Privacy Policy

Processing of Personal Data

The subject of this privacy policy is personal data, which is individual information about personal or factual circumstances of a specific or identifiable natural person. A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by means of assignment to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more special characteristics. This includes, in particular, all information that allows conclusions to be drawn about your identity or the identity of the recipient (such as name, date of birth, postal address, email address, IP address or telephone number).

Processing includes, among other things, the collection, editing, use, reading and querying as well as deletion of personal data. Any processing is carried out exclusively when there is a sufficient legal basis, such as a legal permission or your consent.

Controller and Data Protection Officer

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

For data protection enquiries, you can also contact datenschutz@kettner-edelmetalle.de directly.

Individual Data Processing Operations

Server Log Files

You can visit our website without explicitly providing any personal information. Each time you access our website, usage data is transmitted by your internet browser and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of the access, the amount of data transferred and the requesting provider. This data is used exclusively to ensure the trouble-free operation of our website and to improve our services. It is not possible to assign this data to a specific person. The legal basis for the processing is our legitimate interests, Art. 6(1)(f) GDPR.

Contact

You can contact us in various ways, for example by phone, by sending an email or by using the contact form. In doing so, we collect your personal data (e.g. name, email address, telephone number, message or message text) only to the extent that you have provided it. The data processing serves the purpose of answering and processing your enquiry.

When using the contact form, we use the provider Cloudflare Germany GmbH, Rosental 7, c/o Mindspace 80331 Munich, Germany ("Cloudflare") to ensure security, in particular to prevent automated queries. We have concluded a data processing agreement with Cloudflare.

The legal basis for the processing of data is Art. 6(1)(b) GDPR, insofar as the processing serves to initiate a contractual relationship. Furthermore, we have a legitimate interest within the meaning of Art. 6(1)(f) GDPR in continuing a conversation initiated by you and responding to your enquiry.

The data is stored for the duration of the processing of your enquiry and subsequently deleted as part of our deletion routine, taking into account a three-year retention obligation for contract-relevant enquiries and any other special retention obligations.

Customer Account

When opening a customer account, we collect the following personal data: salutation, first and last name, email address and telephone number. You can store delivery and billing addresses in your customer account. In addition, your orders and invoices are stored in your customer account. The data processing serves the purpose of improving your shopping experience and simplifying order processing.

The processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of the consent until the revocation. Your customer account will then be deleted within 7 days. We would like to point out that you have the option of downloading your invoices; however, these will no longer be accessible after deletion of the customer account.

Orders and Purchase Processing

When placing an order, we collect and use your personal data only to the extent necessary for the fulfilment and processing of your order and for the processing of your enquiries. The provision of data is necessary for the conclusion of the contract. Failure to provide data means that no contract can be concluded. The processing is therefore carried out on the basis of Art. 6(1)(b) GDPR.

Your data will not be passed on to third parties without your express consent. Excluded from this are only our service partners whom we require for the processing of the contractual relationship and/or service providers whom we use in the context of data processing on our behalf (each also referred to as "recipients").

These are the shipping service providers and transport companies, payment service providers, merchandise management service providers, service providers for order processing, web hosts, IT service providers, dropshipping dealers and consulting companies mentioned in this privacy policy.

In all cases, we strictly comply with the legal requirements. The scope of data transmission to the recipients is limited to a minimum.

a. Transfer of personal data to transport companies

UPS and DHL

If the goods are delivered by the transport service provider "UPS" (United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany) or DHL (DHL Paket GmbH, Sträßchensweg 10; 53113 Bonn, Germany), we will pass on your email address in addition to the address data before delivery of the goods pursuant to Art. 6(1)(a) GDPR for the purpose of coordinating a delivery date or for delivery notification and status communication. Furthermore, we will pass on your telephone number in order to simplify delivery if the customer is not present at the time of delivery. The telephone number may also be printed directly on the shipping label by UPS and DHL for the transport driver.

Consent can be revoked at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the transport service provider UPS and DHL; however, simplified delivery and coordination of the delivery date with UPS and DHL or the transmission of status information on the shipment delivery will not be possible.

Prosegur, Intex and DG-Transporte

If the goods are delivered by the transport service provider "Prosegur" (Prosegur Cash Services Germany GmbH, Kokkolastraße 5, 40882 Ratingen, Germany), "Intex" (Intex Paketdienst GmbH, In der Held 2, 66620 Nonnweiler-Otzenhausen, Germany) or "DG-Transporte" (DG Transporte GmbH & Co. KG, Heinkelstraße 17, 73230 Kirchheim / Teck, Germany), we will pass on your telephone number in addition to the delivery address before delivery of the goods with your consent pursuant to Art. 6(1)(a) GDPR for the purpose of coordinating a delivery date or for delivery notification and, where available, status communication to Prosegur, Intex and DG. The transfer takes place regardless of your consent only insofar as this is necessary for the delivery of goods in the individual case. If you do not give us your consent, prior coordination of the delivery date with Prosegur, Intex and DG or the transmission of telephone status information on the shipment delivery will not be possible.

Consent can be revoked at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the transport service provider Prosegur, Intex and DG-Transporte.

b. Shipping service providers

In some cases, we use shipping service providers who store and ship the goods purchased from us. We only pass on data to these service providers for the purpose of shipping. The data is not used for any other purposes. The legal basis is Art. 6(1)(b) GDPR.

c. Use of a merchandise management system and warehouse software

We use a merchandise management system for contract processing as part of data processing on our behalf. For this purpose, your personal data collected as part of the order is transmitted to interSales AG Internet Commerce, Weinsbergstr. 190, 50825 Cologne, Germany. We also use warehouse software as part of data processing on our behalf. For this purpose, your personal data collected as part of the order is transmitted to the provider of the warehouse software, namely SPF GmbH Systemberatung, Augustinusstr. 9a, 50226 Frechen-Königsdorf, Germany.

The data in the merchandise management system and the warehouse software is subject to commercial and tax law retention periods. Your personal data may be stored for up to ten years thereafter.

CRM System HubSpot

We use the CRM system of the software manufacturer "HubSpot" (HubSpot European Headquarters, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland). HubSpot is a software company from the USA with a branch in Ireland.

We use HubSpot as a management system for customer contact data, potential new customer contact data as well as for customer support and the provision of support services. Only a limited number of authorised employees have access, where necessary, to our customer database, which contains names, contact details and order-related information.

With the help of HubSpot, we also analyse our landing pages and receive an evaluation in order to continuously optimise our website and make it more user-friendly. For this purpose, "web beacons" and cookies are used. For analysis purposes, the following personal data may be collected, for example: IP address (truncated), geographical location, type of browser, duration of visit and pages accessed.

HubSpot uses personal data only for technical processing and does not pass it on to third parties. It is possible that your data may be stored and processed by HubSpot on servers in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)). We have concluded a data processing agreement with HubSpot.

The cookies have a lifetime of 13 months. In addition, we delete the personal data collected via HubSpot as soon as the purpose for which it was collected has been achieved, unless statutory retention periods prevent deletion.

The data processing is carried out on the basis of consent pursuant to Art. 6(1)(a) GDPR. HubSpot is certified under the Data Privacy Framework. The data transfer to third countries (here: USA) is thus secured by an adequacy decision (Art. 45 GDPR).

Further information about how HubSpot works can be found in HubSpot's privacy policy (https://legal.hubspot.com/de/privacy-policy).

IT Service Providers

In the context of our IT maintenance by our service provider "encantus" (encantus GmbH, Humboldtstraße 32, 70771 Leinfelden-Echterdingen, Germany), it cannot be excluded that they may gain access to personal data, in particular names and contact details of customers and other contractual partners. We have concluded a data processing agreement with encantus.

Newsletter

We use your email address for our own advertising purposes for newsletter distribution and evaluation of our advertising measures, provided you have expressly consented to this. In our newsletter, we regularly inform you about current offers, news from the financial and investment world.

The processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until the revocation. You can unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the distribution list and associated information will be deleted.

Receiving our newsletter requires the successful completion of the so-called double opt-in procedure. For this purpose, after ordering the newsletter, we send you a confirmation email in which you are asked to confirm that you wish to receive newsletters in the future by clicking on a corresponding link.

We process your IP address registered by your Internet Service Provider (ISP) as well as the date and time of registration and confirmation in order to be able to trace any misuse of your email address at a later date. The processing is based on our legitimate interests in documenting the lawfulness of data processing, Art. 6(1)(f) GDPR.

For newsletter distribution, we use the service providers "Mailgun" (Mailgun Technologies Inc. 112 E Pecan St. #1135, San Antonio, Texas, 78205, USA) and HubSpot. These service providers store the email addresses of our newsletter recipients, as well as their other data described under this section "Newsletter", on their servers. Both Mailgun and HubSpot use this information to send and evaluate the newsletters on our behalf. The evaluation of our advertising measures takes place through analysis of click and open rates. With the help of so-called conversion tracking, it can also be determined whether, after clicking on the links in the newsletter, a previously defined action (e.g. purchase of a product, sharing of information on social media, unsubscriptions) has taken place. The service providers also offer us the option of dividing newsletter recipients into groups based on their interests. In this way, we can provide our newsletter recipients with content that is as relevant to their interests as possible.

Furthermore, according to its own information, Mailgun may use this data to optimise or improve its own services, e.g. for the technical optimisation of sending and the presentation of the newsletters or for economic purposes to determine which countries the recipients come from. However, neither Mailgun nor HubSpot use the data of our newsletter recipients to contact them directly and do not pass the data on to third parties.

We have concluded a data processing agreement with each of the service providers. It cannot be excluded that data may be transferred to the USA. We have concluded Standard Contractual Clauses (Art. 46(2)(c) GDPR) with Mailgun. HubSpot is certified under the Privacy Framework Agreement, so that an adequacy decision pursuant to Art. 45 GDPR serves as the legal basis.

Existing Customer Advertising

We may use your email address, which we received in the course of the sale of goods or services, for the electronic transmission of advertising for our own goods or services that are similar to those you have already purchased from us, provided you have not objected to this use. The provision of the email address is necessary for the conclusion of the contract. The processing is carried out on the basis of Art. 6(1)(f) GDPR, Section 7(3) UWG (German Unfair Competition Act) based on the legitimate interest in direct advertising. You can object to this use of your email address at any time by notifying us. You can also use the link provided for this purpose in the advertising email. There are no costs other than the transmission costs at the basic rates.

For email distribution, we also use the service providers Mailgun and HubSpot. Emails to existing customers are stored in a group separate from the newsletter customers under Section III. 7. In the event of an objection, your email address will be removed from the newsletter distribution list and placed on a "blacklist" to prevent further advertising from being sent. The legal basis for this is Art. 6(1)(f) GDPR.

Online Seminars

We offer live seminars via our website. These take place via web-based software that we operate ourselves. Registration for a seminar only requires a self-chosen username and your email address. The email address is compared with our customer database. If you already have a customer account, we offer you the option of logging in with your customer account. During the online seminar, you can send chat messages that we as the organiser, but also other participants, can see.

The online seminars, including chat messages, may be recorded by us and made available for retrieval on our website.

The legal basis for data processing is the performance of a contract (Art. 6(1)(b) GDPR). The processing of registration data is necessary for the conduct of the online seminar. In addition, we have a legitimate interest (Art. 6(1)(f) GDPR) in the recording so that the online seminar can be viewed again by the participants.

We delete the participation data after 2 years.

Hosting

This website is hosted by several external service providers (hosts). The hosts are:

• Timme Hosting GmbH & Co. KG, Ovelgönner Weg 43, 21335 Lüneburg, Germany
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
• Pusher Ltd, 28 Scrutton Street, London EC2A 4RP
• Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA
• Digital Ocean LLC, 106 6th Avenue, New York USA

For all hosts, we exclusively use European servers.

Personal data collected on this website is stored on the servers of the hosts. This may include, among other things, IP addresses, contact enquiries, meta and communication data, contract data, contact data, names, website accesses and other data generated via the website. The use of the hosts is for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR).

We have concluded a data processing agreement with each host.

Cookies and Third-Party Services

Our website uses cookies and other technologies. Cookies are small text files that are stored in the internet browser or by the internet browser on a user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is accessed again. Other technologies may include, for example, tracking pixels and other tracking code. We use cookies and other technologies for the purpose of making our offering more user-friendly, effective and secure, as well as to track the surfing behaviour of our website visitors and to target them with interest-based advertising.

The legal basis for the processing of personal data using (technically) necessary cookies ("essential cookies") is Art. 6(1)(f) GDPR. This legal basis also applies when the storage of information in the end user's terminal equipment or access to information already stored in the end user's terminal equipment is strictly necessary (Section 25(2) No. 2 TTDSG). The legal basis for the processing of personal data using cookies or technologies that are not strictly necessary ("functional cookies" and "marketing cookies"), such as for improving the experience on the website or for analysis purposes, is Art. 6(1)(a) GDPR and Section 25(1) TTDSG, namely the consent of the website visitor.

Whether and to what extent cookies and other technologies are used on our website, on what legal basis they are used and for what purposes personal data is processed, please refer to our privacy settings tool (also "cookie tool"):

Privacy Settings Button

Further explanations on selected third-party providers can also be found below in this privacy policy.

The cookie tool also provides information about any data transfers to third countries. The data transfer is either secured via Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Alternatively, adequacy decisions pursuant to Art. 45 GDPR may serve as the legal basis. For data transfers to the USA as a third country, the receiving company must be certified under the Data Privacy Framework Agreement for Art. 45 GDPR to apply. A list of certified companies can be accessed via the following link: https://www.dataprivacyframework.gov/s/participant-search

Cookies are stored on your computer. Therefore, you have control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can prevent the storage of cookies and the transmission of the data they contain. Cookies that have already been stored can be deleted at any time. However, we would like to point out that you may not be able to use all functions of this website to their full extent.

Under the following links, you can find out how to manage (including deactivate) cookies in the most common browsers:

• Chrome Browser: https://support.google.com/accounts/answer/61416?hl=en
• Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies
• Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
• Safari: https://support.apple.com/en-us/guide/safari/manage-cookies-and-website-data-sfri11471/mac
• Opera: http://help.opera.com/Windows/10.20/en/cookies.html

Usercentrics – Cookie Tool

To request consent on our website for the processing of your terminal device information and personal data by means of cookies or other tracking technologies, we use the consent tool "Usercentrics" (Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany). With the help of Usercentrics, you have the option of consenting to or declining the processing of your terminal device information and personal data by means of cookies or other tracking technologies. The settings you have made can also be changed subsequently. You can access the cookie tool via the footer on our website. The purpose of integrating "Usercentrics" is to leave the decision about the setting of cookies and similar functionalities to our website users and to offer the possibility of changing settings already made in the course of further use of our website. In the course of using Usercentrics, personal data and information about the terminal devices used are processed by us. Your data is sent to Usercentrics. The information about the settings you have made is also stored on your terminal device. The legal basis for the processing is Art. 6(1)(f) GDPR. Our legitimate interests in the processing lie in the storage of your user settings and preferences regarding the use of cookies and the evaluation of consent rates. After twelve months from the time the user settings were made, a new consent request is made. The user settings made are then stored again for this period, unless you have previously deleted the information about your user settings in the terminal device capacities provided for this purpose.

Google

We use services of Google Ireland Limited (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; subsidiary of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google") on our website.

We use, for example, Google Analytics, Google Ads, Google Maps and YouTube. You can find details of all services used in the cookie tool, in particular regarding the purposes, the data processed, the storage period and the legal basis of the processing.

It cannot be excluded that personal data may be transferred by Google, in particular to the USA. The adequacy decision of the European Commission pursuant to Art. 45 GDPR applies to data transfers to Google in the USA.

Google Analytics

The data processing serves the purpose of analysing this website and its visitors. Google uses the information obtained on our behalf to evaluate your use of the website, to compile reports on website activity and to provide other services related to website and internet use to the website operator. The IP address transmitted by your browser as part of Google Analytics, which is regularly truncated before transmission to the USA, is not merged with other Google data.

You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link: [https://tools.google.com/dlpage/gaoptout?hl=en]. To prevent collection by Google Analytics across devices, you can set an opt-out cookie. Opt-out cookies prevent future collection of your data when visiting this website. You must perform the opt-out on all systems and devices used for this to be fully effective. If you click here, the opt-out cookie will be set: Disable Google Analytics.

Here is a link to set the opt-out cookie

Remarketing or "Similar Audiences" Feature

The remarketing or "Similar Audiences" feature from Google allows the analysis of visitor behaviour and visitor interests.

To carry out the analysis of website usage, which forms the basis for the creation of interest-based advertisements, Google uses cookies. Through the cookies, website visits and anonymised data about the use of the website are recorded. If you subsequently visit another website in the Google Display Network, you will be shown advertisements that are highly likely to take into account previously accessed product and information areas.

You can permanently deactivate the use of cookies by Google by following the link below and downloading and installing the plug-in provided there: https://support.google.com/ads/answer/7395996?hl=en

Alternatively, you can deactivate the use of cookies by third-party providers by visiting the deactivation page of the Network Advertising Initiative at https://www.networkadvertising.org/choices/ and implementing the further information on opt-out mentioned there.

Google AdWords Conversion Tracking

We use the online advertising programme "Google AdWords" on our website and, in this context, conversion tracking (visit action evaluation). When you click on an advertisement placed by Google, a cookie for conversion tracking is placed on your computer. If you visit certain pages of our website and the cookie has not yet expired, Google and we can recognise that you clicked on the advertisement and were redirected to this page.

The information obtained with the help of the conversion cookie serves the purpose of creating conversion statistics. Here we learn the total number of users who clicked on one of our advertisements and were redirected to a page tagged with a conversion tracking tag. However, we do not receive any information that could be used to personally identify users.

Furthermore, you can deactivate personalised advertising for you in the advertising settings at Google. Instructions for this can be found at https://support.google.com/ads/answer/2662922?hl=en. In addition, you can deactivate the use of cookies by third-party providers by visiting the deactivation page of the Network Advertising Initiative at https://www.networkadvertising.org/choices/ and implementing the further information on opt-out mentioned there.

Google AdSense

We use the AdSense feature from Google on our website. This feature serves the purpose of renting out advertising space on the website and targeting visitors to the website with interest-based advertising on these spaces. Personalised, interest-based advertisements are displayed using cookies.

You can permanently deactivate the use of cookies by Google by following the link below and downloading and installing the plug-in provided there: https://support.google.com/ads/answer/7395996?hl=en.

Furthermore, you can deactivate the use of cookies by third-party providers by visiting the deactivation page of the Network Advertising Initiative at https://www.networkadvertising.org/choices/ and implementing the further information on opt-out mentioned there.

YouTube

We use the YouTube video embedding feature of YouTube LLC (901 Cherry Ave., San Bruno, CA 94066, USA; "YouTube") on our website. YouTube is a company affiliated with Google.

The feature displays videos stored on YouTube in an iFrame on the website. The "Enhanced Privacy Mode" option is activated. This means that YouTube does not store any information about visitors to the website. Only when you watch a video is information about it transmitted to YouTube and stored there.

Google Maps

We use the Google Maps embedding feature on our website. The feature enables the visual display of geographical information and interactive maps. Google Maps is only loaded with your consent (Art. 6(1)(a) GDPR).

Google Web Fonts

This site uses so-called web fonts provided by Google and stored on our servers, i.e. they are integrated locally, for the uniform display of fonts. When you access a page, your browser loads the web fonts from our servers. The use of Google Web Fonts is in the interest of a uniform and appealing presentation of our online offerings. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If your browser does not support web fonts, a standard font from your computer will be used.

Google Customer Reviews

For the purpose of customer reviews and internal quality management, we work with the Google Customer Reviews software on our website. With your consent (Art. 6(1)(a) GDPR), we transmit the order number, order number and customer number as well as the email address so that you can submit a review. Your personal data and information will not be passed on to third parties.

Google Tag Manager

We use the "Google Tag Manager" from "Google" on our website to integrate and manage website tags and other third-party elements via an interface on our website.

On the one hand, when the website is accessed with Google Tag Manager, an HTTP request is sent to Google. As a result, terminal device information and personal data such as your IP address and information about your browser settings are transmitted to Google. We use Google Tag Manager for the purpose of facilitating electronic communication by passing information to third-party providers via programming interfaces, among other things. In the Google Tag Manager, the respective tracking codes of third-party providers are implemented without us having to laboriously change the source code of the website ourselves. Instead, the integration takes place through a container that places a so-called "placeholder" code in the source code. In addition, the Google Tag Manager allows the data parameters of users to be exchanged in a specific order, in particular by ordering and systematising data packets.

On the other hand, the Google Tag Manager integrates third-party tags such as tracking codes or counting pixels on our website. The tool triggers other tags, which in turn collect your data. The Google Tag Manager itself does not evaluate the terminal device information and personal data of users collected by the tags. Rather, your data is forwarded to the respective third-party service for the purposes stated in our cookie tool. We have coordinated the Google Tag Manager with our cookie tool so that the triggering of certain third-party services in the Google Tag Manager is dependent on your selection in our cookie tool, so that only those third-party tags trigger data processing for which you have given consent. The use of the Google Tag Manager is covered by the consent for the respective third-party service. The legal basis for the processing is your consent pursuant to Art. 6(1)(a) GDPR. The storage period results from the description of the individual third-party services in the cookie tool.

Microsoft Advertising

Our website uses Microsoft Advertising, a conversion tracking technology from "Microsoft" (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA). A cookie is placed on your computer by Microsoft if you have reached our website via a Microsoft advertisement.

The information collected with the help of the cookie serves to create conversion statistics, i.e. to record how many users reach a conversion page after clicking on an advertisement. We learn the total number of users who clicked on our advertisement and were redirected to a page tagged with a conversion tracking tag. However, we do not receive any information that could be used to personally identify users. If you do not wish to participate in tracking, you can revoke your consent or object to this use by easily deactivating the Bing Ads conversion tracking cookie via your internet browser under user settings. You will then not be included in the conversion tracking statistics.

It cannot be excluded that personal data may be transferred, in particular to the USA. The adequacy decision of the European Commission pursuant to Art. 45 GDPR applies to data transfers to Microsoft in the USA.

Facebook Remarketing

We use the remarketing feature "Custom Audiences" from Meta Platforms Inc. (1601 Willow Road, Menlo Park, CA 94025, USA; or for the European area Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland; "Meta") on our website.

This feature serves the purpose of targeting visitors to the website with interest-based advertising on the social network Facebook.

For this purpose, the Meta pixel has been implemented on the website. Via this pixel, a direct connection to the servers is established when the website is visited. This transmits to the server which of our websites you have visited and what actions you have performed there. Facebook assigns this information to your personal Facebook user account. When you visit the social network Facebook, you will then be shown personalised, interest-based Facebook ads.

It cannot be excluded that personal data may be transferred, in particular to the USA. The adequacy decision of the European Commission pursuant to Art. 45 GDPR applies to data transfers to Meta in the USA.

Fingerprint.com

Our website uses Fingerprint.com, a web analytics service of FingerprintJS, Inc 1440 W. Taylor St #735, Chicago, IL 60607, USA ("Fingerprint.com"). Fingerprint.com uses your device fingerprint ("Device Fingerprint") to analyse your usage behaviour, in particular for fraud control and prevention on our website. Information is stored in the Device Fingerprint that Fingerprint.com recognises as a unique "fingerprint" the next time our website is accessed. Your data is immediately anonymised during this process and randomly changed every 24 hours, so that you remain anonymous to us as a user. The information used for the purpose of website optimisation is stored on our server. We only carry out this type of reach measurement and analysis with your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG.

The following information is stored in the Device Fingerprint:

Location information (browser language, approximate location)

Software (operating system, browser, browser configuration, browser plugins)

(anonymised) IP address

We have concluded a data processing agreement with Fingerprint.com. Data transfer to the USA is secured via Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Content Delivery Network (CDN)

A CDN is a network of servers that is capable of delivering content to website users in an optimised manner. Technically, the information transfer between your browser and our website is routed through the CDN provider's network. By using CDN, we can increase the global accessibility, security and performance of our website. Via CDN, content, especially very large files, can be delivered quickly even during high load peaks.

We use CDN from the following providers:

Google Cloud from Google. Further information about Google Cloud CDN can be found here: https://cloud.google.com/cdn/docs/overview?hl=en.

Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany

Bootstrap CDN, an open-source service from jsdelivr.com of the Polish software company ProspectOne, Królewska 65A/1, 30-081, Kraków, Poland

StackPath LLC, 1950 N Stemmons Fwy, Suite 1001, Dallas TX, 75207, USA, for the JavaScript library jQuery. This library primarily enables a modern design of our website.

The use of CDN providers is based on our legitimate interest in the most error-free and secure provision of our web offering as possible (Art. 6(1)(f) GDPR). The use of Bootstrap is only carried out with your consent (Art. 6(1)(a) GDPR).

The CDN providers are recipients of your personal data (such as IP address, browser type, browser version, which website is loaded or the time and date of the page visit) and act as processors on our behalf.

For data transfers to third countries, we have concluded Standard Contractual Clauses with Cloudflare. Further information can be found at: https://www.cloudflare.com/cloudflare_customer_SCCs-German.pdf. The third-country transfer in the context of Google Cloud usage is covered by Art. 45 GDPR.

Your personal data is stored for as long as is necessary for the purposes described.

Lunio

We use "Lunio.ai" from the provider PPC Protect Limited, The Strawberry Fields Digital Hub, Euxton Lane, Chorley, PR7 1PS, United Kingdom, to detect and prevent click fraud.

For this purpose, Lunio.ai monitors the IP addresses processed on our website and blocks fraudulent IP addresses. When visiting our website, your IP address is therefore also checked for fraud detection. No further personal data is processed. No information on your terminal device is accessed for the check. The legal basis for the processing is Art. 6(1)(f) GDPR. We have a legitimate interest in preventing fraud and securely providing our website. The IP address is deleted as soon as the check of the IP address has taken place.

We have concluded a data processing agreement with the service provider, in which we oblige them to protect the data of our customers and not to pass it on to third parties. For transfers of data to the United Kingdom, the European Commission has issued an adequacy decision (Art. 45 GDPR).

MaTelSo

We use a service from Matelso GmbH, Stuttgart, Germany ("Matelso") on our website. When you call a telephone number set up by Matelso for us, which we have integrated into advertising measures, information about the telephone call (duration and time of the call, which telephone number was dialled) is transferred to a web analytics service used by us (e.g. Google Analytics). Matelso also reads cookies set by our analytics service or other parameters of the website you visited, for example referrer, document path, remote user agent. The corresponding information is processed by Matelso in accordance with our instructions. We have concluded a data processing agreement with Matelso.

The processing is carried out for the purpose of improving the customer journey, customer service and measuring and optimising marketing campaigns.

The legal basis for the processing is your consent pursuant to Art. 6(1)(a) GDPR.

Personal data is stored on servers in the EU and deleted after the purpose has been fulfilled, for example after evaluating the campaign success or answering your enquiry. The standard storage period is 6 months. Further information can be found at: https://www.matelso.de/privacy.

Rights of Data Subjects

Right of Access

You have the right to obtain confirmation as to whether data concerning you is being processed and to access such data as well as further information and a copy of the data in accordance with Art. 15 GDPR.

Right to Rectification

In accordance with Art. 16 GDPR, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.

Right to Erasure and Restriction of Processing

Under the conditions of Art. 17 GDPR and Section 35 BDSG (German Federal Data Protection Act), you have the right to request that personal data concerning you be erased without undue delay. The right to erasure does not exist, among other things, if the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

You have the right, pursuant to Art. 18 GDPR, to request the restriction of the processing of your personal data insofar as the accuracy of the data is contested by you, the processing is unlawful but you oppose its erasure and we no longer need the data, but you require it for the establishment, exercise or defence of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR.

Right to Data Portability

You have the right to request that the data concerning you that you have provided to us be received in accordance with Art. 20 GDPR and to request its transfer to other controllers.

Right to Withdraw Consent

You have the right to withdraw consent given pursuant to Art. 7(3) GDPR at any time without giving reasons with effect for the future. The lawfulness of the processing until the withdrawal remains unaffected. In the event of withdrawal, we will delete the data concerned without delay, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.

Right to Object

You may at any time object, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR). Upon receipt of your objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You may object to the processing of your data for the purpose of direct marketing at any time. In this case, we will no longer process the personal data for these purposes. This also applies to profiling insofar as it is related to such direct marketing.

Right to Lodge a Complaint with a Supervisory Authority

You also have the right, pursuant to Art. 77 GDPR, to lodge a complaint with the competent supervisory authority if you believe that the processing of personal data concerning you infringes data protection law (Art. 77 GDPR).

Automated Decision-Making

Automated decision-making or profiling pursuant to Art. 22 GDPR does not take place.

Reservation of Changes

We reserve the right to adapt or update this privacy policy as necessary in compliance with the applicable data protection regulations. In this way, we can adapt it to current legal requirements and take into account changes to our services, e.g. when introducing new services. The most current version applies to your visit.

Last updated: 15 May 2024