Privacy Policy

Introduction and Overview

We have prepared this Privacy Policy (version dated October 7, 2026) to provide you with information in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, to explain which personal data (hereinafter “data”) we, as the data controller—and the data processors we engage (e.g., service providers)—process, will process in the future, and what legal options are available to you. The terms used are to be understood as gender-neutral. In short: We provide you with comprehensive information about the data we process about you. Privacy policies usually sound very technical and use legal jargon. This privacy policy, however, is intended to explain the most important points to you as simply and transparently as possible. To the extent that it promotes transparency, technical Terms Explained in an Easy-to-Understand Way, links to additional information are provided, and Graphs We use this policy to explain, in clear and simple language, that we process personal data in the course of our business activities only when there is a corresponding legal basis for doing so. This certainly isn’t possible if one provides explanations that are as brief, unclear, and legally technical as those often found online when it comes to data protection. I hope you find the following explanations interesting and informative, and perhaps you’ll discover a piece of information or two that you weren’t aware of before. If you still have questions, please contact the responsible body listed below or in the legal notice, follow the provided links, and review additional information on third-party websites. You can, of course, also find our contact information in the legal notice.

Scope of Application

This Privacy Policy applies to all personal data processed by us within the company and to all personal data processed by companies we have engaged (data processors). By “personal data,” we mean information as defined in Article 4(1) of the GDPR, such as a person’s name, email address, and mailing address. The processing of personal data enables us to offer and bill for our services and products, whether online or offline. The scope of this Privacy Policy includes:

• All online platforms (websites, online stores) that we operate
• Social Media Presence and Email Communication
• Mobile apps for smartphones and other devices

In short: This Privacy Policy applies to all areas within the company where personal data is processed in a structured manner through the channels listed above. Should we enter into a legal relationship with you outside of these channels, we will notify you separately if necessary.

Legal Basis

In the following Privacy Policy, we provide you with transparent information regarding the legal principles and regulations—that is, the legal bases under the General Data Protection Regulation—that enable us to process personal data. With regard to EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016. You can, of course, access this EU General Data Protection Regulation online on EUR-Lex, the portal for EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679 Read more. We process your data only if at least one of the following conditions applies:

1. Consent(Article 6(1)(a) of the GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of the data you entered in a contact form.
2. Contract(Article 6(1)(b) of the GDPR): We process your data to fulfill a contract or pre-contractual obligations with you. For example, when we enter into a purchase agreement with you, we need certain personal information in advance.
3. Legal Obligation(Article 6(1)(c) of the GDPR): We process your data when we are subject to a legal obligation to do so. For example, we are legally required to retain invoices for accounting purposes. These invoices typically contain personal data.
4. Legitimate Interests(Article 6(1)(f) of the GDPR): In cases where legitimate interests do not infringe upon your fundamental rights, we reserve the right to process personal data. For example, we must process certain data in order to operate our website securely and cost-effectively. This processing therefore constitutes a legitimate interest.

Other conditions, such as the processing of data in the public interest, the exercise of official authority, and the protection of vital interests, generally do not apply to us. Should such a legal basis nevertheless be relevant, it will be indicated in the appropriate section. In addition to the EU Regulation, national laws also apply:

• InAustria, this is the Federal Act on the Protection of Natural Persons with Regard to the Processing of Personal Data (Data Protection Act), orDSG for short.
• InGermany, theFederal Data Protection Act(BDSG) applies.

If any additional regional or national laws apply, we will provide you with information about them in the following sections.

Retention period

It is our general policy to store personal data only for as long as is strictly necessary to provide our services and products. This means that we delete personal data as soon as the reason for processing it no longer exists. In some cases, we are legally required to store certain data even after the original purpose has ceased to exist, for example, for accounting purposes. If you request the deletion of your data or revoke your consent to data processing, the data will be deleted as soon as possible, provided there is no legal obligation to retain it. We provide further information below regarding the specific duration of each data processing activity, to the extent that we have additional details available.

Rights Under the General Data Protection Regulation

In accordance with Articles 13 and 14 of the GDPR, we are informing you of the following rights to which you are entitled to ensure that your data is processed in a fair and transparent manner:

• Under Article 15 of the GDPR, you have the right to know whether we are processing any of your data. If so, you have the right to receive a copy of the data and to obtain the following information:
  • the purpose for which we process the data;
  • the categories, that is, the types of data that are processed;
  • who receives this data, and if the data is transferred to third countries, how security can be guaranteed;
  • how long the data is stored;
  • the existence of the right to rectification, erasure, or restriction of processing, and the right to object to processing;
  • that you can file a complaint with a supervisory authority (links to these authorities are provided below);
  • the source of the data, if we did not collect it from you;
  • whether profiling is carried out—that is, whether data is automatically analyzed to create a personal profile of you.
• Under Article 16 of the GDPR, you have the right to have your data corrected, which means that we must correct any data if you find errors.
• Under Article 17 of the GDPR, you have the right to erasure (“right to be forgotten”), which specifically means that you may request the erasure of your data.
• Under Article 18 of the GDPR, you have the right to restrict processing, which means that we may only store the data but may not use it further.
• Under Article 20 of the GDPR, you have the right to data portability, which means that, upon request, we will provide you with your data in a commonly used format.
• Under Article 21 of the GDPR, you have the right to object, which, once exercised, will result in a change to how your data is processed.
  • If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you may object to the processing. We will then review as soon as possible whether we can legally comply with this objection.
  • If your data is used for direct marketing, you may object to this type of data processing at any time. After that, we may no longer use your data for direct marketing.
  • If your data is used for profiling, you may object to this type of data processing at any time. After that, we may no longer use your data for profiling.
• Under certain circumstances, pursuant to Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing (such as profiling).
• Under Article 77 of the GDPR, you have the right to lodge a complaint. This means that you may file a complaint with the data protection authority at any time if you believe that the processing of personal data violates the GDPR.

In short: You have rights—don’t hesitate to contact the data controller listed above! If you believe that the processing of your data violates data protection law or that your data protection rights have been infringed in any other way, you can file a complaint with the supervisory authority. In Austria, this is the Data Protection Authority, whose website can be found at https://www.dsb.gv.at/ find. In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI) contact. The following local data protection authority has jurisdiction over our company:

Austrian Data Protection Authority

Director: Dr. Matthias Schmidl Address: Barichgasse 40-42, 1030 Vienna Phone number: +43 1 52 152-0 Email address: dsb@dsb.gv.at Website: https://www.dsb.gv.at/

Data Transfer to Third Countries

We transfer or process data to countries outside the scope of the GDPR (third countries) only if you consent to such processing or if there is another legal basis for doing so. This applies in particular when the processing is required by law or necessary to fulfill a contractual relationship, and in any case only to the extent that it is generally permitted. In most cases, your consent is the primary reason we have data processed in third countries. The processing of personal data in third countries such as the United States—where many software providers offer services and have their server locations—may mean that personal data is processed and stored in unexpected ways. We expressly note that, in the opinion of the European Court of Justice, an adequate level of protection for data transfers to the U.S. currently exists only if a U.S. company that processes personal data of EU citizens in the U.S. is an active participant in the EU-U.S. Data Privacy Framework. You can find more information on this at: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en Data processing by U.S. services that are not active participants in the EU-U.S. Data Privacy Framework may result in data being processed and stored without being anonymized, where applicable. Furthermore, U.S. government authorities may access specific data, where applicable. In addition, collected data may be linked to data from other services of the same provider, provided you have a corresponding user account. Whenever possible, we try to use server locations within the EU, if such options are available. We provide more detailed information about data transfers to third countries, where applicable, in the relevant sections of this Privacy Policy.

Data Processing Security

To protect personal data, we have implemented both technical and organizational measures. Whenever possible, we encrypt or pseudonymize personal data. In this way, we make it as difficult as possible—within the limits of our capabilities—for third parties to infer personal information from our data. Article 25 of the GDPR refers to “data protection through technology design and privacy-friendly default settings,” meaning that security must always be considered—and appropriate measures implemented—for both software (e.g., forms) and hardware (e.g., access to the server room). Below, we will discuss specific measures where necessary.

TLS Encryption with HTTPS

TLS, encryption, and HTTPS sound very technical—and they are. We use HTTPS (Hypertext Transfer Protocol Secure) to transmit data over the Internet in a way that prevents eavesdropping. This means that the entire transmission of all data from your browser to our web server is secure—no one can “eavesdrop.” In doing so, we have introduced an additional layer of security and comply with data protection through technology design (Article 25(1) of the GDPR). By using TLS (Transport Layer Security), an encryption protocol for secure data transmission over the Internet, we can ensure the protection of confidential data. You can recognize that this data transmission security measure is in use by the small padlock icon  in the upper-left corner of the browser, to the left of the web address (e.g., examplepage.de) and the use of the “https” scheme (instead of “http”) as part of our web address. If you’d like to learn more about encryption, we recommend searching Google for “Hypertext Transfer Protocol Secure wiki” to find useful links to additional information.

Communication

Communication Summary 👥 Data Subjects: Anyone who communicates with us by phone, email, or online form 📓 Data Processed: e.g., phone number, name, email address, form data entered. You can find more details under the respective contact method 🤝 Purpose: Handling communication with customers, business partners, etc. 📅 Retention Period: Duration of the business transaction and as required by law ⚖️ Legal Basis: Art. 6(1)(a) GDPR (Consent), Art. 6(1)(b) GDPR (Contract), Art. 6(1)(f) GDPR (Legitimate Interests)

If you contact us and communicate by phone, email, or through our online form, we may process your personal data. The data is processed to handle and address your inquiry and the related business transaction. The data is stored for as long as necessary to fulfill this purpose or as required by law.

Affected Individuals

The events mentioned above affect everyone who contacts us through the communication channels we provide.

Phone

When you call us, the call data is stored in pseudonymized form on the respective device and with the telecommunications provider used. In addition, data such as your name and phone number may subsequently be sent via email and stored for the purpose of responding to your inquiry. The data will be deleted as soon as the business transaction has been completed and legal requirements permit it.

Email

When you communicate with us via email, data may be stored on your device (computer, laptop, smartphone, etc.) and on the email server. The data will be deleted as soon as the business matter has been resolved and legal requirements permit.

Online Forms

When you contact us via the online form, your data is stored on our web server and, if necessary, forwarded to one of our email addresses. The data will be deleted as soon as the business matter has been resolved and legal requirements permit.

Legal Basis

The processing of data is based on the following legal grounds:

• Art. 6(1)(a) of the GDPR (Consent): You give us your consent to store your data and to use it for purposes related to the business transaction;
• Art. 6(1)(b) of the GDPR (Contract): It is necessary for the performance of a contract with you or a processor, such as a telephone service provider, or we need to process the data for pre-contractual activities, such as preparing a quote;
• Art. 6(1)(f) of the GDPR (Legitimate Interests): We aim to handle customer inquiries and business communications in a professional manner. To do so, certain technical systems—such as email programs, Exchange servers, and mobile network operators—are necessary to ensure efficient communication.

Cookies

Cookies Summary 👥 Data Subjects: Website visitors 🤝 Purpose: Depends on the specific cookie. More details can be found below or from the software provider that sets the cookie. 📓 Data Processed: Depends on the specific cookie used. More details can be found below or from the software provider that sets the cookie. 📅 Storage period: Depends on the specific cookie; may vary from hours to years ⚖️ Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What are cookies?

Our website uses HTTP cookies to store user-specific data. Below, we explain what cookies are and why they are used, so that you can better understand the following privacy policy. Whenever you browse the Internet, you use a browser. Well-known browsers include Chrome, Safari, Firefox, Internet Explorer, and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies. One thing is undeniable: Cookies are really useful little helpers. Almost all websites use cookies. More specifically, they are HTTP cookies, since there are also other types of cookies for different applications. HTTP cookies are small files that our website stores on your computer. These cookie files are automatically placed in the cookie folder—essentially the “brain” of your browser. A cookie consists of a name and a value. When defining a cookie, one or more attributes must also be specified. Cookies store certain user data about you, such as your language or personal page settings. When you visit our site again, your browser sends this “user-specific” information back to our site. Thanks to cookies, our website knows who you are and provides you with the settings you’re used to. In some browsers, each cookie has its own file; in others, such as Firefox, all cookies are stored in a single file. The following diagram illustrates a possible interaction between a web browser—such as Chrome—and the web server. The web browser requests a website and receives a cookie from the server, which the browser then reuses as soon as another page is requested. There are both first-party cookies and third-party cookies. First-party cookies are created directly by our site, while third-party cookies are created by partner websites (e.g., Google Analytics). Each cookie must be evaluated individually, as each cookie stores different data. The expiration time of a cookie also varies from a few minutes to a few years. Cookies are not software programs and do not contain viruses, Trojans, or other “malware.” Cookies also cannot access information on your computer. Here is an example of what cookie data might look like: Name: _ga Value: GA1.2.1326744211.152113107545-9 Purpose: Distinguishing Between Website Visitors Expiration Date: After 2 years A browser should be able to support these minimum sizes:

• At least 4,096 bytes per cookie
• At least 50 cookies per domain
• At least 3,000 cookies in total

What types of cookies are there?

The specific cookies we use depend on the services we employ and are explained in the following sections of this Privacy Policy. At this point, we would like to briefly discuss the different types of HTTP cookies. There are four types of cookies: Essential Cookies These cookies are necessary to ensure the website's basic functionality. For example, these cookies are needed when a user adds a product to the shopping cart, then continues browsing other pages, and only proceeds to checkout later. These cookies ensure that the shopping cart is not cleared, even if the user closes their browser window. Functional Cookies These cookies collect information about user behavior and whether the user receives any error messages. These cookies are also used to measure the website's loading time and performance across different browsers. Targeted Cookies These cookies improve the user experience. For example, they save locations you've entered, font sizes, or form data. Advertising Cookies These cookies are also called targeting cookies. They are used to deliver personalized ads to users. This can be very convenient, but it can also be very annoying. Usually, when you visit a website for the first time, you’ll be asked which of these types of cookies you’d like to allow. And, of course, this decision is also stored in a cookie. If you’d like to learn more about cookies and don’t mind reading technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Internet Engineering Task Force (IETF) Request for Comments titled “HTTP State Management Mechanism.”

Purpose of Processing via Cookies

The purpose ultimately depends on the specific cookie. You can find more details below or by contacting the manufacturer of the software that sets the cookie.

What data is processed?

Cookies are small tools that help with many different tasks. Unfortunately, it’s not possible to generalize about what data is stored in cookies, but we will inform you about the data that is processed or stored in the following privacy policy.

Cookie Retention Period

The retention period depends on the specific cookie and is specified in more detail below. Some cookies are deleted after less than an hour; others may remain stored on a computer for several years. You also have control over the storage period. You can manually delete all cookies at any time via your browser (see also “Right to Object” below). Furthermore, cookies based on your consent will be deleted no later than when you revoke your consent, although the lawfulness of their storage up to that point remains unaffected.

Right to Object – How Can I Delete Cookies?

You decide for yourself how and whether you want to use cookies. Regardless of which service or website the cookies come from, you always have the option to delete, disable, or allow only some cookies. For example, you can block third-party cookies but allow all other cookies. If you want to see which cookies have been stored in your browser, or if you want to change or delete cookie settings, you can find these options in your browser settings: Chrome: Delete, Enable, and Manage Cookies in Chrome Safari: Managing Cookies and Website Data with Safari Firefox: Clear cookies to remove data that websites have stored on your computer Internet Explorer: Deleting and Managing Cookies Microsoft Edge: Deleting and Managing Cookies If you do not want to accept cookies at all, you can configure your browser to notify you whenever a cookie is about to be set. This allows you to decide for each individual cookie whether to allow it or not. The procedure varies depending on the browser. The best approach is to search for instructions on Google using the search terms “delete cookies Chrome” or “disable cookies Chrome” if you are using the Chrome browser.

Legal Basis

The so-called “Cookie Directive” has been in effect since 2009. It stipulates that the storage of cookies is a Consent (Article 6(1)(a) of the GDPR) requires you to do so. However, there are still very different responses to these guidelines among EU countries. In Austria, however, this directive was implemented in Section 165(3) of the Telecommunications Act (2021). In Germany, the Cookie Directive was not transposed into national law. Instead, this directive was largely implemented in Section 15(3) of the Telemedia Act (TMG), which was replaced by the Digital Services Act (DDG) in May 2024. For strictly necessary cookies, even in the absence of consent, the following apply: legitimate interests (Article 6(1)(f) of the GDPR), which are, in most cases, of an economic nature. We want to provide visitors to the website with a pleasant user experience, and certain cookies are often absolutely necessary to achieve this. To the extent that non-essential cookies are used, this occurs only with your consent. The legal basis for this is Article 6(1)(a) of the GDPR. The following sections provide more detailed information about the use of cookies, to the extent that the software used employs cookies.

Which cookie management plugin do we use?

Zur Verwaltung der eingesetzten Cookies und ähnlichen Technologien (Tracking-Pixel, Web-Beacons etc.) und diesbezüglicher Einwilligungen setzen wir das Consent Tool „Real Cookie Banner“ ein. Details zur Funktionsweise von „Real Cookie Banner“ findest du unter <a href=“https://devowl.io/de/rcb/datenverarbeitung/“ rel=“noreferrer“ target=“_blank“>https://devowl.io/de/rcb/datenverarbeitung/</a>. Rechtsgrundlagen für die Verarbeitung von personenbezogenen Daten in diesem Zusammenhang sind Art. 6 Abs. 1 lit. c DS-GVO und Art. 6 Abs. 1 lit. f DS-GVO. Unser berechtigtes Interesse ist die Verwaltung der eingesetzten Cookies und ähnlichen Technologien und der diesbezüglichen Einwilligungen. Die Bereitstellung der personenbezogenen Daten ist weder vertraglich vorgeschrieben noch für den Abschluss eines Vertrages notwendig. Du bist nicht verpflichtet die personenbezogenen Daten bereitzustellen. Wenn du die personenbezogenen Daten nicht bereitstellst, können wir deine Einwilligungen nicht verwalten.

Web Hosting Introduction

Web Hosting Summary 👥 Data Subjects: Website visitors 🤝 Purpose: Professional hosting of the website and ensuring its operation 📓 Data Processed: IP address, time of website visit, browser used, and other data. More details can be found below or from the respective web hosting provider. 📅 Retention period: Depends on the respective provider, but generally 2 weeks ⚖️ Legal basis: Art. 6(1)(f) GDPR (Legitimate Interests)

What is web hosting?

When you visit websites these days, certain information—including personal data—is automatically generated and stored, and this is also the case on this website. This data should be processed as sparingly as possible and only for valid reasons. By “website,” we mean the entirety of all web pages on a domain, i.e., everything from the home page to the very last subpage (such as this one). By “domain,” we mean, for example, example.de or sampleexample.com. If you want to view a website on a computer, tablet, or smartphone, you use a program called a web browser. You’re probably familiar with some web browsers by name: Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari. We refer to them simply as “browsers” or “web browsers.” To display the website, the browser must connect to another computer where the website’s code is stored: the web server. Operating a web server is a complicated and resource-intensive task, which is why it’s usually handled by professional providers. These providers offer web hosting and ensure that website data is stored reliably and without errors. That’s a lot of technical terms, but please stick with it—it gets even better! When the browser on your computer (desktop, laptop, tablet, or smartphone) establishes a connection and during data transmission to and from the web server, personal data may be processed. On the one hand, your computer stores data; on the other hand, the web server must also store data for a certain period of time to ensure proper operation. A picture is worth a thousand words, so the following diagram illustrates the interaction between the browser, the Internet, and the hosting provider.

Why do we process personal data?

The purposes of data processing are:

1. Professional website hosting and ensuring smooth operation
2. to maintain operational and IT security
3. Anonymous analysis of user behavior to improve our services and, if necessary, for law enforcement or the pursuit of legal claims

What data is processed?

Even as you are visiting our website right now, our web server—the computer on which this website is hosted—typically automatically stores data such as

• the complete web address (URL) of the webpage that was accessed
• Browser and browser version (e.g., Chrome 87)
• the operating system used (e.g., Windows 10)
• the address (URL) of the previously visited page (referrer URL) (e.g., the address of the page you came from)
• the hostname and IP address of the device from which the request is being made (e.g., COMPUTERNAME and 194.23.43.121)
• Date and Time
• in files known as web server log files

How long is data stored?

As a rule, the data listed above is stored for two weeks and then automatically deleted. We do not share this data with third parties; however, we cannot rule out the possibility that government authorities may access this data in the event of unlawful conduct. In short: Your visit is logged by our provider (the company that hosts our website on special computers [servers]), but we will not share your information without your consent!

Legal Basis

The lawfulness of processing personal data in the context of web hosting is based on Article 6(1)(f) of the GDPR (protection of legitimate interests), as the use of professional hosting services from a provider is necessary to present the company on the Internet in a secure and user-friendly manner and, if necessary, to investigate any attacks or claims arising therefrom. As a rule, there is a contract between us and the hosting provider regarding data processing in accordance with Article 28 et seq. of the GDPR, which ensures compliance with data protection regulations and guarantees data security.

Introduction to Web Analytics

Web Analytics Privacy Policy Summary 👥 Data Subjects: Website visitors 🤝 Purpose: Analysis of visitor information to optimize the website. 📓 Data Processed: Access statistics, which include data such as visitor locations, device information, duration and time of access, navigation behavior, click behavior, and IP addresses. You can find more details on this in the documentation for the respective web analytics tool used. 📅 Retention period: Depends on the web analytics tool used ⚖️ Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is Web Analytics?

We use software on our website to analyze the behavior of website visitors, commonly referred to as web analytics. This process involves the collection of data, which the respective analytics tool provider (also known as a tracking tool) stores, manages, and processes. This data is used to generate analyses of user behavior on our website, which are then made available to us as the website operator. In addition, most tools offer various testing options. For example, this allows us to test which offers or content are most popular with our visitors. To do this, we show you two different offers for a limited period of time. After the test (known as an A/B test), we know which product or content our website visitors find more interesting. For such testing procedures, as well as for other analytics procedures, user profiles may be created and the data stored in cookies.

Why do we use web analytics?

With our website, we have a clear goal in mind: we want to provide the best online experience in our industry. To achieve this goal, we aim to offer the best and most engaging content while also ensuring that you feel completely at ease on our website. Using web analytics tools, we can take a closer look at the behavior of our website visitors and then improve our website for both you and us accordingly. For example, we can determine the average age of our visitors, where they come from, when our website receives the most traffic, and which content or products are particularly popular. All of this information helps us optimize the website and tailor it as closely as possible to your needs, interests, and preferences.

What data is processed?

Exactly which data is stored depends, of course, on the analytics tools used. However, as a general rule, the following information is stored: what content you view on our website, which buttons or links you click, when you visit a page, which browser you use, what device (PC, tablet, smartphone, etc.) you use to visit the website, and what operating system you use. If you have consented to the collection of location data, this data may also be processed by the web analytics tool provider. In addition, your IP address is stored. According to the General Data Protection Regulation (GDPR), IP addresses are considered personal data. However, your IP address is generally stored in a pseudonymized form (i.e., in an unrecognizable and truncated form). For the purposes of testing, web analytics, and web optimization, no direct data—such as your name, age, address, or email address—is stored. All such data, if collected, is stored in a pseudonymized form. This ensures that you cannot be identified as an individual. The following example schematically illustrates how Google Analytics works as an example of client-based web tracking using JavaScript code. How long the data is stored depends on the provider. Some cookies store data for only a few minutes or until you leave the website, while others can store data for several years.

Duration of Data Processing

We provide information below regarding the duration of data processing, to the extent that we have further details on this matter. In general, we process personal data only for as long as is strictly necessary to provide our services and products. If required by law—as is the case with accounting, for example—this retention period may be extended.

Right to Object

You also have the right and the option to revoke your consent to the use of cookies or third-party providers at any time. You can do this either through our cookie management tool or through other opt-out features. For example, you can also prevent data collection via cookies by managing, disabling, or deleting cookies in your browser.

Legal Basis

The use of web analytics requires your consent, which we have obtained through our cookie pop-up. According to Art. 6(1)(a) of the GDPR (Consent) This constitutes the legal basis for the processing of personal data, as may occur when such data is collected by web analytics tools. In addition to consent, we have a legitimate interest in analyzing the behavior of website visitors in order to improve our services both technically and economically. With the help of web analytics, we detect website errors, identify attacks, and improve cost-effectiveness. The legal basis for this is Art. 6(1)(f) of the GDPR (Legitimate Interests). However, we only use these tools if you have given your consent. Since web analytics tools use cookies, we also recommend that you read our general privacy policy regarding cookies. To find out exactly what data about you is stored and processed, you should review the privacy policies of the respective tools. Information on specific web analytics tools—if available—can be found in the following sections.

Google Analytics Privacy Policy

Google Analytics Privacy Policy Summary 👥 Data Subjects: Website visitors 🤝 Purpose: Analysis of visitor information to optimize the website. 📓 Data Processed: Access statistics, which include data such as visitor locations, device information, duration and time of access, navigation behavior, and click behavior. More details can be found further down in this privacy policy. 📅 Retention period: customizable; by default, Google Analytics 4 stores data for 14 months ⚖️ Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is Google Analytics?

We use the Google Analytics tracking tool, specifically Google Analytics 4 (GA4), on our website. This tool is provided by the U.S.-based company Google Inc. For the European region, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for all Google services. Google Analytics collects data about your activities on our website. However, through the combination of various technologies—such as cookies, device IDs, and login information—you, as a user, can be identified across different devices. This allows your activities to be analyzed across platforms. For example, when you click a link, this event is stored in a cookie and sent to Google Analytics. Using the reports we receive from Google Analytics, we can better tailor our website and our services to your needs. Below, we’ll discuss the tracking tool in more detail and, most importantly, explain what data is processed and how you can prevent this. Google Analytics is a tracking tool used to analyze traffic on our website. These measurements and analyses are based on a pseudonymous user identification number. This number does not contain any personal data such as your name or address; rather, it is used to associate events with a specific device. GA4 uses an event-based model that captures detailed information on user interactions, such as page views, clicks, scrolling, and conversion events. In addition, various machine learning features have been built into GA4 to better understand user behavior and certain trends. GA4 relies on modeling with the help of machine learning features. This means that, based on the collected data, missing data can also be extrapolated to optimize the analysis and enable forecasting. For Google Analytics to function, a tracking code is embedded in our website’s code. When you visit our website, this code records various events that you perform on our website. With GA4’s event-based data model, we as website operators can define and track specific events to obtain analyses of user interactions. This allows us to track not only general information such as clicks or page views but also specific events that are important to our business. Such specific events can include, for example, submitting a contact form or purchasing a product. As soon as you leave our website, this data is sent to the Google Analytics servers and stored there. Google processes the data, and we receive reports on your user behavior. These reports may include, among others, the following:

• Audience Reports: Audience reports help us get to know our users better and understand more precisely who is interested in our service.
• Ad Reports: Ad reports make it easier for us to analyze and improve our online advertising.
• Acquisition Reports: Acquisition reports provide us with helpful information on how we can get more people excited about our service.
• Behavioral Reports: These reports tell us how you interact with our website. We can track the path you take on our site and which links you click.
• Conversion Reports: A conversion is a process in which you take a desired action in response to a marketing message. For example, when you go from being a casual website visitor to a buyer or newsletter subscriber. These reports help us learn more about how our marketing efforts are resonating with you. Our goal is to increase our conversion rate.
• Real-time reports: Here, we always find out immediately what's happening on our website. For example, we can see how many users are currently reading this text.

In addition to the analysis reports mentioned above, Google Analytics 4 also offers the following features, among others:

• Event-based data model: This model tracks very specific events that can occur on our website. For example, playing a video, purchasing a product, or signing up for our newsletter.
• Advanced analytics features: These features allow us to better understand your behavior on our website or certain general trends. For example, we can segment user groups, conduct comparative analyses of target audiences, or track your journey or path on our website.
• Predictive modeling: Based on collected data, machine learning can be used to extrapolate missing data to predict future events and trends. This can help us develop better marketing strategies.
• Cross-Platform Analysis: Data can be collected and analyzed from both websites and apps. This allows us to analyze user behavior across platforms, provided, of course, that you have consented to the processing of your data.

Why do we use Google Analytics on our website?

Our goal with this website is clear: We want to offer you the best possible service. The statistics and data from Google Analytics help us achieve this goal. The statistically analyzed data give us a clear picture of our website’s strengths and weaknesses. On the one hand, this allows us to optimize our site so that interested people can find it more easily on Google. On the other hand, the data helps us better understand you as a visitor. We therefore know exactly what we need to improve on our website to offer you the best possible service. The data also helps us tailor our advertising and marketing efforts to be more personalized and cost-effective. After all, it only makes sense to showcase our products and services to people who are interested in them.

What data does Google Analytics store?

Google Analytics uses a tracking code to generate a random, unique ID that is linked to your browser cookie. This allows Google Analytics to recognize you as a new user and assign you a user ID. The next time you visit our site, you will be recognized as a “returning” user. All collected data is stored along with this user ID. This is what makes it possible to analyze pseudonymous user profiles. To analyze our website using Google Analytics, a property ID must be inserted into the tracking code. The data is then stored in the corresponding property. For each newly created property, the Google Analytics 4 property is set by default. Depending on the property used, data is stored for varying lengths of time. Through identifiers such as cookies, app instance IDs, user IDs, or custom event parameters, your interactions—provided you have given your consent—are measured across platforms. Interactions include all types of actions you perform on our website. If you also use other Google systems (such as a Google Account), data generated by Google Analytics may be linked to third-party cookies. Google does not share Google Analytics data unless we, as the website operator, authorize it. Exceptions may apply if required by law. According to Google, IP addresses are not logged or stored in Google Analytics 4. However, Google uses IP address data to derive location information and deletes it immediately afterward. All IP addresses collected from users in the EU are therefore deleted before the data is stored in a data center or on a server. Since Google Analytics 4 focuses on event-based data, the tool uses significantly fewer cookies compared to earlier versions (such as Google Universal Analytics). Nevertheless, there are some specific cookies used by GA4. These include, for example: Name: _ga Value: 2.1326744211.152113107545-5 Purpose: By default, analytics.js uses the _ga cookie to store the user ID. Its primary purpose is to distinguish between website visitors. Expiration Date: after 2 years Name: _gid Value: 2.1687193234.152113107545-1 Purpose: The cookie is also used to distinguish between website visitors Expiration Date: after 24 hours Name: _gat_gtag_UA_<property-id> Value: 1 Purpose: Wird zum Senken der Anforderungsrate verwendet. Wenn Google Analytics über den Google Tag Manager bereitgestellt wird, erhält dieser Cookie den Namen _dc_gtm_ <property-id>. Expiration Date: after 1 minute Note: This list is not exhaustive, as Google frequently changes the cookies it uses. One of GA4’s goals is to improve data protection. Therefore, the tool offers several options for controlling data collection. For example, we can set the retention period ourselves and also control data collection. Here is an overview of the most important types of data collected by Google Analytics: Heat maps: Google creates what are known as heat maps. Heat maps show exactly which areas you click on. This gives us information about where you are “navigating” on our site. Duration of the session: Google defines a session as the amount of time you spend on our site without leaving the page. If you have been inactive for 20 minutes, the session ends automatically. Bounce Rate (Bounce rate): A bounce occurs when you view only one page on our website and then leave the site. Account Creation: When you create an account or place an order on our website, Google Analytics collects this data. Location: IP addresses are not logged or stored in Google Analytics. However, shortly before the IP address is deleted, it is used to derive location data. Technical Information: Technical information includes, among other things, your browser type, your Internet service provider, and your screen resolution. Source: Google Analytics—and, of course, we—are also interested in knowing which website or advertisement led you to our site. Other data includes contact information, any reviews, media playback (e.g., when you play a video on our site), sharing content via social media, or adding content to your favorites. This list is not exhaustive and is intended only to provide a general overview of the data collected by Google Analytics.

How long and where is the data stored?

Google has servers located all over the world. Here you can find out exactly where Google's data centers are located: https://datacenters.google/ Your data is distributed across various physical storage media. This has the advantage of making the data more readily accessible and better protected against tampering. Every Google data center has appropriate contingency plans in place for your data. For example, even if Google’s hardware fails or natural disasters cripple servers, the risk of a service interruption at Google remains low. The data retention period depends on the properties used. The retention period is always determined separately for each individual property. Google Analytics offers us four options for controlling the retention period:

• 2 months: that is the shortest retention period.
• 14 months: By default, data is stored in GA4 for 14 months.
• 26 months: You can also store the data for 26 months.
• Data is not deleted until we delete it manually

In addition, there is also the option to have data deleted only after you have not visited our website for the period we have selected. In this case, the retention period is reset each time you visit our website again within the specified period. Once the specified period has expired, the data is deleted once a month. This retention period applies to your data associated with cookies, user identification, and advertising IDs (e.g., cookies from the DoubleClick domain). Report results are based on aggregated data and are stored separately from user data. Aggregated data is a combination of individual data points into a larger unit.

How can I delete my data or prevent it from being stored?

Under European Union data protection law, you have the right to access, update, delete, or restrict the use of your data. By using the browser add-on to disable Google Analytics JavaScript (analytics.js, gtag.js), you can prevent Google Analytics 4 from using your data. You can download the browser add-on at https://tools.google.com/dlpage/gaoptout?hl=de Download and install. Please note that this add-on only disables data collection by Google Analytics. If you want to disable, delete, or manage cookies in general, you’ll find the relevant links to instructions for the most popular browsers in the “Cookies” section.

Legal Basis

The use of Google Analytics requires your consent, which we have obtained through our cookie pop-up. According to Art. 6(1)(a) of the GDPR (Consent) the legal basis for the processing of personal data, as may occur when such data is collected by web analytics tools. In addition to consent, we have a legitimate interest in analyzing the behavior of website visitors in order to improve our offerings both technically and economically. With the help of Google Analytics, we detect website errors, identify attacks, and improve cost-effectiveness. The legal basis for this is Art. 6(1)(f) of the GDPR (Legitimate Interests). However, we only use Google Analytics if you have given your consent. Google processes your data in the U.S., among other places. Google is an active participant in the EU-U.S. Data Privacy Framework, which governs the proper and secure transfer of personal data from EU citizens to the U.S. For more information, please visit https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en. In addition, Google uses what are known as Standard Contractual Clauses (Art. 46, paras. 2 and 3 of the GDPR). Standard Contractual Clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the United States). Through the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses, Google commits to adhering to European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the U.S. These clauses are based on an implementing decision by the European Commission. You can find the decision and the corresponding Standard Contractual Clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de The Google Ads Data Processing Terms, which refer to the Standard Contractual Clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/. We hope we've been able to provide you with a better understanding of the key information regarding data processing by Google Analytics. If you'd like to learn more about this tracking service, we recommend these two links: https://marketingplatform.google.com/about/analytics/terms/de/ and https://support.google.com/analytics/answer/6004245?hl=de. If you'd like to learn more about data processing, please refer to the Google Privacy Policy at https://policies.google.com/privacy?hl=de.

Google Analytics Reports on Demographic Characteristics and Interests

We have enabled the advertising reporting features in Google Analytics. The reports on demographic characteristics and interests include information on age, gender, and interests. This allows us to gain a better understanding of our users—without being able to link this data to specific individuals. You can learn more about the advertising features at https://support.google.com/analytics/answer/3450482?hl=de_AT&utm_id=ad. You can manage how your Google Account activity and information are used under “Ad Settings” at https://adssettings.google.com/authenticated Close using the checkbox.

Google Analytics in Consent Mode

Depending on your consent, your personal data will be processed by Google Analytics in what is known as “Consent Mode.” You can choose whether or not to consent to Google Analytics cookies. By doing so, you also choose which of your data Google Analytics is permitted to process. This collected data is primarily used to measure user behavior on the website, display targeted advertising, and provide us with web analytics reports. Typically, you consent to data processing by Google via a cookie consent tool. If you do not consent to data processing, only aggregated data will be collected and processed. This means that data cannot be attributed to individual users, and therefore no user profile of you will be created. You may also choose to consent only to statistical measurement. In this case, no personal data will be processed and, consequently, it will not be used for advertising or to measure advertising performance.

Email Marketing Introduction

Email Marketing Summary 👥 Data Subjects: Newsletter subscribers 🤝 Purpose: Direct marketing via email; notifications about system-related events 📓 Data Processed: Data entered during registration, but at a minimum the email address. You can find more details in the documentation for the respective email marketing tool used. 📅 Retention Period: For the duration of the subscription ⚖️ Legal Basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is email marketing?

To keep you up to date, we also use email marketing. In this context, provided you have consented to receiving our emails or newsletters, we also process and store your data. Email marketing is a subset of online marketing. It involves sending news or general information about a company, its products, or services via email to a specific group of people who are interested in such content. If you’d like to participate in our email marketing (usually via a newsletter), you’ll typically just need to sign up with your email address. To do so, fill out an online form and submit it. However, we may also ask you for your title and name so that we can address you personally. Generally, subscribing to newsletters works using the so-called “double opt-in process.” After you subscribe to our newsletter on our website, you’ll receive an email asking you to confirm your subscription. This ensures that the email address belongs to you and that no one has subscribed using someone else’s email address. We, or a notification tool we use, log every single subscription. This is necessary so that we can verify that the subscription process was carried out in accordance with the law. Typically, the time of subscription, the time of subscription confirmation, and your IP address are stored. Additionally, any changes you make to your stored data are also logged.

Why do we use email marketing?

Of course, we want to stay in touch with you and keep you updated on the most important news about our company. To that end, we use email marketing—often simply referred to as a “newsletter”—as an essential part of our online marketing strategy. Provided you consent or it is permitted by law, we will send you newsletters, system emails, or other notifications via email. When we use the term “newsletter” in the following text, we are primarily referring to emails sent on a regular basis. Of course, we do not want to bother you in any way with our newsletters. That is why we always strive to provide only relevant and interesting content. For example, you’ll learn more about our company, our services, or our products. Since we’re constantly improving our offerings, our newsletter will also keep you informed whenever there’s news or when we’re currently running special, lucrative promotions. If we engage a service provider that offers a professional email distribution tool for our email marketing, we do so to ensure we can deliver newsletters to you quickly and securely. The primary purpose of our email marketing is to inform you about new offers and to help us achieve our business goals.

What data is processed?

If you subscribe to our newsletter through our website, you will confirm your membership in an email list via email. In addition to your IP address and email address, your title, name, address, and phone number may also be stored—but only if you consent to this data storage. The data marked as such is necessary for you to use the service we offer. Providing this information is voluntary; however, failure to do so will prevent you from using the service. In addition, information about your device or your preferred content on our website may also be stored. For more information on data storage when you visit a website, please see the section “Automatic Data Storage.” We record your declaration of consent so that we can always demonstrate that it complies with our laws.

Duration of Data Processing

If you unsubscribe from our email/newsletter distribution list, we may store your email address for up to three years based on our legitimate interests so that we can still provide evidence of your consent at that time. We may process this data only if we need to defend ourselves against any potential claims. However, if you confirm that you gave us your consent to subscribe to the newsletter, you may submit an individual request for deletion at any time. If you permanently revoke your consent, we reserve the right to add your email address to a block list. As long as you have voluntarily subscribed to our newsletter, we will, of course, continue to retain your email address.

Right to Object

You can unsubscribe from our newsletter at any time. To do so, simply revoke your consent to receive the newsletter. This usually takes just a few seconds or one or two clicks. You’ll usually find a link to unsubscribe from the newsletter right at the bottom of each email. If you really can’t find the link in the newsletter, please contact us by email and we’ll cancel your newsletter subscription immediately.

Legal Basis

We send our newsletter based on your consent (Article 6(1)(a) of the GDPR). This means we may only send you a newsletter if you have actively subscribed to it beforehand. We may also send you promotional messages, provided that you have become our customer and have not objected to the use of your email address for direct marketing. Information about specific email marketing services and how they process personal data can be found—where available—in the following sections.

Messaging & Communication: Introduction

Messenger & Communication Privacy Policy Summary 👥 Data Subjects: Website visitors 🤝 Purpose: Contact requests and general communication between us and you 📓 Data Processed: Data such as name, address, email address, phone number, general content data, and, if applicable, IP address You can find more details in the descriptions of the respective tools used. 📅 Retention Period: Depends on the messenger and communication features used ⚖️ Legal Basis: Art. 6(1)(a) GDPR (Consent), Art. 6(1)(f) GDPR (Legitimate Interests), Art. 6(1)(b) GDPR (Contractual or Pre-Contractual Obligations)

What are messaging and communication features?

We offer various ways to communicate with us on our website (such as messaging and chat features, online or contact forms, email, and phone). In doing so, your data will be processed and stored to the extent necessary to respond to your inquiry and take subsequent action. In addition to traditional communication methods such as email, contact forms, or phone, we also use chat and messenger services. The most commonly used messenger service at present is WhatsApp, but there are, of course, many different providers that offer messenger functions specifically for websites. If content is end-to-end encrypted, this will be indicated in the individual privacy notices or in the privacy policy of the respective provider. End-to-end encryption simply means that the content of a message is not visible even to the provider. However, information about your device, location settings, and other technical data may still be processed and stored.

Why do we use messaging and communication features?

We place great importance on being able to communicate with you. After all, we want to talk to you and answer any questions you may have about our service as best as possible. Effective communication is an essential part of our service. With our convenient messenger and communication features, you can choose your preferred method at any time. In exceptional cases, however, we may not be able to answer certain questions via chat or messenger. This is the case, for example, when internal contractual matters are involved. In such instances, we recommend alternative communication channels such as email or phone. We generally assume that we remain the data controller under data protection law, even when we use the services of a social media platform. However, the European Court of Justice has ruled that, in certain cases, the operator of the social media platform may be jointly responsible with us within the meaning of Article 26 of the GDPR. Where this is the case, we will specifically indicate this and operate on the basis of a relevant agreement. The key provisions of the agreement are outlined below for the relevant platform. Please note that when you use our embedded features, your data may also be processed outside the European Union, as many providers—such as Facebook Messenger or WhatsApp—are U.S. companies. As a result, you may no longer be able to assert or enforce your rights regarding your personal data as easily.

What data is processed?

Exactly which data is stored and processed depends on the specific provider of the messaging and communication features. Generally, this includes data such as your name, address, phone number, email address, and content data—for example, any information you enter into a contact form. In most cases, information about your device and your IP address is also stored. Data collected through a messaging and communication feature is also stored on the providers’ servers. If you want to know exactly what data is stored and processed by the respective providers and how you can object to data processing, you should carefully read the company’s privacy policy.

How long is data stored?

How long data is processed and stored depends primarily on the tools we use. You can learn more about how each tool processes data below. The providers’ privacy policies typically specify exactly what data is stored and processed, and for how long. As a general rule, personal data is processed only for as long as is necessary to provide our services. When data is stored in cookies, the retention period varies greatly. The data may be deleted immediately after you leave a website, but it may also remain stored for several years. Therefore, you should review each individual cookie in detail if you want to know more about how data is stored. In most cases, you’ll also find helpful information about individual cookies in the privacy policies of the respective providers.

Right to Object

You also have the right and the option to revoke your consent to the use of cookies or third-party providers at any time. You can do this either through our cookie management tool or via other opt-out features. For example, you can also prevent data collection via cookies by managing, disabling, or deleting cookies in your browser. For more information, please refer to the section on consent. Since cookies may be used in messenger and communication features, we also recommend that you review our general privacy policy regarding cookies. To find out exactly what data about you is stored and processed, you should read the privacy policies of the respective tools.

Legal Basis

If you have consented to the processing and storage of your data through integrated messaging and communication features, this consent serves as the legal basis for the data processing. (Art. 6(1)(a) of the GDPR). We process your request and manage your data within the framework of contractual or precontractual relationships in order to fulfill our precontractual and contractual obligations or to respond to inquiries. The legal basis for this is Art. 6(1), sentence 1, subparagraph (b) of the GDPR. In general, if consent has been provided, your data will also be processed based on our legitimate interest (Art. 6(1)(f) of the GDPR) for the purpose of ensuring prompt and effective communication with you or other customers and business partners.

WhatsApp Privacy Policy

WhatsApp Privacy Policy Summary 👥 Data Subjects: WhatsApp users 🤝 Purpose: Communication 📓 Data Processed: Contact information, messages, media 📅 Retention Period: After account deletion or deactivation ⚖️ Legal Basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is WhatsApp?

We use the instant messaging service WhatsApp on our website. The service provider is the American company WhatsApp Inc., a subsidiary of Meta Platforms Inc. (Facebook Inc. until October 2021). For the European region, the company responsible is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We probably don’t need to introduce WhatsApp to you in any greater detail. The likelihood that you yourself use this well-known messaging service on your smartphone is relatively high. For many years, there have been voices criticizing WhatsApp and its parent company, Meta Platforms, regarding their handling of personal data. In recent years, the main criticism has centered on the merging of WhatsApp user data with Facebook. In response, Facebook took action in 2021 and amended its Terms of Service. In those updates, Facebook stated that, as of 2021, no personal data from WhatsApp users is shared with Facebook. Nevertheless, WhatsApp naturally processes a considerable amount of your personal data, provided you use WhatsApp and have consented to the data processing. In addition to your phone number and chat messages, this includes photos, videos, and profile information you’ve sent. However, photos and videos are only temporarily stored, and all messages and phone calls are protected by end-to-end encryption. This means they should not be accessible even to Meta itself. In addition, information from your address book and other metadata are also stored by WhatsApp.

Why do we use WhatsApp?

We want to stay in touch with you, and WhatsApp is the best way to do that. For one thing, because the service works flawlessly; for another, because WhatsApp is still the most widely used instant messaging tool worldwide. The service is convenient and allows us to communicate with you quickly and easily.

What data does WhatsApp process?

Using WhatsApp may involve the processing of various types of data, including personal data. This includes account information such as your phone number, profile picture, username, or other information you provide to WhatsApp when creating and managing your WhatsApp account. Of course, WhatsApp also stores the content of your messages (text, photos, videos, voice messages). WhatsApp also stores so-called metadata, such as the date and time a message was sent or received. It also stores the phone numbers of the people involved and technical data such as device type, operating system, or location data.

How long and where is the data stored?

In general, WhatsApp stores data for as long as necessary to fulfill its legitimate purposes and comply with legal obligations. It is not possible to specify exactly how long the data is stored here, as this depends heavily on the type of data. Generally, messages are stored in encrypted form on WhatsApp only during delivery and are deleted from the servers as soon as a message has been delivered. Beyond that, messages are stored only on your own device. When media files are sent, WhatsApp stores this data in encrypted form for up to 30 days to optimize delivery. Account data is stored for as long as you have an active WhatsApp account. If you delete or deactivate your account, your account data is normally deleted as well. The data stored by WhatsApp is kept on the company’s own servers, which are located around the world. To operate the web-based WhatsApp services, data is also collected using cookies.

How can I delete my data or prevent it from being stored?

You have the right at any time to access, correct, or delete your personal data, as well as to restrict its processing. You may also withdraw your consent to the processing of your data at any time. If you do not want cookies to be set and data to be stored as a result when using the desktop version, you can prevent cookies from being set in your browser. You can manage, disable, or delete cookies in your browser. The process varies slightly depending on your browser. For more details, please see our section on cookies.

Legal Basis

The use of WhatsApp requires your consent, which we have obtained through our consent tool (pop-up). According to Art. 6(1)(a) of the GDPR (Consent) the legal basis for the processing of personal data, as may occur when such data is collected by WhatsApp. In addition to your consent, we have a legitimate interest in improving our communication services. With the help of WhatsApp, we can respond to your inquiries more quickly and effectively, share important messages with you, and thereby take our service to the next level. The legal basis for this is Art. 6(1)(f) of the GDPR (Legitimate Interests). However, we only use WhatsApp if you have given your consent. WhatsApp processes your data in the U.S., among other places. WhatsApp is an active participant in the EU-U.S. Data Privacy Framework, which governs the proper and secure transfer of personal data from EU citizens to the U.S. For more information, please visit https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en. In addition, WhatsApp uses what are known as Standard Contractual Clauses (Art. 46, paras. 2 and 3 of the GDPR). Standard Contractual Clauses (SCCs) are model templates provided by the European Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the United States). Through the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses, WhatsApp commits to adhering to European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the U.S. These clauses are based on an implementing decision by the European Commission. You can find the decision and the corresponding Standard Contractual Clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. For information on data transfers via WhatsApp that comply with the Standard Contractual Clauses, please visit https://www.whatsapp.com/legal/business-data-transfer-addendum-20210927 We hope we've helped you better understand the key information about WhatsApp's use and processing of data. You can learn more about the data processed when using WhatsApp in the Privacy Policy at https://www.whatsapp.com/privacy.

Olark Live Chat Privacy Policy

We use the Olark live chat tool on our website, provided by Olark LLC, 427 N Tatnall St #42487, Wilmington, DE 19801-2230, USA. Olark allows you to contact us directly via a chat window. The messages you enter, as well as technical data such as your IP address, browser type, operating system, the page you visited, and the time of the chat, are processed and stored on Olark’s servers in the United States. Olark uses cookies to track the chat session; these are set only after you have given your consent via our cookie banner.

Data processing is based on your consent (Art. 6(1)(a) GDPR), which you may revoke at any time via the cookie banner. Data transfers to the U.S. are based on the European Commission’s Standard Contractual Clauses and Olark’s certification under the EU-U.S. Data Privacy Framework. Chat histories are deleted after 12 months at the latest. For more information, please see Olark’s Privacy Policy at https://www.olark.com/privacy-policy.

Cookie Consent Management Platform: Introduction

Cookie Consent Management Platform Summary 👥 Data Subjects: Website visitors 🤝 Purpose: Obtaining and managing consent for specific cookies and, consequently, the use of specific tools 📓 Data Processed: Data used to manage cookie settings, such as IP address, time of consent, type of consent, and individual consents. More details can be found in the documentation for each tool used. 📅 Retention Period: Depends on the tool used; users should expect retention periods of several years ⚖️ Legal Basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is a cookie consent management platform?

We use Consent Management Platform (CMP) software on our website, which makes it easier for both us and you to handle scripts and cookies correctly and securely. The software automatically displays a cookie pop-up, scans and monitors all scripts and cookies, provides you with the cookie consent required under data protection laws, and helps both us and you keep track of all cookies. Most cookie consent management tools identify and categorize all existing cookies. As a website visitor, you then decide for yourself whether and which scripts and cookies you allow or do not allow. The following diagram illustrates the relationship between the browser, web server, and CMP.

Why do we use a cookie management tool?

Our goal is to provide you with the highest possible level of transparency regarding data protection. We are also legally required to do so. We want to inform you as thoroughly as possible about all tools and cookies that may store and process your data. It is also your right to decide for yourself which cookies you accept and which you do not. To grant you this right, we first need to know exactly which cookies are present on our website. Thanks to a cookie management tool that regularly scans the website for all existing cookies, we are aware of all cookies and can provide you with GDPR-compliant information about them. You can then accept or reject cookies using the consent system.

What data is processed?

Through our cookie management tool, you can manage each individual cookie yourself and have full control over the storage and processing of your data. Your consent is stored so that we do not have to ask for it every time you visit our website and so that we can provide proof of your consent if required by law. This information is stored either in an opt-in cookie or on a server. The retention period for your cookie consent varies depending on the provider of the cookie management tool. In most cases, this data (such as a pseudonymous user ID, the time of consent, details regarding cookie categories or tools, browser, and device information) is stored for up to two years.

Duration of Data Processing

We provide information below regarding the duration of data processing, to the extent that we have further details. In general, we process personal data only for as long as is strictly necessary to provide our services and products. Data stored in cookies is retained for varying lengths of time. Some cookies are deleted as soon as you leave the website, while others may remain stored in your browser for several years. The exact duration of data processing depends on the tool used; in most cases, you should expect a retention period of several years. You can usually find detailed information about the duration of data processing in the respective privacy policies of the individual providers.

Right to Object

You also have the right and the option to revoke your consent to the use of cookies at any time. You can do this either through our cookie management tool or through other opt-out features. For example, you can also prevent data collection via cookies by managing, disabling, or deleting cookies in your browser. Information about specific cookie management tools—if available—can be found in the following sections.

Legal Basis

If you consent to cookies, your personal data will be processed and stored via these cookies. If, through your Consent (Article 6(1)(a) of the GDPR) Since we are permitted to use cookies, this consent also serves as the legal basis for the use of cookies and the processing of your data. To manage consent regarding cookies and to enable you to provide your consent, we use cookie consent management platform software. The use of this software enables us to operate the website efficiently and in compliance with the law, which is a legitimate interest (Article 6(1)(f) of the GDPR).

Web Design Introduction

Web Design Privacy Policy Summary 👥 Data Subjects: Website visitors 🤝 Purpose: To improve the user experience 📓 Data Processed: The specific data processed depends heavily on the services used. In most cases, this includes IP addresses, technical data, language settings, browser version, screen resolution, and browser name. You can find more details on this under the respective web design tools used. 📅 Retention period: Depends on the tools used ⚖️ Legal basis: Art. 6(1)(a) GDPR (Consent), Art. 6(1)(f) GDPR (Legitimate Interests)

What is web design?

We use various tools on our website to support our web design. Web design is not, as is often assumed, just about making our website look nice; it’s also about functionality and performance. But of course, achieving the right visual look for a website is also one of the main goals of professional web design. Web design is a subfield of media design and deals with the visual, structural, and functional design of a website. The goal of web design is to enhance your experience on our website. In web design jargon, this is referred to as user experience (UX) and usability. User experience encompasses all the impressions and experiences a website visitor has while on a website. Usability is a component of user experience. It refers to how user-friendly a website is. The primary focus here is on ensuring that content, subpages, or products are clearly structured so that you can find what you’re looking for quickly and easily. To provide you with the best possible experience on our website, we also use third-party web design tools. In this Privacy Policy, the “Web Design” category therefore includes all services that enhance the design of our website. These may include, for example, fonts, various plugins, or other integrated web design features.

Why do we use web design tools?

How you take in information on a website depends heavily on the site’s structure, functionality, and visual appeal. That’s why a high-quality, professional web design has become increasingly important to us as well. We’re constantly working to improve our website and view this as an added service for you, our website visitors. Furthermore, an attractive and functional website also offers economic benefits for us. After all, you’ll only visit us and take advantage of our offerings if you feel completely at ease.

What data is stored by web design tools?

When you visit our website, web design elements may be embedded in our pages that can also process data. Exactly what data is involved depends, of course, largely on the tools used. Below, you can see exactly which tools we use for our website. For more detailed information about data processing, we also recommend that you read the respective privacy policies of the tools used. In most cases, these policies will explain what data is processed, whether cookies are used, and how long the data is retained. For example, when using fonts such as Google Fonts, information such as language settings, IP address, browser version, browser screen resolution, and browser name is automatically transmitted to Google’s servers.

Duration of Data Processing

How long data is processed varies greatly from case to case and depends on the web design elements used. For example, when cookies are used, the retention period can range from just one minute to a few years. Please educate yourself on this matter. To that end, we recommend both our general section on cookies and the privacy policies of the tools used. There, you’ll typically find out exactly which cookies are used and what information is stored in them. Google Font files, for example, are stored for one year. This is intended to improve a website’s loading time. As a general rule, data is only retained for as long as necessary to provide the service. Data may also be stored for longer periods if required by law.

Right to Object

You also have the right and the option to revoke your consent to the use of cookies or third-party providers at any time. You can do this either through our cookie management tool or via other opt-out features. You can also prevent data collection by cookies by managing, disabling, or deleting cookies in your browser. However, some data—particularly in web design elements (most commonly fonts)—cannot be deleted quite so easily. This is the case when data is automatically collected the moment a page is loaded and transmitted to a third-party provider (such as Google). In such cases, please contact the support team of the respective provider. For Google, you can reach support at https://support.google.com/?hl=de.

Legal Basis

If you have consented to the use of web design tools, the legal basis for the corresponding data processing is this consent. Pursuant to Article 6(1)(a) of the GDPR (Consent), this consent constitutes the legal basis for the processing of personal data, as may occur when such data is collected by web design tools. We also have a legitimate interest in improving the web design of our website. After all, this is the only way we can provide you with an attractive and professional website. The corresponding legal basis for this is Article 6(1)(f) of the GDPR (Legitimate Interests). However, we only use web design tools to the extent that you have given your consent. We would like to emphasize this point once again here. Information on specific web design tools—if available—can be found in the following sections.

Weglot Translation Service Privacy Policy

For the English version of our website, we use the Weglot translation service provided by Weglot SAS, 138 Rue Pierre Joigneaux, 92270 Bois-Colombes, France. When you access the English version, the page content is translated and delivered via Weglot’s servers. In doing so, Weglot processes technical data such as your IP address, browser type, the page you visited, and the language you selected. Weglot sets a technically necessary cookie that stores your language selection.

Data processing is based on our legitimate interest (Art. 6(1)(f) of the GDPR) in making our content accessible to English-speaking visitors. Weglot processes the data within the European Union. For more information, please see Weglot’s Privacy Policy at https://www.weglot.com/privacy.

Google Fonts Local Privacy Policy

On our website, we use Google Fonts provided by Google Inc. For the European region, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible. We have embedded the Google fonts locally—that is, on our web server—rather than on Google’s servers. As a result, there is no connection to Google’s servers and, therefore, no data is transmitted or stored.

What are Google Fonts?

Google Fonts used to be called Google Web Fonts. It is an interactive directory with over 800 fonts that Google provides for free. With Google Fonts, you can use fonts without uploading them to your own server. However, to prevent any data transmission to Google’s servers in this regard, we have downloaded the fonts to our server. This ensures that we comply with data protection regulations and do not forward any data to Google Fonts.

Explanation of Terms Used

We always strive to make our Privacy Policy as clear and understandable as possible. However, this isn’t always easy, especially when it comes to technical and legal topics. It often makes sense to use legal terms (such as “personal data”) or certain technical terms (such as “cookies” or “IP address”). However, we do not want to use these terms without explanation. Below, you will find an alphabetical list of important terms we use that we may not have addressed sufficiently in the previous privacy policy. If these terms are taken from the GDPR and are definitions, we will also cite the relevant GDPR text here and, where appropriate, add our own explanations.

Data Processor

Definition pursuant to Article 4 of the GDPR For the purposes of this regulation, the term means:

“Processor” meansa natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller;

Explanation: As a company and website owner, we are responsible for all data we process from you. In addition to the data controllers, there may also be so-called data processors. This includes any company or individual that processes personal data on our behalf. Data processors may therefore include, in addition to service providers such as tax advisors, hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

Consent

Definition pursuant to Article 4 of the GDPR For the purposes of this regulation, the term means:

“Consent”of the data subject meansany freely given, specific, informed, and unambiguous indication of the data subject’s wishes, expressed in the form of a statement or other clear affirmative action, by which the data subject indicates that he or she consents to the processing of personal data relating to him or her;

Explanation: On websites, this consent is typically obtained through a cookie consent tool. You’re probably familiar with it. Whenever you visit a website for the first time, you’re usually asked via a banner whether you agree to or consent to data processing. In most cases, you can also adjust your settings to decide for yourself which types of data processing you allow and which you don’t. If you do not give your consent, no personal data about you may be processed. Of course, consent can also be given in writing—that is, without using a tool.

Personal Data

Definition pursuant to Article 4 of the GDPR For the purposes of this regulation, the term means:

“personal data” any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;

Explanation: Personal data, therefore, refers to any data that can be used to identify you as an individual. This typically includes data such as:

• Name
• Address
• Email address
• Mailing Address
• Phone number
• Date of Birth
• Identification numbers such as Social Security number, tax identification number, ID card number, or student ID number
• Banking information such as account numbers, credit information, account balances, and much more.

According to the European Court of Justice (ECJ), your IP Address and Personal Data. IT experts can use your IP address to determine at least the approximate location of your device and, by extension, identify you as the account holder. Therefore, storing an IP address also requires a legal basis under the GDPR. There are also so-called "special categories" personal data that is also considered particularly sensitive. This includes:

• Racial and Ethnic Origin
• political views
• religious or ideological beliefs
• union membership
• genetic data, such as data obtained from blood or saliva samples
• biometric data (information about psychological, physical, or behavioral characteristics that can identify a person). Health data
• Information about sexual orientation or sex life

Profiling

Definition pursuant to Article 4 of the GDPR For the purposes of this regulation, the term means:

“Profiling” meansany form of automated processing of personal data that consists of using such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;

Explanation: Profiling involves gathering various pieces of information about a person in order to learn more about that person. On the web, profiling is often used for advertising purposes or for credit checks. Web and advertising analytics programs, for example, collect data about your behavior and interests on a website. This results in a specific user profile that can be used to deliver targeted advertising to a specific audience.

Person in Charge

Definition pursuant to Article 4 of the GDPR For the purposes of this regulation, the term means:

“Controller” meansthe natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States;

Explanation: In our case, we are responsible for processing your personal data and are therefore the “data controller.” If we transfer collected data to other service providers for processing, those providers are “data processors.” A “Data Processing Agreement (DPA)” must be signed for this purpose.

Processing

Definition pursuant to Article 4 of the GDPR For the purposes of this regulation, the term means:

“Processing” any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of disclosure; the alignment or combination; the restriction, erasure, or destruction;

Note: When we refer to “processing” in our Privacy Policy, we mean any type of data processing. As mentioned above in the original GDPR statement, this includes not only the collection but also the storage and processing of data. All texts are protected by copyright. Source: Privacy Policy Created using AdSimple's Privacy Policy Generator for Austria