Privacy Policy

1) Introduction and contact details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about the handling of your personal data when using our website. Personal data means any information relating to an identified or identifiable natural person.

1.2 The Controller for data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is WhiteWind Capital GmbH, Bockenheimer Landstraße 2-4, 60306 Frankfurt am Main, Germany, e-mail: info@whitewind.capital. The Controller is the natural or legal person who alone, or jointly with others, determines the purposes and means of the processing of personal data.

2) Data collection when visiting our website

2.1 If you use our website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to the website server (“server log files”). When you visit our website, we collect the following data, which are technically necessary for us to display the website:

The website you visited on our site
Date and time at the moment of access
Amount of data sent in bytes
Source/referrer from which you came to the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be shared or used in any other way. However, we reserve the right to review the server log files at a later time if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the Controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string “https://” and the lock symbol in your browser line.

3) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies—small text files that are placed on your device. Some of these cookies are automatically deleted once you close your browser (“session cookies”). Others remain on your device for longer and enable the site’s settings to be saved (“persistent cookies”). In the latter case, you can find information about the storage duration in the cookie settings of your web browser.

If any of the cookies we deploy also process personal data, that processing occurs based on Art. 6(1)(b) GDPR if required for contract performance, on Art. 6(1)(a) GDPR if you have given consent, or on Art. 6(1)(f) GDPR for the protection of our legitimate interests in ensuring the best possible functionality of the website and a customer-friendly, effective site experience.

You can configure your browser to inform you when cookies are set and decide individually whether to accept them, or to exclude the acceptance of cookies in certain cases or generally.

Please note that if you choose not to accept cookies, the functionality of our website may be limited.

4) Contact

4.1 Tidio

This website uses a live chat system provided by:
Tidio Poland Sp. z o.o., Wojska Polskiego 81, 70-481 Szczecin, Poland

The processing of personal data transmitted via chat takes place pursuant to Art. 6(1)(b) GDPR if necessary for entering into or performing a contract, or pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in effectively supporting visitors to our site.

Unless there are statutory retention obligations to the contrary, the data you provide will be deleted once the relevant matter has been conclusively resolved.

In addition, for the purpose of creating pseudonymous usage profiles by means of cookies, further information may be collected and evaluated, which does not serve to personally identify you and is not merged with other data sets. If such information has any personal reference, the processing is based on Art. 6(1)(f) GDPR, grounded in our legitimate interest in statistical analysis of user behavior for optimization purposes.

You can prevent cookies from being set by configuring your browser accordingly. In that case, however, the functionality of our website may be limited. You may object at any time, with effect for the future, to the collection and storage of data for the purpose of creating a pseudonymous usage profile by informing us of your objection.

We have entered into a data processing agreement with the provider to ensure the protection of our site visitors’ data and to prohibit unauthorized disclosure to third parties.

4.2 Calendly

For providing an online appointment-booking function, we use the services of:
Calendly, LLC, BB&T Tower, 271 17th St NW, Atlanta, GA 30363, USA

To schedule appointments, we collect first name, last name, and email address (and possibly a telephone number if a telephone appointment is requested) pursuant to Art. 6(1)(b) GDPR for contract initiation or performance; and pursuant to Art. 6(1)(f) GDPR, on the basis of our legitimate interest in efficient customer management and efficient appointment scheduling, this data is transferred to Calendly and stored there for the purpose of organizing appointments.

Your data will be deleted by the provider after the appointment has been held or after the agreed appointment period has expired.

We have entered into a data processing agreement with the provider to ensure that our site visitors’ data is protected and that it is not passed on to unauthorized third parties.

For transfers of data to the USA, the provider relies on the European Commission’s standard contractual clauses to ensure compliance with European data protection levels.

4.3 In the course of contacting us (e.g. via contact form or email), personal data is collected. The specific data collected if you use a contact form can be seen from the respective contact form. Such data is stored and used exclusively for the purpose of responding to your request or for contacting you, and for the associated technical administration.

The legal basis for processing these data is our legitimate interest in responding to your request, pursuant to Art. 6(1)(f) GDPR. If your contact aims at concluding a contract, then an additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted once your request has been conclusively processed—i.e., when it can be inferred from the circumstances that the issue in question has been clarified and no legal retention obligations stand in the way.

5) Use of customer data for direct advertising

5.1 Subscribing to our email newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing further data is voluntary and is used to address you personally. For sending the newsletter, we use the so-called double opt-in procedure. This means we will only send you an email newsletter if you have expressly confirmed to us that you consent to receive newsletters. We will then send you a confirmation email asking you to confirm—by clicking a corresponding link—that you wish to receive newsletters going forward.

By activating the confirmation link, you give us your consent to use your personal data as per Art. 6(1)(a) GDPR. When you subscribe to the newsletter, we store your IP address, as entered by the Internet service provider (ISP), as well as the date and time of registration, so we can trace any potential misuse of your email address at a later date. The data we collect when you subscribe to the newsletter is used exclusively for sending newsletters. You can unsubscribe at any time via the link provided in the newsletter or by sending an appropriate message to the Controller mentioned at the beginning. After you unsubscribe, your email address will be immediately deleted from our newsletter distribution list unless you have expressly consented to further use of your data or unless we reserve the right to use the data further, as permitted by law, and about which we inform you in this statement.

5.2 MailChimp

Our email newsletters are sent by:
The Rocket Science Group, LLC d/b/a MailChimp, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we transfer the data you provided when subscribing to the newsletter to this provider, pursuant to Art. 6(1)(f) GDPR, so that the provider can send the newsletter on our behalf.

Subject to your express consent as per Art. 6(1)(a) GDPR, the provider also performs a statistical performance analysis of newsletter campaigns using web beacons or tracking pixels in the emails sent, which can measure opening rates and specific interactions with newsletter content. It also collects and evaluates device information (e.g., time of retrieval, IP address, browser type, and operating system) but does not merge such information with other data sets.

You can withdraw your consent to newsletter tracking at any time, with effect for the future.

We have concluded a data processing agreement with the provider, which protects our website visitors’ data and prohibits disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, based on an adequacy decision by the European Commission to ensure compliance with the European level of data protection.

6) Online marketing

Google AdSense

This website uses Google AdSense, a web advertising service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google AdSense uses cookies, i.e., text files that are stored on your computer and enable an analysis of your website usage. Google AdSense also uses so-called web beacons (small invisible graphics) to collect information, allowing simple actions such as visitor traffic to be recorded, collected, and evaluated. The information generated by the cookie and/or web beacon (including your IP address) about your use of the website is usually transmitted to a Google server and stored there. This may also involve transmission to servers of Google LLC in the USA.

Google uses the information obtained to evaluate your usage behavior with regard to the AdSense ads. The IP address transmitted by your browser as part of Google AdSense is not merged with other data from Google. The information collected by Google may be transferred to third parties if required by law or if third parties process the information on Google’s behalf.

All the processing described above, in particular reading information from the device via cookies or web beacons, takes place only if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. Without this consent, Google AdSense will not be used during your visit.

You can withdraw your given consent at any time with effect for the future by deactivating this service via the cookie-consent tool provided on the website.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision of the European Commission, ensures compliance with European data protection levels.

You can view Google’s privacy policy here: https://www.google.de/policies/privacy/

7) Web analytics services

7.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables an analysis of your use of our website.

By default, when you visit the website, Google Analytics 4 sets cookies, which are small text files placed on your device to collect certain information. This includes your IP address, which, however, is shortened by Google by the last few digits to exclude direct personal reference.

The information is transferred to Google’s servers and processed there. Transfers to Google LLC in the USA may also occur.

Google uses the information collected on our behalf to evaluate your use of the website, to compile reports about website activities for us, and to provide other services related to website and internet usage. The IP address transmitted by your browser as part of Google Analytics, once shortened, is not merged with other Google data. The data collected in the course of using Google Analytics 4 is stored for two months and then deleted.

All the processing described above, especially setting cookies on your device, occurs only if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. If you do not provide consent, Google Analytics 4 will not be used during your website visit. You may withdraw your consent at any time with effect for the future. To do so, please deactivate this service using the cookie-consent tool provided on the website.

We have concluded a data processing agreement with Google that ensures the protection of our website visitors’ data and prevents unauthorized disclosure to third parties.

Further legal information on Google Analytics 4 can be found at:
https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/partner-sites

Demographics

Google Analytics 4 uses a special “demographics” feature to create statistics that provide information about the age, gender, and interests of site visitors. This is done by analyzing advertising and information from third parties. This allows target groups to be identified for marketing purposes. The collected data cannot be assigned to any specific person and is deleted after a storage period of two months.

Google Signals

As an extension of Google Analytics 4, this website can use Google Signals to create cross-device reports. If you have enabled personalized ads and linked your devices to your Google account, Google can—subject to your consent to Google Analytics under Art. 6(1)(a) GDPR—analyze your usage behavior across devices and create database models, including cross-device conversions. We do not receive any personal data from Google—only statistics. If you want to stop cross-device analysis, you can deactivate “Personalized advertising” in your Google account settings by following the instructions here: https://support.google.com/ads/answer/2662922?hl=en. For more information on Google Signals, see: https://support.google.com/analytics/answer/7532985?hl=en

User IDs

As an extension of Google Analytics 4, this website can use the “User IDs” feature. If you have consented to the use of Google Analytics 4 under Art. 6(1)(a) GDPR, created an account on this website, and log in with that account from various devices, your activities—including conversions—can be analyzed across devices.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, based on an adequacy decision by the European Commission ensuring compliance with European data protection levels.

7.2 1&1 IONOS WebAnalytics

This website uses the web analytics service of:
1&1 IONOS Internet SE, Elgendorfer Str. 57, 56410 Montabaur, Germany

Using cookies and/or comparable technologies (tracking pixels, web beacons, algorithms that read device and browser information), the service collects and stores pseudonymized visitor data, including information about the user’s device such as the IP address and browser information, to evaluate these data for statistical analyses of user behavior on our website and to create pseudonymized user profiles. This includes analyzing movement patterns (so-called heatmaps) that show how long visitors stay on our pages and how they interact with site content (e.g., text input, scrolling, clicks, and mouseovers). Pseudonymization generally excludes direct personal references. No merging takes place with other data that could identify you.

All the processing described above, especially reading or storing information on your device, takes place only if you have given your express consent under Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by deactivating this service via the cookie-consent tool provided on our website.

We have concluded a data processing agreement with the provider to ensure that our site visitors’ data is protected and is not passed on to unauthorized third parties.

7.3 Google Optimize

This website uses “Google Optimize,” a service provided by:
Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

Based on Google Analytics, this service enables a statistical evaluation of the use of new features and content of the website by showing test variants to certain user groups. In this way, we can see which variants are preferred by users—helping improve our site’s appeal.

For that purpose, Google Optimize uses cookies that are stored on your device and enable analysis of your website use. The information collected by the cookies about your site use is generally sent to a Google server and stored there. Transfer of information to Google LLC servers in the USA may also occur.

All processing described above, especially setting cookies to store and read information on the device you use, takes place only if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. Without this consent, Google Optimize will not be used while you visit our website. You can withdraw any consent granted at any time with effect for the future. To exercise your revocation, please deactivate this service using the cookie-consent tool provided on the website.

We have concluded a data processing agreement with the provider to ensure the protection of our site visitors’ data and to prohibit unauthorized disclosure to third parties.

7.4 Google Tag Manager

This website uses “Google Tag Manager,” a service provided by:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Tag Manager provides a technical basis to bundle and manage various web applications, including tracking and analytics services, via a single user interface, and to condition them upon certain criteria. Google Tag Manager itself does not store or read information from user devices. Nor does it perform its own data analysis. However, when Google Tag Manager is loaded, your IP address is sent to Google, where it may be stored. Transfer to Google LLC servers in the USA may also occur.

This processing only takes place if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. Without such consent, Google Tag Manager will not be used during your visit. You can withdraw your consent at any time with effect for the future. To do so, please deactivate the service in the cookie-consent tool on the website.

We have concluded a data processing agreement with the provider, ensuring that the data of our site visitors is protected and will not be disclosed to unauthorized third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, based on an adequacy decision by the European Commission to ensure compliance with European data protection levels.

8) Retargeting/Remarketing and conversion tracking

8.1 Facebook Pixel for creating Custom Audiences

Within our online offering, we use “Facebook Pixel,” provided by:
Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”)

When a user clicks on an ad we placed on Facebook, “Facebook Pixel” appends a URL parameter to our linked page’s URL. After being forwarded, this URL parameter is stored in the user’s browser via a cookie set by our linked page.

This enables Facebook to determine visitors to our online offering as a target audience for the display of advertisements (“Facebook Ads”). We use this service to show Facebook Ads we place only to those Facebook users who have shown an interest in our online offering or who exhibit certain characteristics (e.g., interests in particular topics or products determined by their website visits) that we transmit to Facebook (“Custom Audiences”).

Additionally, “Facebook Pixel” lets us track whether users are redirected to our website after clicking on a Facebook ad and which actions they perform there (“Conversion Tracking”).

The data collected remains anonymous to us and does not allow us to identify users. However, the data is stored and processed by Facebook so that it can be linked to the respective user profile, and Facebook may use the data for its own advertising purposes.

All processing described above, especially setting cookies to read information on the used device, only occurs if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service through the cookie-consent tool on our website.

We have concluded a data processing agreement with the provider to ensure the protection of our site visitors’ data and prohibit unauthorized disclosure to third parties.

Information generated by Facebook is typically transferred to a server operated by Facebook and stored there; in this context, data may be transmitted to servers of Meta Platforms Inc. in the USA.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, ensuring compliance with European data protection levels based on an adequacy decision by the European Commission.

8.2 Google Ads Remarketing

This website uses a retargeting technology from:
Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

For this purpose, Google sets a cookie in your browser, which automatically uses a pseudonymous cookie ID, based on the pages you visit, to enable interest-based advertising. Further data processing will only take place if you have agreed with Google that Google may link your web and app browsing history to your Google account and that information from your Google account may be used to personalize ads you see on the web. If, in this case, you are logged into Google during your visit to our website, Google uses your data together with Google Analytics data to create and define target group lists for cross-device remarketing. To create target groups, Google temporarily links your personal data with Google Analytics data. When using Google Ads Remarketing, personal data may also be transmitted to the servers of Google LLC in the USA.

All processing described above, especially setting cookies to read information on your device, only takes place if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. Without your consent, retargeting technology will not be used during your visit.

You can withdraw your given consent at any time with effect for the future. To do so, please deactivate the service via the cookie-consent tool on our website.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, based on an adequacy decision of the European Commission to ensure European data protection levels.

8.3 – Google Ads Conversion Tracking

This website uses the online advertising program “Google Ads” and, as part of Google Ads, the conversion tracking feature of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). We use Google Ads to draw attention to our attractive offers on external websites via advertising media (so-called Google Adwords). We can determine how successful the individual advertising measures are in relation to the data of the ad campaigns. Our aim is to show you advertisements that interest you, make our website more interesting for you, and achieve a fair calculation of advertising costs.

The conversion tracking cookie is set when a user clicks on an ad placed by Google. Cookies are small text files placed on your device, typically expiring after 30 days, and are not used to personally identify you. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can detect that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies can therefore not be tracked across Google Ads customers’ websites. The information obtained via the conversion cookie is used to create conversion statistics for Google Ads customers who have opted in for conversion tracking. Customers learn the total number of users who clicked on their ad and were forwarded to a page tagged with a conversion tracking tag. However, they do not receive information that identifies users personally. When using Google Ads, personal data may also be sent to servers of Google LLC in the USA.

Details regarding the processing triggered by Google Ads Conversion Tracking and Google’s handling of data from websites can be found here:
https://policies.google.com/technologies/partner-sites

All processing described above, especially the setting of cookies to read information on your device, only takes place if you have given your express consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating the service in the cookie-consent tool on our website.

You can also permanently object to the placement of these cookies by Google Ads Conversion Tracking by installing the browser plugin available at the following link:
https://www.google.com/settings/ads/plugin?hl=en

Please note that if you disable the use of cookies, certain features of this website may not function properly or may be limited.

You can find Google’s privacy policy here: https://www.google.de/policies/privacy/

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework to ensure compliance with European data protection levels under the European Commission’s adequacy decision.

– Google Ads Conversion Tracking

We use Google Ads to draw attention to our attractive offers on external websites via advertising media (Google Adwords). We can determine how successful the individual advertising measures are based on the data of the advertising campaigns. Our aim is to show you advertising of interest to you, to make our website more interesting for you, and to achieve a fair calculation of advertising costs.

The conversion tracking cookie is set when a user clicks on an ad placed by Google. These cookies usually expire after 30 days and are not used for personal identification. If a user visits certain pages of this website and the cookie has not expired, Google and we can see that the user clicked on the ad and was redirected. Each Google Ads customer receives a different cookie. Cookies cannot be tracked across the websites of Google Ads customers. The information collected by means of the conversion cookie is used to compile conversion statistics for Google Ads customers who have opted for conversion tracking. The customers learn the total number of users who clicked on their ad and were forwarded to a page containing a conversion tracking tag. They do not receive information that can identify users personally.

When using Google Ads, personal data may be transmitted to Google LLC’s servers in the USA.

Details regarding the processing triggered by Google Ads Conversion Tracking and Google’s handling of website data can be found here:
https://policies.google.com/technologies/partner-sites

All processing described above, in particular setting cookies to read information on the device you use, occurs only if you have given your express consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating the service via the cookie-consent tool provided on the website.

You can also permanently prevent these cookies from being set by downloading and installing the browser plug-in available here:
https://www.google.com/settings/ads/plugin?hl=en

If we have received data from users in the context of business or business-like relationships, we may use a Customer Match function within Google Ads to target such users with more interest-based advertising. In doing so, we send one or more files with aggregated customer data (mainly email addresses and phone numbers) to Google electronically. Google does not gain access to any clear data; instead, it automatically encrypts the information in the customer files via a special algorithm. The encrypted information can only be used by Google to match it with existing Google accounts that users have set up. This process allows personalized ads to be displayed across all Google services linked to that Google account.

We only transfer customer data to Google if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You can withdraw this consent from us at any time with future effect. More details on Google’s privacy measures regarding the Customer Match feature can be found here: https://support.google.com/google-ads/answer/6334160?hl=en&ref_topic=10550182

Google’s privacy policy is available here: https://www.google.de/policies/privacy/

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, ensuring compliance with European data protection standards under the European Commission’s adequacy decision.

– Google Marketing Platform

This website uses the online marketing tool Google Marketing Platform by:
Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“GMP”).

GMP uses cookies to show ads relevant to users, improve campaign performance reports, or prevent users from seeing the same ads multiple times. Using a cookie ID, Google records which ads are displayed in which browser, preventing them from appearing multiple times. GMP can also track conversions using cookie IDs to see if a user sees a GMP ad and later visits the advertiser’s website and makes a purchase. According to Google, GMP cookies do not contain personally identifiable information.

As soon as you use marketing tools from Google, your browser automatically establishes a direct connection to Google’s servers.

We have no control over the extent and further usage of the data collected by Google via this tool. According to our knowledge, by integrating GMP, Google receives the information that you called up the respective part of our web presence or clicked on an ad from us. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or not logged in, there is a possibility that the provider learns and stores your IP address. When using GMP, personal data may also be transmitted to servers of Google LLC in the USA.

All the processing described above, particularly setting cookies to read information from your device, only takes place if you have given your express consent under Art. 6(1)(a) GDPR. You may withdraw this consent at any time with effect for the future by deactivating the service in the cookie-consent tool on our website.

You can find the GMP by Google privacy policy here: https://www.google.de/policies/privacy/

– Google Ads Conversion Tracking without Cookies

This website uses the online advertising program “Google Ads” and, as part of Google Ads, conversion tracking by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

We use Google Ads to draw attention to our attractive offers on external websites (Google Adwords). We can measure the success of individual advertising campaigns. Our purpose is to show you advertising that interests you, make our website more interesting for you, and fairly calculate advertising costs.

This website uses Google Ads Conversion Tracking exclusively without cookies, meaning that at no point does the service place cookies on your device.

Instead, the local storage of your browser is used to store a unique ID assigned by Google, which allows an analysis of your website use. Certain user information is processed via this ID.

The ID is set when a user clicks on an ad placed by Google. If the user visits certain pages on this website, Google and we can recognize that the user clicked on the ad and was redirected. Each Google Ads customer receives a different ID. IDs cannot be tracked across multiple Google Ads customers’ websites. The information obtained through the ID is used to compile conversion statistics for Google Ads customers who have opted in for conversion tracking. The customers learn the total number of users who clicked on their ad and were forwarded to a page with a conversion tracking tag.

They do not obtain any information that allows personal identification. When using Google Ads, personal data may be transmitted to the servers of Google LLC in the USA. Details on the processing triggered by Google Ads Conversion Tracking and how Google handles website data can be found here:
https://policies.google.com/technologies/partner-sites

If the collected information can be considered personal data, it is processed according to Art. 6(1)(f) GDPR, based on our legitimate interest in statistically evaluating the success of our advertising campaigns.

Google’s privacy policy is available here: https://www.google.de/policies/privacy/

9) Site functionalities

9.1 Google Maps

This website uses the online map service:
Google Maps (API) from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

Google Maps is a web service used to display interactive (land) maps and to visually present geographical information. By using this service, our location can be displayed, making a possible route easier for you.

When you open pages in which Google Maps is integrated, information about your usage of our website (e.g., your IP address) is transmitted to Google’s servers and stored there. This may also involve transfer to servers of Google LLC in the USA. This occurs regardless of whether Google provides a user account through which you are logged in or if no user account exists. If you are logged into Google, your data will be directly associated with your account. To avoid association with your Google profile, you must log out before activating the button. Google stores your data (including for users who are not logged in) as usage profiles and evaluates them. Processing, storage, and evaluation occur based on Art. 6(1)(f) GDPR, reflecting Google’s legitimate interest in displaying personalized advertising, conducting market research, and/or tailoring Google websites to user needs. You have a right to object to the creation of these user profiles, and you must direct any such objection to Google. If you do not agree with data transmission to Google in the context of using Google Maps in the future, you can disable the web service by turning off JavaScript in your browser. Google Maps and the map display on this website can then no longer be used.

Where legally required, we have obtained your consent to the above-described data processing pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. To exercise your withdrawal, please follow the procedure described above for raising an objection.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with European data protection levels.

9.2 Google Web Fonts

To ensure a consistent display of fonts, this page uses so-called web fonts from:
Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

When you visit a page, your browser loads the required web fonts into its cache to display text and fonts correctly, establishing a direct connection to the provider’s servers. Certain browser information, including your IP address, is transmitted to the provider.

Data may also be transferred to Google LLC, USA.

The processing of personal data during the connection with the font provider will only occur if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You can withdraw this consent at any time with future effect by disabling this service via the cookie-consent tool on the website. If your browser does not support web fonts, a default font is used by your computer.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards by virtue of an adequacy decision by the European Commission.

9.3 Google Customer Reviews (formerly the Google Certified Shop Program)

We partner with Google as part of the “Google Customer Reviews” program, provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). This program gives us the opportunity to collect customer reviews from users of our website. After a purchase on our website, you may be asked if you would like to participate in an email survey from Google.

If you grant your consent under Art. 6(1)(a) GDPR, we will send your email address to Google. You will receive an email from Google Customer Reviews asking you to rate your purchase experience on our website. The rating you provide will be combined with our other ratings and displayed in our Google Customer Reviews logo and in our Merchant Center dashboard. It will also be used for Google Seller Ratings. When using Google Customer Reviews, personal data may also be transmitted to the servers of Google LLC in the USA.

You can withdraw your consent at any time by notifying the Controller or Google.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework to ensure compliance with the European data protection level under the European Commission’s adequacy decision.

9.4 Google Meet

For conducting online meetings, video conferences, and/or webinars, we use:
Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to the servers of Google LLC in the USA.

The provider processes various data, and the extent of the data processed depends on what data you share before or during participation in an online meeting, video conference, or webinar. Your data, as a communication participant, is processed and stored on the provider’s servers. This may include, in particular, your registration data (name, email address, phone number (optional), and password) and session data (topic, participant IP address, device information, description (optional)).

Additionally, image and sound contributions from participants, as well as voice inputs in chats, may be processed.

If the processing of personal data is required to fulfill a contract with you (this also applies to processing required for pre-contractual measures), the legal basis is Art. 6(1)(b) GDPR. If you have given us your consent to process your data, processing is carried out according to Art. 6(1)(a) GDPR. You can withdraw any consent at any time with future effect.

Otherwise, the legal basis for processing data for online meetings, videoconferences, or webinars is our legitimate interest pursuant to Art. 6(1)(f) GDPR in effectively conducting the online meeting, webinar, or videoconference.

We have concluded a data processing agreement with the provider to ensure our site visitors’ data is protected and is not disclosed to unauthorized third parties.

9.5 Zoom

For conducting online meetings, video conferences, and/or webinars, we use:
Zoom Video Communications Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA

The provider processes various data, depending on which data you share before or during an online meeting, video conference, or webinar. Your data, as a communication participant, is processed and stored on the provider’s servers. This can include, in particular, your registration data (name, email address, phone number (optional), password) and meeting session data (topic, participant IP address, device information, description (optional)).

Additionally, image and sound contributions from participants, as well as chat text entries, may be processed.

Wherever processing of personal data is necessary to fulfill a contract with you (this also applies to pre-contractual measures), Art. 6(1)(b) GDPR serves as the legal basis. If you have given us consent to process your data, processing is based on Art. 6(1)(a) GDPR. Such consent may be withdrawn at any time, with future effect.

Otherwise, the legal basis for data processing in online meetings, video conferences, or webinars is our legitimate interest under Art. 6(1)(f) GDPR in effectively conducting online meetings, webinars, or video conferences.

We have concluded a data processing agreement with the provider to ensure our site visitors’ data is protected and is not disclosed to unauthorized third parties.

For data transfers to the USA, the provider relies on the European Commission’s standard contractual clauses to ensure compliance with European data protection levels.

9.6 Heyflow

To conduct surveys or online forms, we use services by:
Heyflow GmbH, Jungfernstieg 49, 20354 Hamburg, Germany

The provider allows us to create and evaluate surveys and online forms. In addition to the personal data you enter in the forms, information about your operating system, browser, date and time of your visit, referrer URL, and your IP address is collected, transmitted to the provider, and stored on the provider’s servers.

The information you enter into the forms is stored in a password-protected manner to ensure that no third parties can access it, and only we can evaluate the data for the purpose specified in the respective form.

For processing personal data required to fulfill a contract with you (also for pre-contractual measures), the legal basis is Art. 6(1)(b) GDPR. If you have provided us with consent for the processing of your data, processing is based on Art. 6(1)(a) GDPR. You can withdraw your consent at any time, with future effect.

We have concluded a data processing agreement with the provider to ensure that our site visitors’ data is protected and not unlawfully disclosed to third parties.

9.7 Online applications via a form

On our website, we post current job openings in a separate section, and interested parties can apply through a dedicated form.

Applicants must provide all personal data needed for a thorough assessment, including general details (name, address, contact information), work-related evidence, and possibly health-related details. Specifics are described in the job posting.

When the form is submitted, the applicant data is encrypted according to the current state of technology, stored by us, and used solely for processing the application. Processing is based on Art. 6(1)(b) GDPR (and/or § 26(1) of the German Federal Data Protection Act (BDSG) if processed in Germany), under which the application process is deemed contract initiation for an employment agreement.

If, in the context of the application process, we request special categories of personal data according to Art. 9(1) GDPR (e.g., health data such as information on a severe disability), the processing is pursuant to Art. 9(2)(b) GDPR to exercise rights and fulfill obligations of labor law, social security, and social protection.

Alternatively or additionally, processing of special data categories may be based on Art. 9(2)(h) GDPR for healthcare or occupational medicine, for assessment of the applicant’s work capacity, for medical diagnosis, care, or treatment in the health or social sector, or for the administration of health/social services or systems.

If the applicant is not selected or withdraws their application prematurely, data transmitted via the form, as well as all electronic correspondence (including the application email), will be deleted after a notification at the latest six months from that time. This period is determined by our legitimate interest in responding to follow-up inquiries and, if necessary, fulfilling our obligations to provide evidence under the Equal Treatment Act.

In the event of a successful application, the data provided is processed for the purpose of executing the employment relationship based on Art. 6(1)(b) GDPR (in Germany, in conjunction with § 26(1) BDSG).

9.8 Applications for posted positions via email

On our website, we post current job vacancies in a separate section, where interested parties may apply by email to the listed contact address.

Applicants must provide all personal data needed for a careful assessment—general details such as name, address, contact information, performance-related evidence, and possibly health data. Further details can be found in the respective job posting.

After receiving an application by email, the data is stored and evaluated exclusively for processing the application. For queries, we use either the applicant’s email or phone number. Processing is based on Art. 6(1)(b) GDPR (and/or § 26(1) BDSG in Germany), by which the application process is considered contract initiation for an employment agreement.

If special categories of personal data under Art. 9(1) GDPR (e.g., health data such as information on a severe disability) are requested in the context of the application process, processing is pursuant to Art. 9(2)(b) GDPR so that we can exercise the rights and meet the obligations of labor law, social security, and social protection.

Alternatively or additionally, processing of special data categories may be based on Art. 9(2)(h) GDPR if it is for healthcare or occupational medicine, the assessment of the applicant’s capacity to work, medical diagnosis, care, or treatment in the health or social field, or for the administration of health or social systems and services.

If an applicant is not chosen or withdraws their application prematurely, all data provided, along with all electronic correspondence (including the application email), will be deleted after a notification at the latest six months after that point. This period is determined by our legitimate interest in answering any subsequent questions and, if necessary, providing proof under regulations on equal treatment of applicants.

10) Tools and miscellaneous

Cookie-consent tool

This website uses a “cookie-consent tool” to obtain valid user consents for cookies or cookie-based applications that require consent. When users access the site, they see an interactive user interface (the “cookie-consent tool”) where they can consent, via checkboxes, to the use of certain cookies or cookie-based applications. Only if the user grants explicit consent via checkboxes are those cookies or services actually loaded. This ensures that such cookies are set on the user’s device only if consent has been provided.

The tool sets technically necessary cookies to store your cookie preferences. Personal data is not processed as a rule.

If, in exceptional cases, the tool processes personal data (such as the IP address) for storage, assignment, or logging of cookie settings, this processing is pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing a legally compliant, user-specific, and user-friendly cookie-consent management system—and therefore in designing our website to comply with legal requirements.

Another legal basis is Art. 6(1)(c) GDPR, as we, as the Controller, are subject to the legal obligation to make the use of technically unnecessary cookies dependent on user consent.

Where necessary, we have concluded a data processing agreement with the provider, ensuring the protection of our website visitors’ data and preventing unauthorized disclosure to third parties.

For more information about the operator and settings of the cookie-consent tool, please refer to the relevant user interface on our website.

11) Rights of the data subject

11.1 Under applicable data protection law, you have the following rights toward the Controller regarding the processing of your personal data (access and intervention rights). For the conditions governing each right, please refer to the indicated legal basis:

Right of access pursuant to Art. 15 GDPR
Right to rectification pursuant to Art. 16 GDPR
Right to erasure pursuant to Art. 17 GDPR
Right to restriction of processing pursuant to Art. 18 GDPR
Obligation to notify pursuant to Art. 19 GDPR
Right to data portability pursuant to Art. 20 GDPR
Right to withdraw consent granted pursuant to Art. 7(3) GDPR
Right to lodge a complaint pursuant to Art. 77 GDPR

11.2 Right to object

If we process your personal data based on our overriding legitimate interest as determined by a balancing of interests, you have the right at any time to object to such processing with effect for the future, on grounds arising from your particular situation.

If you exercise your right to object, we will stop processing the affected data. However, further processing may be retained if we demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or if the processing serves to assert, exercise, or defend legal claims.

If your personal data is processed by us for direct marketing purposes, you have the right to object to such processing at any time. You may exercise your objection as described above.

If you exercise your right to object, we will stop processing the affected data for direct marketing purposes.

12) Duration of storage of personal data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing, and—where relevant—also by any statutory retention periods (e.g., those under commercial or tax law).

If personal data is processed based on your express consent under Art. 6(1)(a) GDPR, such data is stored until you withdraw your consent.

If there are statutory retention periods for data processed within contractual or contract-like obligations under Art. 6(1)(b) GDPR, that data will be routinely deleted once these retention periods expire, provided that it is no longer necessary for fulfilling or initiating a contract and/or we have no legitimate interest in further storage.

If personal data is processed based on Art. 6(1)(f) GDPR, it is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can prove compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.

Where personal data is processed for direct marketing purposes under Art. 6(1)(f) GDPR, it is stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise stated in the specific information of this policy on certain processing situations, personal data that has been stored will be deleted when it is no longer needed for its intended purpose.