Data Privacy

General Information

Here you will find all necessary information about how, to what extent, and for what purpose we or third-party providers collect and use your data.

The collection and use of your data is strictly in accordance with the requirements of the EU General Data Protection Regulation (GDPR-EU), German data protection law under the DSAnpUG-EU, and the Telemedia Act (TMG) where applicable.

We are committed to the confidentiality of your personal data and therefore work strictly within the limits set by legal requirements.

The collection of this personal data is carried out on a voluntary basis whenever possible. We only pass on this data to third parties with your explicit consent.

For particularly confidential data, such as in payment transactions or regarding your inquiries to us, we ensure high security by using SSL encryption.

At this point, we would like to point out the general risks of internet use, over which we have no influence. Especially in email communication, your data is not secure without additional precautions and may be intercepted by third parties.

Definitions of Terms

"Personal data" means all information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

"Processing" means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data.

"Controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Relevant Legal Bases

In accordance with Art. 13 GDPR-EU, we inform you of the legal bases of our data processing. Unless the legal basis is specified in the privacy policy, the following applies:

• The legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR-EU
• The legal basis for processing for the performance of our services and carrying out contractual measures as well as responding to inquiries is Art. 6(1)(b) GDPR-EU
• The legal basis for processing to fulfill our legal obligations is Art. 6(1)(c) GDPR-EU
• The legal basis for processing to protect our legitimate interests is Art. 6(1)(f) GDPR-EU.
• If vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR-EU serves as the legal basis.

Cooperation with Processors and Third Parties

If we disclose data to other persons and companies (processors or third parties) as part of our processing, transmit it to them, or otherwise grant them access to the data, this is only done on the basis of

• a legal permission (e.g., data to payment service providers required under Art. 6(1)(b) GDPR-EU for contract fulfillment)
• your consent
• a legal obligation, or
• our legitimate interests (e.g., when using agents, web hosts, IT maintenance contracts, shipping companies, suppliers, etc.)

If we commission third parties to process data on the basis of a so-called "processing contract," this is done on the basis of Art. 28 GDPR-EU.

Transfers to Third Countries

If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or this occurs in the context of the use of services of third parties or disclosure, or transmission of data to third parties, this is only done if

• it is necessary for the fulfillment of our (pre-)contractual obligations
• based on your consent
• due to a legal obligation, or
• based on our legitimate interests.

Subject to legal or contractual permissions, we process or have the data processed in a third country only if the special requirements of Art. 44 et seq. GDPR-EU are met. That is, processing takes place, for example, on the basis of special guarantees, such as the officially recognized determination of a level of data protection equivalent to that of the EU (e.g., for the USA through the "Privacy Shield") or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").

Rights of Data Subjects

You have the right to request confirmation as to whether data concerning you is being processed and to obtain information about such data as well as further information and a copy of the data in accordance with Art. 15 GDPR-EU.

You have the right under Art. 16 GDPR-EU to request the completion of data concerning you or the rectification of inaccurate data concerning you.

You have the right under Art. 17 GDPR-EU to request that data concerning you be deleted immediately, or alternatively, under Art. 18 GDPR-EU, to request restriction of the processing of the data.

You have the right to request that the data concerning you that you have provided to us be received and transmitted to other controllers in accordance with Art. 20 GDPR-EU.

You also have the right under Art. 77 GDPR-EU to lodge a complaint with the competent supervisory authority.

Right of Withdrawal

You have the right to withdraw consents granted in accordance with Art. 7(3) GDPR-EU with effect for the future.

Right to Object

You may object at any time to the future processing of data concerning you in accordance with Art. 21 GDPR-EU. The objection may in particular be made against processing for direct marketing purposes.

Deletion of Data

You have the right to request the correction, blocking, or deletion of your data. Excluded from this are data that must be retained due to legal regulations or are required for proper business processing. To ensure that a data block can be implemented at any time, data is kept in a lock file for control purposes. If data is not subject to a statutory archiving obligation, we will delete your data at your request. If the archiving obligation applies, we will block your data. For all questions and concerns regarding the correction, blocking, or deletion of personal data, please contact our data protection officer at the contact details in this privacy policy or at the address stated in the imprint.

Personal Data

If we collect personal data, we do so within the framework of data minimization and data economy only to the extent and for as long as is necessary for the use of our website or as required by law.

When we collect personal data – such as your name, address, or email address – this data collection is voluntary. Without your explicit consent, this data will not be disclosed to third parties.

We take the protection of your personal data seriously and strictly comply with the relevant legal provisions and this privacy policy when collecting and processing personal data.

If the purpose of data collection ceases to apply or the statutory retention period expires, the collected data will be blocked or deleted. As a rule, our website can be used without providing personal data.

Cloudflare Web Analytics

We use Cloudflare Web Analytics, a web analytics service provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, and/or Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany, where applicable.

Cloudflare Web Analytics enables us to statistically evaluate the use of our website, in particular page views, referrers, browsers used, device types, and website performance data. This evaluation serves the technical optimization and improvement of our online offering.

According to Cloudflare, Cloudflare Web Analytics does not use cookies, does not use Local Storage or Session Storage, and does not create personal user profiles or individual fingerprints for analytics purposes.

The processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the analysis, stability, security, and optimization of our online offering.

Further information can be found in Cloudflare’s privacy notices.

Cookies

We do not use cookies for analytics or marketing purposes on our publicly accessible website. If individual integrated services carry out technically necessary storage or access operations, we will provide separate information about this.

SSL Encryption

Our website uses SSL encryption when transmitting confidential or personal content of our users. This encryption is activated, for example, during payment transactions and inquiries you send to us via our website.

Please ensure that SSL encryption is activated for relevant activities on your part. The use of encryption is easy to recognize: The display in your browser's address bar changes from "http://" to "https://". Data encrypted via SSL cannot be read by third parties. Only transmit your confidential information with SSL encryption activated and contact us if in doubt.

Google Maps Plugin

We use a plugin of the internet service Google Maps on our website. It is only loaded after your explicit consent.

Its operator is Google Inc.

It is based in the USA, CA 94043, 1600 Amphitheatre Parkway, Mountain View.

When Google Maps is loaded, information about the use of this website and your IP address is transmitted to a Google server in the USA and also stored on this server.

We have no knowledge of the exact content of the transmitted data, nor of its use by Google. The company denies, in this context, the connection of the data with information from other Google services and the collection of personal data. However, Google may transfer the information to third parties.

You can change or withdraw your consent at any time in the data privacy settings.

If you disable Javascript in your browser, you prevent the execution of Google Maps. However, you will then not be able to use the map display on our website.

Under the following Link you will find more information on the privacy policy and terms of use for Google Maps.