Privacy Policy

Introduction

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter referred to as "data") we process, for what purposes, and to what extent. The privacy policy applies to all the processing of personal data carried out by us, both as part of the provision of our services and especially on our websites, in mobile applications, as well as within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offering").

The terms used are not gender-specific.

As of: August 20, 2024

Table of Contents

• Introduction
• Responsible Party
• Overview of Processing
• Relevant Legal Bases
• Security Measures
• Transfer of Personal Data
• Data Processing in Third Countries
• Deletion of Data
• Business Services
• Providers and Services Used in Business Activity
• Credit Checks
• Provision of Online Offering and Web Hosting
• Contact and Request Management
• Communication via Messenger
• Video Conferences, Online Meetings, Webinars, and Screen Sharing
• Cloud Services
• Newsletters and Electronic Notifications
• Social Media Presences
• Plugins and Embedded Functions/Content
• Changes and Updates to the Privacy Policy
• Rights of Data Subjects
• Definitions of Terms

Responsible Party

WP International Trade GmbH
Peter Hillig
Gartenstraße 63
01156 Dresden

Email Address:

info@wp-international-trade.de

Phone:

+49 351 418 815 23

Imprint:

https://en.wp-international-trade.de/Impressum.html

Overview of Processing

The following overview summarizes the types of data processed and the purposes of their processing, and refers to the affected individuals.

Types of Data Processed

• Inventory data.
• Payment data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta/communication data.

Special Categories of Data

• Health data.

Categories of Data Subjects

• Customers.
• Employees.
• Interested parties.
• Communication partners.
• Users.
• Business and contractual partners.

Purposes of Processing

• Provision of contractual services and customer support.
• Contact inquiries and communication.
• Direct marketing.
• Office and organizational procedures.
• Conversion measurement.
• Management and response to inquiries.
• Feedback.
• Marketing.
• Profiles with user-related information.
• Provision of our online offering and user-friendliness.
• Credit assessment and creditworthiness checks.
• Information technology infrastructure.

Automated Individual Decisions

• Credit check.

Relevant Legal Bases

Below you will find an overview of the legal bases of the GDPR, based on which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection regulations may apply in your or our place of residence or business. If more specific legal bases are applicable in individual cases, we will inform you of this in the privacy policy.

• Consent (Art. 6 para. 1 sentence 1 lit. a GDPR) - The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.
• Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR) - Processing is necessary for the performance of a contract to which the data subject is a party, or to carry out pre-contractual measures requested by the data subject.
• Legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR) - Processing is necessary to fulfill a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring protection of personal data.

In addition to the data protection regulations of the General Data Protection Regulation, national data protection regulations in Germany also apply. This includes, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG includes specific regulations on the right to access, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission, as well as automated individual decision-making, including profiling. Furthermore, it regulates data processing for employment purposes (§ 26 BDSG), particularly with regard to the establishment, execution, or termination of employment relationships, as well as the consent of employees. Additionally, state data protection laws of individual federal states may apply.

Security Measures

We take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk, in accordance with legal requirements, taking into account the state of the art, the implementation costs, and the nature, scope, circumstances, and purposes of the processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons.

These measures include, in particular, securing the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, input, transmission, availability, and separation of the data. Furthermore, we have established procedures to ensure the exercise of data subject rights, the deletion of data, and responses to data threats. Additionally, we take into account the protection of personal data during the development or selection of hardware, software, and procedures in accordance with the principle of data protection through technology design and privacy-friendly default settings.

SSL Encryption (https): To protect your data transmitted via our online offer, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in your browser's address bar.

Transmission of Personal Data

In the course of processing personal data, it may happen that the data is transmitted to other entities, companies, legally independent organizational units, or individuals, or that it is disclosed to them. Recipients of this data may include service providers tasked with IT-related tasks or providers of services and content that are integrated into a website. In such cases, we observe legal requirements and conclude appropriate contracts or agreements with the recipients of your data, in particular to protect your data.

Data transmission within the corporate group: We may transmit personal data to other companies within our corporate group or grant them access to such data. If this transmission occurs for administrative purposes, it is based on our legitimate business and economic interests or is necessary for the fulfillment of our contractual obligations, or when the data subjects have consented or legal permission exists.

Data transmission within the organization: We may transmit personal data to other entities within our organization or grant them access to such data. If this transmission occurs for administrative purposes, it is based on our legitimate business and economic interests or is necessary for the fulfillment of our contractual obligations, or when the data subjects have consented or legal permission exists.

Data Processing in Third Countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or if data processing occurs in the context of the use of services of third parties or the disclosure or transmission of data to other individuals, entities, or companies, this will only take place in accordance with legal requirements.

Subject to explicit consent or contractually or legally required transmission, we process or allow the processing of data only in third countries with a recognized level of data protection, contractual obligations through so-called standard contractual clauses of the EU Commission, existing certifications, or binding internal data protection regulations (Art. 44 to 49 GDPR, EU Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en).

Deletion of Data

The data we process will be deleted in accordance with legal requirements as soon as their consent, which allowed the processing, is revoked, or other permissions expire (e.g., if the purpose of processing this data ceases or it is no longer required for the purpose). If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to these purposes. This means the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons, or whose storage is necessary for the assertion, exercise, or defense of legal claims or to protect the rights of another natural or legal person.

Within the framework of our privacy notices, we can provide users with additional information on the deletion and retention of data that applies specifically to the respective processing processes.

Business Services

We process data from our contractual and business partners, such as customers and interested parties (collectively referred to as "contractual partners"), within the framework of contractual and comparable legal relationships, as well as related measures and communication with the contractual partners (or pre-contractually), e.g., to respond to inquiries.

We process this data to fulfill our contractual obligations. This includes, in particular, obligations to provide the agreed services, any update obligations, and remedies for warranty and other service disruptions. In addition, we process the data to safeguard our rights and for administrative tasks and corporate organization related to these obligations. Furthermore, we process the data based on our legitimate interests in proper and economically sound business management and in security measures to protect our contractual partners and our business operations from misuse, threats to their data, secrets, information, and rights (e.g., involving telecommunications, transport, and other assistance services, as well as subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Within the scope of applicable law, we only disclose the data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners will be informed about further forms of processing, e.g., for marketing purposes, within the framework of this privacy policy.

Which data is necessary for the aforementioned purposes is communicated to the contractual partners before or during data collection, e.g., in online forms, through special labeling (e.g., colors) or symbols (e.g., asterisks), or personally.

We delete the data after the expiration of legal warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, e.g., as long as it must be retained for legal reasons. The statutory retention period for documents relevant to tax law and for commercial books, inventories, opening balances, annual financial statements, the working instructions necessary for understanding these documents, and other organizational documents and booking records is ten years, and for received and sent business letters and reproductions of business letters, it is six years. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory was created, the opening balance or annual financial statement or management report was prepared, the business letter was received or sent, or the booking record was made, or the record or other documents were created.

As far as we use third-party providers or platforms to provide our services, the terms and privacy policies of the respective third-party providers or platforms apply to the relationship between users and the providers.

• Processed data types: Inventory data (e.g., names, addresses); Payment data (e.g., bank details, invoices, payment history); Contact data (e.g., email, phone numbers); Contract data (e.g., contract subject, duration, customer category); Usage data (e.g., visited websites, interest in content, access times); Meta/communication data (e.g., device information, IP addresses).
• Data subjects: Interested parties; Business and contractual partners; Customers.
• Purposes of processing: Provision of contractual services and customer service; Contact requests and communication; Office and organizational procedures; Administration and response to inquiries; Conversion measurement (measuring the effectiveness of marketing measures); Profiles with user-related information (creating user profiles).
• Legal basis: Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR); Legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

HubSpot CRM

We use the CRM system HubSpot from HubSpot, Inc., USA, to manage customer relationships, automate marketing processes, and analyze interactions with our customers. HubSpot allows us to store and process your data in a structured way to provide you with relevant information and efficiently handle your inquiries.

Types of data processed: Inventory data (e.g., name, address), contact data (e.g., email address, phone number), usage data (e.g., visited websites, access times), communication data (e.g., content of emails or contact requests).

Legal basis: The processing of your data is based on our legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) in efficient and secure handling of customer inquiries and optimizing our marketing measures. If consent is required, data processing is based on your consent (Art. 6 para. 1 sentence 1 lit. a GDPR).

Data transfer to third countries: Data may be processed by HubSpot on servers in the USA. To ensure the protection of your data, we have concluded EU standard contractual clauses with HubSpot, guaranteeing an adequate level of data protection.

Right to withdraw: You can object to the processing of your personal data by HubSpot at any time or withdraw a given consent. In such a case, your data will be deleted immediately, provided there are no legal retention obligations.

 

Further notes on processing procedures, methods, and services:

• sevDesk: Online software for invoicing, accounting, banking, and tax submission with document storage; Service provider: sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://sevdesk.de/; Privacy policy: https://sevdesk.de/sicherheit-datenschutz/; Data processing agreement: https://sevdesk.de/sicherheit-datenschutz/.

Credit Check

If we provide services in advance or enter into similar economic risks (e.g., purchasing on account), we reserve the right to obtain identity and credit information to assess the credit risk from specialized service providers (credit agencies) to safeguard our legitimate interests.

The information received from the credit agencies about the statistical probability of a payment default is processed by us as part of a proper discretionary decision regarding the establishment, execution, and termination of the contractual relationship. We reserve the right to refuse payment on account or other advances in the case of a negative credit check result.

The decision whether we provide services in advance is made in accordance with Art. 22 GDPR solely on the basis of an automated decision in the individual case, which our software makes based on the credit agency’s information.

If we obtain explicit consent from contractual partners, the legal basis for the credit check and the transmission of customer data to the credit agencies is consent. If no consent is obtained, the credit check is carried out based on our legitimate interests in the security of our payment claims.

• Types of data processed: Inventory data (e.g., names, addresses); payment data (e.g., bank details, invoices, payment history); contact data (e.g., email, phone numbers); contract data (e.g., contract subject, duration, customer category).
• Affected individuals: Customers; interested parties.
• Purposes of processing: Assessment of creditworthiness and solvency.
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Automated individual decision-making: Credit check (decision based on credit assessment).

Further notes on processing procedures, methods, and services:

• Creditreform Boniversum GmbH and Verband der Vereine Creditreform e.V.: Credit agency; Service provider: Creditreform Boniversum GmbH, Hellersbergstraße 11, 41460 Neuss, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.boniversum.de/; Privacy policy: https://www.boniversum.de/datenschutzerklaerung/.

Provision of Online Services and Web Hosting

To securely and efficiently provide our online services, we use the services of one or more web hosting providers, from whose servers (or servers they manage) the online offering can be accessed. For these purposes, we may utilize infrastructure and platform services, computing capacity, storage space, and database services, as well as security services and technical maintenance services.

The data processed in the context of providing the hosting services may include all information related to users of our online services that arises during use and communication. This regularly includes the IP address, which is necessary to deliver the contents of online services to browsers, and all entries made within our online services or on websites.

• Types of data processed: Content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta/communication data (e.g., device information, IP addresses).
• Affected individuals: Users (e.g., website visitors, online service users).
• Purposes of processing: Provision of our online services and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)).
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further notes on processing procedures, methods, and services:

• Collection of access data and log files: We (or our web hosting provider) collect data on each access to the server (so-called server log files). Server log files may include the address and name of the retrieved websites and files, date and time of the retrieval, transmitted data volumes, message about successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), and usually IP addresses and the requesting provider. Server log files may be used for security purposes, for example, to prevent server overload (especially in the case of abusive attacks, so-called DDoS attacks), and to ensure the load and stability of the servers; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Data deletion: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data that is required for evidentiary purposes is excluded from deletion until the respective incident is conclusively clarified.
• STRATO: Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacity); Service provider: STRATO AG, Pascalstraße 10, 10587 Berlin, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.strato.de; Privacy policy: https://www.strato.de/datenschutz; Data processing agreement: Provided by the service provider.

Contact and Inquiry Management

When contacting us (e.g., via contact form, email, phone, or social media) as well as in the context of existing user and business relationships, the information of the inquiring individuals is processed as far as necessary to respond to contact requests and any requested actions.

Responding to contact requests and managing contact and inquiry data in the context of contractual or pre-contractual relationships is carried out to fulfill our contractual obligations or to respond to (pre)contractual inquiries and, otherwise, based on legitimate interests in responding to inquiries and maintaining user or business relationships.

• Types of data processed: Contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); usage data (e.g., visited websites, interest in content, access times); meta/communication data (e.g., device information, IP addresses).
• Affected individuals: Communication partners.
• Purposes of processing: Provision of contractual services and customer service; contact requests and communication; management and response to inquiries; feedback (e.g., collecting feedback via online forms); provision of our online services and user-friendliness.
• Legal basis: Fulfillment of contracts and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR); legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further notes on processing procedures, methods, and services:

• Contact form: When users contact us via our contact form, email, or other communication channels, we process the data provided in this context to handle the communicated concern. For this purpose, we process personal data in the context of pre-contractual and contractual business relationships, as far as necessary for their fulfillment, and otherwise based on our legitimate interests and the interests of the communication partners in addressing concerns and our legal retention obligations; Legal basis: Fulfillment of contracts and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR), legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Communication via Messenger

We use messengers for communication purposes and therefore ask you to note the following information about the functionality of the messengers, encryption, the use of communication metadata, and your options to object.

You can also contact us through alternative means, e.g., by phone or email. Please use the contact options provided to you or the contact options specified within our online services.

In the case of end-to-end encryption of content (i.e., the content of your message and attachments), we point out that the communication contents (i.e., the content of the message and attached images) are encrypted from end to end. This means that the content of the messages is not visible, not even to the messenger providers themselves. You should always use an up-to-date version of the messengers with activated encryption to ensure the encryption of message content.

We also inform our communication partners that although the providers of the messaging services cannot view the content, they can determine if and when communication partners are communicating with us, as well as gather technical information about the communication partners' devices and, depending on their device settings, location information (so-called metadata).

Legal Basis Notes: If we request permission from communication partners before communicating with them via messenger, the legal basis for processing their data is their consent. Otherwise, if we do not request consent and, for example, they contact us on their own initiative, we use messengers with our contractual partners and in the context of contract initiation as a contractual measure. For other interested parties and communication partners, we base the use of messengers on our legitimate interests in fast and efficient communication and meeting the needs of our communication partners. Furthermore, we inform you that we do not transmit the contact details provided to us to the messengers without your consent.

Revocation, Objection, and Deletion: You can withdraw any consent given at any time and object to communication with us via messenger at any time. In the case of communication via messenger, we delete messages according to our general deletion policies (e.g., as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise as soon as we assume that any inquiries from communication partners have been answered, provided there is no expectation of a reference to a previous conversation and no legal retention obligations stand in the way of deletion.

Reservation of Reference to Other Communication Channels: Finally, we would like to point out that for security reasons, we reserve the right not to respond to requests via messenger. This is the case if, for example, contract details require special confidentiality or a response via messenger does not meet formal requirements. In such cases, we will refer you to more appropriate communication channels.

• Types of Data Processed: Contact data (e.g., email, phone numbers); Usage data (e.g., visited websites, interest in content, access times); Meta/communication data (e.g., device information, IP addresses); Content data (e.g., inputs in online forms).
• Affected Persons: Communication partners.
• Purposes of Processing: Contact inquiries and communication; Direct marketing (e.g., by email or postal mail).
• Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a DSGVO); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO).

Further Notes on Processing Procedures, Processes, and Services:

• Apple iMessage: Service Provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://www.apple.com/de/; Privacy Policy: https://www.apple.com/legal/privacy/de-ww/.
• Instagram: Messaging via the social network Instagram; Service Provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy.
• Facebook Messenger: Facebook Messenger with end-to-end encryption (end-to-end encryption of Facebook Messenger requires activation if it is not activated by default); Service Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Data Processing Agreement: https://www.facebook.com/legal/terms/dataprocessing; Standard Contractual Clauses (Guaranteeing Data Protection Level for Processing in Third Countries): https://www.facebook.com/legal/EU_data_transfer_addendum.
• Microsoft Teams: Microsoft Teams - Messenger; Service Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, Parent Company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://products.office.com; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement, Security Information: https://www.microsoft.com/de-de/trustcenter; Standard Contractual Clauses (Guaranteeing Data Protection Level for Processing in Third Countries): https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.
• Signal: Signal Messenger with end-to-end encryption; Service Provider: Privacy Signal Messenger, LLC 650 Castro Street, Suite 120-223 Mountain View, CA 94041, USA; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://signal.org/de; Privacy Policy: https://signal.org/legal/.
• Skype: Skype Messenger with end-to-end encryption - The end-to-end encryption of Skype requires activation (if not activated by default); Service Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://www.skype.com/de/; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement, Security Information: https://www.microsoft.com/de-de/trustcenter.
• Telegram Broadcasts: Telegram Broadcasts - Messenger with end-to-end encryption; Service Provider: Telegram, Dubai; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://telegram.org/; Privacy Policy: https://telegram.org/privacy.
• Threema: Threema Messenger with end-to-end encryption; Service Provider: Threema GmbH, Churerstrasse 82, 8808 Pfäffikon SZ, Switzerland; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://threema.ch/en; Privacy Policy: https://threema.ch/de/privacy.
• WhatsApp: WhatsApp Messenger with end-to-end encryption; Service Provider: WhatsApp Ireland Limited, 4 Grand Canal Quay, Dublin 2, D02 Kh48, Ireland; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://www.whatsapp.com/; Privacy Policy: https://www.whatsapp.com/legal.
• Wire: Wire Messenger with end-to-end encryption; Service Provider: Wire Swiss GmbH, Untermüli 9, 6300 Zug, Switzerland; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://wire.com/de; Privacy Policy: https://wire.com/de/legal/#terms.

Video Conferences, Online Meetings, Webinars, and Screen Sharing

We use platforms and applications from other providers (hereinafter referred to as "conference platforms") for the purpose of conducting video and audio conferences, webinars, and other types of video and audio meetings (hereinafter collectively referred to as "conferences"). When selecting conference platforms and their services, we comply with legal requirements.

Data Processed by Conference Platforms: In the context of participating in a conference, the conference platforms process the personal data of participants as mentioned below. The extent of processing depends on the data required for a specific conference (e.g., providing access credentials or real names) and any optional information provided by the participants. Besides processing for conducting the conference, participant data may also be processed by the conference platforms for security purposes or service optimization. Processed data includes personal data (first name, last name), contact information (email address, phone number), access credentials (access codes or passwords), profile pictures, details about professional positions/functions, the IP address of the internet connection, details about participants' devices, their operating system, browser and its technical and language settings, information on content-related communication processes, i.e., entries in chats, as well as audio and video data, and the use of other available functions (e.g., surveys). Communication content is encrypted to the extent technically provided by the conference providers. If participants are registered users with the conference platforms, additional data may be processed according to the agreement with the respective conference provider.

Logging and Recordings: If text entries, participation results (e.g., from surveys), or video or audio recordings are logged, this will be transparently communicated to the participants in advance, and they will be asked for consent if necessary.

Participants' Privacy Measures: Please refer to the privacy notices of the conference platforms for details on how your data is processed, and select the optimal security and privacy settings in the settings of the conference platforms. Furthermore, ensure data and personal protection during a video conference by managing the background of your recording (e.g., by informing housemates, locking doors, and using, where technically possible, the background blurring function). Links to conference rooms and access credentials must not be shared with unauthorized third parties.

Notes on Legal Basis: If, in addition to the conference platforms, we also process user data and request users' consent for the use of conference platforms or specific functions (e.g., consent for recording conferences), the legal basis for processing is this consent. Additionally, our processing may be necessary for fulfilling our contractual obligations (e.g., in participant lists, in the context of processing conversation results, etc.). Otherwise, user data is processed based on our legitimate interests in efficient and secure communication with our communication partners.

• Types of Data Processed: Inventory data (e.g., names, addresses); Contact data (e.g., email, phone numbers); Content data (e.g., entries in online forms); Usage data (e.g., visited websites, interest in content, access times); Meta/communication data (e.g., device information, IP addresses).
• Affected Persons: Communication partners; Users (e.g., website visitors, online service users).
• Purposes of Processing: Provision of contractual services and customer service; Contact inquiries and communication; Office and organizational procedures.
• Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a DSGVO); Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b DSGVO); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO).

Further Notes on Processing Procedures, Processes, and Services:

• Microsoft Teams: Messaging and conferencing software; Service Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, Parent Company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://products.office.com; Privacy Statement: https://privacy.microsoft.com/de-de/privacystatement, Security Information: https://www.microsoft.com/de-de/trustcenter; Standard Contractual Clauses (Guaranteeing Data Protection Level for Processing in Third Countries): https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.
• Zoom: Video conferences, web conferences, and webinars; Service Provider: Zoom Video Communications, Inc., 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://zoom.us; Privacy Statement: https://zoom.us/docs/de-de/privacy-and-legal.html; Data Processing Agreement: https://zoom.us/docs/de-de/privacy-and-legal.html (referred to as Global DPA); Standard Contractual Clauses (Guaranteeing Data Protection Level for Processing in Third Countries): https://zoom.us/docs/de-de/privacy-and-legal.html (Referred to as Global DPA).

Cloud Services

We use software services accessible via the internet and executed on the servers of their providers (so-called "Cloud Services," also referred to as "Software as a Service") for the following purposes: document storage and management, calendar management, email sending, spreadsheets and presentations, exchanging documents, content and information with specific recipients or publishing websites, forms or other content and information, as well as chats and participation in audio and video conferences.

In this context, personal data may be processed and stored on the providers' servers if it is part of communication processes with us or otherwise processed by us as described in this privacy policy. Such data may particularly include master data and contact data of users, data on processes, contracts, other processes, and their contents. Cloud service providers also process usage data and metadata, which they use for security purposes and service optimization.

If we use cloud services to provide forms or other documents and content for other users or publicly accessible websites, the providers may store cookies on users' devices for web analysis purposes or to remember user settings (e.g., in the case of media control).

• Types of Data Processed: Inventory data (e.g., names, addresses); Contact data (e.g., email, phone numbers); Content data (e.g., entries in online forms); Usage data (e.g., visited websites, interest in content, access times); Meta/communication data (e.g., device information, IP addresses).
• Affected Persons: Customers; Employees (e.g., staff, applicants, former employees); Prospects; Communication partners.
• Purposes of Processing: Office and organizational procedures; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)).
• Legal Bases: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b DSGVO); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO).

Further Notes on Processing Procedures, Processes, and Services:

• Apple iCloud: Cloud storage service; Service Provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://www.apple.com/de/; Privacy Statement: https://www.apple.com/legal/privacy/de-ww/.
• Microsoft Cloud Services: Cloud storage, cloud infrastructure services, and cloud-based application software; Service Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, Parent Company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO); Website: https://microsoft.com/de-de; Privacy Statement: https://privacy.microsoft.com/de-de/privacystatement, Security Information: https://www.microsoft.com/de-de/trustcenter; Data Processing Agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA; Standard Contractual Clauses (Guaranteeing Data Protection Level for Processing in Third Countries): https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.

Newsletters and Electronic Notifications

We send newsletters, emails, and other electronic notifications (hereinafter "Newsletters") only with the consent of the recipients or where legally permissible. If, as part of a newsletter subscription, the content is specifically described, it is relevant for the consent of the users. Otherwise, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for personal addressing in the newsletter or additional information if it is necessary for the purposes of the newsletter.

Double Opt-In Procedure: Subscription to our newsletter follows a double opt-in procedure. This means that after registering, you will receive an email requesting confirmation of your subscription. This confirmation is necessary to prevent unauthorized use of email addresses. Newsletter subscriptions are logged to ensure the registration process is in compliance with legal requirements. This includes storing the time of registration and confirmation, as well as the IP address. Changes to your data stored with the mailing service provider are also logged.

Deletion and Restriction of Data Processing: We may retain unsubscribed email addresses for up to three years based on our legitimate interests to provide evidence of previously given consent. The processing of this data will be limited to the purpose of potential defense against claims. An individual deletion request is possible at any time, provided the previous existence of consent is confirmed. In the event of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a blocklist (commonly referred to as a "blocklist").

Logging the registration process is based on our legitimate interests to demonstrate its proper execution. If we engage a service provider for email delivery, this is done based on our legitimate interest in an efficient and secure mailing system.

Content:

Information about us, our services, promotions, and offers.

• Processed Data Types: Inventory data (e.g., names, addresses); Contact details (e.g., email, phone numbers); Meta/communication data (e.g., device information, IP addresses); Usage data (e.g., visited websites, interest in content, access times).
• Special Categories of Personal Data: Health data (Art. 9 para. 1 GDPR).
• Affected Persons: Communication partners.
• Purposes of Processing: Direct marketing (e.g., via email or postal mail).
• Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).
• Opt-Out Option: You can unsubscribe from our newsletter at any time, i.e., revoke your consent or object to further receipt. You will find a link to unsubscribe at the end of each newsletter or can use any of the contact methods provided above, preferably via email.

Further Information on Processing Procedures, Methods, and Services:

• Measurement of Open and Click Rates: The newsletters contain a so-called "web beacon," i.e., a pixel-sized file that is retrieved from our server or, if we use a mailing service provider, from their server when the newsletter is opened. During this retrieval, technical information such as information about the browser and your system, as well as your IP address and the time of retrieval, is collected. This information is used to improve the technical performance of our newsletters based on technical data or the target audience and their reading habits based on their retrieval locations (which can be determined using the IP address) or access times. This analysis also includes determining whether the newsletters are opened, when they are opened, and which links are clicked. These evaluations are associated with individual newsletter recipients and are stored in their profiles until they are deleted. The evaluations help us recognize the reading habits of our users and tailor our content to them or send different content based on their interests. The measurement of open and click rates, as well as the storage of measurement results in user profiles, and further processing, are based on the consent of the users. A separate revocation of the success measurement is unfortunately not possible; in this case, the entire newsletter subscription must be canceled or objected to. In this case, the stored profile information will be deleted; Legal Basis: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR).
• Rapidmail: Email marketing platform; Service Provider: rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg i.Br., Germany; Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Website: https://www.rapidmail.de; Privacy Policy: https://www.rapidmail.de/datenschutz; Data Processing Agreement: https://www.rapidmail.de/hilfe/datenschutzvertrag-nach-eu-dsgvo-abschliessen.

Social Media Presence

We maintain online presences within social networks and process user data in this context to communicate with users active there or to offer information about us.

Please note that user data may be processed outside the European Union. This can result in risks for users, as it may be difficult for them to exercise their rights.

Furthermore, user data is generally processed for market research and advertising purposes within social networks. For example, usage profiles may be created based on user behavior and their resulting interests. These usage profiles can in turn be used to display advertisements within and outside the networks that presumably match the interests of users. For these purposes, cookies are usually stored on users' devices in which their usage behavior and interests are stored. Additionally, data can also be stored in usage profiles regardless of the devices used by users (especially if the users are members of the respective platforms and logged in).

For a detailed description of the respective forms of processing and the opt-out options, we refer to the privacy policies and information of the operators of the respective networks.

Even in the case of information requests and the assertion of user rights, we point out that these can be most effectively addressed to the providers. Only the providers have access to the users' data and can take appropriate measures and provide information. If you still need assistance, you can contact us.

• Processed Data Types: Contact data (e.g., email, phone numbers); Content data (e.g., entries in online forms); Usage data (e.g., visited websites, interest in content, access times); Meta/communication data (e.g., device information, IP addresses).
• Affected Persons: Users (e.g., website visitors, users of online services).
• Purposes of Processing: Contact requests and communication; Feedback (e.g., collecting feedback via online form); Marketing.
• Legal Basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further Information on Processing Procedures, Methods, and Services:

• Instagram: Social network; Service Provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy.
• Facebook Pages: Profiles within the social network Facebook - We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data from visitors to our Facebook page (so-called "Fanpage"). These data include information about the types of content that users view or interact with, or the actions they take (see "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g., IP addresses, operating systems, browser types, language settings, cookie data; see "Device information" in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under "How do we use this information?", Facebook also collects and uses information to provide analytics services, known as "Page Insights," to page operators to give them insights into how people interact with their pages and with the associated content. We have concluded a special agreement with Facebook ("Page Insights Information," https://www.facebook.com/legal/terms/page_controller_addendum), which specifically regulates the security measures that Facebook must observe and in which Facebook has agreed to fulfill the rights of data subjects (i.e., users can, for example, send information or deletion requests directly to Facebook). The rights of users (in particular to access, deletion, objection, and complaint to the competent supervisory authority) are not limited by the agreements with Facebook. Further information can be found in the "Page Insights Information" (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Standard Contractual Clauses (Ensuring data protection levels when processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further Information: Joint responsibility agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data.
• LinkedIn: Social network; Service Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Ireland; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Data Processing Agreement: https://legal.linkedin.com/dpa; Standard Contractual Clauses (Ensuring data protection levels when processing in third countries): https://legal.linkedin.com/dpa; Opt-out Option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Twitter: Social network; Service Provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, Parent company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Privacy Policy: https://twitter.com/privacy, (Settings: https://twitter.com/personalization).
• YouTube: Social network and video platform; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Privacy Policy: https://policies.google.com/privacy; Opt-out Option: https://adssettings.google.com/authenticated.
• Xing: Social network; Service Provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Website: https://www.xing.de; Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung.

Plugins and Embedded Functions as well as Content

We integrate function and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may include graphics, videos, or maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the users, as without the IP address they could not send the content to their browser. The IP address is therefore necessary for the display of this content or functions. We strive to use only such content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. Through the "pixel tags," information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the users' devices and may include, among other things, technical information about the browser and operating system, referring websites, visit times, as well as other details regarding the use of our online offering, and may also be combined with such information from other sources.

• Types of data processed: Usage data (e.g., visited websites, interest in content, access times); meta/communication data (e.g., device information, IP addresses); inventory data (e.g., names, addresses); contact data (e.g., email, phone numbers); content data (e.g., input in online forms).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: Providing our online offering and user-friendliness.
• Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Google Analytics

Our website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses so-called "cookies", text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there.

IP Anonymization: We have activated IP anonymization on this website. As a result, your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator.

Processed Data Types: Usage data (e.g., visited websites, access times), meta/communication data (e.g., device information, IP addresses).

Legal Basis: The data processing is based on your consent (Art. 6 Para. 1 S. 1 lit. a GDPR).

Objection to Data Collection: You can prevent the storage of cookies by adjusting your browser software accordingly; however, we would like to point out that in this case, you may not be able to fully use all the functions of this website. You can also prevent the collection of the data generated by the cookie and related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

Further Information: Further information on the terms of use and data protection can be found at https://www.google.com/analytics/terms/en.html or https://policies.google.com/?hl=en.

Further information on processing operations, procedures, and services:

• YouTube Videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Legal basis: Legitimate interests (Art. 6 Para. 1 S. 1 lit. f GDPR); Website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy; Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=en, Ad settings: https://adssettings.google.com/authenticated.

Amendment and update of the privacy policy

We kindly ask you to regularly review the content of our privacy policy. We will adjust the privacy policy as soon as changes in our data processing make this necessary. We will notify you if the changes require your cooperation (e.g., consent) or any other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time, and we ask you to verify the information before contacting them.

Rights of the data subjects

As a data subject under the GDPR, you have various rights, which arise in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you, which is based on Art. 6 Para. 1 lit. e or f GDPR, including profiling based on these provisions. If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: You have the right to revoke any consent given at any time.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to obtain information about this data as well as further information and a copy of the data in accordance with legal requirements.
• Right to rectification: In accordance with the law, you have the right to request the completion of data concerning you or the correction of incorrect data concerning you.
• Right to erasure and restriction of processing: In accordance with the law, you have the right to request that data concerning you be deleted without delay or, alternatively, to request a restriction of the processing of the data in accordance with legal requirements.
• Right to data portability: You have the right to receive the data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, or to request its transfer to another controller, in accordance with legal requirements.
• Right to lodge a complaint with a supervisory authority: In accordance with the law and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular, a supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged infringement if you believe that the processing of personal data concerning you violates the GDPR.

Definitions

This section provides an overview of the terminology used in this privacy policy. Many of the terms are taken from the law and defined mainly in Art. 4 GDPR. The legal definitions are binding. The following explanations are primarily intended to aid understanding. The terms are listed alphabetically.

• Credit check: Automated decisions are based on automatic data processing without human intervention (e.g., in the case of an automatic rejection of a purchase on account, an online loan application, or an online job application without any human involvement). Such automated decisions are only permitted under Art. 22 GDPR if data subjects have given their consent, if they are necessary for fulfilling a contract, or if national laws permit such decisions.
• Conversion tracking: Conversion tracking (also referred to as "visitor action evaluation") is a procedure that can be used to determine the effectiveness of marketing measures. For this purpose, a cookie is usually stored on the users' devices within the websites where the marketing measures are carried out and then retrieved again on the target website. For example, we can track whether the ads we placed on other websites were successful.
• Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• Profiles with user-related information: The processing of "profiles with user-related information," or simply "profiles," includes any type of automated processing of personal data that involves using such personal data to analyze, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profile formation, these may include different information regarding demographics, behavior, and interests, such as interactions with websites and their content). Cookies and web beacons are often used for profiling purposes.
• Controller: The "controller" is the natural or legal person, authority, institution, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: "Processing" means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data, whether collecting, evaluating, storing, transmitting, or deleting.