Privacy Policy

A. Our contact details

maut1 GmbH
Anton-Jakob-Straße 5
83026 Rosenheim
Germany

represented by the managing directors: Julian Schmelzer and Simon Baumgartner

The Data Protection Officer can also be contacted at: enzo@eb-con.com

B. Our data processing principles

The principles set out in this section apply to all personal data processed by us as the data controller. Where we are able to provide further details in the context of specific data processing operations, we set out our explanations in more detail from section C onwards at the relevant points.

I. Purpose limitation

We process your personal data only for the pursuit of a legitimate purpose. As a general rule, we process personal data solely for the purpose of providing and deliv-ering our services, including our online offerings (e.g. the maintenance of our web-site).

II. Legal bases

We process your personal data only insofar as at least one of the following legal bases applies:

1. Consent (Article 6(1), first sentence, point (a) of the GDPR)

In individual cases, we will ask for your consent to process certain personal data for predefined and notified purposes in accordance with Article 6(1), first sentence, point (a) of the GDPR.

By giving your consent, you authorise us to process the data covered by that consent. You may withdraw your consent at any time without any adverse consequences for the future. In this case, you have the right to withdraw your consent (Section E.II).

2. Performance of a contract (Article 6(1), first sentence, point (b) of the GDPR)

The processing of personal data for the purpose of taking precontractual measures or in the context of the performance of a contract is based on Article 6(1), first sentence, point (b) of the GDPR. This applies, for example, to your contact details, which we require to process the contract and for communication purposes.

3. Compliance with a legal obligation (Article 6(1), first sentence, point (c) of the GDPR)

Where we process data to comply with a legal obligation (e.g. obligations under commercial or tax law), the legal basis is Article 6(1), first sentence, point (c) of the GDPR.

4. Vital interests (Article 6(1), first sentence, point (d) of the GDPR)

Where the vital interests of the data subject or of another natural person necessitate the processing of personal data, the legal basis is Article 6(1), first sentence, point (d) of the GDPR.

5. Performance of tasks carried out in the public interest or in the exercise of official authority (Article 6(1), first sentence, point (e) of the GDPR)

For the processing of personal data in the performance of tasks carried out in the public interest or in the exercise of official authority, we rely on the legal basis set out in Article 6(1), first sentence, point (e) of the GDPR.

6. Protection of legitimate interests (Article 6(1), first sentence, point (f) of the GDPR)

In accordance with Article 6(1), first sentence, point (f) of the GDPR, we process personal data where we are safeguarding our legitimate interests or those of a third party, and where these interests override your interests, fundamental rights and freedoms. In such cases, you may have the right to object to the processing. Please refer to the further details regarding your right to object under section E.I .

III. Deletion of data

We will erase your personal data as soon as the purpose of the processing has been achieved or otherwise ceases to apply, unless further storage is required by law, for example in accordance with Article 17(3) of the GDPR. Where consent has been given, we will delete the data in the event of withdrawal of consent or after a certain period has elapsed, after which we can no longer assume that you continue to con-sent.

To ensure that any necessary erasure takes place in a timely manner, we follow an erasure policy based on the erasure of personal data upon the expiry of specific re-tention and erasure periods, which we categorise according to the following criteria:

We retain accounting records and balance sheets for 10 years (Section 257(1), in particular No. 4, and (4) of the German Commercial Code (HGB), Section 238(1) HGB),
we retain business letters, contracts and correspondence relating to the ne-gotiation and performance of contracts for 6 years in accordance with Section 257(1) Nos. 2–3, (4) of the German Commercial Code (HGB),
We retain documents and associated personal data that may give rise to claims (for example, warranty claims) until the expiry of the relevant limi-tation period (generally three years in accordance with Section 195 of the German Civil Code (BGB)),
In the case of other personal data not falling within the aforementioned categories, we delete the data immediately once the purpose for which it was collected has been fulfilled.

IV. Disclosure of personal data to third parties

We only disclose personal data to third parties if we are legally obliged or authorised to do so. Disclosures are made, for example, to the following categories of recipients:

Our contractual partners who assist us in fulfilling our (pre-)contractual obli-gations towards you (e.g. logistics, mobility and payment service providers),
Administrative authorities (e.g. tax or supervisory authorities) and courts, provided there is an obligation or legitimate interest to do so,
Web services and advertising partners who assist us in presenting and analysing our website (such as Google), and who use your personal data – provided you have given your consent – for interest analysis and, based on this, targeted advertising.

If required, we can provide you with a list of the specific recipients of your personal data.

V. Processing of data in so-called third countries, in particular the USA

As a general rule, your personal data is processed only in countries within the EU or the European Economic Area that are subject to the scope of the GDPR. We will on-ly transfer your personal data to all other so-called ‘third countries’ if an adequate level of data protection in accordance with Article 44 et seq. of the GDPR is guaran-teed in the respective third country or by the respective recipient in that third country. This is the case, for example,

where a so-called ‘adequacy decision’ by the European Commission in accordance with Article 45 of the GDPR is in place, and
by putting in place appropriate safeguards in accordance with Article 46 of the GDPR, such as the use of so-called ‘EU Standard Contractual Clauses’ in accordance with Article 46(2)(c) or binding corporate rules in accordance with Article 47 of the GDPR.

If we are unable to ensure an adequate level of data protection when transferring da-ta to a third country, we will only process your personal data if you give us your ex-plicit consent to do so (Article 49(1), first sentence, point (a) of the GDPR) and we will inform you of the relevant risks associated with transfers to third countries, such as in the case of data transfers to the USA:

In the case of data transfers to the USA, an adequate level of data protection may be assumed on the basis of the adequacy decision pursuant to Article 45 of the GDPR, provided that the relevant recipient is also registered under the ‘EU-US Data Privacy Framework’. The list of registered organisations can be viewed at https://www.dataprivacyframework.gov/s/. However, US investigative authorities, amongst others, may, under certain circumstances, gain access to this data without us or the organisations behind the services used having any control over this. It is therefore not possible to fully guarantee that your data will be subject to the level of data protection required by the GDPR.

C. Data processing when visiting our website

In this section, we inform you about the personal data processing operations that take place when you visit our website.

I. Log files

When you visit our website, the browser you are using on your device automatically sends information to our website’s server. This information is temporarily stored in what is known as a ‘log file’.

1. Data collected

The following information is automatically collected in anonymised form when you vis-it our website and is stored until it is automatically deleted:

the IP address of the requesting computer,
information about the device type (mobile device, desktop computer, etc.), the browser type and version used, and, where applicable, the operating system of your device,
the user’s internet service provider
the date and time of access to our website,
the website from which the user accessed our website (known as the ‘refer-rer URL’),
websites accessed by the user’s system via our website, and
the user’s navigation on our website.

2. Purpose and legal basis

We collect and process “log data” for the following purposes on the following legal basis:

To provide the content of our website to the user, which, amongst other things, requires the temporary storage of the IP address in order to en-able the user’s communication with our website. The legal basis for this data processing – i.e. for the duration of your visit to the website – is Ar-ticle 6(1), first sentence, point (b) of the GDPR. Furthermore, the data processing is based on Article 6(1), first sentence, point (f) of the GDPR (see section B.II.6 ), whereby our legitimate interest arises from the fact that we are able to make the provision of the content possible in the first place.
To ensure a smooth connection and a user-friendly experience on our web-site, to assess system security and stability, and for other administrative purposes. This is achieved by processing and storing the IP address in the log files beyond the scope of the communication process. We also base this on Article 6(1), first sentence, point (f) of the GDPR (see section B.II.6 ).

3. Retention period

The data is deleted once the purpose for which it was collected no longer applies. In the context of providing the content of our website, the data is therefore generally deleted when you leave our pages and the session is thus terminated.

The data recorded in the log file is stored for a maximum of seven days beyond the end of the session for the purposes of system security and stability. Beyond these seven days, any further storage or other processing will, if at all, only take place in such a way that users’ IP addresses are deleted after the expiry of the aforementioned seven-day retention period, or are modified (e.g. through anonymisation or pseudonymisation) in such a way that it is no longer possible to link the log data to an IP address and thus to the user.

4. Right to object

In principle – as we explain in more detail under section E.I – you have the right to object where we rely on legitimate interests. However, as the data processing described above is strictly necessary for the operation of our website, you may only exercise your right to object where your particular circumstances give rise to grounds that preclude processing to the extent described above. As a rule, however, we are able to demonstrate the aforementioned absolute necessity of the data processing.

5. Data security

During your visit to the website, we use the widely adopted SSL (Secure Socket Lay-er) protocol in conjunction with the highest level of encryption supported by your browser. This is usually 256-bit encryption. If your browser does not support 256-bit encryption, we will use 128-bit v3 technology instead. You can tell whether a particular page on our website is being transmitted in encrypted form by the closed key or padlock symbol displayed in the status bar at the bottom of your browser.

We have implemented appropriate technical and organisational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

II. Content Delivery Network (Cloudflare)

We use the service provided by Cloudflare (Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C – 8th floor, 81671 Munich) as a Content Delivery Network (CDN). A CDN temporarily stores content using geographically distributed groups of servers and enables the rapid transfer of resources required to load web content. In doing so, Cloudflare processes technical access data (e.g. IP address, date and time, pages accessed, header information).

1. Purpose and legal basis

We use Cloudflare to protect our website against DDoS attacks and other security risks. This is carried out on the basis of our legitimate interest in the secure and sta-ble provision of our online services (Article 6(1)(f) of the GDPR).

2. Use of cookies in the event of suspicious access attempts

As a rule, Cloudflare does not set any cookies. However, in the event of suspicious access attempts, technically necessary cookies may be stored as part of security checks (e.g. CAPTCHA challenges).

Where personal data is transferred to the USA, this is done on the basis of appropri-ate safeguards in accordance with Article 44 et seq. of the GDPR, in particular the EU-US Data Privacy Framework or standard contractual clauses. Please refer to our information on this at B.V. . Cloudflare is registered under the ‘EU-US Data Privacy Framework’; in addition, we enter into standard contractual clauses.

III. Storyblok (content management system)

1. Purpose

We use the headless content management system Storyblok provided by Storyblok GmbH, Dreifaltigkeitsgasse 9, 4020 Linz, Austria (hereinafter “Storyblok”). Storyblok serves as our content management system for maintaining and publishing the con-tent on our website. When our website is accessed, loads the user’s browser content (e.g. text, images) via the Storyblok Content Delivery API. In doing so, access data is transmitted to Storyblok as technically necessary. The legal basis is Article 6(1)(f) of the GDPR (legitimate interest in the stable and efficient provision of website con-tent).

2. Data collected

When content is retrieved via the Storyblok API, technical access data is transmitted, in particular: IP address, date and time of access, content accessed, HTTP status code, browser and operating system version. Storyblok stores this data in the form of server logs.

3. Retention period

Storyblok typically stores server logs for 30 days. For further information on data processing by Storyblok, please refer to the privacy policy at https://www.storyblok.com/legal/privacy-policy.

IV. Use of a consent management tool (‘Cookiebot’)

As part of the operation of our website, we use a consent management tool to man-age our cookies. The use of this tool gives you the proactive option to decide for yourself to what extent you wish to make use of our website by giving your consent to the use of cookies (see the following section C.III ) (full use of the website), de-cline to do so (partial use of the website) and/or object to the use of any cookies (re-stricted use of the website).

This tool collects and stores information on our behalf regarding the decision you made at a specific point in time and allows you to revise your decision. Data relating to the device you are using and associated data (e.g. the truncated IP address) are also stored.

1. Purpose and legal basis

By using the CookieBot, our aim is to be able to provide evidence of your decision regarding cookies. This also includes recording the time at which consent was given. The legal basis for this type of consent management is Article 6(1), first sentence, point (f) of the GDPR. We have a legitimate interest in being able to document existing consents or, where applicable, objections in a legally compliant and verifiable manner.

2. Retention period

Where you give your consent, we will store this information until we have fully com-plied with our accountability obligations and any limitation periods (usually three years) have expired. The consent management cookie itself has a duration of 30 days.

3. Option to object and withdraw consent

You can withdraw your consent or object to processing at any time by accessing the ‘Settings’ section, tapping the fingerprint icon and then ticking the relevant checkbox.

V. Cookies

As already stated in our Cookie Bot, we use cookies on our website. Cookies are small text files that your browser automatically creates and stores on your device (PC, laptop, tablet, smartphone, etc.) when you visit our website. Cookies contain in-formation that enables the browser to be uniquely identified when the same website is visited again. We do not gain direct knowledge of your identity through the setting of cookies; however, depending on the type of cookie placed and the possibility of linking a cookie to an IP address, it is in principle possible to establish a personal link to the user.

We generally distinguish between two types of cookies:

Essential cookies, which are necessary to display and provide the services and information you have requested (in the best possible way), such as language settings, shopping basket and/or login functions.
Optional cookies, which track and, where applicable, analyse user behaviour on our websites and across website or device boundaries (i.e. across different domains of different providers), store this information in a cookie on your device and, where applicable, make it available for retrieval by web applications.

1. Purpose and legal basis

The use of essential cookies serves to enable the provision of our website and the full use of our services, and to make your experience more pleasant. Features such as language settings, a shopping basket and the like would not be possible without the use of these cookies.

We also use optional cookies to collect statistical data on the use of our website and to analyse users’ browsing behaviour on our website. This helps us to optimise our services as well as the quality of our website and its content. Through these analytics cookies, we learn how the website is used and can thus continuously optimise our services. This enables us to tailor our services to the preferences of our user base – for example, through market research – and to design them to meet specific needs. The data collected in this way about users is pseudonymised through technical measures. We are therefore no longer able to link the data to the specific user accessing the site; however, the companies whose tools we use when employing cook-ies (such as Google) may be able to link and identify the user more clearly (We pro-vide further details on this in connection with the tools used) .

The legal basis for the use of our cookies in relation to the provision of our website and the full use of our services is Article 6(1), first sentence, point (b) of the GDPR, insofar as their use is strictly necessary for the performance of a contract or for the implementation of pre-contractual measures (such as the shopping basket function). Where we pursue other functional purposes (such as an appealing design, etc.) and access to your device is required for this, we require your consent in accordance with Section 25(1) of the German Telemedia Act (TTDSG) for the initial access to your device and for any subsequent data processing in accordance with Article 6(1), first sentence, point (a) of the GDPR.

Where we analyse our users’ browsing behaviour using optional cookies and, in some cases, rely on third-party software to do so, we rely on the consent you have previously given. We obtain your consent for the initial access to your device in accordance with Section 25(1) of the TTDSG and for the subsequent processing of the data in accordance with Article 6(1), first sentence, point (a) of the GDPR. Naturally, we will refrain from these types of data processing if you have not given your con-sent or have withdrawn your previously given consent.

2. retention period

Session cookies are stored by your browser only for the duration of your browsing session and are deleted when you close your browser. Optional cookies remain stored on the device you are using for a longer period.

3. Right to object and option to delete

When you accessed our website, you were informed about the use of cookies and referred to this privacy policy. You were asked to give your consent to the use of op-tional cookies. You may withdraw any consent you have given at any time (section E.II). You can exercise your right to withdraw consent by accessing the cookie widget and ticking the relevant checkbox.

As a user, you can also use technical settings to decide for yourself whether and how cookies are used or stored by your browser. You can configure your browser so that no cookies are stored on your computer or so that a notification always appears before a new cookie is created. You can delete cookies that have already been created or have your browser delete them automatically. However, completely disabling cookies may mean that you are unable to use all the features of our website.

VI. Web analytics services

Provided that, when accessing our website, you have given your consent to this via the Consent Management Tool in accordance with the legal bases set out in Article 6(1), first sentence, point (a) of the GDPR and Section 25(1) of the TTDSG (see Section B.II.1), we use analytics tools on our website, i.e. tools for so-called web analytics. These collect information, for example, on user behaviour on our websites as well as technical details, such as the extent to which new technologies are used and the reach of our services. Please note that you have the right to withdraw your consent (Section F.II ), which you can also exercise via the Consent Management Tool.

Where we use services that also process personal data on servers in the USA (here-inafter referred to as ‘US services’), we ask you to take note of our explanations re-garding the level of data protection in section B.V and the associated risks. If you have given your consent whilst taking these risks into account, your consent ex-pressly implies that you are aware of and accept these risks.

The following analytics tools are used on our websites:

1. Google Tag Manager (US service)

a) Purpose

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a tag management system that enables us to centrally manage and integrate tracking tags and other code snip-pets on our website without direct changes having to make to the source code. Tags in Google Tag Manager are small code snippets (e.g. JavaScript or tracking pixels) from analytics or marketing tools. They collect data on user behaviour on your website and send this to Google. The tool triggers other tags, which in turn may collect data. Google Tag Manager itself does not access personal data. The tools loaded via Google Tag Manager, in particular Google Analytics 4, Microsoft Clarity and other services, are described in the following sections. The legal basis for the use of Google Tag Manager is Article 6(1)(f) of the GDPR (legitimate interest in efficient and uniform tag management).

b) Recipients of the data and transfers to third countries

Technical access data (in particular the IP address) is transmitted to Google’s serv-ers in the USA when the Tag Manager script is loaded. Google is certified under the EU-US Data Privacy Framework; in addition, we enter into EU Standard Contractual Clauses in accordance with Article 46(2)(c) of the GDPR. Please refer to our general information on transfers to third countries in Section B.V.

c) Right to object

As Google Tag Manager is used exclusively for the technical management of tags and does not collect any personal data of its own, no separate right to object is provided for. You can withdraw your consent to the data processing carried out by the services triggered via the Tag Manager via our Consent Management Tool.

d) Server-side tagging

We serve tags via serverside tagging, i.e. users’ tracking data is not sent directly from the browser to third-party providers such as Google or Meta, but first passes through our own server (e.g. Google Tag Manager). There, it is anonymised, enriched and only then processed further.

2. Google Analytics (US service)

a) Purpose

For the purposes of analysis, as well as the needs-based design and ongoing optimi-sation of our website, we use Google Analytics 4 (GA4) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GA4 is the latest genera-tion of Google’s web analytics service and operates on an event-based rather than session-based basis. No persistent cookies are used to identify users; instead, GA4 uses so-called ‘cookieless measurement’ based on algorithmically derived identifiers.

We have enabled IP anonymisation (IP masking) in GA4. Data is collected exclusive-ly where consent has been given via our Consent Management Tool. Legal basis: Ar-ticle 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG. Further information on data processing by Google: https://support.google.com/analytics/answer/6004245.Google Analytics uses cookies (see section C.II ), which enable an analysis of website usage by creating pseudon-ymous user profiles of our customers.

We use Google Analytics to analyse data from AdWords and the DoubleClick cookie for statistical purposes. If you do not wish this to happen, you can disable it via the Ads Preferences Manager ( http://www.google.com/settings/ads/onweb/?hl=en ).

b) Recipients of the data

As Google exchanges data with us in the manner described above, Google is also a recipient of the data. We cannot rule out the possibility that the information generat-ed by the cookie (such as browser type, operating system, IP address, etc.) regard-ing your use of the website may be transmitted by Google to a server in the USA and stored there. If this is the case, your IP address will be truncated and anonymised by Google within the Member States of the European Union or in other signatory states to the Agreement on the European Economic Area prior to transmission (socalled ‘IP masking’). Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.

We are jointly responsible with Google for the entire data processing chain (Article 26 of the GDPR). Data collection on the website is initially carried out by us; the website then transmits the collected data to Google via the relevant tool. When you visit the website, Google receives the information that you have accessed the relevant page of our website. The data is transmitted to Google regardless of whether you have a Google user account through which you are logged in or not. If you are logged in to Google, your data will be directly associated with your account. If you do not wish this to happen, you must log out before clicking the button. Once the data has been transmitted, Google is solely responsible for its further processing. Google uses the aforementioned information to analyse website usage on our behalf, to compile re-ports on website activity, and to provide other services relating to website and internet usage for the purposes of market research and the needs-based design of these websites. Google also pursues its own purposes in doing so; where applicable, this information may be transferred to third parties where required by law or where third parties process this data on Google’s behalf. Where applicable, Google may also combine data from its own other sources with your data, meaning that Google can identify you even despite IP masking. Further information on data processing by Google can be found at https://support.google.com/analytics/answer/6004245?sjid=9484776245034955392-EU.

We have entered into an agreement with Google under which you may exercise your data subject rights in relation to this processing operation both with us and with Google. Should the exercise of your rights relate to a data processing operation falling within the remit of the other joint controller, we will forward your request accordingly to ensure that your rights are safeguarded.

3. Google AdWords Conversion Tracking (US service)

a) Purpose

In order to collect statistical data on the use of our website and to optimise our web-site (including the aim of marketing our products in a more targeted and needs-based manner and to increase marketing efforts overall), we also use Google Con-version Tracking provided by Google, a company based in Ireland (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4; hereinafter ‘Google’). In this process, Google AdWords places a cookie (see section C.II ) on your computer, provid-ed you have accessed our website via a Google advert.

These cookies store, amongst other things, the IP address and data relating to the user’s behaviour. If the user visits certain pages on the AdWords client’s website and the cookie has not yet expired, Google and the client can recognise that the user clicked on the advert and was redirected to that page. Furthermore, we can track whether and which website activities led to a ‘conversion’ (successful marketing). Each AdWords client is assigned a different cookie. Cookies cannot therefore be tracked across the websites of different AdWords clients. The information collected via the conversion cookie is used to generate conversion statistics for AdWords cli-ents who have opted for conversion tracking. AdWords customers – including us – are informed of the total number of users who clicked on their advert and were redi-rected to a page tagged with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. These cookies expire after 30 days and are not used for personal identification.

b) Recipients of the data

As Google exchanges data with us in the manner described above, Google is also a recipient of the data. We cannot rule out the possibility that the information generated by the cookie (such as browser type, operating system, IP address, etc.) regarding your use of the website may be transmitted by Google to a server in the USA and stored there. If this is the case, your IP address will be truncated and anonymised by Google within the Member States of the European Union or in other signatory states to the Agreement on the European Economic Area prior to transmission (so-called ‘IP masking’). Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.

We are jointly responsible with Google for the entire data processing chain (Article 26 of the GDPR). Data collection on the website is initially carried out by us; the website then transmits the collected data to Google via the relevant tool. When you visit the website, Google receives the information that you have accessed the relevant page of our website. The data is transmitted to Google regardless of whether you have a Google user account through which you are logged in or not. If you are logged in to Google, your data will be directly associated with your account. If you do not wish this to happen, you must log out before clicking the button. Once the data has been transmitted, Google is solely responsible for its further processing. Google uses the aforementioned information to analyse website usage on our behalf, to compile re-ports on website activity, and to provide other services relating to website and inter-net usage for the purposes of market research and the needs-based design of these websites. Google also pursues its own purposes in doing so; where applicable, this information may be transferred to third parties where required by law or where third parties process this data on Google’s behalf. Where applicable, Google may also combine data from its own other sources with your data, meaning that Google can identify you even despite IP masking. Further information on data processing by Google can be found at https://support.google.com/analytics/answer/6004245?sjid=9484776245034955392-EU.

We have entered into an agreement with Google under which you may exercise your data subject rights in relation to this processing activity both against us and against Google. Should the exercise of your rights relate to a data processing operation falling within the remit of the other joint controller, we will forward your request accordingly to ensure that your rights are safeguarded.

4. Google Ads and Google Remarketing (US service)

We use the remarketing technology provided by Google, a company based in Ireland (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4; hereinafter ‘Google’), which is an additional feature of Google Analytics. Users who have previously visited our website and/or our online services and shown an interest in our offering are targeted again with tailored advertising on websites within the Google Partner Network. The display of these adverts is facilitated through the use of cookies. Cookies enable us to analyse user behaviour whilst visiting the website and sub-sequently use this information for targeted product recommendations and interestbased advertising.

a) Purpose

This tool is used to market our products and services. If you do not wish to receive interest-based advertising, you can disable the use of cookies by Google for these purposes by visiting https://www.google.de/settings/ads/onweb. Alternatively, users can opt out of third-party cookies by visiting the Network Advertising Initiative’s opt-out page at http://optout.networkadvertising.org/?c=1.

b) Recipients of the data

As Google exchanges data with us in the manner described above, Google is also a recipient of the data. We cannot rule out the possibility that the information generat-ed by the cookie (such as browser type, operating system, IP address, etc.) regard-ing your use of the website may be transmitted by Google to a server in the USA and stored there. If this is the case, your IP address will be truncated and anonymised by Google within the Member States of the European Union or in other signatory states to the Agreement on the European Economic Area prior to transmission (so-called ‘IP masking’). Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.

We are jointly responsible with Google for the entire data processing chain (Article 26 of the GDPR). Data is initially collected on the website by us; the website then transmits the collected data to Google via the relevant tool. When you visit the web-site, Google receives information that you have accessed the relevant page on our website. The data is transmitted to Google regardless of whether you have a Google user account through which you are logged in or not. If you are logged in to Google, your data will be linked directly to your account. If you do not wish this to happen, you must log out before clicking the button. Once the data has been transmitted, Google is solely responsible for its further processing. Google uses the aforemen-tioned information to analyse website usage on our behalf, to compile reports on website activity, and to provide other services relating to website and internet usage for the purposes of market research and the needs-based design of these websites. Google also pursues its own purposes in doing so; where applicable, this information may be transferred to third parties where required by law or where third parties pro-cess this data on Google’s behalf. Where applicable, Google may also combine data from its own other sources with your data, meaning that Google can identify you even despite IP masking. Further information on data processing by Google can be found at https://support.google.com/analytics/answer/6004245?sjid=9484776245034955392-EU.

5. Google Reviews

We use the website features for displaying Google reviews (“Google Reviews”) provided by Google, a company based in Ireland (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4; hereinafter “Google”), provided that you give your consent via our Consent Management Tool.

a) Purpose

The integration of Google Reviews serves to display customer reviews and thereby strengthen trust in our services.

b) Recipients of the data

As a connection to Google’s servers is established when you visit our page featuring integrated Google Reviews, Google is also the recipient of the data. We cannot rule out the possibility that the information generated by the cookie (e.g. browser type, operating system, IP address, etc.) regarding your use of the website may be transmitted by Google to a server in the USA and stored there.

We have entered into an agreement with Google under which you may exercise your data subject rights in relation to this processing chain both vis-à-vis us and vis-à-vis Google. Should the exercise of your rights relate to a data processing operation fall-ing within the remit of the other joint controller, we will forward your request accord-ingly to ensure that your rights are safeguarded. Further information on data pro-cessing by Google can be found at https://policies.google.com/privacy?hl=en.

6. Microsoft Clarity (US service)

a) Purpose

We use Microsoft Clarity, provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA, on our website. Microsoft Clarity is a analytics tool user behaviourthat enables us to understand how visitors interact with our website through so-called heatmaps, session recordings and click analyses. The aim is to continuously improve the user experience and website design. Microsoft Clarity is only used if you have given your consent via our consent management tool. The legal basis is Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG.

b) Data collected

Microsoft Clarity collects, amongst other things: IP address (anonymised), click and scroll behaviour, mouse movements, page views, browser and device information, session duration and – in the form of session recordings – an anonymised record of user interaction. Personal data (passwords, payment details) is automatically masked by Microsoft Clarity and is not recorded. We use the functions provided by Microsoft for masking sensitive content (e.g. in form fields) to enhance the protection of personal data.

c) Recipients of the data and transfers to third countries

The data collected is transferred to Microsoft servers in the USA. Microsoft is certi-fied under the EU-US Data Privacy Framework; in addition, we enter into EU Stand-ard Contractual Clauses in accordance with Article 46(2)(c) of the GDPR. Further in-formation can be found in Microsoft’s privacy policy at https://privacy.microsoft.com/de-de/privacystatement as well as at https://clarity.microsoft.com/terms, https://learn.microsoft.com/en-us/clarity/setup-and-installation/cookie-list, and https://learn.microsoft.com/en-us/clarity/faq#privacy.

d) Retention period and right to object

Session recordings and heatmap data are stored for 13 months. You can withdraw your consent at any time via our Consent Management Tool. Alternatively, you can disable recording by Microsoft Clarity at https://clarity.microsoft.com/opt-out.

7. Trustpilot

We use widgets and content from the Trustpilot review service, operated by Trustpi-lot A/S, Pilestræde 58, 1112 Copenhagen, Denmark (“Trustpilot”), on our website, provided that you give your consent via our Consent Management Tool.

When a page containing a Trustpilot widget is accessed, a connection is established with Trustpilot’s servers. In the process, personal data such as the IP address and browser information is transmitted.

a) Purpose

The integration of Trustpilot serves to display customer reviews and thereby strengthen confidence in our offering.

b) Recipients of the data

As a connection to Trustpilot’s servers is established when you visit our page featur-ing embedded Trustpilot reviews, Trustpilot is also the recipient of the data.

Where Trustpilot requests a review from you and collects the review on our behalf, Trustpilot acts as a data processor with whom we have entered into a data pro-cessing agreement. As soon as you register an account with Trustpilot as part of the review process, Trustpilot acts as a separate data controller in relation to your ac-count. Further information on this division of responsibilities can be found at https://help.trustpilot.com/s/article/Is-Trustpilot-a-data-processor-or-data-controller?language=en_US. Further details can also be found in Trustpilot’s privacy poli-cy at https://corporate.trustpilot.com/legal/for-reviewers/privacy-policy-end-user/jun-2026.

8. Adcell

We use the Adcell affiliate marketing network operated by Firstlead GmbH, Rosenfelder Str. 15–16, 10315 Berlin (‘Adcell’), to promote our products or services via affiliate links. If you give your consent, we may use cookies to measure the success of online advertising (known as ‘conversion’) via the affiliate marketing network. To this end, usage data relating to the website and clicks on individual elements are logged.

a) Purpose

The aim is to acquire new customers through performance-based online advertising and to reward successful online marketing campaigns. Furthermore, the aim is to analyse how successfully online marketing measures are being implemented.

b) Recipients of the data

Data is received by our partners in the affiliate marketing network as well as by Adcell itself.

VII. Social media presence

We have included links to social media platforms such as Facebook, Instagram and YouTube on our website. When clicked, these links will take you to our respective company pages on these social media platforms. By including these links and main-taining our presence on these platforms, we aim to raise awareness of our company through these networks.

You can access our social media profiles via the relevant link (indicated by icons) on our website. In this case, the social media platforms may link the IP address of your browser session to your own profile on the respective social media platform via one of their cookies.

Where we use services that also process personal data on servers in the USA (hereinafter referred to as ‘US services’), we ask you to take note of our explanations regarding the level of data protection in section B.V and the associated risks. If you have given your consent whilst taking these risks into account, your consent expressly implies that you are aware of and accept these risks.

1. Facebook and Instagram (US service)

We maintain a presence on the social networks Facebook and Instagram, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: ‘Meta’). As a result, Meta initially receives, amongst other things, the information that you have visited our site using your IP address.

a) Data processing and responsibilities

Meta generally uses the aforementioned information under its own responsibility to analyse the use of the website, to compile reports on website activity, and to provide further services related to website and internet usage for the purposes of market re-search and the needs-based design of these websites. Where applicable, this infor-mation may be transferred to third parties where required by law or where third par-ties process this data on Meta’s behalf. Where applicable, Meta may also combine your data with data from its own other sources.

For further details on the purpose and scope of data collection, as well as the further processing and use of the data by Meta, and your rights and settings options regard-ing the protection of your privacy, please also refer to Meta’s privacy policy (https://www.facebook.com/about/privacy/).

Data processing takes place as soon as you access our profile on Meta (‘Facebook page’ or ‘Instagram page’) via the relevant link on our website. When you access our respective Meta profile, Meta may process data stored in cookies, as well as any log data originating from our website that is transmitted to Meta. However, when you vis-it our profile, Meta primarily processes data relating to how and whether you have in-teracted with our profile (for example, posts, follows, etc.). If you are also a member of the relevant Meta social networks, Meta processes the data you have already provided (e.g. name, age, gender, etc.), compiles analyses and statistics, and then makes these available to us in aggregated form. This aggregated data does not allow for identification of individuals. Meta refers to this as ‘Page Insights’. Further infor-mation on this can be found at https://www.facebook.com/privacy/policy?section_id=0-WhatIsThePrivacy.

We are jointly responsible with Meta for the “Page Insights” data processing described above (Article 26 of the GDPR). We have transparently set out the obliga-tions and rights regarding data processing in an agreement with Meta, which is avail-able at https://www.facebook.com/legal/controller_addendum. From this, you can see that Meta has also primarily taken on the task of addressing your data subject rights (see section F ), should you wish to exercise them. You can do this easily via your profile settings on Meta or by contacting them directly. You are also free to con-tact us regarding your data subject rights. However, please note that, as we do not have insight into the specific data processing involved, we will generally forward your enquiry to Meta.

The data processing associated with ‘Page Insights’ (such as the use of aggregated statistics and analyses) is carried out by us under our own responsibility. Similarly, we are solely responsible for the use and further processing of your personal and publicly visible interactions on our profile page (e.g. likes, posts, sharing of posts, etc.) as well as for any contact made with us. Meta is solely responsible for all data processing carried out outside of ‘Page Insights’.

b) Purpose and legal basis

We operate our profiles on Meta in order to present our services in an appealing way and to ensure they reach a suitable audience.

The analytics services provided by ‘Page Insights’ serve to generate aggregated sta-tistics for us. This enables us to better understand our visitors and customers and to improve our offering. We can also use this data (which is not personally identifiable) to tailor our advertising to specific target groups.

We base this processing on the consent you have given (to Meta) (Article 6(1)(a) of the GDPR).

Where we communicate with you on our own behalf, the processing serves to re-spond to enquiries, prepare for the conclusion of a contract and, where applicable, even to execute it (Article 6(1), first sentence, point (b) of the GDPR), as is the case with other instances of establishing contact (see section C.VIII ). Any other use is based on legitimate interests (Article 6(1), first sentence, point (f) of the GDPR), which lie in our ability to improve our offers and services in a manner tailored to specific target groups. Please note your right to withdraw consent with regard to the processing of personal data which we base on our legitimate interests (see F.I.1 ).

c) Data transfers to the USA

Some data processing also takes place in the USA. The USA is a third country (for the definition of this term and further explanations, see section B.V ), for which the European Commission has issued an adequacy decision. Meta is registered under the EU-US Data Privacy Framework.

2. YouTube channel (US service)

We maintain a presence (‘YouTube channel’) on the video-hosting platform YouTube, a service provided by Google, a company based in Ireland (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4; hereinafter ‘Google’).

When you access YouTube via our website, the data we have already mentioned under section C.I.1 is transferred to YouTube. If you have a user account with YouTube or Google and are logged in whilst visiting our website, the data will also be linked to your user account. You can prevent this by logging out of YouTube and/or Google before playing the video.

a) Data processing and responsibilities

If you access our website via the link, the data mentioned in section I.1 is transmitted to YouTube. If you have a user account with YouTube or Google and are logged in whilst visiting our website, the data will also be linked to your user account. You can prevent this by logging out of YouTube and/or Google before playing the video.

Provided you give your consent to Google (by agreeing to the setting of cookies when accessing YouTube), Google uses the aforementioned information to analyse the use of the website, to compile reports on website activity and to provide other services relating to website and internet usage for the purposes of market research and the needs-based design of these websites. Where applicable, this information may be transferred to third parties where required by law or where third parties process this data on Google’s behalf. Where applicable, Google may also combine your data with data from its own other sources. If you would like to know more about the purpose and scope of data collection, as well as your rights and technical options for managing your settings, you can view Google’s privacy policy at: https://policies.google.com/privacy?hl=de

However, when you visit our channel, Google/YouTube primarily processes data on how and whether you have interacted with our channel (for example, videos viewed, viewer engagement, click-through rate, target audience, etc.). If you have a YouTube account and visit our channel whilst logged in, the data you have already provided to YouTube (e.g. name, age, gender, etc.) is also included in the analyses and statistics described above. YouTube then provides us with all this data in aggregated (summarised, anonymised and condensed) form. This aggregated data does not allow for any personal identification. YouTube refers to this as ‘YouTube Analytics’. Further in-formation and the data we can access are summarised and explained at https://support.google.com/youtube/answer/9002587?hl=de&ref_topic=9313691&sjid=15447359475380143902-EU.

We are jointly responsible with YouTube or Google for the ‘YouTube Analytics’ data processing described above (Article 26 of the GDPR). We have transparently set out the obligations and rights regarding data processing in a contract with Google, which is available here:

https://support.google.com/analytics/answer/9012600?hl=en

From this, you can see that Google has also primarily assumed the responsibility for addressing your data subject rights (see section F ), should you wish to exercise them. You can do this easily via your profile settings on Facebook or by contacting them directly. You are also free to contact us regarding your data subject rights. However, please note that, as we do not have insight into the specific data processing involved, we will generally forward your enquiry to Google.

The data processing associated with ‘YouTube Analytics’ (such as the use of aggre-gated statistics and analyses) is carried out by us under our own responsibility. We are also solely responsible for the use and further processing of your personal and publicly visible interactions on our channel page (e.g. likes, posts, sharing of content, etc.) as well as for any contact made with us.

YouTube is solely responsible for all data processing carried out outside the scope of ‘YouTube Analytics’.

b) Purpose and legal basis

We operate our YouTube channel in order to present our services in an appealing way and to ensure they reach a suitable audience.

The analytics services provided by ‘YouTube Analytics’ serve to generate aggregated statistics for us. This enables us to better understand our visitors and customers and to improve our offering. We can also use this data (which is not personally identifiable) to tailor our advertising to specific target groups.

We base this processing on the consent you have given (to Google) (Article 6(1), first sentence, point (a) of the GDPR).

3. LinkedIn (US service)

We maintain a presence on the social network LinkedIn. This service is provided by LinkedIn Ireland Limited, 77 Sir John Rogerson’s Quay, Dublin 2, Ireland. We also maintain our own profile on LinkedIn, which you can access via the link on our website.

a) Data processing and responsibilities

Data processing takes place as soon as you visit our LinkedIn profile. When you visit our LinkedIn profile, LinkedIn may process data stored in cookies, as well as any log data originating from our website that is transmitted to LinkedIn. However, when you visit our profile, LinkedIn primarily processes data relating to how and whether you have interacted with our profile (for example, posts, follows, etc.).

If you are also a member of the LinkedIn social network, LinkedIn processes the data you have already provided (e.g. job title, country, sector, length of service, com-pany size and employment status), compiles analyses and statistics, and then makes these available to us in aggregated form. This aggregated data does not allow for identification of individuals. LinkedIn refers to this as ‘Page Insights’. Further infor-mation on this can be found at (https://www.linkedin.com/help/linkedin/answer/4499/linkedin-page-analytics-overview?lang=en).

We are jointly responsible with LinkedIn for the “Page Insights” data processing de-scribed above (Article 26 of the GDPR). We have transparently set out the obliga-tions and rights regarding this data processing in an agreement with LinkedIn (“Page Insights Joint Controller Addendum”), which is available at https://legal.linkedin.com/pages-joint-controller-addendum.

From this, you can see that LinkedIn has also primarily assumed the responsibility for addressing your data subject rights (see section F ), should you wish to exercise them. You can do this easily via your profile settings on LinkedIn or by contacting them directly. You are also free to contact us regarding your data subject rights. However, please note that, as we do not have insight into the specific data pro-cessing involved, we will generally forward your enquiry to LinkedIn.

The data processing activities associated with ‘Page Insights’ (such as the use of ag-gregated statistics and analyses) are carried out by us under our own responsibility. Similarly, we are solely responsible for the use and further processing of your per-sonal and publicly visible interactions on our profile page (e.g. likes, posts, sharing of posts, etc.) as well as for any contact made with us.

b) Purpose and legal basis

We use the plug-in on our website to draw attention to our LinkedIn profile and to enable you to use the functions of the LinkedIn social network directly.

We maintain our LinkedIn profile in order to present our services in an appealing way and to ensure they reach a suitable audience.

The analytics services provided by ‘Page Insights’ are used to generate aggregated statistics for us. This enables us to better understand our visitors and customers and to improve our offering. We can also use this data (which does not contain any per-sonal references) to tailor our advertising to specific target groups.

We base this processing on the consent you have given (to LinkedIn) (Article 6(1)(a) of the GDPR).

c) Retention period

The storage of personal data by us when you contact us is carried out in accordance with the general rules (see B.III ).

For the retention period of data processed by LinkedIn, please refer to LinkedIn’s privacy policy (see the link provided above).

4. Xing

Functions and services of the social network ‘Xing’ are integrated into our website. These are provided by New Work SE, Baumwall 7, 20459 Hamburg.

a) Data processing and responsibilities

Data processing takes place as soon as you access our Xing profile via the relevant link on our website, marked by a Xing icon (plug-in). When you access our Xing profile, Xing may process data stored in cookies, as well as any log data originating from our website and transmitted to Xing.

However, when you visit our profile, Xing primarily processes data on how and whether you have interacted with our profile (for example, posts, follows, etc.).

If you are also a member of the Xing social network, Xing processes the data you have already provided (e.g. job title, country, sector, length of service, company size and employment status), compiles analyses and statistics, and then makes these available to us in aggregated form. In doing so, Xing utilises additional analytics services (e.g. Adobe Digital Analytics, Google Analytics, etc.). This aggregated data does not allow us to identify any specific individuals.

We are jointly responsible with LinkedIn for the data processing described above (Ar-ticle 26 of the GDPR). We have transparently set out the obligations and rights regarding data processing in a contract with Xing.

Xing is also primarily responsible for addressing your data subject rights (see Section F), should you wish to exercise them. You can do this easily via your profile settings on Xing or by contacting Xing directly. You are also free to contact us regarding your data subject rights. However, please note that, as we do not have insight into the specific data processing involved, we will generally forward your enquiry to Xing.

We carry out the subsequent data processing described above (such as the use of aggregated statistics and analyses) on our own responsibility. We are also solely responsible for the use and further processing of your personal and publicly visible interactions on our profile page (e.g. likes, posts, sharing of posts, etc.) as well as for any contact made with us.

When you activate and use the plug-in, your browser establishes a direct connection to Xing’s servers. The content of the plug-in is transmitted directly from Xing to your browser and integrated into the website by your browser. By activating the plug-in, Xing receives the information that you have accessed the relevant page on our website.

If you are logged in to Xing, Xing can associate your visit with your Xing account. For details of the purpose and scope of data collection, as well as the further processing and use of the data by Xing, and your rights in this regard and the settings available to protect your privacy, please refer to Xing’s privacy policy at https://privacy.xing.com/de/datenschutzerklaerung.

For further information, please feel free to consult Xing’s privacy policy, where you will also find details on how to disable certain tracking data processing activities: https://privacy.xing.com/de/datenschutzerklaerung/druckversion

b) Purpose and legal basis

We use the plug-in on our website to draw attention to our Xing profile and to enable you to use the functions of the Xing social network directly.

We maintain our profile on Xing in order to present our services in an appealing way and to ensure they reach a suitable audience.

Xing’s analytics services are used to generate aggregated statistics for us. This ena-bles us to better understand our visitors and customers and to improve our offering. We can also use this data (which does not contain any personal references) to tailor our advertising to specific target groups.

We base this processing on the consent you have given (to Xing) (Article 6(1), first sentence, point (a) of the GDPR).

Where we communicate with you on our own behalf, the processing serves to re-spond to enquiries, prepare for the conclusion of a contract and, where applicable, even to execute it (Article 6(1), first sentence, point (b) of the GDPR), as is the case with other instances of establishing contact (see section C.VIII ). Any other use is based on legitimate interests (Article 6(1), first sentence, point (f) of the GDPR), which lie in our ability to improve our offers and services in a manner tailored to specific target groups. Please note your right to withdraw consent with regard to the pro-cessing of personal data which we base on our legitimate interests (see F.I.1 ).

c) Retention period

The storage of personal data by us when you contact us is carried out in accordance with the general rules (see B.III ).

Please refer to Xing’s privacy policy (see the link provided above) for the retention period of data processed by LinkedIn.

VIII. Registration / Setting up a user account

We offer the option to register and set up a personal user account on our websites. This is essential for using some of our offers and services. In all cases, the user’s IP address and the date and time of registration are stored as part of the registration and creation of the user account. In addition, we collect and store the following necessary personal data as mandatory information (marked with an “*” as a mandatory field):

Password
Email address
First name, surname, title
Company (where relevant)
Address
Vehicle registration number and country of registration
Vehicle-related data, insofar as this is necessary for toll collection,
Telephone number (optional)

The registration process is only complete once you have filled in the mandatory fields and confirmed the link contained in an email sent by us. You may also provide volun-tary information, such as a telephone number, fax number or mobile number. This information may be used, in particular, to improve our services and enhance customer support. The data will not be passed on to third parties.

1. Purpose and legal basis

The purpose of user registration is to restrict and control access to certain content and services which we make available exclusively to registered users as part of our offerings. The provision of certain content and services to registered users in the context of contract performance and the implementation of pre-contractual measures is also covered by the purpose of registration. We rely on the following legal bases:

Article 6(1), first sentence, point (a) of the GDPR, where the user has con-sented to the processing of their personal data during registration,
Article 6(1), first sentence, point (b) of the GDPR, insofar as registration serves the performance of a contract to which the user is a party, or the implementation of pre-contractual measures, such as when retrieving up-to-date information regarding the order status, and
Article 6(1), first sentence, point (f) of the GDPR, insofar as registration is carried out for the purpose of restricting access and/or access control, as we are safeguarding our legitimate interests; the legitimate interest in this context lies in restricting access to protect the content and infor-mation we have developed.

2. Retention period

If the registration and creation of the user account serve to fulfil a contract or to take steps prior to entering into a contract in accordance with Article 6(1), first sentence, point (b) of the GDPR, we shall store the registration data for as long as the contrac-tual relationship exists and no contractual time limits have expired. In all other cases, we shall store the registration data for as long as the user does not cancel the regis-tration.

The deletion period is subject to any obligations and rights in accordance with section B.III

3. Right to object and right to rectification

As a user, you have the option at any time to cancel your registration and to amend the data you have provided. However, deletion is subject to our previous statements under section B.III .

IX. Newsletters and advertising

We offer you the opportunity to subscribe to our newsletters. We also use other ad-vertising channels.

1. Newsletters

If you wish to subscribe to our newsletter, you thereby give us your express consent to collect your email address, which you provide to us during the registration pro-cess. To verify your identity, we use the so-called ‘double opt-in’ procedure, i.e. upon receipt of your email address, we send an automated email to the address provided, containing a confirmation link. The registration process is only complete once you have confirmed your email address. Apart from your email address and the details required to confirm your registration, we do not collect any further data. Please note that you may withdraw your consent at any time (Section F.II ).

The purpose of data processing is solely to send you the newsletter you have re-quested. The legal basis for this is Article 6(1)(a) of the GDPR (consent) and Article 6(1), first sentence, (b) of the GDPR (performance of a contract). If you unsubscribe from the newsletter, we will delete the data you have provided, subject to any obliga-tions and rights set out in section B.III .

2. Direct advertising and marketing, and customer service

We use your personal data either on the basis of consent previously given by you (Article 6(1), first sentence, point (a) of the GDPR) for the purposes of direct adver-tising and marketing as well as other customer support, which you may withdraw at any time ( F.II ), or on the basis of a legitimate interest (Article 6(1), first sentence, point (f) of the GDPR). In the latter case, our interest lies in improving and marketing our products and services in line with users’ preferences.

Should we carry out direct advertising and marketing, as well as other customer sup-port, by electronic means, we rely on the legal basis of Section 7(3) of the Unfair Competition Act (UWG), provided that we

have received your email address in connection with the sale of a good or service,
you have not objected to the use of your email address for the purposes of direct marketing, and
we clearly inform you, both when collecting your email address and on each occasion it is used, that you may object to such use of your email ad-dress at any time.

You may therefore object at any time, without incurring any costs other than the basic transmission costs, to our data processing, as well as to direct advertising and marketing and other customer service activities (Section F.I.2 ). In this case, please contact us using the contact details provided above.

X. Contact form and email contact

On our website, we offer you the option to contact us via our contact form. In all cases, when you contact us, the user’s IP address and the date and time your mes-sage was sent are stored. We collect and store the following personal data as man-datory information (marked with an “*” as a mandatory field):

First name
Surname
Email
Telephone number (optional)
Postcode (address)
Your message

If you choose to contact us via the email address provided on our website, we will store your email address and any other data you have (voluntarily) provided. This in-formation will only be passed on to third parties if this is necessary to deal with your enquiry.

1. Purpose and legal basis

We process the aforementioned data to deal with your enquiry. Other data is pro-cessed solely for technical or security reasons (for example, to prevent misuse and ensure the security of our systems). The legal basis is Article 6(1), first sentence, point (a) of the GDPR (consent), Article 6(1), first sentence, point (b) of the GDPR (performance of a contract or pre-contractual measures) and, with regard to the lat-ter purpose, Article 6(1), first sentence, point (f) of the GDPR, as we have a legiti-mate interest in the integrity of our website.

2. Retention period

All the aforementioned data will be deleted as soon as we have processed your en-quiry and no further clarification is required. Deletion is subject to any obligations and rights in accordance with section B.III .

3. Right to object and right to erasure

Once you have contacted us, you may withdraw your enquiry at any time and object to the further processing of your data. Furthermore, you may, under certain circum-stances, have a right to object in accordance with Article 21 of the GDPR (see sec-tion F.I.1 ).

XI. Contact by telephone via an AI telephone assistant (‘fonio’)

We use the AI-powered telephone assistant ‘fonio’, provided by fonio GmbH, Joanel-ligasse 5/16, 1060 Vienna, Austria (hereinafter ‘fonio’), to answer and handle incom-ing telephone calls. If you call us, your call may be answered by the AI telephone as-sistant. It records your enquiry in a natural language dialogue, converts your spoken input into text and makes the information captured in this way available to us for fur-ther processing (for example, as a call note, by email or by transferring the call). At the start of the conversation, you will be informed that you are speaking to an AI as-sistant.

1. Data collected

When using the AI telephone assistant, we process the following personal data:

your telephone number, as well as the date, time and duration of the call,
the audio recording of your spoken input and its transcript,
the information you provide during the conversation (e.g. name, contact details and the nature of your enquiry), and
technical connection and metadata, as well as data from call analysis for quality assurance purposes.

We ask that you do not disclose any special categories of personal data within the meaning of Article 9 of the GDPR (e.g. health data) to the AI telephone assistant.

2. Purpose and legal basis

We use the AI telephone assistant to reliably answer your calls – even outside our business hours or during periods of high call volume – to record your enquiry in a structured manner and to process your request promptly.

Insofar as your call serves to initiate, conclude or perform a contract with you, the legal basis is Article 6(1), first sentence, point (b) of the GDPR. In all other respects, the processing is based on Article 6(1), first sentence, point (f) of the GDPR (see section B.II.6 ); our legitimate interest lies in the efficient, consistently accessible and resource-efficient handling of telephone enquiries, as well as in ensuring that we re-main contactable.

3. Recipients of the data and data processing on our behalf

The recipient of the aforementioned data is, first and foremost, fonio, which process-es this data exclusively on our behalf in accordance with our instructions. We have concluded a data processing agreement with fonio in accordance with Article 28 of the GDPR. fonio operates the underlying infrastructure in data centres belonging to Hetzner Online GmbH in Germany (including Nuremberg and Falkenstein). For speech processing (speech-to-text, text-to-speech and language models), fonio en-gages further, carefully selected sub-processors who process data within the EU; according to the provider, a ‘zero-data-retention’ policy applies consistently to audio data, i.e. the audio data is not stored permanently. According to the provider, neither fonio nor its sub-processors use your data for the training, improvement or evalua-tion of AI models.

4. Processing of data in so-called third countries

Where fonio engages sub-processors based in a third country, in particular the USA, for the purposes of speech processing, any transfer takes place only in accordance with the conditions set out in Articles 44 et seq. of the GDPR. An adequate level of data protection is ensured by an adequacy decision of the European Commission pursuant to Article 45 of the GDPR – in the case of the USA, through the ‘EU-US Da-ta Privacy Framework’, provided the relevant recipient is certified – and/or by the conclusion of the EU Standard Contractual Clauses pursuant to Article 46(2)(c) of the GDPR. Please also refer to our comments on processing in third countries under section B.V.

5. Retention period

We store the data collected in connection with your call only for as long as is neces-sary to deal with your enquiry, and subsequently delete it, provided that no statutory retention periods preclude this (see , section B.III). Data stored with fonio is deleted by default no later than six months after the end of the data processing relationship, in accordance with the contractual provisions, unless we issue any other instructions.

6. Right to object and right to erasure

Where we process your data on the basis of Article 6(1), first sentence, point (f) of the GDPR, you have the right to object in accordance with Article 21 of the GDPR (see section F.I.1 ). You can also avoid processing by the AI telephone assistant by contacting us via another available communication channel (e.g. by email or via our contact form) or by requesting that your enquiry be dealt with personally.

D. Online shop

I. Use of our online shop

To use the ordering function of our online shop, we require data to complete the or-dering process. Mandatory data is marked as such; further details are optional. We process the data you provide to fulfil your order. In addition, you may use the pay-ment method of your choice, for which data entry is also required. The legal basis for this is Article 6(1), first sentence, point (b) of the GDPR.

We process user and customer data in accordance with the principles set out above. Furthermore, we draw your attention to the data processing operations carried out within the framework of our contracts (Chapter E ).

II. Provision of data to payment and logistics service providers

In order to process orders, we use service providers for payment and dispatch oper-ations when operating our online shop. The service providers listed below are provid-ed by way of example only, as the data processing operations are generally similar. Furthermore, these service providers operate independently, so we ask you to famil-iarise yourself with the respective privacy policies of our service providers and part-ners.

1. DHL

We use the services of the transport provider DHL (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn). In doing so, we pass on your delivery details (title, first name, surname, country/region, street, house number, postcode, town/city, tel-ephone number (optional), email address, alternative delivery address (optional), comments (optional) and payment method) to DHL, for which we are authorised un-der Article 6(1)(b) of the GDPR. If you give us your consent, we will also provide your email address to DHL for the purpose of tracking the parcel.

For further information, you can also view DHL’s privacy policy at https://www.dhl.de/de/toolbar/footer/datenschutz.html

2. PayPal

We have integrated a PayPal plug-in (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg) to process payments. Payments are pro-cessed via your personal PayPal account.

If you choose PayPal as your payment provider, we will transmit your order details to PayPal, which generally includes your first name, surname, address, email address, IP address, telephone number, mobile number or other data necessary for payment processing that you have provided to us. This is covered by Article 6(1)(b) of the GDPR, as our purpose is to be able to process the order in full.

Please note that PayPal is a separate data controller within the meaning of the GDPR and may, in certain circumstances, pass on data to its own partners. PayPal is also responsible for obtaining consent in the case of certain data transfers (such as for credit checks). For further information, please visit PayPal’s privacy policy at

https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

III. retention

As stated above, we are obliged under commercial and tax law to store your ad-dress, payment and order details for a period of ten years. However, after approxi-mately three years – i.e. once any warranty and other rights have expired – we will restrict the processing of your data. Your data will then only be retained to comply with legal obligations.

IV. Encryption

To prevent unauthorised access by third parties to your personal data, in particular financial data, the ordering process is encrypted.

E. Contracts

If you are our contractual partner, this section provides additional information to our Terms and Conditions and our data processing principles set out at B .

I. Purposes, legal bases and retention periods

Any processing of personal data received in the context of concluding and perform-ing the contract serves, first and foremost, to enable us to fulfil our contractual obli-gations and to provide you with customer service. The legal basis is Article 6(1), first sentence, point (b) of the GDPR. Data will only be disclosed to third parties in ac-cordance with the conditions set out in section B.IV and B.V . In the context of our contracts, categories of recipients include, for example, payment service providers and logistics service providers. Failure on your part to provide the data may result in the contract not being concluded and/or performed.

Where appropriate, we use data for statistical market and opinion research purpos-es, as well as for product development. This is necessary in order to continuously improve our products and services, market them appropriately and adapt them to the needs of our customers. These also constitute legitimate interests pursuant to Article 6(1), first sentence, point (f) of the GDPR. Data is only processed for advertising purposes if you have given your consent in accordance with Article 6(1), first sen-tence, point (a) of the GDPR, or if we can, in turn, assert legitimate interests in ac-cordance with Article 6(1), first sentence, point (f) of the GDPR.

The retention period is in accordance with our data processing principles ( B.III ).

II. Right to object and right to erasure

With regard to the collection and further processing of data based on consent, you have, in particular, the right to withdraw your consent (see section F.II ). Data pro-cessing necessary for the performance of a contract or for the implementation of pre-contractual measures is not subject to any right to object; however, you may ob-ject to data processing carried out on the basis of a legitimate interest under the conditions set out in section F.I.1 . With regard to our direct marketing, we draw your attention to your right to withdraw consent (where consent has been given) in ac-cordance with section F.II and to your right to object in accordance with section F.I.2 . Furthermore, you are entitled to the data subject rights already set out in section F .

F. Your rights as a data subject

If you are affected by our processing of your personal data, you may be entitled to the following rights:

I. Right to object (Art. 21 GDPR)

Where data is processed for specific purposes, you have a right to object in accord-ance with Article 21 of the GDPR. To object to any data processing on our website, you can use our Consent Management Tool. Alternatively, please contact us or our Data Protection Officer using the contact details provided. You will not incur any costs other than the transmission costs charged at your telecoms provider’s stand-ard rates. A right to object applies in the following cases:

1. Processing on the basis of a legitimate interest (Article 6(1), first sen-tence, point (f), and Article 21(1) of the GDPR):

Where personal data is processed to pursue legitimate interests (Article 6(1), first sentence, point (f) of the GDPR), you may object at any time to the processing of your personal data on grounds relating to your particular situation. If you object, we will no longer process your personal data unless we can demonstrate compelling le-gitimate grounds for the processing which override your interests, rights and free-doms as the data subject, or the processing is necessary for the establishment, ex-ercise or defence of legal claims.

2. Processing for the purposes of direct marketing (Article 21(2) of the GDPR, Section 7(3) of the UWG):

Where we process data for the purposes of direct marketing and/or profiling related thereto, you may at any time object to the processing of your personal data for the purposes of such marketing and/or profiling. Upon receipt of your objection, we shall cease all further processing of your data for the purposes of direct marketing and/or profiling.

3. Processing for the performance of a task carried out in the public interest or in the exercise of official authority (Article 6(1), first sentence, point (e), and Article 21(1) of the GDPR):

Where personal data is processed for the performance of a task carried out in the public interest or in the exercise of official authority (Article 6(1), first sentence, point (e) of the GDPR), you may object at any time to the processing of your personal da-ta on grounds relating to your particular situation. If you object, we will no longer pro-cess your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms as the data subject, or the processing is necessary for the establishment, exercise or defence of legal claims.

4. Processing for scientific or historical research purposes or for statistical purposes (Article 21(6)):

Where personal data is processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR, you have the right to object, on grounds relating to your particular situation, to the processing of per-sonal data concerning you, unless the processing is necessary for the performance of a task carried out in the public interest.

II. Right to withdraw consent (Article 7(3) of the GDPR)

You may withdraw your consent at any time, with effect for the future – in full or in part – at no cost, by contacting us using the contact details provided. The lawfulness of the processing of the data covered by the consent carried out on the basis of that consent up to the time of withdrawal remains unaffected by the withdrawal.

III. Right of access (Article 15 of the GDPR)

You have the right to request information about your personal data processed by us. This right to information includes

the purposes of the processing;
the categories of personal data processed by us;
the categories of recipients to whom your data has been or will be disclosed;
in the event of a transfer of personal data to so-called ‘third countries’ (see section B.V ) outside the scope of the GDPR, whether and how we en-sure an adequate level of protection through appropriate safeguards (Articles 45 and 46 of the GDPR) at the data recipient in the third coun-try;
the planned retention period, insofar as we are able to assess this; if it is not yet possible to make a definitive assessment or specify the retention pe-riod, we will at least provide information on the criteria used to deter-mine the retention period (e.g. limitation periods, statutory retention pe-riods; see also section B.III );
Your right to rectification, erasure, restriction of processing and to object to the processing of your personal data (details below);
the right to lodge a complaint with a supervisory authority;
the source of the data, where it was not collected by us; and
the existence of automated decision-making in individual cases within the meaning of Article 22 of the GDPR, including profiling, which also in-cludes details of the decision-making criteria (i.e. the logic used) for the automated decision and the implications and scope for the data subject.

You have the right to request a copy of your personal data processed by us. There is no charge for the first copy of the data; for further copies, we will charge a reasona-ble fee. If you exercise this right, we will, in the absence of any other instructions, generally provide the copy of the data in electronic form. The provision of the data is subject to the rights and freedoms of other individuals who may be adversely affect-ed by the transmission of the copy of the data.

IV. Right to rectification (Art. 16 GDPR)

You have the right to request that we rectify any inaccurate data concerning you without delay. You may also request that we complete any incomplete personal data by means of supplementary statements or information provided by you.

V. Right to erasure (Art. 17 GDPR)

You have the right to request that we erase your personal data stored by us without undue delay, provided that

you have withdrawn your consent (see B.II.1 ) to the processing of your personal data, unless there is another legal basis for the processing;
the storage or other processing of your personal data is no longer necessary for the purposes for which it was collected and processed;
you have objected to data processing in accordance with Article 21 of the GDPR and there are no overriding legitimate grounds for further pro-cessing; in the case of direct marketing pursuant to Article 21(2) of the GDPR, erasure shall take place unconditionally following an objection;
your personal data has been processed unlawfully;
the data relates to a child and was collected in connection with information society services in accordance with Article 8(1) of the GDPR.

Should we have made personal data public, we shall, to the extent technically feasi-ble and reasonable, also inform other controllers of your request for erasure, includ-ing the removal of links, copies and/or replicas.

The aforementioned rights to the erasure of your personal data do not apply insofar as the processing

for the exercise of the right to freedom of expression and information;
is necessary for compliance with a legal obligation which requires processing under Union or Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
is necessary for reasons of public interest in the area of public health in ac-cordance with Article 9(2)(h) and (i) of the GDPR and Article 9(3) of the GDPR;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR, in so far as your right to erasure is likely to render impossible or seriously impair the achievement of the objectives of such processing; or
to establish, exercise or defend legal claims.

VI. Right to restriction of processing (Article 18 of the GDPR)

You have the right to request that we restrict the processing of your personal data (i.e. limiting processing to mere storage) if any of the following applies:

You have contested the accuracy of your personal data. For the duration of our verification of accuracy, you may request that your data not be used for other purposes and that processing be restricted accordingly.
The processing is unlawful and you object to the erasure of the personal da-ta (Article 17(1), first sentence, point (d) of the GDPR) and instead re-quest the restriction of the use of the personal data (Article 18 of the GDPR).
We no longer require the personal data for the purposes of processing, but you require it to establish, exercise or defend legal claims. In this case, you may request that processing be restricted to the aforementioned purposes.
You have objected to the processing in accordance with Article 21(1) of the GDPR. Until it has been determined whether our legitimate interests or grounds for processing outweigh yours, you may require us to process your data solely for the purpose of assessing the aforementioned bal-ancing of interests.

If we have restricted the processing of your personal data at your request, we may and will process this data – apart from its storage – only with your consent or for the purpose of establishing, exercising or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the Union or a Member State.

Should a restriction on processing be lifted, you will be informed of this in advance.

VII. Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provid-ed to us in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, provided that

the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1), first sen-tence, (b) of the GDPR, and
the processing is carried out by automated means.

Where technically feasible, you may also request that we transfer your personal data directly to another controller.

Exercising the right to data portability does not affect the right to erasure (Article 17 of the GDPR). However, the right to data portability does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

You may not exercise the right to data portability if this would adversely affect the rights and freedoms of other individuals.

VIII. Right to lodge a complaint (Article 77 of the GDPR)

We always process personal data in accordance with the law. Should you neverthe-less have reason to believe that we have breached applicable data protection law, you may contact the relevant supervisory authority of the Union or of the Member States at any time and lodge a complaint. The competent supervisory authority is that of your usual place of residence, your place of work or the place where the alleged infringement occurred. The processing of personal data carried out on our behalf as the data controller is supervised by the following supervisory authority:

Bavarian State Office for Data Protection Supervision
Promenade 18
91522 Ansbach

Telephone: +49 (0) 981 180093-0
Email address: poststelle@lda.bayern.de

You can also find a list of all data protection supervisory authorities via the following link:

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html