Privacy policy

e) Comfort Cookies

f) Marketing-Cookies

4. Processing for analysis purposes (Google Analytics)

We use Google Analytics, a web analysis service of Google Inc. (“Google”) on the basis of our legitimate interests. Google uses cookies. Information generated by the cookie about your use of the online offer is generally transmitted to a Google server in the United States and stored there. Google is certified under the Privacy Shield Agreement and therefore offers a guarantee of compliance with European data privacy legislation. You can view further information at the following address: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

a) What is the purpose of using Google Analytics?

Google will process the information generated about the user on our behalf to analyse use of our online offer by the users, in order to compile reports about the activities within our online offer and to provide further services associated with use of this online offer and Internet usage for us. In so doing, pseudonymised us-er profiles of the users can be generated from the processed data. We only use Google Analytics with activated IP anonymisation. This means the IP address of the users is truncated by Google within member states of the European Union or in other states which are party to the Agreement on the European Economic Area. Only in exceptional cases is a full IP address transmitted to a Google server in the United States and truncated there. The IP address transmitted by the user’s browser is not combined with any other Google data.

b) How can I prevent the use of Google Analytics?

The users are able to prevent the storage of cookies by means of a corresponding setting in their browser software; the users are also able to prevent the recording of the data relating to their usage of the online offer generated by the cookie and processing of this data by Google by downloading and installing the browser plugin available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de. You will find further information about Google’s data usage, possibilities for stopping or objecting to processing on Google’s website: https://www.google.com/intl/de/policies/privacy/partners (“Data usage by Google during your usage of our partners’ websites or apps”), http://www.google.com/policies/technologies/ads (“Data usage for advertising purposes"), http://www.google.de/settings/ads (“Manage information that Google uses to display advertising to you").

5. Processing for the purposes of personalised advertising (Google-Re/Marketing Services)

We use the marketing and remarketing services (“Google Marketing Services” for short) of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”) on the basis of our legitimate interests.

a) What is the purpose of using Google Marketing Services?

Google Marketing Services enable us to display advertisements for and on our website more effectively in order only to present advertisements to users that potentially meet their interests. For example, if a user is shown advertisements for products for which they have shown an interest on other websites, we talk here about “remarketing”. For these purposes, a Google code is exported directly by Google when our or other websites are accessed on which Google Marketing Services is enabled and (re)marketing tags (invisible graphics or code, also re-ferred to as “web beacons”) are integrated into the website. An individual cookie, i.e. a tiny file, is cached on the users’ device with their help. (Other comparable technologies can also be used instead of cookies). The cookies can be set from a variety of domains, including google.com, doubleclick.net, invitemedia.com, ad-meld.com, googlesyndication.com or googleadservices.com. A note is made in this file which of the users’ websites have been searched, in what content they have shown an interest and what offers they have clicked, further technical information about the browser and operating system, linked websites, length of the visit, and other details about use of the online offer. The users’ IP address is also recorded, although we do give notice within the scope of Google Analytics that the IP ad-dress is truncated within member states of the European Union or in other states party to the Agreement on the European Economic Area and only transmitted in full to a server at Google in the USA and truncated there in exceptional circum-stances. The IP address shall not be combined with the user’s data within other Google offers. Google may combine the aforesaid information also with such in-formation from other sources. If the user subsequently visits other websites, they may be displayed advertisements tailored to them based on their interests. The users’ data is processed pseudonymised with the scope of Google Marketing Ser-vices. This means that Googles does not save and process the name or email ad-dress of the users but processes the relevant data cookie-related within pseudon-ymised user profiles. This means that from Google’s perspective, the advertise-ments are not administered and displayed for a specifically identified person but for the owner of the cookie, regardless of who this cookie owner is. This does not apply if a user has explicitly permitted Google to process the data without this pseudonymisation. The information gathered by Google Marketing Services about the users is transmitted to Google and stored on Google’s servers in the USA. The Google Marketing Services used by us include the online advertising program “Google AdWords”. In the case of Google AdWords, each AdWord customer re-ceives a different “conversion cookie”. Cookies can therefore not be tracked using the websites AdWords customers. The information collected with the help of cookies serves to generate conversion statistics for AdWords customers who have opted for conversion tracking. The AdWords customers learn about the to-tal number of users who have clicked their advertisement and who were for-warded to a page provided with a conversion tracking tag. However, they are not given any information that can be used to identify users personally. We are able to integrate third parties’ advertisements because of the Google Marketing Ser-vice “DoubleClick”. DoubleClick uses cookies, with which Google and its partner websites enable the placement of advertisements based on visits by users on this website and other websites on the Internet. Furthermore, we are able to use “Google Tag Manager” in order to integrate and manage the Google analysis and marketing services into our website. You will find further information about data usage on marketing purposes by Google on the overview screen: https://www.google.com/policies/technologies/ads, Google’s Data Privacy Notice can be accessed at https://www.google.com/policies/privacy.

b) How can I prevent the use of Google re/marketing services?

If you would like to object to the interest-related advertising by Google Marketing Services, you can use the settings and opt-out options provided by Google: http://www.google.com/ads/preferences.

6. Processing for the purpose of various social media applications

The links/buttons to social media networks and platforms used within our online offer (hereinafter referred to as “social media”) only create a contact between social networks and the users when users click the links/buttons and the respec-tive networks or their websites are accessed. This function equates to the mecha-nism of a standard online link. The following presentation offers an overview of the linked social media provid-ers, alongside links to their data privacy notices which contain further infor-mation about processing of data and, already mentioned here in part, options for raising an objection (‘opt-out’):

» facebook.com Facebook Ireland Ltd. 4 Grand Canal Square Grand Canal Harbour Dublin 2, Ireland Data Privacy Notice: de-de.facebook.com/policy.php, Opt-Out: www.facebook.com/settings.

» YouTube/ Google Inc. 1600 Amphitheatre Parkway Mountain View CA 94043, USA Data Privacy Notice: https://www.google.com/policies/privacy/, Opt-Out: https://www.google.com/settings/ads/.

» Twitter Inc. 795 Folsom St., Suite 600 San Francisco CA 94107, USA Data Privacy Notice: http://twitter.com/privacy.

» kununu GmbH Neutorgasse 4-8, Top 3.02 1010 Vienna Austria Operator of the kununu website and controller as defined by data protection legislation: https://www.xing.com/privacy.

» XING AG Dammtorstrasse 29-32 20354 Kraiburg Germany Data Privacy Notice: https://www.xing.com/privacy.

» LinkedIN Ireland 70 Sir John Rogerson’s Quay, Dublin 2, Ireland Data Privacy Notice: https://www.linkedin.com/legal/privacy-policy.

7. Further services and third-party content

Within our online offer we employ content or service offers from third-party providers based on our legitimate interests (i.e. interest in the analysis, optimisa-tion and economic operation of our online offer, as defined by Art. 6 (1) f) GDPR, in order to integrate their content and services, such as videos and fonts (herein-after referred to collectively as “contents”). That always depends on third-party providers of this content using the users’ IP address, as they could not send the content to their browsers without the IP address. The IP address is therefore re-quired in order to display this content. We make every effort only to use such content whose respective providers use the IP address to deliver content. Third-party providers are able to use ‘pixel tags’ (invisible graphics, also referred to as “web beacons”) for statistical and marketing purposes. The visitor traffic on the pages of this website can be analysed with the help of “pixel tags”. Furthermore, the pseudonymised information can be saved in cookies on the users’ device and include technical information about the browser and operating system, linked websites, length of the visit and further details on how to use our online offer and also combined with such information from other sources. The following presentation offers an overview of third-party providers, along-side links to their data privacy notices, which contain further information about the processing of data and, already mentioned in part here, options for raising an objection (‘opt-out’):

» Maps of the “Google Maps” service Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA Data Privacy Notice: https://www.google.com/policies/privacy/, Opt-Out: https://www.google.com/settings/ads/.

» Videos on the platform “YouTube” Google Inc. 1600 Amphitheatre Parkway Mountain View, CA 94043, USA Data Privacy Notice: https://www.google.com/policies/privacy/ Opt-Out: https://www.google.com/settings/ads/.

Information about Google Inc.: Google is certified under the Privacy Shield Agreement and therefore offers a guarantee of compliance with European data privacy legislation. You can view further information at the following address: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

E. Legal basis for processing

We only process users’ personal data in compliance with the relevant data priva-cy requirements. That means the users’ data is only processed if there is legal consent. That means, in particular, if data processing is necessary to provide our contractual services (e.g. process orders) and online services or required under the law, the users have given their consent, and because of our legitimate inter-ests. With respect to processing personal data based on the General Data Protection Regulation (GDPR), we point out that the legal basis of consent is Art. 6 (1) a and Art. 7 GDPR, the legal basis for processing to provide our services and implement contractual measures is Art. 6 (1) b GDPR, the legal basis for processing to meet our legal obligations Art. (1) c GDPR, and the legal basis for processing to assume our legitimate interests is Art. 6 (1) f GDPR. We would additionally also like to refer to the legal basis of Art. 26 (1) of the German Federal Data Protection Act (BDSG) for the purposes of processing appli-cants’ data.

F. Legitimate interests

We process users’ personal data, in part, on the basis of legitimate interests. Data is only processed on the basis of legitimate interests, if this is necessary and our interests predominate in the individual case. If we support processing on this le-gal basis, our interest in processing relates particularly to the guarantee of securi-ty of the places of work, the functionality of the internal administration and, espe-cially, on the analysis and optimisation and on the economic operation and securi-ty of our online offer, as defined by Art. 6 (1) f GDPR. To do this, processing the user’s personal data is necessary to measure reach, generate profiles for adver-tising and marketing purposes and to collect access data and use of the services of third-party providers.

G. Recipients of personal data and transmission in a third country or an international organisation

Data is only disclosed to third parties as part of the statutory requirements. We only disclose users’ data to third parties if this is required, for example, for invoic-ing purposes or for other purposes, if these are required in order to meet our contractual obligations to users. If we employ subcontractors to provide our ser-vices, we take suitable legal precautions and appropriate technical and organisa-tional measures to guarantee the protection of personal data in accordance with the relevant statutory regulations. If content, tools or other means are used by other providers within the scope of this Data Privacy Notice (hereinafter referred to collectively as “third-party providers”) and their given registered office is in a third country, it is to be assumed that data will be transferred to the countries in which the third-party provider is located. By third countries, we mean countries, in which the GDPR is not directly enforceable under the law, i.e. principally coun-tries outside the EU or the European Economic Area. Data is transferred to third countries, either when there is a reasonable level of data protection, consent from users or other statutory permission.

H. Retention period

The data saved at our company is erased if it is no longer required for its intend-ed purpose and there are no statutory retention obligations that stand in the way of the erasure. If the users’ data is not erased because it is required for other le-gally permitted purposes, its processing will be restricted. This means that data will be blocked and not processed for other purposes. This applies, for example, to users’ data which has to be retained for commercial or tax reasons. Based on statutory requirements, the retention is for 6 years pursuant to Art. 257 (1) Ger-man Commercial Code [HGB] (books of account, inventories, opening balances, annual statements, commercial letters, accounting records etc.) and for 10 years pursuant to section 147 (1) German Fiscal Code (AO) (books, records, manage-ment reports, accounting records, commercial letters, documents relevant to taxa-tion etc.).

I. Your rights based on processing

When personal data is processed, you have the following aforesaid rights pursu-ant to Art. 15 ff GDPR:

I. Right of access

You are able to demand information if we process personal data concerning you. If this is the case, you have the right to information about this personal data and to further information associated with processing (Art. 15 GDPR). Please bear in mind that this right of access may be restricted or excluded in certain cases.

II. Right to rectification

In the event that personal data concerning you is (no longer) accurate or com-plete, you can demand rectification and, if necessary, completion of this data (Art. 16 GDPR).

III. The right of erasure and restriction of processing

Provided the legal conditions are met, you may demand the erasure of your per-sonal data (Art. 17 GDPR) or the restriction of processing of this data (Art. 18 GDPR). However, there is no right of erasure pursuant to Art. 17 (1) and (2) GDPR, if processing of personal data is necessary to carry out a task that is in the public interest or to exercise official authority (Art. 17 (3) b GDPR).

IV. Right to object

For reasons connected with your particular situation, you can object to our pro-cessing personal data concerning you at any time (Art. 21 GDPR). Provided the legal conditions are met, we will no longer process your personal data as a result.

J. Right to object where there is consent

You have the right to withdraw your consent at any time. The objection only has an effect for the future. This means that the lawfulness of the processing that took place on grounds of consent until the objection will not be affected.

K. Right of complaint with a supervisory authority

Sie haben das Recht, sich bei einer Aufsichtsbehörde im Sinn des Art. 51 DS-GVO über die Verarbeitung Ihrer personenbezogenen Daten zu beschweren. Die zuständige Aufsichtsbehörde können Sie wie folgt kontaktieren: SGF Waldkraiburg Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 27 91522 Ansbach Telefon: +49 (0) 981 53 1300 Telefax: +49 (0) 981 53 98 1300 E-Mail: poststelle@lda.bayern.de Zudem stellt das Landesamt ein elektronisches Beschwerdeformular zur Verfügung, welches Sie unter der nachfolgenden Adresse abrufen können: https://www.lda.bayern.de/de/beschwerde.html SGF Waltershausen Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit Postfach 900455 99107 Erfurt Telefon: +49 (361) 57-3112900 Telefax: +49 (361) 57-3112904 E-Mail: poststelle@datenschutz.thueringen.de

L. Changes to the Data Privacy Notice

We reserve the right to make changes to the Data Privacy Notice to take account of changes in the legal environment or changes to the services and to data pro-cessing. This only applies to declarations about data processing, however. If con-sents are required from the users or elements of the Data Privacy Notice contain regulations of the contractual relationship with the users, the changes will only be made with the users’ consent. The users are urged to familiarise themselves with the contents of the Data Privacy Notice.

M. Web analytics