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Conclusion of a Data Processing Agreement

We have entered into a data processing agreement with Microsoft and fully comply with the strict requirements of the German data protection authorities regarding the use of Microsoft.

Data Transfer

Data may be transferred to entities in countries outside the EU or the European Economic Area (EEA)—so-called third countries—if such a transfer is necessary to fulfill an order or contract, is required by law, is based on a legitimate interest, or consent has been granted. In this context, the processing of personal data in a third country may also occur in connection with the engagement of service providers within the framework of data processing on behalf of the controller. If the European Commission has not issued a decision recognizing an adequate level of data protection in the country in question, appropriate contracts will be used in accordance with EU data protection regulations to ensure that the rights and freedoms of business partners and prospective customers are adequately protected and guaranteed.

HubSpot API

Nature and Scope of Processing

We use the HubSpot API from HubSpot, Inc., Cambridge, Massachusetts, USA, to access additional services and data from HubSpot, Inc. In doing so, your IP address is transmitted to HubSpot, Inc. Please note that a separate section in this privacy policy is dedicated to each additional service we use from HubSpot, Inc.

Purpose and Legal Basis

This processing is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring that our website is displayed as reliably as possible. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) as defined by the TDDDG. Consent may be revoked at any time.

Retention Period

We have no influence over the specific retention period of the processed data; it is determined by HubSpot, Inc. For further information, please refer to the privacy policy for the HubSpot API: legal.hubspot.com/privacy-policy.

HubSpot Analytics

Nature and Scope of Processing

We use HubSpot Analytics from HubSpot, Inc., Cambridge, Massachusetts, USA, as an analytics service for the statistical evaluation of our online offering. This includes, for example, the number of visits to our online offering, the subpages visited, and the length of time visitors spend on the site.

HubSpot Analytics uses cookies and other browser technologies to analyze user behavior and recognize users.

This information is used, among other things, to compile reports on website activity.

Purpose and Legal Basis

We process data using HubSpot Analytics for the purpose of optimizing our website and for marketing purposes. This processing is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) as defined by the TDDDG. Consent may be revoked at any time.

Retention Period

We have no influence over the specific retention period of the processed data; it is determined by HubSpot, Inc. For further information, please refer to the privacy policy for HubSpot Analytics: legal.hubspot.com/privacy-policy.

HubSpot CDN

Nature and Scope of Processing

We use HubSpot CDN to properly deliver the content of our website. HubSpot CDN is a service provided by HubSpot, Inc., which functions as a Content Delivery Network (CDN) on our website to ensure the functionality of other HubSpot, Inc. services. A separate section in this privacy policy addresses those services. This section deals solely with the use of the CDN.

A CDN helps deliver content from our online offering—particularly files such as graphics or scripts—more quickly using servers distributed regionally or internationally. When you access this content, you establish a connection to servers operated by HubSpot, Inc., Cambridge, Massachusetts, U.S., during which your IP address and, if applicable, browser data such as your user agent are transmitted. This data is processed exclusively for the purposes mentioned above and to maintain the security and functionality of the HubSpot CDN.

Purpose and Legal Basis

The use of the Content Delivery Network is based on our legitimate interests, i.e., our interest in the secure and efficient delivery and optimization of our online offerings. This use is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring that our website is displayed as reliably as possible. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) as defined by the TDDDG. Consent may be revoked at any time.

Retention Period

HubSpot Chat

Nature and Scope of Processing

We have integrated components of the HubSpot Chat customer communication platform into our website. HubSpot Chat is a service provided by HubSpot, Inc. and enables us to communicate with visitors to our website via chat and provide targeted assistance with their inquiries. HubSpot Chat uses cookies and other browser technologies to analyze user behavior and recognize users. Furthermore, HubSpot Chat is used to store and transmit data entered in chats—including your IP address—via cookies. In this case, your data is transferred to the operator of HubSpot Chat, HubSpot, Inc., Cambridge, Massachusetts, US.

Purpose and Legal Basis

The use of HubSpot Chat is based on our legitimate interests, i.e., our interest in optimizing our online offering. This use is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

Retention Period

HubSpot Cookie Banner

Nature and Scope of Processing

We have integrated the HubSpot Cookie Banner on our website. The HubSpot Cookie Banner is a consent solution provided by HubSpot, Inc., Cambridge, Massachusetts, USA, which allows us to obtain and document consent for the storage of cookies. The HubSpot Cookie Banner uses cookies or other web technologies to recognize users and to store consent that has been granted or revoked.

Purpose and Legal Basis

Use of the service is based on obtaining the legally required consent to the use of cookies in accordance with Article 6(1)(c) of the GDPR.

Retention Period

HubSpot Forms

Nature and Scope of Processing

We have integrated HubSpot Forms into our website. HubSpot Forms is a service provided by HubSpot, Inc. and offers marketing automation software for marketing services and products, including SEO and content creation, lead management, email marketing, and web analytics.

HubSpot Forms is used to store data entered into forms, e.g., when contacting us via the contact form. The data provided may be stored in our Customer Relationship Management (CRM) system.

In this case, your data is transferred to the operator of HubSpot Forms, HubSpot, Inc., Cambridge, Massachusetts, US.

Purpose and Legal Basis

We process your data using HubSpot Forms for the purpose of handling your contact request and processing it in accordance with Article 6(1)(b) of the GDPR.

The use of HubSpot Forms and its integrated services is based on our legitimate interest under Article 6(1)(f) of the GDPR to optimize our marketing activities and improve the quality of our services on the website.

Retention Period

We have no control over the specific retention period for the processed data; it is determined by HubSpot, Inc. For more information, please see the HubSpot Forms Privacy Policy: legal.hubspot.com/privacy-policy.

HubSpot LeadFlow

Nature and Scope of Processing

We have integrated HubSpot LeadFlow into our website. HubSpot LeadFlow is a service provided by HubSpot, Inc., Cambridge, Massachusetts, USA, that identifies anonymous website visitors and provides complete contact information and insights into their browsing history.

HubSpot LeadFlow uses cookies and other browser technologies to analyze user behavior and recognize users.

Among other things, HubSpot LeadFlow shows us which companies have visited our website, tracks the history of your visit—including all pages you’ve visited and viewed—and the length of your stay on this website.

HubSpot LeadFlow collects and processes data about companies, such as company name, phone number, address, website URL, industry, company profile, revenue, and key contacts on LinkedIn.

Purpose and Legal Basis

We process your data using HubSpot LeadFlow for the purpose of optimizing our website and for marketing purposes based on our legitimate interest. This processing is carried out pursuant to Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

Retention Period

HubSpot Pixel

Nature and Scope of Processing

We use HubSpot Pixels from HubSpot, Inc., Cambridge, Massachusetts, USA, to create so-called “Custom Audiences”—that is, to segment groups of visitors to our online offering, determine conversion rates, and subsequently optimize them. This occurs in particular when you interact with advertisements that we have placed using HubSpot, Inc.

Purpose and Legal Basis

We process your data using HubSpot Pixels for the purpose of optimizing our website and for marketing purposes. This processing is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) as defined by the TDDDG. Consent may be revoked at any time.

Retention Period

Azure Logic Apps

We use Azure Logic Apps as a Platform-as-a-Service (iPaaS). The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Azure Logic Apps is a leading Integration Platform-as-a-Service (iPaaS) based on a containerized runtime. With Logic Apps, we can create and run workflows anywhere to improve scalability and portability. At the same time, we automate all business-critical workflows. This platform enables us to create and execute automated workflows with little to no code. Using the visual designer and a selection of pre-built actions, we can quickly create a workflow that integrates and manages your apps, data, services, and systems. The use of this tool is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in implementing workflows. Data processing may also be based on Article 6(1)(b) of the GDPR, provided that your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user’s device as defined by the TDDDG. Consent may be revoked at any time.

Note on Data Transfer to the U.S.

Your personal data may be transferred to Microsoft’s servers in the U.S. Please note that the U.S. is not a “safe third country” within the meaning of EU data protection law. U.S. companies are required to disclose personal data to law enforcement agencies without you, as the data subject, having the right to challenge this in court. It therefore cannot be ruled out that U.S. authorities (e.g., intelligence agencies) may process, analyze, and permanently store your data located on U.S. servers for surveillance purposes. We have no influence over these processing activities. The transfer of data to the U.S. is based on the European Commission’s Standard Contractual Clauses. Furthermore, Microsoft is certified under the EU-U.S. Data Privacy Framework (EU-US DPF) (https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000KzNaAAK&status=Active).

Retention Period

The data processed with Azure Logic Apps remains with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Conclusion of a Data Processing Agreement

We have entered into a data processing agreement with Microsoft and fully comply with the strict requirements of the German data protection authorities regarding the use of Microsoft.

Data Transfer

Data may be transferred to entities in countries outside the EU or the European Economic Area (EEA)—so-called third countries—if such a transfer is necessary to fulfill an order or contract, is required by law, is based on a legitimate interest, or consent has been granted. In this context, the processing of personal data in a third country may also occur in connection with the engagement of service providers within the framework of data processing on behalf of the controller. If the European Commission has not issued a decision recognizing an adequate level of data protection in the country in question, appropriate contracts will be used in accordance with EU data protection requirements to ensure that the rights and freedoms of business partners and interested parties are adequately protected and guaranteed.

Microsoft Stream

We use Microsoft Stream to host videos. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Microsoft Stream is a platform for managing, presenting, and sharing videos in Microsoft 365. With Stream, we can record instructional videos, conduct meetings, find chapters and transcripts, perform analyses, and more. The use of this tool is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in providing videos. Data processing may also be based on Article 6(1)(b) of the GDPR, provided that your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device within the meaning of the TDDDG. Consent may be revoked at any time.

Notice Regarding Data Transfer to the United States

Your personal data may be transferred to Microsoft’s servers in the U.S. Please note that the U.S. is not a “safe third country” within the meaning of EU data protection law. U.S. companies are required to disclose personal data to law enforcement agencies, and you, as the data subject, have no legal recourse against this. It therefore cannot be ruled out that U.S. authorities (e.g., intelligence agencies) may process, analyze, and permanently store your data located on U.S. servers for surveillance purposes. We have no influence over these processing activities. The transfer of data to the U.S. is based on the European Commission’s Standard Contractual Clauses. Furthermore, Microsoft is certified under the EU-U.S. Data Privacy Framework (EU-US DPF) (https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000KzNaAAK&status=Active).

Retention Period

The data processed using Microsoft Stream remains with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Conclusion of a Data Processing Agreement

We have entered into a data processing agreement with Microsoft and fully comply with the strict requirements of the German data protection authorities regarding the use of Microsoft.

Data Transfer

Data may be transferred to entities in countries outside the EU or the European Economic Area (EEA)—so-called third countries—if such a transfer is necessary to fulfill an order or contract, is required by law, is based on a legitimate interest, or consent has been granted. In this context, the processing of personal data in a third country may also occur in connection with the engagement of service providers within the framework of data processing on behalf of the controller. If the European Commission has not issued a decision recognizing an adequate level of data protection in the country in question ( ), appropriate contracts in accordance with EU data protection regulations ensure that the rights and freedoms of business partners and prospective customers are adequately protected and guaranteed.

Microsoft Dynamics 365 Business Central

We use Business Central for Enterprise Resource Planning (ERP). The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Microsoft Dynamics 365 Business Central is a comprehensive enterprise resource planning (ERP) solution for small and medium-sized businesses. The use of this tool is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in enterprise resource planning. Data processing may also be based on Article 6(1)(b) of the GDPR, provided that your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device within the meaning of the TDDDG. Consent may be revoked at any time.

Note on Data Transfer to the U.S.

Your personal data may be transferred to Microsoft’s servers in the U.S. Please note that the U.S. is not a “safe third country” within the meaning of EU data protection law. U.S. companies are required to disclose personal data to law enforcement agencies without you, as the data subject, being able to challenge this in court. It therefore cannot be ruled out that U.S. authorities (e.g., intelligence agencies) may process, analyze, and permanently store your data located on U.S. servers for surveillance purposes. We have no influence over these processing activities. The transfer of data to the U.S. is based on the European Commission’s Standard Contractual Clauses. Furthermore, Microsoft is certified under the EU-U.S. Data Privacy Framework (EU-US DPF) (https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt0000000KzNaAAK&status=Active).

Retention Period

The data processed with Business Central remains with us until you request its deletion, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Conclusion of a Data Processing Agreement

We have entered into a data processing agreement with Microsoft and fully comply with the strict requirements of the German data protection authorities regarding the use of Microsoft.

Data Transfer

Data may be transferred to entities in countries outside the EU or the European Economic Area (EEA)—so-called third countries—if such a transfer is necessary to fulfill an order or contract, is required by law, is based on a legitimate interest, or consent has been granted. In this context, the processing of personal data in a third country may also occur in connection with the engagement of service providers within the framework of data processing on behalf of the controller. If the European Commission has not issued a decision recognizing an adequate level of data protection in the country in question, appropriate contracts will be used in accordance with EU data protection regulations to ensure that the rights and freedoms of business partners and prospective customers are adequately protected and guaranteed.

Registration of a Customer Account

Nature and Scope of Processing

As part of the order processing, we collect your personal data to register a customer account. You can choose whether to place an order as a guest or to register a permanent user account. The information collected via the required fields during registration is identical in both cases and is necessary for processing the order in the online store. When registering a permanent user account, we also collect a password that you set yourself. In addition, you may voluntarily provide additional information that you consider necessary for processing the order.

Your personal data will only be disclosed to third parties (e.g., payment service providers, shipping service providers, freight forwarders) and processors pursuant to Art. 28 of the GDPR to the extent necessary for processing the order.

Purpose and Legal Basis

We process your personal data for the purpose of registering a customer account to fulfill a contract with you in accordance with Article 6(1)(b) of the GDPR. There is a contractual obligation to provide your data with respect to the required fields, as this information is necessary to identify you and for us to fulfill the contract. There is no legal obligation to provide this data. Without providing this information, it is not possible to place an order in our online store and, consequently, to enter into a contract. There is no obligation to provide any additional information provided on a voluntary basis. It is possible to place an order in our online store even without disclosing this voluntary information.

The additional processing of your password for the registration of a permanent user account is carried out for the purpose of providing a customer account, displaying your previous purchases, and storing your purchase-related data (e.g., billing address, various shipping addresses) based on your consent pursuant to Art. 6(1)(a) of the GDPR. By deleting your customer account, you may revoke your consent at any time with future effect in accordance with Article 7(3) of the GDPR.

Retention Period

If you place an order as a guest, your personal data will be stored until your order has been fully processed (end of the contract). If you register a permanent customer account, we will store the purchase-related data beyond the end of the contract until you revoke your consent (deletion of the customer account). In both cases, your data will only be stored further if statutory retention obligations (e.g., tax and commercial law) apply.

5. Analytics Tools and Advertising

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies, or perform independent analyses. It serves solely to manage and deploy the tools integrated through it. However, Google Tag Manager collects your IP address, which may also be transferred to Google’s parent company in the United States.

The use of Google Tag Manager is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in the quick and straightforward integration and management of various tools on its website. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5780.

Google Analytics

This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyze the behavior of website visitors. In doing so, the website operator receives various usage data, such as page views, time spent on the site, operating systems used, and the user’s origin. This data is associated with the user’s respective device. It is not linked to a user ID.

Google Analytics uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting). The information collected by Google regarding the use of this website is generally transmitted to a Google server in the United States and stored there.

Use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may revoke your consent at any time.

Data transfers to the United States are based on the European Commission’s Standard Contractual Clauses. Details can be found here: business.safety.google/adscontrollerterms/sccs/.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when processing data in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: www.dataprivacyframework.gov/participant/5780.

Browser Plugin

You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at the following link: tools.google.com/dlpage/gaoptout.

For more information on how Google Analytics handles user data, please see Google’s Privacy Policy: support.google.com/analytics/answer/6004245.

Data transfers to the U.S. are based on the European Commission’s Standard Contractual Clauses. Details can be found here: https://business.safety.google/adscontrollerterms/sccs/.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information on this, please contact the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

IP Anonymization

Google Analytics IP anonymization is enabled. As a result, your IP address is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before being transmitted to the United States. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising program provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display ads in the Google search engine or on third-party websites when users enter specific search terms into Google (keyword targeting). Furthermore, targeted ads can be displayed based on user data available to Google (e.g., location data and interests) (audience targeting). As the operator of the website , we can evaluate this data quantitatively by, for example, analyzing which search terms led to the display of our advertisements and how many ads resulted in corresponding clicks.

Use of this service is based on your consent pursuant to Art. 6(1)(a) of the GDPR and § 25(1) of the TDDDG. You may revoke your consent at any time.

Data transfers to the U.S. are based on the EU Commission’s Standard Contractual Clauses. Details can be found here: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when processing data in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5780.

Google Search Console

This website uses Google Search Console, a service for analyzing and optimizing the visibility of websites in Google Search. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Search Console provides us with information about how our website appears in Google search results. In particular, the service enables us to monitor the indexing of web pages, analyze search queries, detect technical errors, and optimize the visibility of our content in search engines.

Google Search Console processes statistical information about the use and discoverability of the website. In particular, it provides technical data and performance metrics for search engine optimization. Google Search Console is used exclusively via a secure operator account.

If personal data is processed in the course of this use, the transfer of data to companies within the Google Group—including to third countries, particularly the United States—cannot be ruled out.

Legal Basis

The use of Google Search Console is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the technically error-free provision of our website, search engine optimization, and the analysis of the visibility of our online offerings.

To the extent that individual processing operations involve accessing information on the user’s device or reading information from the device, this is carried out in accordance with the relevant provisions of the Telecommunications and Digital Services Data Protection Act (TDDDG).

For data transfers to the U.S., Google relies on the European Commission’s EU Standard Contractual Clauses (SCCs) and, where applicable, on additional appropriate safeguards pursuant to Article 46 of the GDPR. Furthermore, Google is certified under the EU-U.S. Data Privacy Framework (DPF), to the extent that this applies to the respective data processing.

Data Processing

We have entered into a data processing agreement with Google and fully comply with the strict requirements of the German data protection authorities when using Google Search Console. To the extent that Google processes personal data on our behalf, this is done exclusively on the basis of the relevant contractual agreements for data processing pursuant to Article 28 of the GDPR.

Google DoubleClick

Nature and Scope of Processing

We have integrated components from DoubleClick by Google into our website. DoubleClick is a Google brand primarily used to market specialized online marketing solutions to advertising agencies and publishers. DoubleClick by Google transmits data to the DoubleClick server with every impression, as well as with clicks or other activities.

Each of these data transfers triggers a cookie request to the data subject’s browser. If the browser accepts this request, DoubleClick sets a cookie in your browser.

DoubleClick uses a cookie ID, which is necessary to carry out the technical process. The cookie ID is required, for example, to display an advertisement in a browser. DoubleClick can also use the cookie ID to track which advertisements have already been displayed in a browser in order to prevent duplicate ad placements. Furthermore, the cookie ID enables DoubleClick to track conversions. Conversions are tracked, for example, when a user has previously been shown a DoubleClick ad and subsequently makes a purchase on the advertiser’s website using the same web browser.

A DoubleClick cookie does not contain any personal data, but may contain additional campaign identifiers. A campaign identifier is used to identify the campaigns with which you have already interacted on other websites. As part of this service, Google receives information that it also uses to generate commission reports. Among other things, Google can track that you have clicked on certain links on our website. In this case, your data is transferred to the operator of DoubleClick, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information and the applicable privacy policy of DoubleClick by Google can be found atpolicies.google.com/privacy .

Purpose and Legal Basis

We process your data using the DoubleClick cookie for the purpose of optimizing and displaying advertisements based on your consent pursuant to Art. 6(1)(a) of the GDPR. You provide your consent by configuring your cookie settings (cookie banner / consent manager), through which you may also revoke your consent at any time with future effect in accordance with Article 7(3) of the GDPR. Among other things, the cookie is used to serve and display user-relevant advertisements, as well as to generate reports on advertising campaigns or to improve them. Furthermore, the cookie serves to prevent the same advertisement from being displayed multiple times. Each time you visit a page on our website that includes a DoubleClick component, your browser is automatically prompted by that DoubleClick component to transmit data to Google for the purposes of online advertising and commission billing. There is no legal or contractual obligation to provide your data. If you do not give us your consent, you may still visit our website without restriction; however, not all features may be fully available.

Retention Period

We have no influence over the specific retention period of the processed data; it is determined by Google Ireland Limited. For more information, please see the Google DoubleClick Privacy Policy:policies.google.com/privacy .

Webmag.io

This website uses Webmag.io, a service for creating, managing, and publishing digital magazines, publications, and online content. The provider is Webmag ApS, Klareboderne 10, 1115 Copenhagen K, Denmark.

Webmag.io enables the display and publication of digital content via a web-based service. When accessing content provided via Webmag.io, technical information such as IP address, date and time of access, browser type, operating system, and other data necessary for the provision and security of the service may be processed.

This processing is carried out to ensure the technically error-free provision of digital publications, to guarantee system security, to analyze errors, and to optimize the display and use of the content provided.

To the extent that Webmag.io uses analytics or statistical functions, or employs cookies or similar technologies, their use is based exclusively on the users’ consent, where such consent is required by law.

Legal Basis

The use of Webmag.io is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the appealing, secure, and efficient provision of our online content and digital publications.

To the extent that consent is required for the storage of cookies or for access to information on the user’s device, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. Consent may be revoked at any time with future effect.

If personal data is transferred to third countries in the course of use, such transfers are carried out exclusively in compliance with the provisions of Articles 44 et seq. of the GDPR. Where necessary, Standard Contractual Clauses (SCCs) recognized by the competent authorities are entered into.

Data Processing on Behalf of the Controller

We have entered into a data processing agreement with Webmag.io and fully comply with the strict requirements of the German data protection authorities when using Webmag.io. To the extent that Webmag.io processes personal data on our behalf, this is done exclusively in accordance with our instructions and the legal requirements of the GDPR.

Note: Before using this text, please verify whether your specific website actually incorporates analytics functions, tracking cookies, or external content from Webmag.io. If so, the text should be amended accordingly.

6. Newsletter

Newsletter Information

If you would like to subscribe to the newsletter offered on the website, we require your email address as well as information that allows us to verify that you are the owner of the provided email address and that you consent to receiving the newsletter. We use this data to send the requested information and do not share it with third parties. As part of newsletter campaigns, we may analyze various data (e.g., time of opening, IP address, device information, links clicked, and, if applicable, subsequent actions).

The processing of the data entered in the newsletter sign-up form is based exclusively on your consent (Art. 6(1)(a) GDPR). You may revoke your consent to the storage of your data and email address, as well as their use for sending the newsletter, at any time—for example, via the “Unsubscribe” link in the newsletter. The lawfulness of data processing operations that have already taken place remains unaffected by this revocation.

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter, and will be deleted from the newsletter distribution list after you unsubscribe or once the purpose for which it was collected no longer applies. We reserve the right to delete or block email addresses from our newsletter distribution list at our sole discretion within the scope of our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

Data stored by us for other purposes remains unaffected by this.

After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider on a blacklist, if necessary, to prevent future mailings. The data from the blacklist is used solely for this purpose and is not combined with other data. This serves both your interest and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Article 6(1)(f) of the GDPR). There is no time limit on storage in the blacklist. You may object to this storage if your interests outweigh our legitimate interest.

7. Plugins und Tools

YouTube

This website embeds videos from YouTube. The website is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our web pages that embeds YouTube, a connection is established with YouTube’s servers. In the process, the YouTube server is informed which of our pages you have visited.

Furthermore, YouTube may store various cookies on your device or use comparable technologies for recognition (e.g., device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to collect video statistics, improve user experience, and prevent fraud. Furthermore, the collected data is processed within the Google advertising network.

If you are logged into your YouTube account, you allow YouTube to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account.

The use of YouTube is in the interest of presenting our online offerings in an appealing manner. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

For more information on how user data is handled, please see YouTube’s Privacy Policy at: https://policies.google.com/privacy?hl=de.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when processing data in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information on this, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5780.

Supademo

This website uses plugins from the Supademo portal. The provider is Supademo Inc., New York, New York, United States

When you visit one of our pages equipped with Supademo, a connection is established to Supademo’s servers. In the process, the Supademo server is informed which of our pages you have visited. Additionally, Supademo obtains your IP address.

We use Supademo to ensure an appealing presentation of our online offerings. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. If consent has been obtained, processing is based exclusively on Article 6(1)(a) of the GDPR; consent may be revoked at any time.

According to Supademo, data transfers outside the EEA are based on the European Commission’s Standard Contractual Clauses: “We ensure that any transfer of personal data from countries within the European Economic Area (EEA) to countries outside the EEA is protected by appropriate safeguards, such as the use of Standard Data Protection Clauses approved by the European Commission, the use of binding corporate rules, or other legally recognized means.”

For more information on how user data is handled, please see Supademo’s Privacy Policy at: https://supademo.com/privacy.

CodeTwo Email Signatures 365

This website uses CodeTwo Email Signatures 365 for the centralized management and automatic insertion of email signatures in Microsoft 365. The provider is CodeTwo sp. z o.o. sp. k., Jerozolimskie 93, 02-001 Warsaw, Poland.

CodeTwo Email Signatures 365 enables the centralized management of company-wide standardized email signatures, disclaimers, marketing banners, and legally required information, which are then automatically inserted into outgoing emails. To do this, the service processes information from the Microsoft 365 directory (e.g., name, job title, department, phone number, or email address) to create personalized signatures. This processing occurs via an integration with Microsoft 365 and, depending on the selected configuration, may also include the processing of metadata or the content of outgoing emails.

The data is used exclusively for the provision, management, and delivery of email signatures, as well as for the administration of the service. CodeTwo generally operates its services within Microsoft Azure data centers and offers data processing in European data centers.

Legal Basis

The use of CodeTwo Email Signatures 365 is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring the consistent and legally compliant design of external corporate communications, as well as the efficient management of email signatures.

To the extent that processing takes place in connection with the performance or initiation of contractual relationships, an additional legal basis is Article 6(1)(b) of the GDPR.

The service does not regularly store or access information on the user’s device as defined by the TDDDG. Therefore, consent under § 25 TDDDG is generally not required.

To the extent that personal data is transferred to third countries outside the European Union or the European Economic Area, this is done only in compliance with the legal requirements of Art. 44 et seq. of the GDPR. Where necessary, appropriate safeguards, in particular the Standard Contractual Clauses (SCCs) adopted by the European Commission, are implemented.

Data Processing

We have entered into a data processing agreement with CodeTwo sp. z o.o. sp. k. in accordance with Article 28 of the GDPR and fully comply with the strict requirements of the German data protection authorities when using CodeTwo Email Signatures 365. The provider processes personal data exclusively on our instructions and for the contractually agreed purposes.

Google Fonts

This site uses so-called Google Fonts, provided by Google, to ensure a consistent font display. When you visit a page, your browser loads the required fonts into its cache to display text and fonts correctly.

To do this, the browser you are using must establish a connection to Google’s servers. As a result, Google becomes aware that this website has been accessed via your IP address. The use of Google Fonts is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in the consistent display of fonts on its website. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

If your browser does not support Google Fonts, a default font from your computer will be used.

For more information about Google Fonts, visit https://developers.google.com/fonts/faq and Google’s Privacy Policy: https://policies.google.com/privacy?hl=de.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5780.

Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on this website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA is designed to verify whether data entry on this website (e.g., in a contact form) is performed by a human or by an automated program. To do this, reCAPTCHA analyzes the website visitor’s behavior based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. For the analysis, reCAPTCHA evaluates various pieces of information (e.g., IP address, the length of time the website visitor spends on the website, or mouse movements made by the user). The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyses run entirely in the background. Website visitors are not notified that an analysis is taking place.

In this context, Google acts solely as a data processor within the meaning of Article 28 of the GDPR and will not use the data collected in this manner for its own purposes. Use of the tool is based on a Data Processing Agreement (DPA) with Google.

The storage and analysis of the data are based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in protecting its web offerings from abusive automated surveillance and from spam. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

Leadinfo and Leadinfo CDN

We have integrated Leadinfo into this website. The provider is Leadinfo / Team.Blue GmbH, Bunsenstr. 19, 40215 Düsseldorf (hereinafter “Leadinfo”).

Leadinfo allows us to track visits to our website by employees of other companies. To do this, the website visitor’s IP address is compared with the company IP addresses stored in Leadinfo’s database. If the IP address belongs to a company, that visit and the user’s behavior are recorded. IP addresses not found in Leadinfo’s database are immediately deleted, so that visits to the website by private individuals are ignored by Leadinfo.

The use of Leadinfo is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in tracking corporate visits to our website and their user behavior. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

For further details, please refer to the provider’s privacy policy at https://www.leadinfo.com/de/datenschutz/.

Data Processing on Behalf of the Controller

We have entered into a data processing agreement (DPA) for the use of the aforementioned service. This is a contract required under data protection law that ensures the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

GoToWebinar

We use GoToWebinar. The provider is LogMeIn, Inc., 320 Summer Street, Boston, MA 02210, USA. For details on data processing, please refer to GoToMeeting’s Privacy Policy: https://www.logmeininc.com/de/legal/privacy. Data transfers to the U.S. are based on the EU Commission’s Standard Contractual Clauses. Details can be found here:logmeincdn.azureedge.net/legal/lmi-customer-dpa-2020v1-de.pdf .

Data Processing

LinkedIn Ads

Nature and Scope of Processing

We have integrated LinkedIn Ads into our website. LinkedIn Ads is a service provided by LinkedIn Corporation that displays targeted advertisements to users. LinkedIn Ads uses cookies and other browser technologies to analyze user behavior and recognize users. LinkedIn Ads collects information about visitor behavior on various websites. This information is used to optimize the relevance of the advertisements. Furthermore, LinkedIn Ads delivers targeted advertisements based on behavioral profiles and geographic location. Your IP address and other identifying characteristics, such as your user agent, are transmitted to the provider. In this case, your data is transferred to the operator of LinkedIn Ads, LinkedIn Corporation, Sunnyvale, California, USA.

Web tracking technologies are used to create pseudonymized user profiles. These profiles cannot be linked to you as a natural person but are used, for example, for segmentation when displaying advertisements.

Purpose and Legal Basis

The use of LinkedIn Ads is based on your consent in accordance with Art. 6(1)(a) of the GDPR and § 25(1) of the TDDDG.

Retention Period

We have no influence over the specific retention period of the processed data; it is determined by LinkedIn Corporation. For further information, please refer to the privacy policy for LinkedIn Ads: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy

LinkedIn Insight Tag

Nature and Scope of Processing

We use the LinkedIn Insight Tag from LinkedIn Corporation, Sunnyvale, California, USA, to create target audiences, segment groups of visitors to our website, determine conversion rates, and subsequently optimize them. This occurs in particular when you interact with advertisements that we have placed in collaboration with LinkedIn Corporation. To this end, LinkedIn Corporation offers retargeting for website visitors to display targeted ads outside of our website.

The LinkedIn Insight Tag collects data on visits to our website, including the URL, referrer URL, IP address, device and browser characteristics (user agent), and timestamps. This data is used to generate anonymized reports on the website audience and ad performance.

Purpose and Legal Basis

The use of the LinkedIn Insight Tag is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.

Retention Period

We have no influence over the specific retention period of the processed data; it is determined by LinkedIn Corporation. For further information, please refer to the privacy policy for the LinkedIn Insight Tag: https://www.linkedin.com/legal/privacy-policy

8. Audio and Video Conferences

Data Processing

We use online conferencing tools, among other means, to communicate with our customers. The specific tools we use are listed below. When you communicate with us via video or audio conference over the Internet, your personal data is collected and processed by us and by the provider of the respective conferencing tool.

The conferencing tools collect all data that you provide or use to access the tools (email address and/or your phone number). Furthermore, the conferencing tools process the duration of the conference, the start and end times of your participation in the conference, the number of participants, and other “contextual information” related to the communication process (metadata).

Furthermore, the tool provider processes all technical data necessary for handling the online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker, and the type of connection.

If content is exchanged, uploaded, or otherwise made available within the tool, it is also stored on the tool provider’s servers. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards, and other information shared while using the service.

Please note that we do not have full control over the data processing operations of the tools used. Our options depend largely on the corporate policies of the respective provider. For further information on data processing by the conferencing tools, please refer to the privacy policies of the respective tools, which we have listed below this text.

Purpose and Legal Basis

The conferencing tools are used to communicate with prospective or existing contractual partners or to provide certain services to our customers (Art. 6(1)(b) GDPR). Furthermore, the use of these tools serves to generally simplify and expedite communication with us or our company (legitimate interest within the meaning of Article 6(1)(f) of the GDPR). To the extent that consent has been requested, the use of the relevant tools is based on this consent; consent may be revoked at any time with future effect.

Retention Period

The data collected directly by us via the video and conferencing tools is deleted from our systems as soon as you request deletion, revoke your consent to storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no influence over the retention period of your data that is stored by the operators of the conferencing tools for their own purposes. For details on this, please contact the operators of the conferencing tools directly.

Conference Tools Used

We use the following conference tools:

Microsoft Teams

We use Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. For details on data processing, please refer to the Microsoft Teams Privacy Statement: https://privacy.microsoft.com/de-de/privacystatement.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when data is processed in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information on this, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/6474.

Data Processing

Recordings

If we create audio or video recordings during online conferences, the resulting audio, video, and conversation content will be stored and processed. Participants will be informed about the recording and transcription before the recording begins. Any recording, transcription, or AI-assisted analysis will take place exclusively with the prior consent of the individuals concerned.

AI-Assisted Transcription

During online meetings via Microsoft Teams, the AI-assisted transcription feature may be used optionally. This feature automatically recognizes the spoken content of the meeting, converts it into text, and makes it available to meeting participants. This feature is activated only if prior consent has been obtained from all affected participants (Art. 6(1)(a) GDPR).

Use of the transcription feature is voluntary. If consent is not granted, no transcription will be generated, and the data subject may still participate in the meeting without restriction.

Processed Data

When using the transcription feature, the following personal data in particular is processed:

– Audio recordings of the speakers,

– transcripts generated from them,

– metadata such as speaker identification or timestamps.

Purpose of Processing

The processing is carried out for the purpose of recording and documenting meeting content, as well as to support follow-up work by the participants.

Storage and Deletion

Transcripts are stored in accordance with the retention periods we have defined and are subsequently deleted, provided there are no legal retention requirements. Further information on processing by Microsoft can be found in the provider’s privacy statement as well as in the documentation on data protection and security for Microsoft Teams.

9. Our Own Services

Personio for the Application Process

We use the “Personio” service. The provider is Personio GmbH & Co. KG, Rundfunkplatz 4, 80335 Munich.

Purpose of Data Processing

We use Personio to integrate job postings into our website. When you view our job postings, a connection is established between your browser and Personio. Personio stores a cookie in your browser that is necessary for displaying the website; this cookie is deleted once the session ends. Cookies are text files stored on your computer that enable an analysis of your use of the website. You can prevent the storage of cookies by adjusting your browser settings accordingly; however, please note that in this case, you may not be able to use all features of this website to their full extent.

Legal Basis for Data Processing

The use of Personio on our website is based on our legitimate interest (Art. 6(1)(f) GDPR). We have a legitimate interest in presenting our job postings as reliably as possible. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

You can access information on data protection at Personio and regarding the application process via the following link: https://www.personio.de/datenschutzerklaerung/ https://edocag.jobs.personio.de/privacy-policy?language=de

We have entered into a data processing agreement (DPA) with the aforementioned provider. This is a contract required under data protection law that ensures the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Data Retention Period

Application documents will be deleted no later than 6 months after rejection. If the storage is based on your consent, we will delete your personal data if you revoke your consent.

edoc system control

Nature and Scope of Processing

Through our system-control websites, employees of edoc solutions gmbh, as well as other registered partners and customers, can manage customers’ systems.

Purpose and Legal Basis

The use of the service serves, among other things, to monitor and administer the systems. This constitutes a contractual basis pursuant to Art. 6(1)(b) of the GDPR.

Retention Period

We have no influence over the specific retention period for the processed data; it is determined by the customer.

Microsoft Azure

We use Microsoft Azure for the edoc system control. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

The use of this tool is based on Article 6(1)(b) of the GDPR. If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR; consent may be revoked at any time.

System Control is hosted via an Azure Kubernetes Service in the North Europe region. Users log in via Microsoft Entra ID. Users (customers) are assigned to individual systems via their Microsoft Entra ID account.

For more details, please refer to Microsoft’s privacy policy at:privacy.microsoft.com/de-de/privacystatement .

Conclusion of a Data Processing Agreement

We have entered into a data processing agreement with Microsoft and fully comply with the strict requirements of the German data protection authorities regarding the use of Microsoft.

Lead Generation

As part of our marketing activities, we also engage in lead generation and use a service provider for this purpose. Personal data is processed in this context. This privacy notice serves to transparently describe the data processing in accordance with Articles 13 and 14 of the GDPR.

The data controller within the meaning of the GDPR is edoc solutions gmbh, Metternicher Str. 4, 53919 Weilerswist. Personal data is processed for the purpose of carrying out marketing activities, in particular:

Email outreach campaigns
LinkedIn Outreach Campaigns
Lead Generation and Qualification
CRM Integration and Appointment Scheduling
Creation and Maintenance of Lead Lists

The following personal data is processed as part of the campaigns:

Title, first name, last name
Company name and location
Email address and, if applicable, LinkedIn profile
Communication content (messages, replies)
Appointment booking data

Processing is based on Article 6(1)(f) of the GDPR (legitimate interest in direct marketing) and, where applicable, Article 6(1)(a) of the GDPR (consent), provided this is necessary in individual cases. The data is processed exclusively by Arvana GmbH within the scope of the contractually agreed services. Data is disclosed to third parties only:

for technical implementation (e.g., software providers)
in compliance with legal obligations

The personal data is derived from the following sources:

LinkedIn profiles
LinkedIn Sales Navigator
Apollo.io.
Data enrichment using AI-powered tools
CRM systems

Outreach and CRM tools are used to carry out the campaigns. This may involve the processing of personal data by third-party providers. The tools used are subject to the privacy policies of the respective providers.

You may object to the processing of your personal data for marketing purposes at any time (Art. 21 GDPR). Upon receipt of your objection, we will immediately cease processing for these purposes. Any consent you have given may be revoked at any time with future effect, and you may request at any time that we no longer send you such informational emails—to do so, please contact us at info(at)edoc.de. You will incur no costs other than the standard transmission fees.

Personal data will be stored only for as long as necessary to carry out the campaigns. Upon completion of the activities or at the request of the data subject, the data will be deleted, provided there are no legal retention obligations. Data subject requests may be directed to edoc solutions gmbh.

Data Processing on Behalf of a Client

Our Social Media Presence

This Privacy Policy applies to the following social media accounts

https://www.facebook.com/edocsolutionsgmbh

https://www.instagram.com/edoc_solutions_gmbh/?hl=de

https://www.xing.com/pages/edoc-solutions-ag

https://www.linkedin.com/company/edoc-solutions-gmbh

Data Processing by Social Networks

We maintain publicly accessible profiles on social media platforms. The specific social media platforms we use are listed below.

Social networks such as Facebook, X, etc., can generally analyze your user behavior in detail when you visit their website or a website with integrated social media content (e.g., “Like” buttons or advertising banners). Visiting our social media pages triggers numerous data processing operations relevant to data protection. Specifically:

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can associate this visit with your user account. However, your personal data may also be collected even if you are not logged in or do not have an account with the respective social media platform. In this case, data collection occurs, for example, through cookies stored on your device or by recording your IP address.

Using the data collected in this way, the operators of the social media platforms can create user profiles that store your preferences and interests. This allows interest-based advertising to be displayed to you both on and off the respective social media platform. If you have an account with the respective social network, interest-based advertising may be displayed on all devices on which you are currently logged in or have previously been logged in.

Please also note that we cannot track all processing activities on social media platforms. Depending on the provider, additional processing operations may therefore be carried out by the operators of the social media platforms. For details, please refer to the terms of use and privacy policies of the respective social media platforms.

Legal Basis

Our social media presence is intended to ensure the most comprehensive online presence possible. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. The analytics processes initiated by the social networks may be based on different legal grounds, which must be specified by the operators of the social networks (e.g., consent within the meaning of Article 6(1)(a) of the GDPR).

Data Controller and Exercising Rights

When you visit one of our social media pages (e.g., Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered by that visit. You may generally exercise your rights (right of access, rectification, erasure, restriction of processing, data portability, and the right to lodge a complaint) both against us and against the operator of the respective social media platform (e.g., against Facebook).

Please note that, despite our joint responsibility with the social media platform operators, we do not have full control over the data processing activities of the social media platforms. Our options depend largely on the corporate policies of the respective provider.

Retention Period

Data collected directly by us through our social media presence is deleted from our systems as soon as you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies. Stored cookies remain on your device until you delete them. Mandatory legal provisions—in particular retention periods—remain unaffected.

We have no influence over the retention period of your data that is stored by the operators of social networks for their own purposes. For details on this, please contact the operators of the social networks directly (e.g., in their privacy policies, see below).

Your Rights

You have the right at any time to receive, free of charge, information about the origin, recipients, and purpose of your stored personal data. You also have the right to object, the right to data portability, and the right to file a complaint with the competent supervisory authority. Furthermore, you may request the correction, blocking, deletion, and, under certain circumstances, the restriction of the processing of your personal data.

Social Networks in Detail

Facebook

We maintain a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter “Meta”). According to Meta, the collected data is also transferred to the United States and other third countries.

We have entered into a joint processing agreement (Controller Addendum) with Meta. This agreement specifies which data processing operations we or Meta are responsible for when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings yourself in your user account. To do so, click the following link and log in: https://www.facebook.com/settings?tab=ads.

Data transfers to the U.S. are based on the European Commission’s Standard Contractual Clauses. For details, see here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

For details, please refer to Facebook’s Privacy Policy: https://www.facebook.com/about/privacy/.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when processing data in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information on this, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/4452

Instagram

We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Data transfers to the U.S. are based on the European Commission’s Standard Contractual Clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

For details on how Instagram handles your personal data, please refer to Instagram’s Privacy Policy: https://privacycenter.instagram.com/policy/.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when processing data in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information on this, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/4452

XING

We have a profile on XING. The provider is New Work SE, Am Strandkai 1, 20457 Hamburg, Germany. For details on how they handle your personal data, please refer to XING’s Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung.

LinkedIn

We have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.

If you wish to disable LinkedIn advertising cookies, please use the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Data transfers to the U.S. are based on the EU Commission’s Standard Contractual Clauses. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

For details on how LinkedIn handles your personal data, please refer to LinkedIn’s Privacy Policy: https://www.linkedin.com/legal/privacy-policy.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when processing data in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information on this, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5448

Handling of Data from Business Partners (Customers, Prospects, Suppliers)

We collect personal data for the purpose of contract performance, to fulfill contractual and pre-contractual obligations, and for direct marketing. The collection and processing of data are necessary for the performance of the contract and are based on Article 6(1)(b) of the GDPR. The use of personal data for marketing purposes constitutes a legitimate interest of our company (Article 6(1)(f) of the GDPR). Data may be disclosed to third parties if this is necessary to fulfill an order (e.g., to handle complaints). The data will be deleted as soon as it is no longer necessary for the purpose for which it was processed. You have the right to object to the use of your data for direct marketing purposes at any time. In addition, you are entitled to request information about the data we have stored about you, as well as to request the correction of inaccurate data or the deletion of data if it is being stored unlawfully. To exercise your rights, please use the contact information provided above.