Table of contents

1. Foreword and Selected Terminology
2. Responsible Party and Data Protection Officer
3. A Brief Overview
4. Legal Basis for Processing Personal Data
5. Your Rights Under the EU Data Protection Regulation
6. External Hosting
7. Automatic Server Log Files
8. Use of Cookies
9. Cookie Consent Management
10. Data Processing in The Context of Communication and Contacting
11. Information for Applicants
12. CRM System Zoho
13. Direct Marketing
14. Appointments with Calendly.Com
15. Audio and Video Conferencing with MS Teams
16. Remote Support with Team Viewer
17. Webinars Via GoToWebinar
18. Training via Reteach
19. Analysis Tools and Advertising
20. Other Plugins and Tools
21. Our Social Media Appearances
22. Supplementary Privacy Information for our Business Partners
23. Overview of Cookies used

1. Preface and selected Terminology

On the one hand, this privacy policy informs visitors and users of our website about the data processing operations that take place online and involve the processing of personal data. On the other hand, you will receive information about our processing operations that do not primarily take place online.

• GDPR is an abbreviation for the European General Data Protection Regulation.
• BDSG is the abbreviation for the Federal Data Protection Act in its current version.
• Personal data are all individual details that allow conclusions to be drawn about a natural person (for definition see Art. 4 (1) GDPR). This includes, for example, names, e-mail addresses, telephone numbers, but also data such as IP addresses or customer numbers.
• The processing of personal data includes all operations, for example the collection, storage, transmission, archiving or deletion of personal data (definition Art. 4 (2) GDPR).
• The data subject within the meaning of data protection law is any natural person from whom personal data is processed.
• Further definitions of terms can be taken from the General Data Protection Regulation, these can be found authoritatively in Art. 4 of the GDPR (Definitions).

2. Responsible Partyand Data Protection Officer

Responsible Party for Data Processing

iqs Software GmbH
Erlenstraße 13c
D-77815 Bühl (Baden)

Telefon: +49 7223 281480
E-Mail: info@iqs.de

Data protection officer required by law

DSB Externer Datenschutzbeauftragter Stuttgart
Fabian Henkel
Diplom-Betriebswirt (FH)
Zertifizierter Datenschutzbeauftragter
Telefon: +49(0)176 32744172
E-Mail: info@externer-datenschutzbeauftragter-stuttgart.de
Web: https://www.externer-datenschutzbeauftragter-stuttgart.de

Joint responsibility within the meaning of Art. 26 GDPR
Within the group of companies, we use various tools together with our partner companies PLATO (Plato GmbH Maria-Goeppert-Straße 15, 23562 Lübeck, Germany) on the basis of our legitimate interests (Art. 6 para. 1lit. f GDPR). We have concluded a joint responsibility agreement with Plato within the meaning of Art. 26 GDPR.
This relates in particular to the shared use of a CRM system Zoho, the webinar platform GoTo Webinar and the chair platform Reteach. All applications are described in the privacy policy below.

3. A brief Overview

The following contents provide you with a brief overview of the processing of personal data; more detailed information can be found in the respective passages presented in detail.

Security on our website (SSL Secure Socket Layer)
Our website is provided with an SSL certificate, with the help of which data transmission processes are encrypted. This happens, for example, when you send us a message via a form. However, as a precaution, we would like to point out that one hundred percent security in electronic data processing is not possible and that there is always a residual risk.

Data that you transmit to us On
this site, we process on the one hand the data that you enter yourself, for example in a form. In this case, the purpose of the processing results from the type of form and, on the other hand, from this privacy policy. Also, if you send us a message by e-mail, for example, or otherwise contact us, we process your data in accordance with the purpose of the contact.

Automatic server log files
On the other hand, our server automatically records all accesses and thus also IP addresses (log files), this serves the defense against attacks, the analysis of access figures and the smooth operation.

Use of cookies
Cookies help us to provide various services, for more information please refer to this privacy policy.

Analysis and Tracking Tools
In addition to the pure server log files, which also provide us with information about page views, we use analysis tools. These tools give us detailed insights about the visited content of our site, the behavior flow and, for example, the country from which access took place. In order for such services to work, cookies must be set on the site visitor or scripts must be executed.

Plugins and Content Delivery Networks
We partly use plugins and content delivery networks, known examples for such services would be the video service Youtube or the map service Google Maps. If such services are integrated via a website, access data is transmitted to the services. This is usually your IP address and other metadata, such as time and date of access. As a rule, the provision takes place through the setting of cookies.

Newsletter / Direct marketing

a) Direct marketing to existing customers in the legitimate interest.
We reserve the right to send newsletters to our customers on the basis of §7 para. 3 UWG in conjunction with Art. 6 para. 1 lit. f GDPR. You can of course object to receiving direct marketing information at any time.

b) Direct marketing on the basis of your consent.
If you give us your consent, we will send you newsletters until you revoke it. You can revoke your consent to us at any time with effect for the future.

Other data recipients

a) Use of order processors
We use order processors in accordance with the requirements of Art. 28 GDPR, for example in the area of IT services, web hosting, e-mail hosting or printing services. These process personal data for us in accordance with instructions.

b) Use of external services
If it is necessary (for example, for the execution of contracts), we pass on your data, for example, to banks, shipping service providers, our tax advisor or lawyer.

c) Legal obligations
In addition, in certain cases we are obliged to make a report to the competent authorities on the basis of the Money Laundering Act. In addition, we are subject to other legal obligations, such as commercial laws or tax law, in this context we must disclose certain data to tax authorities, for example.

d) Clarification of criminal offences
Insofar as it should be necessary for the clarification of a criminal offense, we pass on data to the law enforcement authorities.

General information on deletion periods for personal data
We process data as long as this is necessary for the respective purpose. As far as necessary, we process your personal data for the duration of our business relationship, which also includes the initiation and execution of a contract; in addition, we are obliged to comply with statutory retention obligations. If the data processing is based on your consent, we will delete your data after your revocation.

Transfer of personal data to a third country
If possible, we try to have all service providers and services provided by providers within the European Union. A transfer to a third country is possible if you have given us your consent and/or we have concluded a contract for commissioned processing pursuant to Art. 28 GDPR, taking into account appropriate guarantees. In individual cases, we may use plugins or tools that are hosted in third countries, but we use them on the basis of our legitimate interests. In these cases, we point out the circumstance where appropriate.

Obligation to provide personal data
Whether you provide personal data on our website for specific purposes is up to you. Insofar as you wish to make a purchase in our online store, the execution of the legal transaction is only possible with the provision of personal data.

4. Legal Bases for the Processing of Personal Data

The legal bases for the processing of personal data are exceptional circumstances that permit the processing of personal data. The main legal bases are illustrated in particular in Art. 6 GDPR. The legal bases according to which we process personal data are described in the individual processing operations in this privacy policy.

Consent given (Art. 6 para. 1 lit. a GDPR)
Consent is one of these legal bases and requires that the consenting person gives it in an informed manner and on a voluntary basis. Consent based on Art. 6 para. 1 lit a GDPR can be revoked at any time without giving reasons.

Contract-related data processing (Art. 6 para. 1 lit. b GDPR)
The processing of personal data for the initiation or execution of contracts is also a legal basis and is defined in Art. 6 para. 1 lit. b GDPR.

Legal obligation (Art. 6 para. 1 lit. c GDPR)
The exceptional case of data processing due to a legal obligation is found in Art. 6 para. 1 lit. c GDPR, for example, we are obliged to comply with certain retention periods under commercial law and tax law.

Legitimate interests (Art. 6 para. 1 lit. f GDPR)
The processing of personal data on the basis of a balance of interests pursuant to Art. 6 para. 1 lit. f GDPR allows the processing after careful consideration of financial or legal interests against the interests of the data subject that are worthy of protection.

5. Your Rights under the EU Data Protection Regulation

Every natural person is entitled to certain rights, these are defined in particular in Articles 15 to 21 and 77 of the GDPR. In principle, you have the following rights, which you can claim against us.

Right to revoke consent granted in accordance with Art. 7 GDPR
You may revoke consent granted to us at any time without giving reasons with effect for the future.

Right to information according to Art. 15 GDPR (restrictions possible according to § 34 BDSG)
You have the right to request information about the data processed about you and the purposes of the processing at any time.

Right to rectification according to Art. 16 GDPR
If you discover that we are processing incorrect or incomplete data about you, you have the right to rectification.

Right to deletion according to Art. 17 GDPR (restrictions possible according to § 35 BDSG)
You have the right at any time to demand the deletion of your personal data that we process about you. Insofar as complete deletion is not possible, for example because we have to fulfill legal retention obligations or we can assert legitimate interests for another reason, we will restrict your data until such time as these reasons no longer apply.

Right to restriction of processing according to Art. 18 GDPR
You have the right to request the restriction of the processing of your personal data. To do so, you can contact us at any time at the address given in the imprint. The right to restriction of processing exists in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data happened / happens unlawfully, you may request the restriction of the data processing instead of the deletion.
• If we no longer need your personal data, but you need it to exercise, defend or enforce legal claims, you have the right to request restriction of the processing of your personal data instead of deletion.
• If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balancing of your and our interests must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.
• If you have restricted the processing of your personal data, this data may - apart from being stored - only be processed with your consent or for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

Right to object to certain processing operations and direct marketing pursuant to Art. 21 GDPR.
If data processing is based on Art. 6 para. 1 (e) or (f) GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this privacy policy. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims (objection pursuant to Art. 21(1) GDPR).

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is associated with such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct marketing (objection pursuant to Art. 21 (2) GDPR).

Right of appeal to a supervisory authority pursuant to Article 77 of the GDPR in conjunction with Section 19 of the German Federal Data Protection Act (BDSG)
In the event of violations of the GDPR, data subjects shall have a right of appeal to a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged violation. The right of appeal is without prejudice to other administrative or judicial remedies.

6. External Hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the hoster(s). This may include, but is not limited to, IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated via a website.

External hosting is carried out for the purpose of contract fulfillment vis-à-vis our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR). Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) as defined by the TTDSG. The consent can be revoked at any time.
Our hoster will or will process your data only to the extent necessary to fulfill its performance obligations and to follow our instructions with respect to such data.

We use the following hoster:

netcup GmbH
Daimlerstr. 25
76185 Karlsruhe

Data Processing Agreement
We have concluded a GDPR for the use of the above-mentioned service. This is a contract required by data protection law, which ensures that this processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

7. Automatic Server Log Files

Our web server automatically logs all accesses and thus also IP addresses of visitors. This serves the defense against attacks, the analysis of access figures and the smooth operation. We have a legitimate interest in this (Art. 6 lit. f GDPR).

The server log usually records not only the IP address but also other metadata about the session, this data can be found below.

• Date and time of the retrieval
• Information about the type of browser and the version browser used
• Information about the operating system used
• Device (client)
• Refferer URL (via which page you landed on our site)
• Accessed hyperlinks

We process this data only for the purposes mentioned above. We delete server log files after six months at the latest.

8. Use of Cookies

Our website uses cookies for the provision of services and to ensure full functionality. Cookies - which are small text files that are automatically stored in your browser or device - can have various functions and contain a characteristic string that allows unique identification of the browser when you return to the website.

Cookies are stored on your terminal device and transmitted from it to our site. As a user, you have full control over the use of cookies. You can define whether and which cookies you generally allow in your browser settings. We recommend that you set your browser so that you are informed when a website wants to set cookies on you. This gives you control over which cookies you want to allow. However, to the extent that you do not allow cookies, the functionality of websites may be limited.

Cookies are basically divided into non-persistent and persistent cookies. A further distinction is made between first party cookies (which come directly from our web server) and third party cookies (which are set by third-party providers).

8.1 Cookie Types by Runtime

Session cookies: Session cookies are deleted at the latest when you leave our website and close your browser.

Persistent cookies: These cookies remain stored even after you leave our website and close your browser of the browser. Persistent cookies can have different durations, from one day to several years. These cookies can perform various functions, for example, your login information can be stored so that you are automatically logged in when you return to our website. Other persistent cookies are used for analysis, tracking and marketing purposes.

8.2 Cookie Types by Origin

We use both first-party cookies and third-party cookies. First-party cookies are cookies that come directly from us. Third-party cookies are cookies that are placed via a third-party provider. We use various third-party cookies for analytics, tracking and marketing purposes.

8.3 Cookie Types by Function

Technically required or necessary cookies
These cookies enable the operation of our website, without technical necessary cookies our site would not be usable or only usable in a very limited way. For example, such cookies are used when you log in to our site or place a product in the shopping cart. In some cases, necessary cookies also serve security purposes.

Analysis and statistics cookies
Analysis cookies collect information about the behavior of site visitors, provide information about the length of stay and what information was called up. Furthermore, information is collected about which website page visitors come from, how many visitors the websites have and how long the user stays on the websites. The aim of these cookies is to optimize our website based on the collected information.

Tracking and marketing cookies
Tracking and marketing cookies (also remarketing and retargeting cookies) enable an analysis of browsing behavior, they store which content was visited or which products the user searched for (tracking in this sense means tracking). On the basis of these cookies, a user can also be identified across pages, with the aim of placing advertisements tailored to his interests.

8.4 Legal Basis and Information for Setting your Preferences

We use technically necessary cookies in the interest of a functional and stable website (Art. 6 para. 1 lit. f GDPR), we use other cookies only with your consent (Art. 6 para. 1lit. a GDPR). You can make your preferences regarding the selection of non-essential cookies at the beginning of your visit, furthermore you have the possibility to adjust your preferences at any time.

The individual legal bases for the use of various tools that use cookies can be found in the respective passages in our privacy policy.

9. Cookie Consent Management

We offer you the option to select whether and which cookies and services you want to allow. For this purpose, we have implemented a so-called consent management, which is automatically displayed the first time you visit our website or after the expiration of the preference cookie. If you have confirmed your selection regarding cookies and services, a cookie will be stored in your browser to save your preferences. For more information about this cookie, please see our cookie list.

10. Data Processing Within the Scope of Communication and Contacting

Message via contact form

You have the possibility to send us messages via contact form. We process the data that you have entered in the data entry mask. Mandatory fields are marked and must be filled in. The purpose of the data processing is to handle your request and, if necessary, to contact you afterwards. The legal basis for processing the data entered in the contact form is always based on your consent (Art. 6 para. 1 lit. a GDPR). You can revoke your consent at any time without giving reasons for doing so in the future. In addition, we process your data for the initiation or execution of purchase contracts, insofar as you ask us product-related questions, for example (Art. 6 para. 1 lit. b GDPR).

If necessary, your data and request will be further processed in our CRM Zoho, which we operate in joint responsibility with our partner company Plato.

We store the transmitted data until the purpose of the data storage has been achieved or you revoke your consent. Please note that the process may be subject to legal retention periods. In this case, we restrict your data for further processing until they expire.

Communication by e-mail
Insofar as you write us an email, we process your data according to the content and purpose of the message. As a rule, processing is carried out on the basis of pre-contractual measures or in the context of the implementation of a contractual relationship on the basis of Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. f. GDPR. It is a legitimate interest to process your request quickly and efficiently.

Insofar as it is a product- or service-related message, we generally process your data on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. b GDPR.

Please note that we store all incoming e-mails for a period of ten years in accordance with the principles of proper accounting, starting on the first day of the following year in which the message was received. Therefore, to the extent that you request us to delete the data, we will henceforth restrict your data for processing and store it only for the purpose of complying with retention periods in our legitimate interest.

Communication by telephone or fax
Even if you contact us by phone or fax, we process your data either for the initiation and implementation of contractual relationships (if the content is product- or service-related) and/or in our legitimate interest, analogous to contacting you by e-mail.
We do not record the content of conversations, but may make notes for processing your request. We store these until the purpose of the data processing has been achieved.

Order form
If you request our customer magazine via an order form, the information you provide in the request form, including the contact data you enter there, will be stored by us for the purpose of processing the request and in case of follow-up questions. By submitting the order form, you agree to receive the customer magazine by mail. For this purpose, we will pass on your data to a shipping service provider. We do not pass on your data to other third parties without your consent.

The processing of the data entered in the order form is therefore based exclusively on your consent (Art. 6 Para. 1 lit. a GDPR). You can revoke this consent at any time. For this purpose, an informal communication by e-mail to us is sufficient. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation.

The data you entered in the order form will remain with us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g. after we have completed processing your request). Mandatory legal provisions - in particular retention periods - remain unaffected.

Service Request

If you send us a service request using the form, the information you provide in the request form, including the contact data you enter there, will be stored by us for the purpose of processing the request and in the event of follow-up questions. We do not pass on this data without your consent.

Please note that we cannot process your request without the requested mandatory data.

Mandatory data are:
First name, last name
Email address
Phone number
Company
Perspective concerned
CAQ version
Environment
Type of request
Urgency
Subject

You can provide additional information on a voluntary basis, in particular the upload of supplementary documents is done on a voluntary basis.

The processing of the data entered in the service request form is thus based exclusively on your consent (Art. 6 Para. 1 lit. a GDPR). You can revoke this consent at any time. For this purpose, an informal communication by e-mail to us is sufficient. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation.

The data you entered in the service request form will remain with us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g. after we have completed processing your request). Mandatory legal provisions - in particular retention periods - remain unaffected.

Registration on this Website
You can register on our website to create a customer account. We use the data entered for this purpose only for the purpose of using the respective offer or service for which you have registered. The mandatory information requested during registration must be provided in full. Otherwise we will reject the registration.

For important changes, for example in the scope of the offer or for technically necessary changes, we use the e-mail address provided during registration to inform you in this way.

The processing of the data entered during registration is based on your consent (Art. 6 para. 1 lit. a GDPR). You can revoke any consent you have given at any time. For this purpose, an informal communication by e-mail to us is sufficient. The legality of the data processing already carried out remains unaffected by the revocation.

The data collected during registration will be stored by us as long as you are registered on our website and will then be deleted. Legal retention periods remain unaffected.

Processing of Data (Customer and Contract Data)
We collect, process and use personal data only to the extent that they are necessary for the establishment, content or modification of the legal relationship (inventory data). This is done on the basis of Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the fulfillment of a contract or pre-contractual measures. We collect, process and use personal data about the use of our Internet pages (usage data) only insofar as this is necessary to enable the user to use the service or to bill the user.

The collected customer data will be deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Joint Responsibility for Processing Customer and Contract Data
Customer data is processed in particular in our CRM Zoho, which we operate under joint responsibility with our partner company Plato.

11. Informationen for Applicants

Privacy policy application procedure
If you apply to us, whether for an advertised position or on your own initiative, we process your data to carry out the selection process. It is irrelevant for us whether you apply by mail, by e-mail or, if available for the respective position, by online form.
As a matter of principle, we only process the data that you yourself have provided to us as part of an application process. The use of other sources may only be considered after information and consultation with you. For example, whether we may contact a former employer.

The legal basis for conducting an application procedure is §26 BDSG in conjunction with Art. 6 Para. 1 lit. b GDPR (initiation of employment contract). If you give us your consent to store your data for a longer period of time, this is done on the legal basis of Art. 6 para. 1 lit. a GDPR.

Deletion periods for applicant data
We delete applicant data a maximum of 4 months after the end of the application process (when a candidate has been selected and all applicants have been informed of the outcome). The purpose of the data processing is basically no longer given with the end of the selection process, however, we have a legitimate interest (Art. 6 para. 1 lit. f GDPR) in being able to defend ourselves against any claims by rejected applicants. If you have the impression that your interests in immediate deletion outweigh this, you have the options to request us to do so. We will then review your request and provide you with feedback.

After the expiration of the above-mentioned period, your data will be deleted unless we have to defend ourselves, for example, in ongoing proceedings, such as a lawsuit under the General Equal Treatment Act. In this case, we will delete your data after the proceedings have been concluded, subject to there being no statutory retention periods.

If we are allowed to store your data for a longer period of time based on your consent, we will delete your data if you request us to do so and revoke your consent. If necessary, we will also delete your data before revoking your consent if it is foreseeable that no position will be available.

Inclusion in our applicant pool
If we are unable to offer you a position at the current time, we may ask you for your consent to continue storing your data. This serves the purpose of offering you a suitable position at a later date. The legal basis for processing your data in our applicant pool is your consent (Art. 6 Aba. 1 lit. a GDPR). Of course, you can revoke your consent at any time with effect for the future. If you do not revoke your consent yourself within a period of two years, we will delete your data from our applicant pool no later than then.

12. CRM System Zoho

Personal data that you have communicated to us through a contact request or direct business relations are processed and maintained by us with the help of a customer relationship management system (CRM system).

Provider is Zoho Corporation Pvt. Ltd, Estancia IT Park, Plot No. 140 151, GST Road, Vallancherry Village, Chengalpattu Taluk, Kanchipuram District 603 202, India (hereinafter "Zoho CRM"). Zoho's privacy policy can be found at https://www.zoho.eu/privacy.html.

The CRM system is cloud-based. Since some time Zoho.eu also offers servers in Europe (Netherlands and Ireland) to comply with EU data protection directives.

Among other things, Zoho CRM enables us to manage existing and potential customers as well as customer contacts and to organize sales and communication processes. The use of the CRM system also enables us to analyze and optimize our customer-related processes. The customer data is stored on Zoho CRM servers.

The data that is transmitted to Zoho is only used for the purpose of the desired contact and will also only be used further for this purpose. This must be agreed to separately. After the initial contact, we offer our visitors to choose for themselves how much or how little they want to share with us. This data will not be passed on or distributed to any third parties.

The use of Zoho CRM is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the most efficient customer management and customer communication possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) as defined by the TTDSG. The consent can be revoked at any time.

Data transfer to third countries outside the European Union is based on the standard contractual clauses of the EU Commission. For details, please refer to Zoho CRM's privacy policy: https://www.zoho.com/privacy.html and https://www.zoho.com/gdpr.html.

Data processing Agreement and Operation under Joint Responsibility
A Data Processing Agreement (DPA) has been concluded with the provider Zoho. This is a contract required by data protection law, which ensures that the latter only processes the personal data of our website visitors according to our instructions and in compliance with the GDPR. Zoho's direct contractual partner is our partner company, Plato GmbH.

13. Direct Marketing

Direct Marketing to existing Customers based on Legitimate Interests
We reserve the right to use the data collected on the occasion of a purchase contract or service contract, if necessary, for direct advertising by e-mail or postal mail pursuant to Section 7 (3) UWG (German Competition Law), if the customer does not object or has not objected to this use. The direct advertising exclusively comprises offers for similar products or services to those already purchased by the user from us.

We use your data for up to three years after the last legal transaction for direct marketing purposes in the legitimate interest.

We have a legitimate, economic interest (Art. 6 para. 1 lit. f GDPR) in informing our customers about new products and improving our services. Of course, you can object to receiving direct advertising at any time. Please address your objection to the above-mentioned responsible party. In addition, you will find information in each newsletter on how to assert your objection.

Direct Marketing based on your Consent (Newsletter)
You have the option to give us your consent to receive direct marketing content. If you give your consent (Art. 6 para. 1 lit. a GDPR), for example, to receive our e-mail newsletter, we will process your data for direct marketing measures by e-mail for a specific purpose.

Since we are obliged to verify the accuracy of your e-mail address provided as part of the newsletter registration and want to ensure the correctness, we use procedures that allow the verification of the ownership of the e-mail address. As a rule, this verification is carried out by the double opt-in procedure, you will receive an e-mail after registration with a link that you must click to confirm. If, due to temporary technical causes, the double opt-in procedure is not available, we will send you an email to which you can reply without text to confirm your identity.

You can revoke your consent at any time with effect for the future, for this purpose you will find an "unsubscribe" link in every newsletter. Alternatively, you can send us an email with the subject "Unsubscribe from newsletter". We will process your data until you revoke your consent. Legal retention periods remain unaffected.

After your unsubscription from the newsletter distribution list, your e-mail address will be stored by us or the newsletter service provider in a blacklist, if necessary, to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). The storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.

Use of CleverReach
We use CleverReach to send newsletters. The provider is CleverReach GmbH & Co KG, Mühlenstr. 43, 26180 Rastede. CleverReach is a service with which the newsletter dispatch can be organized and analyzed. The data you enter for the purpose of receiving newsletters (e.g. e-mail address) is stored on CleverReach's servers in Germany or Ireland.

Our newsletters sent with CleverReach allow us to analyze the behavior of newsletter recipients. Among other things, we can analyze how many recipients have opened the newsletter message and how often which link in the newsletter was clicked. With the help of so-called conversion tracking, it can also be analyzed whether a predefined action (e.g. purchase of a product on this website) has taken place after clicking on the link in the newsletter. For more information on data analysis by CleverReach newsletters, please visit: https://www.cleverreach.com/de/funktionen/reporting-und-tracking/.
The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time by unsubscribing from the newsletter. The legality of the data processing operations already carried out remains unaffected by the revocation.

If you do not want any analysis by CleverReach, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in each newsletter message. Furthermore, you can also unsubscribe from the newsletter directly on the website.

The data you provide for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe. Data that has been stored by us for other purposes remains unaffected by this.

After you have unsubscribed from the newsletter distribution list, your e-mail address may be stored by us or the newsletter service provider in a blacklist to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). The storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.
For more details, please refer to the data protection provisions of CleverReach at: https://www.cleverreach.com/de/datenschutz/.

Conclusion of a Data Processing Agreement
We have concluded an order processing contract with the CleverReach provider and fully implement the strict requirements of the German data protection authorities when using CleverReach.

14. Appointments with Calendly.com

On our website you have the possibility to make an appointment with us. We use "Calendly" for this purpose. Calendly is a service of Calendly, LLC, 1315 Peachtree St NE, Atlanta, GA 30309, https://calendly.com.

If you want to register an appointment with us, you can use the form provided for this purpose. The data you provide will then be transmitted via Calendly to the respective contact person and the data will be entered in our calendar (Outlook). In addition, the data can be viewed by us in the login area of Calendly and is stored there.

You will receive a confirmation of the appointment by e-mail, with the possibility of entering the dates in your calendar.

The purpose of processing the data provided is to be able to make an appointment, process the contact request and get in touch with you.

The legal basis for the use of Calendly is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to offer you the possibility to arrange appointments with us independently. This simplifies the coordination regarding appointments and enables an efficient appointment arrangement.

We generally process your data for the purpose of making appointments on the basis of Art. 6 para. 1 lit. b GDPR within the framework of the initiation or implementation of contractual relationships. The personal data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected.

Conclusion of a Data Processing Agreement
We have concluded an order agreement with Calendly so that the data provided by you is processed for us in accordance with instructions and orders. Since it cannot be ruled out that the data will also be processed in a third country (USA), we have concluded an agreement with Calendly in accordance with the EU standard contractual clauses, so that secure data processing is also guaranteed here. You can also find more information at https://calendly.com/pages/dpa.

15. Audio and Video Conferencing with MS Teams

We use the Microsoft Teams tool for communication. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. For details on data processing, please refer to the Microsoft Teams privacy policy: https://privacy.microsoft.com/de-de/privacystatement.

Data Processing Agreement
We have concluded a Data Processing Agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law, which ensures that this processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

Microsoft Teams thereby all data that you provide/enter to use the tools (email address and/or your phone number). Furthermore, the conferencing tools process the duration of the conference, start and end (time) of participation in the conference, number of participants and other "context information" related to the communication process (metadata).

Furthermore, the provider of the tool processes all technical data required to handle online communication. This includes in particular IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker, and the type of connection.

If content is exchanged, uploaded or otherwise made available within the tool, this is also stored on the servers of the tool providers. Such content includes, in particular, cloud recordings, chat/ instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared during the use of the service.

Please note that we do not have full influence on the data processing operations of the tools used. Our options are largely determined by the corporate policy of the respective provider. For further information on data processing by the conference tools, please refer to the data protection statements of the respective tools used, which we have listed below this text.

Purpose and legal basis
We use Microsoft Teams to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6 para. 1 lit. b GDPR). Furthermore, the use of the tools serves the general simplification and acceleration of communication with us or our company (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). Insofar as consent has been requested, the tools in question are used on the basis of this consent; consent can be revoked at any time with effect for the future.

Storage duration
The data collected directly by us via the video and conference tools is deleted from our systems as soon as you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies. Stored cookies remain on your terminal device until you delete them. Mandatory legal retention periods remain unaffected.
We have no influence on the storage period of your data, which is stored by the operators of the conference tools for their own purposes. For details, please contact the operators of the conference tools directly.

16. Remote Support with Team Viewer

For remote support we use the service TeamViewer. The provider is TeamViewer Germany GmbH, Jahnstr. 30, 73037 Göppingen. For details on data processing, please refer to TeamViewer's privacy policy: https://www.teamviewer.com/de/datenschutzerklaerung/.

We do not store any data from sessions with TeamViewer and do not record TeamViewer sessions.

Data Processing Agreement
We have concluded a Data Processing Agreement (DPA) for the above-mentioned service. This is a contract required by data protection law, which ensures that this processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

17. Webinare via GoTo Webinar

We use the GoToWebinar service to conduct webinars. The provider is LogMeIn, Inc, 320 Summer Street Boston, MA 02210, USA. For details on data processing, please refer to the privacy policy of GoToWebinar: https://www.logmeininc.com/de/legal/privacy. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://logmeincdn.azureedge.net/legal/lmi-customer-dpa-2020v1-de.pdf.
When using GoToWebinar, various data are processed. The scope of the data also depends on what data a participant makes before and during participation in a webinar.

User details
First name
Last name
e-mail address
personal participation link

To enter the "virtual webinar room", you must at least enter your name. Furthermore, in addition to your registration data, we receive information about the duration of participation, interest in the webinar and questions asked or answers given.

Webinar Metadata
Topic
Description (optional)
Subscriber IP addresses
Device/hardware information
Date of the webinar
Time of participation

Processing of text, audio and video data
You may have the option of using the chat, question or survey functions in a webinar. In this respect, the text entries you make will be processed in order to display them in the webinar and, if necessary, to log them. If necessary, the organizer of the webinars will give you the option to "share" your screen so that your screen content is also displayed to the other webinar participants and the organizer as well as any moderators/speakers. To enable this, as well as the display of video and the playback of audio, the data from your terminal's microphone and any terminal video camera, as well as the video data displayed on your screen, will be processed accordingly for the duration of the meeting. If necessary, you can switch off or mute the camera, the microphone and the sharing of your screen yourself at any time via the "GoToWebinar" applications.

Webinar recording
We use "GoToWebinar" to conduct webinars. Recording webinars is technically possible and is usually done for archiving purposes. If we want to record the webinar in which you participate, we will transparently inform you of this in advance and - if necessary - ask for your consent. The fact of the recording will also be displayed to you in the "GoToWebinar" application. If it is necessary for the purposes of logging and post-processing the results of a webinar, we will log the chat content as well as questions asked. Participants are prohibited from making recordings of any kind of the webinar. Sound, image or text data may not be recorded, copied or stored. By entering the virtual webinar room, you confirm this.

Further notes
If you access the website of "GoToWebinar", its provider "LogMeIn" is responsible for data processing. You can find the data protection information of this provider on its website. Calling up the "GoToWebinar" website is necessary for the use of "GoToWebinar" for two purposes:
to download the software for the use of "GoToWebinar to register for a webinar.
You can also use "GoToWebinar" if you use the "GoToWebinar" app and enter the access data for the webinar there.

If you do not want to or cannot use the "GoToWebinar" app, then the functions can also be used via a browser version, which you can also find on the "GoToWebinar" website.

Legal bases of data processing
Insofar as personal data of employees is processed, § 26 BDSG is the legal basis for data processing. If, in connection with the use of "GoToWebinar", personal data is not required for the establishment, implementation or termination of the employment relationship, but is nevertheless an elementary component in the use of "GoToWebinar", Art. 6 para. 1 lit. f GDPR is the legal basis for data processing. In these cases, our interest is in the effective implementation of webinars.
Incidentally, the legal basis for data processing when conducting webinars is Art. 6 para. 1 lit. b GDPR, insofar as the webinars are conducted in the context of contractual relationships. Should no contractual relationship exist, the legal basis is Art. 6 para. 1 lit. f GDPR. Here, too, our interest is in the effective implementation of webinars. Insofar as we ask for your consent for one or more purposes, Art. 6 para. 1 lit. a GDPR is the legal basis. Consent can be revoked at any time without giving reasons.

Other recipients of personal data
The provider of the "GoToWebinar" platform, LogMeIn, Inc., necessarily obtains knowledge of the above-mentioned data to the extent provided for under our order processing agreement with "GoToWebinar". This provider also uses subcontracted processors. The company provides an up-to-date list of these sub-processors on its website.

Data Processing Agreement and Operation under Joint Responsibility
The direct contractual partner of LogMeIn, Inc. is our partner company, Plato GmbH. A Data Processing Agreement (DPA) has been concluded between Plato and LogMeIn, Inc. We use the service under joint responsibility with Plato.

18. Trainings via Reteach

We use the reteach solution from Susell GmbH (Rosenthaler Straße 38, 10178 Berlin) as our e-learning platform. For the associated use of data, we refer to the data protection information of the provider Susell GmbH, which is exclusively responsible for the corresponding data processing here. You can find the data protection information of Susell GmbH at https://www.reteach.com/datenschutz.

The use of the platform is done by sending a personally generated link to the email address you have given us.

In the course of using a training platform, the following personal data is processed by us and reteach:

First and last name
Company
E-mail address
Date of participation
Designation of the training
IP address
Metadata
if applicable Image data
if applicable Sound
data.

Legal basis for the processing of personal data in the context of training videos Art. 6 para. 1 lit. b GDPR. In addition, we use reteach on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR.

Data Processing Agreement and Operation under Joint Responsibility
The direct contractual partner of Susell GmbH is our partner company, Plato GmbH. A Data Processing Agreement (DPA) has been concluded between Susell GmbH and Plato. We use the service within the scope of joint responsibility with Plato. An order processing contract has been concluded between Plato and Susell GmbH.

19. Analysis Tools and Advertising

Google Tag Manager

We use the Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to embed tracking or statistical tools and other technologies on our website. The Google Tag Manager itself does not create user profiles, does not store cookies and does not perform any independent analyses. It only serves to manage and play out the tools integrated via it. However, the Google Tag Manager collects your IP address, which may also be transferred to Google's parent company in the United States.

The use of Google Tag Manager is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in a fast and uncomplicated integration and management of various tools on his website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) as defined by the TTDSG. The consent can be revoked at any time.

Google Analytics
This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyze the behavior of website visitors. In doing so, the website operator receives various usage data, such as page views, dwell time, operating systems used and the origin of the user. This data is assigned to the respective end device of the user. An assignment to a user ID does not take place.

Furthermore, Google Analytics allows us to record your mouse and scroll movements and clicks, among other things. Furthermore, Google Analytics uses various modeling approaches to supplement the collected data sets and uses machine learning technologies in the data analysis.

Google Analytics uses technologies that enable the recognition of the user for the purpose of analyzing user behavior (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is usually transferred to a Google server in the USA and stored there.

The use of this service is based on your consent according to Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. The consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.

Browser Plugin
You can prevent the collection and processing of your data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

For more information on how Google Analytics handles user data, please see Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

Data Provcessing Agreement

We have concluded a Data Processing Agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Google Ads
The website operator uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). Furthermore, targeted advertisements can be played on the basis of user data available at Google (e.g. location data and interests) (target group targeting). As the website operator, we can evaluate this data quantitatively by analyzing, for example, which search terms led to the display of our advertisements and how many ads resulted in corresponding clicks.

The use of this service is based on your consent according to Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. The consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/.

Google Ads Remarketing
This website uses the functions of Google Ads Remarketing. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

With Google Ads Remarketing, we can assign people who interact with our online offering to specific target groups in order to subsequently display interest-based advertising to them in the Google advertising network (remarketing or retargeting).

Furthermore, the advertising target groups created with Google Ads Remarketing can be linked with Google's cross-device functions. In this way, interest-based, personalized advertising messages that have been adapted to you depending on your previous usage and surfing behavior on one end device (e.g. cell phone) can also be displayed on another of your end devices (e.g. tablet or PC).

If you have a Google account, you can object to personalized advertising at the following link: https://www.google.com/settings/ads/onweb/.

The use of this service is based on your consent according to Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. The consent can be revoked at any time.

For more information and the privacy policy, please see Google's privacy policy at: https://policies.google.com/technologies/ads?hl=de.

Google Conversion Tracking
This website uses Google Conversion Tracking. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can recognize whether the user has performed certain actions. For example, we can evaluate which buttons on our website were clicked how often and which products were viewed or purchased particularly frequently. This information is used to create conversion statistics. We learn the total number of users who clicked on our ads and what actions they took. We do not receive any information with which we can personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.

The use of this service is based on your consent according to Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDSG. The consent can be revoked at any time.

For more information on Google conversion tracking, please see Google's privacy policy: https://policies.google.com/privacy?hl=de.

LinkedIn Insight Tag
This website uses the Insight tag from LinkedIn. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Data processing by LinkedIn Insight Tag
With the help of the LinkedIn Insight Tag, we obtain information about the visitors to our website. If a website visitor is registered with LinkedIn, we can, among other things, analyze the key professional data (e.g., career level, company size, country, location, industry, and job title) of our website visitors and thus better tailor our site to the respective target groups. Furthermore, we can use LinkedIn Insight Tags to measure whether visitors to our websites make a purchase or take another action (conversion measurement). Conversion measurement can also be done across devices (e.g., PC to tablet). LinkedIn Insight Tag also offers a retargeting function that allows us to display targeted off-site advertising to visitors to our website, whereby according to LinkedIn no identification of the advertising addressee takes place.

LinkedIn itself also collects so-called log files (URL, referrer URL, IP address, device and browser properties and time of access). The IP addresses are shortened or (if they are used to reach LinkedIn members across devices) hashed (pseudonymized). The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymized data is then deleted within 180 days.

The data collected by LinkedIn cannot be assigned to specific individuals by us as the website operator. LinkedIn will store the collected personal data of the website visitors on its servers in the USA and use them in the context of its own advertising measures. For details, please refer to LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy#choices-oblig.

Legal basis
Insofar as consent has been obtained, the aforementioned service is used exclusively on the basis of Art. 6 Para. 1 lit. a GDPR and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of this service is based on Art. 6 para. 1 f GDPR; the website operator has a legitimate interest in effective advertising measures including social media.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.

Objection to the use of LinkedIn Insight Tag
Object to the analysis of usage behavior as well as targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Furthermore, LinkedIn members can control the use of their personal data for advertising purposes in the account settings. To avoid a link between data collected on our website by LinkedIn and your LinkedIn account, you must log out of your LinkedIn account before visiting our website.

Data Processing Agreement
We have concluded a Data Processing Agreement for the use of the above-mentioned service. This is a contract required by data protection law, which ensures that this processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

20. Other Plugins and Tools

YouTube with enhanced privacy
This website embeds videos from YouTube. The operator of the pages is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

We use YouTube in extended data protection mode. According to YouTube, this mode means that YouTube does not store any information about visitors to this website before they watch the video. However, the transfer of data to YouTube partners is not necessarily excluded by the extended data protection mode. Thus, YouTube - regardless of whether you watch a video - establishes a connection to the Google DoubleClick network.

As soon as you start a YouTube video on this website, a connection to YouTube's servers is established. This tells the YouTube server which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

Furthermore, YouTube can save various cookies on your end device after starting a video or use comparable recognition technologies (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to collect video statistics, improve the user experience, and prevent fraud attempts.

If necessary, further data processing operations may be triggered after the start of a YouTube video, over which we have no control.

YouTube is used in the interest of an appealing presentation of our online offers. This represents a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.

For more information about data protection at YouTube, please see their privacy policy at: https://policies.google.com/privacy?hl=de.

Google Maps
This site uses the map service Google Maps via an API. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this site has no influence on this data transmission.

The use of Google Maps is in the interest of an appealing presentation of our online offers and an easy location of the places indicated by us on the website. This represents a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. Insofar as a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.

More information on the handling of user data can be found in Google's privacy policy: https://policies.google.com/privacy?hl=de.

iqs File Transfer Tool
We offer our customers to transfer files securely and encrypted via our own iqs File Transfer Tool.

We offer our existing customers the use of the File Transfer Tool within the framework of existing contractual relationships (Art. 6 para. 1 lit. b GDPR).

File Transfer is hosted on an external server, the hosting provider is mentioned below.

IONOS SE
Elgendorfer Str. 57
56410 Montabaur

We use the hoster on the basis of our legitimate interests (Art. 6 para. 1lit. f GDPR).

Data Processing Agreement
We have concluded a Data Processing Agreement (AVV) with the aforementioned hoster. This is a contract required by data protection law, which ensures that the hoster only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

21. Our Social Media Appearances

Data processing through social networks
We maintain publicly accessible profiles on social networks. The social networks used by us in detail can be found below.

Social networks such as Facebook, Google+, etc. can generally analyze your user behavior extensively when you visit their website or a website with integrated social media content (e.g., like buttons or advertising banners). Visiting our social media appearances triggers numerous processing operations relevant to data protection. In detail:

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected under certain circumstances if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection takes place, for example, via cookies that are stored on your end device or by recording your IP address.

With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, you can be shown interest-based advertising inside and outside the respective social media presence. Provided you have an account with the respective social network, the interest-based advertising may be displayed on all devices on which you are or were logged in.

Please also note that we cannot track all processing on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection provisions of the respective social media portals.

Legal basis
Our social media presences are intended to ensure the most comprehensive presence possible on the Internet. This is a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. The analysis processes initiated by the social networks may be based on deviating legal bases to be specified by the operators of the social networks (e.g. consent within the meaning of Art. 6 para. 1 lit. a GDPR).

Responsible party and assertion of rights
If you visit one of our social media sites (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. In principle, you can assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) both vis-à-vis us and vis-à-vis the operator of the respective social media portal (e.g. vis-à-vis Facebook).

Please note that despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options are largely determined by the corporate policy of the respective provider.

Storage period
The data collected directly by us via the social media presence will be deleted from our systems as soon as the purpose for storing it no longer applies, you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies. Stored cookies remain on your terminal device until you delete them. Mandatory legal provisions - in particular retention periods - remain unaffected.
We have no influence on the storage period of your data, which is stored by the operators of social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).

Soziale networks im detail

Google / Youtube
We have a profile on Google+. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. You can independently adjust your advertising settings in your user account. To do so, click on the following link and log in: https://adssettings.google.com/authenticated. For details, please refer to Google's privacy policy: https://policies.google.com/privacy.

XING
We have a profile on XING. The provider is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany. For details on how they handle your personal data, please refer to the XING privacy policy: https://privacy.xing.com/de/datenschutzerklaerung

LinkedIn
We have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.
If you would like to disable LinkedIn advertising cookies, please use the following link:https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

For details on their handling of your personal data, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy.

22. Supplementary Privacy Information for our Business Partners

Data categories and purposes of processind

We process personal data of our service providers and partners that we receive directly in the course of our business relationship. If we have received data from you, we generally process it only for the purposes for which we received or collected it.

As a rule, we process the following categories of data from you

• Name, first name
• Address and / or company address
• Telecommunications data
• E-mail address
• Company
• professional function and/or position
• Bank details / other payment details
• Data on the history of the business relationship

In the course of the business initiation phase and during the business relationship, in particular through personal, telephone or written contacts, initiated by you or by one of our employees, further personal data is generated, e.g. information on contact channel, date, occasion and result; (electronic) copies of correspondence and information on participation in direct marketing measures.

On the other hand, we process personal data that we have permissibly obtained from publicly accessible sources (e.g. commercial and association registers, press, media, Internet) and are allowed to process.

Data processing for other purposes can only be considered if the necessary legal requirements pursuant to Art. 6 para. 4 GDPR are met. We will, of course, comply with any information obligations pursuant to Art. 13 para. 3 GDPR and Art. 14 para. 4 GDPR in this case.

Legal Bases

Based on your consent (Art. 6 para. 1 lit. a) GDPR)
We process personal data for one or more specific purposes if you have given us consent to do so. If personal data is processed on the basis of your consent, you have the right to revoke your consent to us at any time with effect for the future.

Data processing for the performance of contracts (Art. 6 para. 1 lit. b) GDPR)
We process personal data for the performance of contracts. The performance of contracts includes, for example, the conclusion, execution and reversal of a contract. In addition, we process personal data that is required for the performance of pre-contractual measures, such as the initiation of a contract, and which is carried out at your request.

Data processing due to a legal obligation (Art. 6 para. 1 lit. c) GDPR)
Like any company, we must comply with retention obligations and other documentation requirements, this may also affect documents containing personal information. To the extent that we process data for these purposes, the processing is based on a legal obligation.

Data processing on the basis of a balance of interests (Art. 6 para. 1 f) GDPR)
If we process data on the basis of a balance of interests, you as the data subject have the right to object to the processing of personal data, taking into account the requirements of Art. 21 GDPR. As far as the specific purpose allows, we process your data pseudonymized or anonymized.

Other Recipients of your Data

Disclosure to order processors within the scope of Art. 28 GDPR
Order processors used by us (Art. 28 GDPR), in particular in the area of IT services and, for example, printing services, who process your data for us in accordance with instructions. If we commission service providers to perform our tasks, we always comply with the provisions of data protection law; in particular, data is only passed on after the conclusion of contracts for order processing. We will be happy to inform you about which order processors we use.

For the execution of a contractual relationshipDisclosure due to a legal obligation
If it is necessary for the execution of the contract with you, we pass on your data, for example, to our bank for the processing of payments or shipping service providers, such as the German Post, DHL, UPS, GSL, DPD or other occasion-related providers.

Disclosure due to a legal obligation
If there is a legal or official obligation, we will disclose your data to public bodies or institutions (authorities, for example in the context of a criminal prosecution).

Other bodies, insofar as you have given us your consent
If you have given us explicit consent, we will also pass on your data to other bodies. However, this is done within the limits of your verifiable consent.

Information on Deletion Periods of Personal Data

Principle of purpose limitation and compliance with statutory retention periods
We process the data as long as this is necessary for the respective purpose. To the extent necessary, we process your personal data for the duration of our business relationship, which also includes the initiation and execution of a contract.

In addition, like any company, we are obliged to comply with the statutory retention periods, for example the periods under commercial and tax law. Insofar as statutory retention obligations exist, the personal data in question is stored for the duration of the retention obligation. The storage period is also based on the statutory limitation periods, which, for example, according to §§ 195 et seq. of the German Civil Code (BGB), are generally three years, but in certain cases can be up to thirty years. After the retention period has expired, a check is made to determine whether there is a further need for processing. If there is no longer a need, the data is deleted.

As a rule, such retention periods in the context of legal transactions (according to §147 AO which is the German Tax Code/ §257 HGB – the German Commercial Code/ §14b UStG – German Sales Tax Law) are 10 years, starting with the year following the legal transaction.

Concrete example Insofar as you
provide us with your contact data, for example by e-mail, telephone, or by handing over your business card, we store this data on the basis of Art. 6 para. 1 lit. b GDPR on the basis of pre-contractual measures and in the legitimate interest (Art. 6 para. 1 lit. f GDPR) of smooth and targeted communication. Insofar as no legal transaction is concluded, we will delete your data if you request us to do so or if no further contact takes place within a period of three years. If you enter into a legal transaction with us (Art. 6 para. 1 lit b GDPR), we store your data for ten years until the expiry of the requirements under commercial and tax law. After this period, we will check whether we can delete the data and, if necessary, we will lead it to deletion.

E-mails and business letters
We archive all our e-mail traffic for ten years. If you write us an e-mail, your data and the entire e-mail content are stored accordingly for 10 years. Most e-mails count as business letters; in addition, e-mails may contain information relevant under tax law. In our opinion, the effort to check each individual e-mail in this respect is not in proportion to the benefit and the interests of the sender that are worthy of protection. However, you can of course request deletion at any time and we will carry out a case-by-case check and inform you of the result. This may lead to deletion or restriction of processing, depending on the content of the correspondence.

Revocation of your consent
Insofar as we process your data on the basis of your consent (Art. 6 para. 1 lit. a GDPR), we will delete it after your revocation. Unless there are legitimate interests against a complete deletion. For example, we generally retain declarations of consent for up to three years after receipt of your revocation in the legitimate interest (Art. 6 para. 1 (f) GDPR). We retain consent exclusively under restriction of processing in order to be able to defend ourselves in the event of a dispute.

Legal or Contractual Obligation to provide Personal Data
The provision of personal data is regularly required for the initiation, conclusion, execution and reversal of a contract. In the event that you do not provide the required personal data, we are not able to conclude and fulfill a contract with you.

Transfer to a third Country
Your personal data will generally be processed by us in data centers in the Federal Republic of Germany or the European Union. A transfer to a third country is only possible if you have given us your consent or we have concluded a contract for commissioned processing in accordance with Art. 28 GDPR, taking into account appropriate safeguards or other suitable guarantees.