OVERVIEW OF DATA PROCESSING

Below we provide information about the types of data collected and processed and the purposes of their processing and refer to the data subjects.

Types of data processed

We collect and use your personal data, i.e. H. any information that identifies you or allows you to be identified.

Depending on the type of product or service we offer you and the interactions we have with you, we collect different types of personal data about you:

• Contact information, postal address (personal or professional), email address, mobile number, name and mobile number of a contact person;
• Personal information, e.g. date of birth, passport details, etc.
• Travel information, such as travel dates, destination, etc.;
• Data from our interactions with you, e.g. B. Your comments, suggestions, needs collected during our exchanges with you in person and during telephone communications, email communications, exchanges on our social media and any complaints you may have. Your connection and tracking data (e.g. collected via cookies for non-advertising or analytical purposes on our websites), other applications;
• Data about your devices (mobile phone, computer, tablet, etc.), such as IP address, technical data and unique identifying data;
• Personalized login details or security features used to connect you to our website.

Categories of persons affected

• customers.
• employees.
• interested persons.
• communication partner.
• user.
• business and contractual partners.

Purposes of processing

In this section we explain the purposes for which we process your personal data and the legal basis on which this is done. We primarily use your personal data to process a contract to which you are a party or to carry out pre-contractual measures at your request. However, we may also process your personal data to fulfill our legitimate interests or those of third parties.

In particular, your personal data will be processed if this is necessary for the conclusion or performance of a contract in order to:

• to conclude a (travel) contract with you. We may process personal data to register you as a new customer, enter into and perform a contract with you;
• To provide you with products and services purchased under the relevant Agreement;
• carry out billing, invoicing and debt collection;
• to provide you with services related to the preparation and implementation of a trip;
• for insurance purposes;
• to offer consulting services;
• to be able to provide assistance if necessary in case of difficulties during the trip;
• To provide you with access to our digital platforms. We may process personal data when you use our digital platforms for various purposes (e.g. to manage your personal information or to access travel information);
• to communicate with you. We may process personal data if you want to contact us, if you ask us for information about our company or services or if the contract needs to be updated;
• Respond to your inquiries and support you;
• manage the termination of the contract.

When we base a processing activity on a legitimate interest, we will balance that interest against your interests or fundamental rights and freedoms to ensure that they are proportionate. As part of our business as a travel provider, we also use your personal data to:

• to further develop our products and services;
• improve cybersecurity, manage our platforms and websites and ensure business continuity;
• to implement the introduction of IT solutions;
• to carry out maintenance of IT systems during ongoing operations;
• Improve the automation and efficiency of our operations and customer services (e.g. automatically filling complaints, tracking your requests and improving your satisfaction based on personal data collected during our interactions with you, such as telephone calls or emails);
• enable the assertion of legal claims and defense in connection with legal disputes and official proceedings.

Further purposes of data processing:

• Marketing;
• Provision of our online offering and user-friendliness.

SAFETY MEASURES

We take appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the type, scope, circumstances and purposes of the processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons to ensure a level of protection appropriate to the risk.

The measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, transfer, securing availability and their separation. We have also set up procedures to ensure that the rights of those affected are exercised, data are deleted and responses are made to data threats. We also take the protection of personal data into account when developing or selecting hardware, software and procedures in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.

TLS encryption (https): To protect your data transmitted via our online offering, we use TLS encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

TRANSMISSION OF PERSONAL DATA

In order to fulfill some of the purposes described in this data protection declaration, in particular to carry out a trip, we may, if necessary, pass on your personal data to other bodies, companies, legally independent organizational units or persons. These can be the following:

• Our service providers in the travel country (e.g. hotel reservation, transfer service, travel guide), transport service providers (airline, etc.) and accommodation operators (hotel, hostels, etc.);

• Processors who provide services on our behalf (e.g. IT services, logistics, printing services, telecommunications, debt collection, consulting and sales as well as marketing);

• certain regulated professional groups such as lawyers, notaries or auditors when necessary in certain circumstances (litigation, auditing, etc.) and to our insurers;

• Partner to carry out advertising, market and opinion research;

• Partner to support the investigation of criminal offenses (e.g. fraud), assertion, exercise or defense of legal claims;

• Authorities and official bodies (e.g. tax authorities, embassies of the destination country) if there is a legal or official obligation (e.g. retention requirements, obtaining visas, obtaining entry requirements).

In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

INTERNATIONAL DATA TRANSFERS

Datenverarbeitung in Drittländern: In particular, you must expect your data to be transmitted to the countries you are traveling to. If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)) or the processing occurs in the context of using third-party services or disclosing or transmitting data to other people, bodies or companies takes place, this only takes place in accordance with the legal requirements. If the level of data protection in the third country has been recognized by means of an adequacy decision (Art. 45 DSGVO), this serves as the basis for the data transfer. Furthermore, data transfers only take place if the level of data protection is otherwise secured, in particular through standard contractual clauses (Art. 46 Para. 2 lit. c) DSGVO), express consent or in the case of contractually or legally required transfer (Art. 49 Para. 1 DSGVO). We will also inform you about the basics of third-country transfers for the individual providers from the third country, with the adequacy decisions taking precedence as the basics. Information on third country transfers and existing adequacy decisions can be found in the EU Commission’s information offering: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de.

EU-US Trans-Atlantic Data Privacy Framework: As part of the so-called “Data Privacy Framework” (DPF), the EU Commission has also recognized the level of data protection as secure for certain companies from the USA as part of the adequacy decision of July 10, 2023. The list of certified companies and further information about the DPF can be found on the US Department of Commerce websitehttps://www.dataprivacyframework.gov/. As part of the data protection information, we will inform you which service providers we use are certified under the Data Privacy Framework.

Disclosure of personal data abroad: In accordance with the Swiss Data Protection Act (DSG), we only disclose personal data abroad if adequate protection of the persons concerned is guaranteed (Art. 16 Swiss Data Protection Act). If the Federal Council has not determined adequate protection (list: https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html), we take alternative security measures. These may include international contracts, specific guarantees, data protection clauses in contracts, standard data protection clauses approved by the Federal Data Protection and Information Commissioner (FDPIC), or internal company data protection regulations previously recognized by the FDPIC or a competent data protection authority of another country.

According to Article 16 of the Swiss Data Protection Act, exceptions for the disclosure of data abroad can be permitted if certain conditions are met, including the consent of the data subject, execution of the contract, public interest, protection of life or physical integrity, data made public or data from a data subject register provided for by law. These announcements are always made in accordance with legal requirements.

DELETION OF DATA

The data processed by us will be deleted in accordance with the legal requirements as soon as the consent for processing is revoked or other permissions no longer apply (e.g. if the purpose of processing this data no longer applies or it is not necessary for the purpose). Unless the data is deleted because it is required for other legally permissible purposes, its processing will be limited to these purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be stored for commercial or tax reasons or whose storage is necessary to assert, exercise or defend legal claims or to protect the rights of another natural or legal person.
As part of our data protection information, we can provide users with further information about the deletion and storage of data that specifically applies to the respective processing processes.

RIGHTS OF THE PERSONS AFFECTED

You have rights that enable you to effectively control your personal data and the way we process it. Below we explain your rights in connection with your personal data.

If you would like to exercise the rights listed below, please submit a request by email to info@flywithandy.com or by mail to the address above. If you have any questions about the use of your personal data under this privacy policy, please direct them to info@flywithandy.com

Rights of the data subjects under the DSGVO: As a data subject, you are entitled to various rights under the DSGVO, which arise in particular from Articles 15 to 21 of the DSGVO:

• Right to object: You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you based on Art. 6 para. 1 lit. e or f DSGVO to lodge an objection; This also applies to profiling based on these provisions. If your personal data is processed for the purpose of direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; This also applies to profiling insofar as it is connected to such direct advertising.
• Right to withdraw consent: You have the right to revoke your consent at any time.
• Right of providing information: You have the right to request confirmation as to whether the data in question is being processed and to receive information about this data as well as further information and a copy of the data in accordance with legal requirements.
• Right to rectification: In accordance with legal requirements, you have the right to request that the data concerning you be completed or that incorrect data concerning you be corrected.
• Right to deletion and restriction of processing: In accordance with the legal requirements, you have the right to demand that data concerning you be deleted immediately, or alternatively, in accordance with the legal requirements, to request a restriction on the processing of the data.
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, common and machine-readable format in accordance with legal requirements or to request that it be transmitted to another person responsible.
• Complaint to supervisory authority: In accordance with legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State in which you usually reside, the supervisory authority of your place of work or the place of the alleged violation If you believe that the processing of your personal data violates the DSGVO.

Rights of the data subjects according to the Swiss Data Protection Act (DSG):

As a data subject, you are entitled to the following rights in accordance with the provisions of the Swiss Data Protection Act:

• Right to information: You have the right to request confirmation as to whether personal data concerning you is being processed and to receive the information necessary to enable you to exercise your rights under this law and to ensure transparent data processing.
• Right to data release or transfer: You have the right to request that the personal data you have provided to us be released in a common electronic format. If technically feasible, you may request that we transmit this copy to a third party.
• Right to rectification: You have the right to request that incorrect or incomplete personal data concerning you be corrected. In some cases, supporting documents may be required.
  
• Right to deletion and restriction of processing: In accordance with the legal requirements, you have the right to demand that data concerning you be deleted immediately, or alternatively, in accordance with the legal requirements, to request a restriction on the processing of the data.
• Right of Contradiction: If you do not agree to processing based on legitimate interest, you can object on grounds relating to your individual situation. In this case, please inform us in detail about the relevant processing and the reasons for your objection. We will stop processing your personal data unless there are compelling legitimate reasons or the processing serves to assert, exercise or defend legal claims.
• Right to withdraw consent: You have the right to revoke your consent at any time.
• Complaint to supervisory authority: In addition to the above rights, you can lodge a complaint with the relevant supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.
  

Use of cookies

Cookies are small text files or other storage notes that store information on end devices and read information from the end devices. E.g. to save the login status in a user account, the contents of a shopping cart in an e-shop, the content accessed or the functions used in an online offer. Cookies can also be used for various purposes, e.g. for the purposes of the functionality, security and comfort of online offerings as well as the creation of analyzes of visitor flows.

Notes on consent: We use cookies in accordance with legal regulations. We therefore obtain prior consent from users, unless this is not required by law. In particular, consent is not necessary if the storage and reading of the information, including cookies, is absolutely necessary in order to provide the user with a telemedia service they have expressly requested (i.e. our online offering). Strictly necessary cookies generally include cookies with functions related to the display and operability of the online offering, load balancing, security, storage of users’ preferences and choices or similar to the provision of the main and secondary functions of those requested by users purposes related to the online offering. The revocable consent is clearly communicated to the users and contains information on the respective cookie use.

Information on data protection legal bases: The data protection legal basis on which we process users’ personal data using cookies depends on whether we ask users for consent. If users consent, the legal basis for processing your data is their declared consent. Otherwise, the data processed using cookies will be processed on the basis of our legitimate interests (e.g. in the commercial operation of our online offering and improving its usability) or, if this is within the scope of the fulfillment of our contractual obligations, if the use of cookies is necessary for our purposes to fulfill contractual obligations. We will explain the purposes for which we process cookies in the course of this data protection declaration or as part of our consent and processing processes.

Storage period: With regard to the storage period, the following types of cookies are distinguished:

• Temporary cookies (also: session or session cookies): Temporary cookies are deleted at the latest after a user has left an online offer and closed their device (e.g. browser or mobile application).

• Permanent cookies: Permanent cookies remain stored even after the device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user visits a website again. User data collected using cookies can also be used to measure reach. Unless we provide users with explicit information about the type and storage period of cookies (e.g. when obtaining consent), users should assume that cookies are permanent and that the storage period can be up to two years.

General information on revocation and objection (so-called “opt-out”): Users can revoke the consent they have given at any time and object to the processing in accordance with legal requirements. To do this, users can, among other things, restrict the use of cookies in their browser settings (which may also limit the functionality of our online offering). You can also object to the use of cookies for online marketing purposes via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

• Legal basis: Legitimate interests (Art. 6 Para. 1 Sentence 1 Letter f) DSGVO). Consent (Art. 6 Abs. 1 S. 1 lit. a) DSGVO).

Further information on processing processes, procedures and services:

• Processing of cookie data based on consent:We use a cookie consent management process, within which the users’ consent to the use of cookies, or the processing and providers mentioned as part of the cookie consent management process, is obtained, managed and revoked by the users can be. The declaration of consent is saved so that it does not have to be asked again and to be able to prove consent in accordance with the legal obligation. The storage can take place on the server side and/or in a cookie (so-called opt-in cookie, or using comparable technologies) in order to be able to assign the consent to a user or their device. Subject to individual information about the providers of cookie management services, the following information applies: The duration of the storage of consent can be up to two years. Here, a pseudonymous user identifier is created and stored with the time of consent, information about the scope of the consent (e.g. which categories of cookies and/or service providers) as well as the browser, system and device used; Legal basis: Consent (Art. 6 Abs. 1 S. 1 lit. a) DSGVO).

• BorlabsCookie: cookie consent management; Service provider: Hosted locally on our server, no data passed on to third parties; Website: https://de.borlabs.io/borlabs-cookie/. Further information: An individual user ID, language as well as types of consent and the time of their submission are stored on the server and in the cookie on the user’s device.

Business benefits

We process data from our contractual and business partners, e.g. customers and interested parties (collectively referred to as “contractual partners”) within the framework of contractual and comparable legal relationships as well as associated measures and as part of communication with the contractual partners (or pre-contractual), e.g. to respond to inquiries answer.

We process this data to fulfill our contractual obligations. This includes, in particular, the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other service disruptions. In addition, we process the data to protect our rights and for the purposes of the administrative tasks associated with these obligations and the company organization. In addition, we process the data on the basis of our legitimate interests in proper and business management as well as security measures to protect our contractual partners and our business operations from misuse and jeopardy of their data, secrets, information and rights (e.g. the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the scope of applicable law, we only pass on the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or to fulfill legal obligations. The contractual partners will be informed about other forms of processing, e.g. for marketing purposes, as part of this data protection declaration.

We inform the contractual partners which data is required for the aforementioned purposes before or as part of the data collection, e.g. in online forms, through special marking (e.g. colors) or symbols (e.g. asterisks, etc.), or in person.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e. generally after 4 years, unless the data is stored in a customer account, e.g. as long as it must be retained for legal archiving reasons. The statutory retention period is ten years for documents relevant to tax law as well as for commercial books, inventories, opening balance sheets, annual financial statements, the work instructions required to understand these documents and other organizational documents and accounting documents, and six years for commercial and business letters received and copies of the commercial and business letters sent. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance sheet, the annual financial statements or the management report were prepared, the commercial or business letter was received or sent or the accounting document was created and the recording was also made has been made or the other documents have been created.

To the extent that we use third-party providers or platforms to provide our services, the terms and conditions and data protection notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.

• Types of data processed: Inventory data (e.g. names, addresses); Contact details (e.g. email, telephone numbers); Contract data (e.g. subject matter of the contract); Usage data (e.g. websites visited, interest in content, access times). Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).

• Persons affected: customers; interested persons. business and contractual partners.

• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; Safety measures; Contact inquiries and communication; Office and organizational procedures. Managing and responding to inquiries.

• Legal basis: Fulfillment of the contract and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b) DSGVO); Legal obligation (Art. 6 Abs. 1 S. 1 lit. c) DSGVO). Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO).

Further information on processing processes, procedures and services:

• Customer account: Customers can create an account within our online offering (e.g. customer or user account, “customer account” for short). If registration of a customer account is required, customers will be informed of this as well as the information required for registration. Customer accounts are not public and cannot be indexed by search engines. As part of the registration and subsequent logins and use of the customer account, we store the customers’ IP addresses along with the access times in order to be able to prove registration and prevent any misuse of the customer account. If the customer account has been terminated, the customer account data will be deleted after the time of termination, unless it is retained for purposes other than provision in the customer account or must be retained for legal reasons (e.g. internal storage of customer data, order processes or invoices). It is the responsibility of customers to secure their data upon termination of the customer account; Legal basis: fulfillment of contract and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b) DSGVO).

• Shop and E-Commerce: We process our customers’ data to enable them to select, purchase or order the selected products and related services, as well as their payment and execution. If necessary for the execution of an order/the trip, we use external service providers. We use the services of banks and payment service providers to process payment transactions. The required information is marked as such during the ordering process and includes the information required for billing as well as contact information in order to be able to make any consultations; Legal basis: fulfillment of contract and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b) DSGVO).

• Travel-related services: We process the data of our customers and interested parties (uniformly referred to as “customers”) in accordance with the underlying contractual relationship. As part of our commission, it may be necessary for us to process special categories of data within the meaning of Art. 9 Para. 1 DSGVO, in particular, process information about a person’s health. The processing is carried out to protect the health interests of the customers and otherwise only with the consent of the customers.

  If required for the fulfillment of the contract or by law, or consented by the customer or based on our legitimate interests, we disclose or transmit the customer’s data, for example, to the service providers involved in the fulfillment of the travel services;
  Legal basis: fulfillment of contract and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b) DSGVO).

Provision of online offerings and web hosting

We process users’ data in order to be able to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

• Types of data processed: Usage data (e.g. websites visited, interest in content, access times); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status). Content data (e.g. entries in online forms).

• Persons affected: Users (e.g. website visitors, users of online services).

• Purposes of processing: Provision of our online offering and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.).). Safety measures.

• Legal basis: Legitimate interests (Art. 6 Para. 1 Sentence 1 Letter f) DSGVO).

Further information on processing processes, procedures and services:

• Provision of online offerings on rented storage space: To provide our online offerings, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also called a “web host”); Legal basis: legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO).

• Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files”. The server log files include the address and name of the websites and files accessed, date and time of access, amount of data transferred, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP address. Addresses and the requesting provider belong.

  The server log files can be used on the one hand for security purposes, e.g. to avoid overloading the servers (particularly in the case of abusive attacks, so-called DDoS attacks) and on the other hand to ensure the utilization of the servers and their stability;
  Legal basis: legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further storage is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

• Cyon:Services in the field of providing information technology infrastructure and related services (e.g. storage space and/or computing capacity); Service provider: cyon GmbH, Brunngässlein 12, CH – 4052 Basel, Switzerland; Legal basis: Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO); Website: https://www.cyon.ch. Data protection: https://www.cyon.ch/legal/datenschutzerklaerung.

• WordPress.com: Hosting and software for creating, providing and operating websites, blogs and other online offerings; Service provider: Aut O’Mattic A8C Irland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland; Legal basis: Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO); Website: https://wordpress.com; Data protection: https://automattic.com/de/privacy/; Order processing contract: https://wordpress.com/support/data-processing-agreements/. Basis for third country transfer: EU-US Data Privacy Framework (DPF).

Registration, login and user account

Users can create a user account. As part of registration, users are provided with the required mandatory information and processed for the purpose of providing the user account on the basis of contractual fulfillment of obligations. The data processed includes, in particular, login information (username, password and an email address).

As part of the use of our registration and login functions and the use of the user account, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests and those of the users in protecting against misuse and other unauthorized use. In principle, this data will not be passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so.

Users can be informed by email about processes that are relevant to their user account, such as technical changes.

• Types of data processed: Inventory data (e.g. names, addresses); Contact details (e.g. email, telephone numbers); Content data (e.g. entries in online forms); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status); Payment data (e.g. invoices, payment history); Contract data (e.g. subject matter of the contract). Usage data (e.g. websites visited, interest in content, access times).

• Persons affected: Users (e.g. website visitors, users of online services). customers.

• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; Safety measures; Managing and responding to inquiries. Provision of our online offering and user-friendliness.

• Legal basis: fulfillment of contract and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b) DSGVO). Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO).

Further information on processing processes, procedures and services:

• Registration with real name: Due to the nature of our services, we ask users to only use our offering using real names. This means that the use of pseudonyms is not permitted; Legal basis: fulfillment of contract and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b) DSGVO).

• User profiles are not public: Users’ profiles are not publicly visible or accessible.

• No obligation to retain data: It is the users’ responsibility to back up their data before the end of the contract if the contract is terminated. We are entitled to irretrievably delete all user data stored during the term of the contract; Legal basis: fulfillment of contract and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b) DSGVO).

• Customer account: Customers can create an account within our online offering (e.g. customer or user account, “customer account” for short). If registration of a customer account is required, customers will be informed of this as well as the information required for registration. Customer accounts are not public and cannot be indexed by search engines. As part of the registration and subsequent logins and use of the customer account, we store the customers’ IP addresses along with the access times in order to be able to prove registration and prevent any misuse of the customer account. If the customer account has been terminated, the customer account data will be deleted after the time of termination, unless it is retained for purposes other than provision in the customer account or must be retained for legal reasons (e.g. internal storage of customer data, order processes or invoices). It is the responsibility of customers to secure their data upon termination of the customer account; Legal basis: fulfillment of contract and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b) DSGVO).

Contact and inquiry management

When you contact us (e.g. by post, contact form, email, telephone or via social media) as well as within the framework of existing user and business relationships, the information provided by the inquiring person is processed to the extent that this is necessary to answer the contact request and any requested measures.

• Types of data processed: Contact details (e.g. email, telephone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times). Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).

• Persons affected: Communication partner.

• Purposes of processing: Contact inquiries and communication; managing and responding to inquiries; Feedback (e.g. collecting feedback via online form). Provision of our online offering and user-friendliness.

• Legal basis: Legitimate interests (Art. 6 Para. 1 Sentence 1 Letter f) DSGVO).

Cloud services

We use software services accessible via the Internet and running on their providers’ servers (so-called “cloud services”, also referred to as “Software as a Service”) for the storage and management of content (e.g. document storage and management, exchange of documents, Content and information with specific recipients or publication of content and information).

Within this framework, personal data can be processed and stored on the providers’ servers, provided that they are part of communication processes with us or are otherwise processed by us as set out in this data protection declaration. This data may include, in particular, user master data and contact details, data on processes, contracts, other processes and their content. The cloud service providers also process usage data and metadata, which they use for security purposes and service optimization.

If we use cloud services to provide forms or other documents and content to other users or publicly accessible websites, the providers may set cookies on the users’ devices for the purposes of web analysis or to remember user settings (e.g. in the case of media control). remember, save.

• Types of data processed: Inventory data (e.g. names, addresses); Contact details (e.g. email, telephone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times). Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).

• Persons affected: Customers; Employees (e.g. employees, applicants, former employees); Interested persons; Communication partner. Users (e.g. website visitors, users of online services).

• Purposes of processing: Office and organizational procedures. Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.).).

• Legal basis: Legitimate interests (Art. 6 Para. 1 Sentence 1 Letter f) DSGVO).

Further information on processing processes, procedures and services:

• Google Workspace: Cloud-based application software (e.g. text and spreadsheet editing, appointment and contact management), cloud storage and cloud infrastructure services; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO); Website: https://workspace.google.com/; Data protection: https://policies.google.com/privacy; Order processing contract: https://cloud.google.com/terms/data-processing-addendum; Basis for third country transfer: EU-US Data Privacy Framework (DPF), Standard contractual clauses (https://cloud.google.com/terms/eu-model-contract-clause). Further information: https://cloud.google.com/privacy.

Newsletters and electronic notifications

We only send newsletters, emails and other electronic notifications (hereinafter “newsletter”) with the consent of the recipient. If the contents are specifically described when registering for the newsletter, they are decisive for the user’s consent. Our newsletters also contain information about our services and us.

In order to register for our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name so that you can be addressed personally in the newsletter, or other information if this is necessary for the purposes of the newsletter. The data you enter here will only be used to personalize the newsletter and will not be passed on to third parties.

Deletion and restriction of processing:Your data will be deleted within one month after you cancel your newsletter receipt, provided that deletion does not conflict with any legal retention requirements.

Content: Information about us, our services, promotions and offers.

• Types of data processed: Inventory data (e.g. names, addresses); Contact details (e.g. email, telephone numbers); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status). Usage data (e.g. websites visited, interest in content, access times).

• Persons affected: Communication partner.

• Purposes of processing: Direct marketing (e.g. via email or post).

• Legal basis: Consent (Art. 6 Abs. 1 S. 1 lit. a) DSGVO). Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO).

• Option to object (opt-out): You can cancel your receipt of our newsletter at any time, i.e. revoke your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter or you can use one of the contact options listed above, preferably email.

Further information on processing processes, procedures and services:

• Measuring open and click rates: The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from our server when the newsletter is opened or, if we use a shipping service provider, from its server. As part of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of access.

  This information is used to technically improve our newsletter based on the technical data or the target groups and their reading behavior based on their access locations (which can be determined using the IP address) or access times. This analysis also includes determining whether the newsletters are opened, when they are opened and which links are clicked. This information is assigned to the individual newsletter recipients and stored in their profiles until it is deleted. The evaluations help us to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

  The measurement of the opening rates and click rates as well as the storage of the measurement results in the users’ profiles and their further processing are based on the users’ consent.

  Unfortunately, it is not possible to revoke the success measurement separately; in this case, the entire newsletter subscription must be canceled or objected to. In this case, the saved profile information will be deleted;
  Legal basis: Consent (Art. 6 Abs. 1 S. 1 lit. a) DSGVO).

• CleverReach: email delivery and automation services; Service provider: CleverReach GmbH & Co. KG, //CRASH Building, Schafjückenweg 2, 26180 Rastede, Germany; Legal basis: Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO); Website: https://www.cleverreach.com/de; Data protection: https://www.cleverreach.com/de/datenschutz/. Order processing contract: Provided by the service provider.

• reCAPTCHA: We include the “reCAPTCHA” function in order to be able to recognize whether entries (e.g. in online forms) are made by people and not by automatically acting machines (so-called “bots”). The data processed may include IP addresses, information about operating systems, devices or browsers used, language settings, location, mouse movements, keyboard strokes, time spent on websites, previously visited websites, interactions with ReCaptcha on other websites, possibly cookies and results of manual recognition processes ( e.g. answering questions or selecting objects in pictures). Data processing is based on our legitimate interest in protecting our online offering from abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO); Website: https://www.google.com/recaptcha/; Data protection: https://policies.google.com/privacy; Basis for third country transfer: EU-US Data Privacy Framework (DPF). Option to object (opt-out): Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for displaying advertisements: https://adssettings.google.com/authenticated.

Presences in social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with active users there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This can result in risks for users because, for example, it could make it more difficult to enforce users’ rights.

Furthermore, user data within social networks is usually processed for market research and advertising purposes. For example, usage profiles can be created based on usage behavior and the resulting interests of users. The usage profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users’ computers, in which the usage behavior and interests of the users are stored. Furthermore, data can also be stored in the usage profiles regardless of the devices used by the users (particularly if the users are members of the respective platforms and are logged in to them).

For a detailed description of the respective forms of processing and the options for objection (opt-out), we refer to the data protection declarations and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of the rights of those affected, we would also like to point out that these can most effectively be asserted with the providers. Only the providers have access to user data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

• Types of data processed: Contact details (e.g. email, telephone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times). Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status).

• Persons affected: Users (e.g. website visitors, users of online services).

• Purposes of processing: Contact inquiries and communication; Feedback (e.g. collecting feedback via online form). marketing.

• Legal basis: Legitimate interests (Art. 6 Para. 1 Sentence 1 Letter f) DSGVO).

Further information on processing processes, procedures and services:

• Instagram: Social network;Service provider: Meta Platforms Irland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal Basis: Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO); Website: https://www.instagram.com. Data protection: https://instagram.com/about/legal/privacy.

• Facebook pages: Profiles within the social network Facebook – Together with Meta Platforms Ireland Limited, we are responsible for the collection (but not further processing) of data from visitors to our Facebook page (so-called “fan page”). This data includes information about the types of content users view or interact with, or the actions they take (see “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see “Device Information” in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services called “Page Insights” to site operators to provide them with insights into how people engage with their Pages and interact with the content associated with them. We have concluded a special agreement with Facebook (“Information on Page Insights”, https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular which security measures Facebook must observe and in which Facebook has agreed to fulfill the rights of those affected (i.e. users can, for example, send information or deletion requests directly to Facebook). The rights of users (in particular to information, deletion, objection and complaint to the responsible supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Information about Page Insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO); Website: https://www.facebook.com; Data protection: https://www.facebook.com/about/privacy; Basis for third country transfer: EU-US Data Privacy Framework (DPF), Standard contractual clauses (https://www.facebook.com/legal/EU_data_transfer_addendum). Further information: Agreement on shared responsibility: https://www.facebook.com/legal/terms/information_about_page_insights_data. The joint responsibility is limited to the collection by and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, in particular the transmission of the data to the parent company Meta Platforms, Inc. in the USA (based on the Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).

• YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO); Data protection: https://policies.google.com/privacy; Basis for third country transfer: EU-US Data Privacy Framework (DPF). Option to object (opt-out): https://adssettings.google.com/authenticated.

Plugins and embedded functions and content

We include functional and content elements in our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). This can be, for example, graphics, videos or city maps (hereinafter referred to as “content”).

The integration always requires that the third party providers of this content process the users’ IP address, as without the IP address they would not be able to send the content to their browser. The IP address is therefore required to display this content or functions. We strive to only use content whose respective providers only use the IP address to deliver the content. Third parties may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offering, as well as being linked to such information from other sources.

• Types of data processed: Usage data (e.g. websites visited, interest in content, access times); Meta, communication and procedural data (e.g. IP addresses, times, identification numbers, consent status). Location data (information about the geographical position of a device or person).

• Persons affected: Users (e.g. website visitors, users of online services).

• Purposes of processing: Provision of our online offering and user-friendliness. Provision of contractual services and fulfillment of contractual obligations.

• Legal basis: Legitimate interests (Art. 6 Para. 1 Sentence 1 Letter f) DSGVO).

Further information on processing processes, procedures and services:

• Google Maps: We integrate the maps from the “Google Maps” service provided by Google. The data processed may include, in particular, IP addresses and location data of the users; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO); Website: https://mapsplatform.google.com/; Data protection: https://policies.google.com/privacy. Basis for third country transfer: EU-US Data Privacy Framework (DPF).

• YouTube-Videos: video content; YouTube videos are integrated via a special domain (recognizable by the “youtube-nocookie” component) in the so-called “extended data protection mode”, which means that no cookies are collected on user activities in order to personalize video playback. Nevertheless, information about the user’s interaction with the video (e.g. remembering the last playback point) can be saved; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f) DSGVO); Website: https://www.youtube.com; Data protection: https://policies.google.com/privacy. Basis for third country transfer: EU-US Data Privacy Framework (DPF).

Changes and updates to the data protection declaration

We ask you to regularly inform yourself about the content of our data protection declaration. We will adapt the data protection declaration as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.

If we provide addresses and contact information for companies and organizations in this data protection declaration, please note that the addresses may change over time and ask you to check the information before contacting us.

Definitions of terms

This section provides an overview of the terms used in this data protection declaration. To the extent that the terms are defined by law, their legal definitions apply. The following explanations, on the other hand, are intended primarily to provide understanding.

• Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); A natural person is considered identifiable if he or she can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or one or more special features, which are an expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

• Location data: Location data is created when a mobile device (or another device with the technical requirements for location determination) connects to a radio cell, a WLAN or similar technical mediators and location determination functions. Location data is used to indicate at which geographically determinable position on earth the respective device is located. Location data can e.g. can be used to display map functions or other information dependent on a location.

• Controller: The “controller” is the natural or legal person, authority, institution or other body that alone or jointly with others decides on the purposes and means of processing personal data.

• Processing: “Processing” means any operation or series of operations carried out on personal data, whether or not by automated means. The term is wide-ranging and includes practically every handling of data, be it collecting, evaluating, storing, transmitting or deleting.