Privacy Policy
Privacy Policy
We greatly appreciate your interest in our company. Data protection is of particular importance to the management of our companies. Generally, it is possible to use our websites without providing any personal data. However, if an individual wishes to use special services provided by our company via our website, processing of personal data may become necessary. If processing personal data is necessary and there is no legal basis for such processing, we generally obtain consent from the individual concerned.
The processing of personal data, such as the name, address, email address, or telephone number of an individual, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with country-specific data protection regulations applicable to our companies. Through this privacy policy, our company would like to inform the public about the type, scope, and purpose of the personal data we collect, use, and process. Furthermore, individuals are informed about their rights via this privacy policy.
As the controller responsible for processing, our companies have implemented numerous technical and organizational measures to ensure the most comprehensive protection of personal data processed through this website. Nevertheless, Internet-based data transmissions can inherently have security gaps, making absolute protection impossible. Therefore, individuals are free to provide personal data to us through alternative means, for example, by telephone.
1. Definitions
The privacy policy of our companies is based on terms used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our privacy policy should be easily readable and understandable for the general public, as well as for our customers and business partners. To ensure this, we will first explain the terminology used.
In this privacy policy, we use the following terms, among others:
a) Personal data
Personal data refers to any information relating to an identified or identifiable natural person (“ data subject” ). An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
b) Data subject
A data subject is any identified or identifiable natural person whose personal data is processed by the controller.
c) Processing
Processing is any operation or set of operations performed on personal data, with or without automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
d) Restriction of processing
Restriction of processing refers to the marking of stored personal data to limit its processing in the future.
e) Profiling
Profiling refers to any automated processing of personal data intended to evaluate certain personal aspects related to a natural person, particularly to analyze or predict aspects concerning that person’ s work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
f) Pseudonymization
Pseudonymization is the processing of personal data in a way that personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures ensuring that personal data are not attributed to an identified or identifiable natural person.
g) Controller or responsible for processing
The controller or responsible for processing is the natural or legal person, public authority, agency, or other body determining alone or jointly with others the purposes and means of processing personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or specific criteria for its nomination may be provided for under Union or Member State law.
h) Processor
A processor is a natural or legal person, public authority, agency, or other body processing personal data on behalf of the controller.
i) Recipient
A recipient is a natural or legal person, public authority, agency, or another body to whom personal data are disclosed, whether a third party or not. Authorities receiving personal data in the context of a specific inquiry under Union or Member State law shall not be regarded as recipients.
j) Third party
A third party is a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons authorized to process personal data under the direct authority of the controller or processor.
k) Consent
Consent is any freely given, specific, informed, and unambiguous indication of the data subject’ s wishes by which they signify agreement to the processing of their personal data by a clear affirmative action.
2. Name and address of the controller
The controller as defined by the GDPR, other data protection laws applicable in EU Member States, and other provisions related to data protection is:
3. Cookies
Our website does not use cookies for general browsing. Cookies are only set when users actively interact with the website, for example by submitting forms, logging in, or using features that require session handling. In these cases, cookies are necessary for technical reasons – such as managing sessions or remembering form inputs – and are typically limited to standard WordPress functionality.
These cookies do not track users across websites and are not used for marketing or analytics purposes. The legal basis for setting such cookies is Art. 6(1)(b) GDPR, as they are required to fulfill user-initiated actions or provide requested services.
No third-party or tracking cookies are used on this website.
Users can control and delete cookies through their browser settings. Disabling cookies may affect the functionality of features that rely on user interaction.
4. Collection of general data and information
The websites of our companies collect a variety of general data and information each time the website is accessed by an individual or automated system. This data and information are stored in server log files. The data collected may include (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (referrer), (4) the sub-websites accessed on our website, (5) the date and time of website access, (6) an Internet Protocol (IP) address, (7) the Internet service provider of the accessing system, and (8) similar data and information used for security purposes in the event of attacks on our IT systems.
Our companies do not draw conclusions about the data subject from this general data and information. Rather, this information is needed to (1) correctly deliver the contents of our website, (2) optimize the contents of our website as well as advertising, (3) ensure the long-term functionality of our IT systems and website technology, and (4) provide law enforcement authorities with the information necessary for criminal prosecution in the case of a cyberattack. This anonymously collected data and information is evaluated statistically and further analyzed to enhance data protection and data security in our company, ultimately ensuring an optimal level of protection for the personal data processed by us. The anonymous data in the server log files are stored separately from any personal data provided by the data subject.
Log files are stored for seven days and then deleted.
5. Use of Cloudflare
We use the services of Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter “ Cloudflare” ) as a content delivery network (CDN) and security provider to optimize the loading times of our website and to protect it against attacks such as DDoS. When accessing our website, your browser connects to Cloudflare’ s servers, which may be located in various countries worldwide. This means that your IP address and other technical data (such as browser type, requested content, and system configuration information) may be transmitted to Cloudflare.
Cloudflare acts as a data processor under the GDPR. We have concluded a Data Processing Agreement (DPA) with Cloudflare, which includes standard contractual clauses to ensure an adequate level of data protection. Cloudflare states that it does not store personal data beyond what is technically necessary for the delivery of content and the security of the connection.
The legal basis for the use of Cloudflare is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing a secure and high-performance website. More information on data processing by Cloudflare can be found in their privacy policy: https://www.cloudflare.com/privacypolicy/.
6. Legal basis for processing
The processing of personal data on our website is based on the following legal grounds under the General Data Protection Regulation (GDPR):
- a) Art. 6(1)(a) GDPR – Consent: for processing activities that require your explicit consent, such as newsletter subscriptions or form submissions.
- b) Art. 6(1)(b) GDPR – Performance of a contract: when processing is necessary for fulfilling a contract or pre-contractual measures, such as responding to inquiries.
- c) Art. 6(1)(f) GDPR – Legitimate interest: for technical security (e.g., server logs, Cloudflare), website optimization, and prevention of misuse.
7. Data retention and erasure
Personal data is stored only for as long as necessary to fulfill the purpose of collection or as required by law. After the storage period expires, the corresponding data is routinely deleted, provided it is no longer required for contract fulfillment or initiation.
8. Data subject rights
As a data subject, you have the following rights under the GDPR:
- a) Right to access – Art. 15 GDPR
- b) Right to rectification – Art. 16 GDPR
- c) Right to erasure – Art. 17 GDPR
- d) Right to restriction of processing – Art. 18 GDPR
- e) Right to data portability – Art. 20 GDPR
- f) Right to object – Art. 21 GDPR
- g) Right to lodge a complaint with a supervisory authority – Art. 77 GDPR
If you wish to exercise any of these rights, please contact us using the contact details provided in section 2 of this privacy policy.
9. Hosting and data processing
Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. In the context of hosting, personal data such as IP addresses, access times, and technical metadata are processed on our behalf to ensure the operation and security of the website.
We have concluded a data processing agreement (DPA) with Hetzner in accordance with Art. 28 GDPR. Data processing takes place exclusively within the European Union. This ensures the protection of your data and compliance with applicable data protection regulations.
10. Contact forms and communication
If you contact us via a form or email, the data you submit (e.g., name, email address, message content) will be stored and processed for the purpose of responding to your inquiry. The legal basis is Art. 6(1)(b) GDPR. This data will not be passed on to third parties without your consent and will be deleted after your request has been resolved, unless statutory retention periods apply.
11. Use of Cloudflare Turnstile
We use “ Cloudflare Turnstile” on our website to protect forms from abuse and spam bots. Turnstile is a CAPTCHA service provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA.
When using Turnstile, technical data such as the IP address, browser information, and user interaction (mouse movements, keystrokes, etc.) may be transmitted to Cloudflare to verify whether the interaction is made by a human. According to Cloudflare, this data is not used for tracking or advertising purposes and is only stored temporarily for verification.
We have concluded a Data Processing Agreement (DPA) with Cloudflare. The legal basis for the use of Turnstile is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website from automated misuse and ensuring the security of our web forms.
For more information, please refer to Cloudflare’ s privacy policy: https://www.cloudflare.com/privacypolicy/.
12. Use of AI-based chatbot (OpenAI API)
On specific pages of our website, users can interact with an AI-based chatbot to receive automated responses. This functionality is provided using the API service of OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA.
When using the chatbot, only the text inputs provided by the user are transmitted to OpenAI’s servers. No connection data such as IP addresses, browser information, or metadata are sent. The user input is processed solely for generating a response and is stored by OpenAI for up to 60 days for abuse monitoring and system integrity purposes.
We have concluded a data processing agreement (DPA) with OpenAI in accordance with Art. 28 GDPR. According to OpenAI, input data is not used for model training and is not linked to any user identity. Nonetheless, we recommend that users do not enter sensitive personal data or information requiring special protection.
The legal basis for using the chatbot is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing an interactive and modern user experience. More information can be found in OpenAI’s privacy policy: https://openai.com/policies/privacy-policy.