Privacy Policy

This is an English translation of our German privacy notice („Datenschutzhinweise“), provided for your convenience. Only the German version is legally binding; in the event of any discrepancies between the German and English versions, the German version shall prevail.

As the operator of these pages, we take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data are collected. Personal data are data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

We would like to point out that data transmission over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

1. General Information

1.1 Provider and controller within the meaning of data protection law

Grapevine Frankfurt GmbH, Dieselstraße 22, 61184 Karben
as well as
Grapevine München GmbH, Tengstraße 9, 80798 München

Phone: +49 89 588 0317-0
Email: datenschutz@grapevine.agency

Please direct general data protection inquiries, such as the enforcement of data subject rights, to: datenschutz@grapevine.agency.

You can direct confidential data protection inquiries to our data protection officer by telephone, post or email:

Ronald Baranowski

SIX DATENSCHUTZ GmbH

Marktplatz 6
D – 61118 Bad Vilbel
Phone: +49 6101 982 9422
rb(at)six-datenschutz.de

1.2 Scope

This privacy policy applies to our online offering, accessible in particular at https://www.grapevine.agency/, as well as whenever this privacy policy is otherwise referenced from one of our offerings (e.g. websites, subdomains, mobile applications, web services or integrations into third-party sites), regardless of how you access or use it.

All of these offerings are also collectively referred to as „Services“.

1.3 Integration of third-party services and content

Our offering sometimes includes content, services and features from other providers. In order for these data to be retrieved and displayed in the user’s browser, the transmission of the IP address is absolutely necessary. The providers (hereinafter referred to as „third-party providers“) thus receive the IP address of the respective user.
Even though we make every effort to use only third-party providers that require the IP address solely in order to deliver content, we have no influence on whether the IP address may be stored. In such cases, this process serves, among other things, statistical purposes. Where we are aware that the IP address is stored, we inform our users accordingly.

1.4 Transfer of personal data to third countries

If we transfer data to third countries, i.e. countries outside the European Union, the transfer takes place exclusively in compliance with the legally regulated admissibility requirements.

If the transfer of data to a third country does not serve to fulfil our contract with you, we do not have your consent, the transfer is not necessary for the establishment, exercise or defence of legal claims and no other exemption under Art. 49 GDPR applies, we only transfer your data to a third country if an adequacy decision under Art. 45 GDPR or appropriate safeguards under Art. 46 GDPR exist.

An adequate level of data protection in the USA was most recently declared by the adequacy decision “Data Privacy Framework (DPF)“ adopted in July 2023. US companies must certify in order to be listed in it. You can find the adequacy decision here: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

We have agreed so-called EU standard contractual clauses with the providers in third countries and, in some cases, data processing on servers in Germany and the EU. Timely data deletion reduces the risk of access by third parties.

Alternatively or additionally, the conclusion of the EU standard contractual clauses issued by the European Commission with the receiving party creates appropriate safeguards under Art. 46(2)(c) GDPR as well as an adequate level of data protection. You can obtain copies of the EU standard contractual clauses on the website of the European Commission, accessible here.

1.5 Disclosure of data to third parties

Your data are not transferred to unauthorised third parties. Where external service providers receive your personal data, we have ensured that they implement appropriate technical and organisational measures and that they comply with the applicable data protection regulations and laws.

1.6 Data minimisation

In accordance with the principles of data avoidance and data minimisation, we store personal data only for as long as is necessary or required by law (statutory retention period). If the purpose of the collected data ceases to apply or the retention period expires, we block or delete the data.

2. Processing activities in detail

Below we inform you for what purpose, in what manner and to what extent your personal data may be processed when you visit our website.

2.1 Collection of personal data when visiting our website

When you use the website purely for informational purposes, i.e. when you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security (the legal basis for this is Art. 6(1) sentence 1(f) GDPR, legitimate interest):

IP address
Hostname
Date and time of the request
Time zone difference to Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status/HTTP status code
Amount of data transferred in each case
Website from which the request originates (referrer)
The specific pages of our website that you access
Browser: type, version and language setting
Operating system: type and version

If JavaScript is enabled, additionally:

Screen resolution
Colour depth
Size of the browser window
Installed browser plug-ins

2.2 Cookies

This website uses so-called cookies. These are text files that are stored on your computer from the server. They may contain information about the browser, the IP address, the operating system and the internet connection. We do not pass these data on to third parties or link them to personal data without your consent.
Cookies primarily serve two purposes. They help us to make it easier for you to navigate through our offering and enable the correct display of the website. They are not used to introduce viruses or to launch programs.
Users have the option of accessing our offering without cookies. To do so, the relevant settings in the browser must be changed. Please consult the help function of your browser on how to deactivate cookies. However, we would like to point out that this may impair some functions of this website and restrict user comfort.

The pages www.aboutads.info/choices/ (USA) and www.youronlinechoices.com/uk/your-ad-choices/ (Europe) allow you to manage the display of interest-based advertising.

2.3 Use of essential cookies

Essential cookies do not require your consent and are processed by us in accordance with Art. 6(1)(f) GDPR. Our legitimate interest here is the smooth and optimal use and display of our website.

2.4 Cookie consent / Required consent to the use of third-party provider services

Our website uses the consent technology of Borlabs Cookie to obtain your consent to the storage of certain cookies in your browser or to the use of certain technologies and to document this in a data protection-compliant manner. The provider of this technology is Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg (hereinafter Borlabs).

When you enter our website, a Borlabs cookie is stored in your browser in which the consents you have given or the revocation of these consents are stored. These data are not passed on to the provider of Borlabs Cookie.

The collected data are stored until you request us to delete them, or until you delete the Borlabs cookie yourself, or until the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected. Details on the data processing by Borlabs Cookie can be found at https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/.

The Borlabs cookie consent technology is used to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6(1)(c) GDPR.

2.5 Hosting and content delivery networks

The service provider Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (hereinafter Hetzner) is used for hosting our website. For this purpose, Hetzner provides us with various functionalities so that our pages can be displayed correctly and optimally on the respective end devices.

The personal data collected on this website are stored on the servers of the host(s). This may primarily involve IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access and other data generated via a website.

The hosting of our website takes place under joint controllership (Art. 26 GDPR) with our partner, Personalwerk GmbH, Dieselstraße 22 in 61184 Karben, which provides us with this service. The processing by Hetzner takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

The hosting is carried out in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR). Where corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR.

The data are stored until they are no longer required for the purposes stated above.

Cloudflare

For the purpose of shorter loading times, we use a so-called content delivery network („CDN“). With this service, content, e.g. large media files, is delivered via regionally distributed servers of the external CDN service provider Cloudflare. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter Cloudflare). In technical terms, the transfer of information between your browser and our website is routed via Cloudflare’s network (e.g. IP address, browser type, browser version, date and time of access). This enables Cloudflare to analyse the data traffic between your browser and our website and to act as a filter between our servers and potentially malicious traffic from the internet. In doing so, Cloudflare may also use cookies or other technologies to recognise internet users, which are, however, used solely for the purpose described here.

The use of Cloudflare is based on our legitimate interest in providing our web offering as error-free and securely as possible (Art. 6(1)(f) GDPR). The data are stored for the duration of the provision of services or until the purpose no longer applies.

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details and further information on the subject of security and data protection at Cloudflare can be found here: https://www.cloudflare.com/privacypolicy/.

The company holds a certification under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information on this from the provider at the following link: https://www.dataprivacyframework.gov/participant/5666.

2.6 Contact form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provide there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not pass on these data without your consent.

The processing of these data is carried out on the basis of Art. 6(1)(b) GDPR, provided that your inquiry is related to the performance of a contract or is necessary for carrying out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this was requested; the consent can be revoked at any time.

The data you enter in the contact form remain with us until you request us to delete them, revoke your consent to storage, or the purpose for storing the data no longer applies (e.g. after your inquiry has been fully processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

2.7 Inquiry by email, telephone or fax

If you contact us by email, telephone or fax, your inquiry, including all resulting personal data (name, inquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on these data without your consent.

The data you send us via contact requests remain with us until you request us to delete them, revoke your consent to storage, or the purpose for storing the data no longer applies (e.g. after your request has been fully processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

2.8 Analysis tools and advertising

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (belonging to Google Inc., headquartered at 1600 Amphitheatre Parkway in Mountain View, CA 94043, USA).

Google Tag Manager is a tool that enables us to integrate tracking or statistics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any independent analyses. It merely serves to manage and deliver the tools integrated via it. However, Google Tag Manager records your IP address, which may also be transferred to Google’s parent company in the United States.

The storage and analysis of the data is carried out on the basis of Art. 6(1)(a) GDPR (consent), either as part of registration with Google (opening a Google account and accepting the privacy policy implemented there) or, if you have not registered with Google, through explicit consent when opening our page. Your consent can be revoked at any time in the cookie settings.

Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Ireland (belonging to Google Inc., headquartered at 1600 Amphitheatre Parkway in Mountain View, CA 94043, USA).

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, length of stay, operating systems used and the origin of the user. These data are combined in a user ID and assigned to the respective end device of the website visitor.

Furthermore, with Google Analytics we can, among other things, record your mouse and scroll movements and clicks. Google Analytics also uses various modelling approaches to supplement the collected data sets and employs machine learning technologies in data analysis. Google Analytics uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transferred to a Google server in the USA and stored there.

All of the processing described above, in particular the setting of cookies on the end device used, only takes place if you have given us your express consent for this in accordance with Art. 6(1)(a) GDPR. Without your consent, Google Analytics is not used during your visit to the site. You can revoke your consent at any time with effect for the future. To exercise your right of revocation, please deactivate this service in the cookie settings.

We have concluded a data processing agreement with Google that ensures the protection of our site visitors’ data and prohibits unauthorised disclosure to third parties. The data transfer to the USA is also based on the standard contractual clauses of the EU Commission. Details can be found here: https://business.safety.google/adscontrollerterms/sccs/.

Google Analytics IP anonymisation is enabled. As a result, your IP address is truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area prior to transmission to the USA. Only in exceptional cases is the full IP address transferred to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services related to website and internet use. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

You can prevent the collection and processing of your data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

More information on how user data is handled by Google Analytics can be found in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Google Signals

We use Google Signals. When you visit our website, Google Analytics collects, among other things, your location, search history and YouTube history as well as demographic data (visitor data). These data can be used for personalised advertising with the help of Google Signals. If you have a Google account, the visitor data from Google Signals is linked to your Google account and used for personalised advertising messages. The data are also used to create anonymised statistics on the user behaviour of our users. If you have activated personalised ads and have linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics in accordance with Art. 6(1)(a) GDPR, analyse your usage behaviour across devices and create database models, including on cross-device conversions.

We do not receive any personal data from Google, only statistics. If you would like to stop the cross-device analysis, you can deactivate the “Personalised advertising” function in the settings of your Google account. To do so, follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=de Further information on Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Ireland (belonging to Google Inc., headquartered at 1600 Amphitheatre Parkway in Mountain View, CA 94043, USA).

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). Furthermore, targeted advertisements can be displayed based on the user data available at Google (e.g. location data and interests) (audience targeting). As the website operator, we can evaluate these data quantitatively by, for example, analysing which search terms led to the display of our advertisements and how many ads led to corresponding clicks.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR. The consent can be revoked at any time. You have the option of objecting to interest-based advertising by Google. To do so, you can access the link www.google.de/settings/ads and make the desired settings there. Further information and the applicable data protection provisions of Google can be found at www.google.de/intl/de/policies/privacy/.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.

Google Ads Remarketing

This website uses the functions of Google Ads Remarketing. The provider is Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Ireland (belonging to Google Inc., headquartered at 1600 Amphitheatre Parkway in Mountain View, CA 94043, USA).

With Google Ads Remarketing, we can assign people who interact with our online offering to specific target groups in order to subsequently display interest-based advertising to them in the Google advertising network (remarketing or retargeting).

Furthermore, the advertising target groups created with Google Ads Remarketing can be linked to Google’s cross-device functions. In this way, interest-based, personalised advertising messages that have been adapted to you depending on your previous usage and browsing behaviour on one end device (e.g. mobile phone) can also be displayed on another of your end devices (e.g. tablet or PC).

The data processed by Google include your IP address, device information, browser details, pages visited, time and duration of the visit, and cookies are set to track interaction with the website for remarketing purposes. The maximum storage period is 540 days or a maximum of 26 months if storage takes place in Google Analytics (when the service is used via Google Analytics). Please also note the section on Google Analytics.

If you have a Google account, you can object to personalised advertising at the following link: https://adssettings.google.com/anonymous?hl=de.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR. The consent can be revoked at any time.

Further information and the data protection provisions can be found in Google’s privacy policy at: https://policies.google.com/technologies/ads?hl=de.

Audience building with customer matching

To build audiences, we use, among other things, the customer matching feature of Google Ads Remarketing. In doing so, we transfer certain customer data (e.g. email addresses) from our customer lists to Google. If the customers in question are Google users and are logged into their Google account, matching advertising messages are displayed to them within the Google network (e.g. on YouTube, Gmail or in the search engine).

Google Conversion Tracking

This website uses Google Conversion Tracking. The provider is Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Ireland (belonging to Google Inc., headquartered at 1600 Amphitheatre Parkway in Mountain View, CA 94043, USA).

With the help of Google Conversion Tracking, Google and we can recognise whether the user has carried out certain actions. For example, we can evaluate which buttons on our website were clicked how often and which products were viewed or purchased particularly frequently. This information is used to create conversion statistics. We learn the total number of users who clicked on our ads and what actions they carried out. We do not receive any information with which we can personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.

This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR. The consent can be revoked at any time.

More information on Google Conversion Tracking can be found in Google’s data protection provisions: https://policies.google.com/privacy?hl=de.

LinkedIn Insight Tag

This website uses the Insight Tag from LinkedIn. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (headquartered in the USA: LinkedIn Corp., 1000 Q Maude Ave, Sunnyvale, CA 94085).

With the help of the LinkedIn Insight Tag, we receive information about the visitors to our website. If a website visitor is registered with LinkedIn, we can, among other things, analyse the professional key data (e.g. career level, company size, country, location, industry and job title) of our website visitors and thus better tailor our site to the respective target groups. Furthermore, with the help of LinkedIn Insight Tags, we can measure whether the visitors to our web pages make a purchase or carry out any other action (conversion measurement). The conversion measurement can also take place across devices (e.g. from PC to tablet). LinkedIn Insight Tag also offers a retargeting function that enables us to display targeted advertising to the visitors of our website outside the website, whereby, according to LinkedIn, no identification of the advertising recipient takes place.

LinkedIn itself also collects so-called log files (URL, referrer URL, IP address, device and browser properties and time of access). The IP addresses are truncated or (if they are used to reach LinkedIn members across devices) hashed (pseudonymised). The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymised data are then deleted within 180 days.

The data collected by LinkedIn cannot be assigned to specific individuals by us as the website operator. LinkedIn will store the collected personal data of website visitors on its servers in the USA and use them as part of its own advertising measures. For details, please refer to LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy#choices-oblig.

Insofar as consent has been obtained, the above-mentioned service is used exclusively on the basis of Art. 6(1)(a) GDPR. The consent can be revoked at any time.

We have concluded an agreement on the data processing operations with LinkedIn (Data Processing Agreement) that governs the following operations: the processing of personal data that we upload or otherwise make available to LinkedIn in the context of the services, the processing of personal data by LinkedIn on our behalf in connection with the services, as well as the processing of any personal data that LinkedIn uploads or otherwise makes available to us in connection with the services. The agreement is available at: https://de.linkedin.com/legal/l/dpa. The disclosure of data to LinkedIn is additionally governed by the standard contractual clauses to ensure compliance with the applicable data protection provisions.

Please note that, according to LinkedIn’s privacy policy, personal data are also processed by LinkedIn in the USA or other third countries. According to its own information, LinkedIn only transfers personal data to countries for which an adequacy decision of the European Commission under Art. 45 GDPR exists or on the basis of appropriate safeguards under Art. 46 GDPR.

LinkedIn is a listed company in the Data Privacy Framework (see also section 1.4 of this privacy policy).

Objection to the use of the LinkedIn Insight Tag

You can object to the analysis of usage behaviour and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Furthermore, LinkedIn members can control the use of their personal data for advertising purposes in the account settings. To avoid a linking of data collected on our website by LinkedIn with your LinkedIn account, you must log out of your LinkedIn account before visiting our website.

2.9 Processing of customer and contract data

We collect, process and use personal data only insofar as they are necessary for the establishment, content design or amendment of the legal relationship (inventory data). This is carried out on the basis of Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures. In all other cases, the processing is carried out in our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest lies in the design of efficient and optimal processes for initiating and maintaining our business relationship with you. Only those data that are essential for the respective purpose are processed. We collect, process and use data on the use of our web pages (usage data) only insofar as this is necessary to enable you to use the service or to bill for it.

The customer data collected are deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

2.10 Audio and video conferences

Among other things, we use online conference tools to communicate with our customers. The specific tools we use are listed below. If you communicate with us via video or audio conference over the internet, your personal data are collected and processed by us and by the provider of the respective conference tool.

The conference tools collect all data that you provide/use in order to use the tools (email address and/or your telephone number). Furthermore, the conference tools process the duration of the conference, the start and end (time) of participation in the conference, the number of participants and other „contextual information“ in connection with the communication process (metadata).

Furthermore, the provider of the tool processes all technical data required to handle the online communication. This includes in particular IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker as well as the type of connection.

Insofar as content is exchanged, uploaded or otherwise made available within the tool, this is also stored on the servers of the tool providers. Such content includes in particular cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared during the use of the service.

Please note that we do not have full influence over the data processing operations of the tools used. Our options depend largely on the corporate policy of the respective provider. Further information on the data processing by the conference tools can be found in the privacy policies of the respective tools used, which we have listed below this text.

Purpose and legal bases

The conference tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6(1)(b) GDPR). Furthermore, the use of the tools serves the general simplification and acceleration of communication with us or our company (legitimate interest within the meaning of Art. 6(1)(f) GDPR). Insofar as consent has been requested, the tools in question are used on the basis of this consent; the consent can be revoked at any time with effect for the future.

Storage period

The data collected directly by us via the video and conference tools are deleted from our systems as soon as you request us to delete them, revoke your consent to storage, or the purpose for storing the data no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no influence on the storage period of your data that are stored by the operators of the conference tools for their own purposes. For details, please inquire directly with the operators of the conference tools.

We use the following conference tools:

Microsoft Teams

We use Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When using this service, it cannot be ruled out that personal data may be transferred to servers of the parent company Microsoft Corporation, based in the USA (1 Microsoft Way, Redmond, WA 98052, USA). Microsoft is certified under the Data Privacy Framework and also uses the EU standard contractual clauses to ensure a European data protection standard (see also section 1.4 of this privacy policy).

We have concluded a contractual basis with Microsoft pursuant to Art. 28 GDPR for the processing of personal data. Information on the use of your data by Microsoft can be found here. Data processed by Microsoft are stored in accordance with their privacy policy for the provision for a „minimum necessary period“ and then deleted.

Google Meet

We use Google Meet. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (belonging to Google Inc., headquartered at 1600 Amphitheatre Parkway in Mountain View, CA 94043, USA). Details on the data processing can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=de. The processing takes place on a contractual basis pursuant to Art. 28 GDPR. Google is certified under the Data Privacy Framework and also uses the EU standard contractual clauses to ensure a European data protection standard (see also section 1.4 of this privacy policy).

2.11 Social Media

We maintain publicly accessible profiles on social networks, to which we provide links on our website. Responsibility for the respective presence on the respective social network thus lies with the controller.

As a rule, social networks comprehensively analyse your user behaviour when you visit their websites. Visiting the social media presences therefore triggers numerous data protection-relevant processing operations over which we have no influence.

If you are logged into your social media account and visit a social media presence, the operator of the social network can assign this visit to your user account. However, your personal data may under certain circumstances also be collected if you are not logged in or do not have an account with the respective social network. In this case, this data collection takes place, for example, via cookies that are stored on your end device or by recording your IP address.

With the help of the data collected in this way, the operators of the social networks can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be displayed to you inside and outside the respective social networks. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices on which you are logged in or have been logged in.

Please also note that we cannot trace all processing operations of the social networks. Depending on the provider, further processing operations may therefore be carried out. For details, please refer to the terms of use and data protection provisions of the respective social network (see below).

Our social media presences are intended to ensure the most comprehensive presence possible of our company, our goods and services on the internet. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The analysis processes initiated by the social networks may be based on different legal bases, which must be stated by the operators of the social networks (e.g. on your consent within the meaning of Art. 6(1)(a) GDPR).

The data collected directly by us via the social media presence are deleted from our systems as soon as the purpose for their storage no longer applies, you request us to delete your data, revoke your consent to storage, or the purpose for storing the data no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory provisions and retention periods remain unaffected.

We have no influence on the duration of the storage of your personal data by the operators of the social networks for their own purposes. Please inquire directly with the operators of the social networks (e.g. in their privacy policies, see below).

Social networks in detail:

Instagram

The operating company of Instagram’s services is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland.

The collected data are also transferred to the USA and to other third countries and stored on servers in the USA or in other third countries. We have concluded a joint controllership agreement (Controller Addendum) with Meta. This agreement specifies which data processing operations we or Meta are responsible for when you visit the Instagram page. You can view this agreement at the following link:

www.facebook.com/legal/terms/page_controller_addendum

You can adjust your advertising settings yourself in your user account. To do so, click on the following link and log in:

https://help.instagram.com/131112217071354

For details, please refer to Instagram’s privacy policy:

https://about.instagram.com/de-de/safety

Further information and the applicable data protection provisions of Instagram can be found at help.instagram.com/155833707900388 and www.instagram.com/about/legal/privacy/.

The platform is provided by LinkedIn Corporation (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2 Ireland). LinkedIn is solely responsible for the processing of personal data when you visit our LinkedIn profile.

Further information on the processing of personal data by LinkedIn can be found here: https://www.linkedin.com/legal/privacy-policy

2.12 Data protection for applications and in the application process

We offer you the opportunity to apply to us (e.g. by email, by post or via an online application form). Below we inform you about the scope, purpose and use of your personal data collected as part of the application process. We assure you that the collection, processing and use of your data takes place in accordance with applicable data protection law and all other statutory provisions and that your data are treated in strict confidence.

If you apply to us for a position we have advertised or send us an unsolicited application by email or to our postal address, the following personal data, among others, are required from you and processed accordingly:

Master data such as salutation, title, first name, surname, etc.

Contact data such as private address with postal code, city, street, house number, email addresses, telephone numbers (landline and/or mobile), etc.

Application documents such as cover letter, curriculum vitae, application photo, school and employment references and other proof of qualifications.

Should information be missing for carrying out the application process, we may request it from you separately, insofar as it is necessary for our decision-making.

We collect and process the personal data of applicants for the purpose of handling the application process and for the decision on the establishment of an employment relationship. This is carried out on the basis of Art. 88(1) GDPR in conjunction with Section 26 of the Federal Data Protection Act (BDSG) as well as Art. 6(1)(b) GDPR – pre-contractual measures. Insofar as you provide us with documents containing „special categories of personal data“ pursuant to Art. 9(1) GDPR, the legal basis for the processing of these data is Art. 9(2)(a) GDPR (express consent), since the data were transmitted voluntarily and knowingly. Insofar as data that are necessary for the exercise of the profession are included, the legal basis is Art. 9(2)(b) GDPR – performance of a contract.

It is of particular importance to us to handle your personal data with trust as early as during the application process. The data you transmit are processed exclusively for the above-mentioned purposes. In principle, only those persons who need it for the proper conduct of the application process have access to your data. Your data are not passed on to unauthorised third parties.

We would like to point out that, as part of the application process, we may also view and use publicly accessible data. This includes, for example, data that can be found in search engines or that you publish about yourself on professional social networks (e.g. Xing, LinkedIn, Stepstone). We may also contact you via the professional social networks. This processing constitutes a pre-contractual measure for the preparation and initiation of a contract pursuant to Art. 6(1)(b) GDPR. The categories of data processed include data about your person and contact data, as well as other data that you make publicly accessible (e.g. photos, professional career, etc.). For this purpose, we only process personal data that are related to the planned filling of the position.

If no employment contract is concluded between the controller and the applicant, the application documents are automatically deleted six months after notification of the rejection decision, provided that no contractual, statutory or other legitimate interests of the controller preclude deletion. Other legitimate interest in this sense is, for example, an obligation to provide evidence when defending against proceedings under the General Equal Treatment Act (AGG).

Longer storage may also take place if you have given corresponding consent (Art. 6(1)(a) GDPR) or if statutory retention obligations preclude deletion.

Inclusion in the applicant pool

If we do not make you a job offer, there may be the option of including you in our applicant pool. In the event of inclusion, all documents and information from the application are transferred to the applicant pool in order to contact you in the event of suitable vacancies.

Inclusion in the applicant pool takes place exclusively on the basis of your express consent (Art. 6(1)(a) GDPR). Giving consent is voluntary and has no bearing on the ongoing application process. The data subject can revoke their consent at any time. In this case, the data are irrevocably deleted from the applicant pool, provided that there are no statutory retention reasons.

The data in the applicant pool are irrevocably deleted no later than two years after consent is given.

If the application is successful, the data you have submitted are stored in our data processing systems on the basis of Section 26 BDSG and Art. 6(1)(b) GDPR for the purpose of carrying out the employment relationship.

You have the option of withdrawing your application in whole or in part at any time. You can also request at any time that all or individual data and files you have transmitted be deleted or amended. Likewise, you have the right to revoke your consent to the processing of the personal data you transmitted as part of your application at any time with effect for the future. An email to us is sufficient for this purpose.

2.13 Other services

YouTube

This website contains plug-ins from YouTube by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (belonging to Google Inc., headquartered at 1600 Amphitheatre Parkway in Mountain View, CA 94043, USA).

We use the YouTube No-Cookies function, i.e. we have activated enhanced privacy mode; videos are not accessed via youtube.com but via youtube-nocookie.com.

This is provided by YouTube itself, which thereby assures that YouTube initially does not store any cookies on your device. When the relevant pages are accessed, however, the IP address and the other data mentioned in section 2.1 are transmitted, thereby in particular communicating which of our web pages you have visited. However, this information cannot be assigned to you if you are permanently logged into YouTube or another Google service when accessing the page.

As soon as you start playing an embedded video by clicking on it, YouTube, due to the enhanced privacy mode, only stores cookies on your device that do not contain any personally identifiable data, unless you are currently logged into a Google service. According to information from YouTube, the cookies serve, among other things, to record video statistics, improve user-friendliness and prevent abusive behaviour.

If you wish, you can use the „YouTube button“ or the share function. This requires you to log in to YouTube. Logging in results in the provider’s service being activated.

The processing takes place in accordance with your consent (Art. 6(1)(a) GDPR). If you have given consent, you can revoke it at any time in the cookie settings.

As a result of the embedded use of YouTube, further services are loaded; we cannot prevent this and we do not actively use these services ourselves.

These services are:

Google Fonts
Uniform display of fonts
DoubleClick
Improvement of advertising campaigns
Google Photos
Supporting service at YouTube for image display
Google APIs
Supporting service at Google for providing the programming interface
Google Video
Supporting service at YouTube for video display
YouTube Images
Supporting service at YouTube for image display

Further information on YouTube and its terms of use and privacy policy can be found here and here.

Google Fonts (local hosting)

For the uniform display of fonts, this site uses so-called Google Fonts, which are provided by Google. The Google Fonts are installed locally. No connection to Google servers and no associated data transmission takes place.

Further information on Google Fonts can be found at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

Font Awesome (local hosting)

For the uniform display of fonts, this site uses Font Awesome. Font Awesome is installed locally. No connection to servers of Fonticons, Inc. takes place.

Further information on Font Awesome can be found in the privacy policy for Font Awesome at: https://fontawesome.com/privacy.

ManageWP

We manage this website with the help of the ManageWP tool. The provider is GoDaddy.com WP Europe, Trg republike 5, 11000 Belgrade, Serbia (hereinafter ManageWP), belonging to GoDaddy Operating Company, LLC based in the USA (100 S. Mill Ave., Suite 1600, Tempe, AZ 85281, USA).

With ManageWP, we can, among other things, monitor the security and performance of our website. ManageWP is used exclusively for managing plug-in updates and SEO reports. Database backups or the active transfer of user data to ManageWP servers are not activated. For the technical management of the WordPress installation, ManageWP has, by virtue of the system, access to the database structure of the website.

The use of ManageWP is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the most effective and secure operation of its website(s) possible. Where corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR, insofar as the consent includes the storage of cookies or access to information on the user’s end device (e.g. device fingerprinting). The consent can be revoked at any time.

We have concluded a Data Processing Addendum with the provider that governs the data processing operations. The disclosure of data to ManageWP is additionally governed by the standard contractual clauses to ensure compliance with the applicable data protection provisions.

Further information on ManageWP and data protection can be found here.

3. Your Rights

Information, blocking, deletion and correction

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, their origin and recipients and the purpose of the data processing and, where applicable, a right to correction, blocking or deletion of these data. For this and for further questions on the subject of personal data, you can contact us or our data protection officer at any time at the address given in the legal notice.

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. An informal notification by email to us is sufficient for this. The lawfulness of the data processing carried out up until the revocation remains unaffected by the revocation.

Right to object to data collection and to direct advertising (Art. 21 GDPR)

If the data processing is carried out on the basis of Art. 6(1)(a) or (f) GDPR (consent or legitimate interest), you have the right at any time to object, on grounds relating to your particular situation, to the processing of your personal data; this also applies to profiling based on these provisions. You can find the respective legal basis on which processing is based in this privacy policy. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection pursuant to Art. 21(1) GDPR).

If you are a customer of ours, your data may also be used for direct advertising if it concerns the same or similar topics in connection with the services you have commissioned. If your personal data are processed for the purpose of direct advertising, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is connected with such direct advertising. If you object, your personal data will subsequently no longer be used for the purpose of direct advertising (objection pursuant to Art. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged violation. The right to lodge a complaint exists without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place insofar as it is technically feasible.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. For this, you can contact us at any time at the address given in the legal notice. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.

If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of deletion.

If we no longer need your personal data, but you need them for the exercise, defence or establishment of legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.

If you have lodged an objection pursuant to Art. 21(1) GDPR, a balancing of your interests and ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, these data – apart from their storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a member state.

4. Changes to our privacy policy

To ensure that our privacy policy always complies with the current legal requirements, we reserve the right to make changes at any time. This also applies in the event that the privacy policy needs to be adapted due to new or revised services, for example new service offerings. The new privacy policy then takes effect on your next visit to our offering. This privacy policy is dated July 2026.