Snapshot 166867
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy Settings View the history of your consents and change or revoke consent. Change privacy settings Privacy settings history Revoke consents Privacy Policy 1. Name and address of the controller 2. Name and address of the data protection officer 3. General information on data processing 4. Provision of the website and creation of log files 5. Use of cookies 6. Newsletter 7. Registration 8. Contact form and e-mail contact 9. Job advertisements / online applications 10. Blog systems, mailing lists and discussion platforms 11. Events: ticket sales and personal schedule 12. Order processing in the online shop and customer account 13. External payment service providers 14. Use of third-party services 15. Rights of the data subject 16. Age of majority and legal capacity 17. Security measures 1. Name and address of the controller The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the Member States and other data protection provisions is: Icinga GmbH Deutschherrnstr. 15-19 90429 Nürnberg Germany Phone: +49 911 92885-55 E-mail: info@icinga.com Website: icinga.com 2. Name and address of the data protection officer The data protection officer of the responsible company is: Marius Hein NETWAYS GmbH Deutschherrnstr. 15-19 90429 Nürnberg Germany Phone: +49 911 92885-0 E-mail: datenschutz@netways.de Website: netways.de 3. General information on data processing 3.1 Scope of the processing of personal data As a matter of principle, we process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. Personal data is only processed if one of the legal bases listed in section 3.2 applies, in particular on the basis of your consent, for the performance of a contract, due to a legal obligation or on the basis of a legitimate interest. 3.2 Legal basis for the processing of personal data Where we obtain the data subject’s consent for processing operations, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis. Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for taking steps prior to entering into a contract. Where processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis. Where processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, Art. 6(1)(d) GDPR serves as the legal basis. Where processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and these interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Art. 6(1)(f) GDPR serves as the legal basis for the processing. 3.3 Erasure of data and storage period The personal data of the data subject is erased or its processing restricted as soon as the purpose of storage no longer applies. Data may also be stored beyond this if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. Data is also erased or its processing restricted when a storage period prescribed by these provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract. 3.4 Scope of this policy This privacy policy informs users about the nature, scope and purposes of the collection and use of personal data by the responsible provider. It applies to our online platforms such as websites, blog, shop and event websites. 4. Provision of the website and creation of log files 4.1 Description and scope of data processing Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected: Information about the browser type and version used The user’s operating system The user’s internet service provider The user’s IP address Date and time of access Websites from which the user’s system reaches our website Websites accessed by the user’s system via our website 4.2 Legal basis for data processing The legal basis for the temporary storage of the data is Art. 6(1)(f) GDPR. 4.3 Purpose of data processing The data is stored in log files to ensure the functionality of the website. In addition, the data helps us to optimise the website and to ensure the security of our IT systems. The data is not evaluated for marketing purposes in this context. 4.4 Storage period The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. Where data is collected to provide the website, this is the case when the respective session has ended. Where data is stored in log files, this is the case after six months at the latest. Storage beyond this period is possible. In this case, the users’ IP addresses are deleted or altered so that the accessing client can no longer be identified. 4.5 Right to object and removal The collection of data for the provision of the website and the storage of data in log files is essential for operating the website. You may object to the processing under Art. 21 GDPR (see section 15.7); as a rule, however, our compelling legitimate grounds for the secure operation of the website prevail in this case. 5. Use of cookies 5.1 Description and scope of data processing Our website uses cookies. Cookies are text files that are stored in or by the web browser on the user’s computer system. When a user visits a website, a cookie may be stored on the user’s device. This cookie contains a characteristic string that allows the browser to be uniquely identified when the website is visited again. We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change. The following data is stored and transmitted in the cookies: Operating data of the software, e.g. language settings, time zone etc. Items in a shopping cart Login information 5.2 Legal basis for data processing For technically necessary cookies, the storage of and access to information on your device is based on Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the subsequent processing of personal data is based on Art. 6(1)(f) GDPR. All other cookies and similar technologies, in particular for analytics and marketing purposes (see section 14), are only used with your consent pursuant to Section 25 (1) TDDDG in conjunction with Art. 6(1)(a) GDPR. 5.3 Purpose of data processing The purpose of using technically necessary cookies is to make websites easier to use. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after a page change. The user data collected by technically necessary cookies is not used to create user profiles. 5.4 Storage period, right to object and removal Cookies are stored on the user’s computer and transmitted from it to our website. As a user, you therefore have full control over the use of cookies. By changing the settings in your browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all functions of the website to their full extent. You can withdraw any consent you have given at any time with effect for the future via the cookie settings of the respective website. 6. Newsletter 6.1 Description and scope of data processing On our website you can subscribe to a free newsletter. When you subscribe, the data from the input form is transmitted to us. If you purchase goods or services on our website and provide your e-mail address in the process, we may subsequently use it to send you a newsletter. In such a case, the newsletter will exclusively contain direct advertising for our own similar goods or services. 6.2 Legal basis for data processing The legal basis for processing the data after the user has subscribed to the newsletter is Art. 6(1)(a) GDPR, provided the user has given consent. The legal basis for sending the newsletter as a result of the sale of goods or services is Art. 6(1)(f) GDPR in conjunction with Section 7 (3) of the German Act against Unfair Competition (UWG). You may object to this use of your e-mail address at any time without incurring any costs other than the transmission costs at the basic rates. 6.3 Purpose of data processing The user’s e-mail address is collected in order to deliver the newsletter. Other personal data collected during the subscription process serves to prevent misuse of the services or of the e-mail address used. 6.4 Storage period The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. The user’s e-mail address is therefore stored for as long as the newsletter subscription is active. Other personal data collected during the subscription process is generally erased after a period of six months. 6.5 Right to object and removal The user can cancel the newsletter subscription at any time. For this purpose, every newsletter contains a corresponding link. This also allows the user to withdraw consent to the storage of the personal data collected during the subscription process. 7. Registration 7.1 Description and scope of data processing On our website, we offer users the opportunity to register by providing personal data. The data from the input form is transmitted to us and stored. Only relevant data is collected, e.g. contact details (surname, first name, e-mail addresses etc.) or content data. At the time of registration, the following data is also stored: The user’s IP address Date and time of registration The user’s consent to the processing of this data is obtained during the registration process. 7.2 Legal basis for data processing If the registration serves the performance of a contract to which the user is party, or taking steps prior to entering into a contract, the additional legal basis for processing the data is Art. 6(1)(b) GDPR. Otherwise, consent pursuant to Art. 6(1)(a) GDPR is obtained. 7.3 Purpose of data processing Registration of the user is required for the performance of a contract with the user, for taking steps prior to entering into a contract, or for providing and reviewing content in blog systems, mailing lists or discussion platforms. 7.4 Disclosure of data to third parties An order or a request by the user for a quotation or individual contact may result in the data being forwarded to a partner company. In this case, the user is explicitly informed of the possible disclosure and the corresponding consent is obtained. Where necessary, data is disclosed to: Affiliated sales partners Hotels and restaurants for events and training courses Logistics partners 7.5 Storage period The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For data collected during the registration process for the performance of a contract or for taking steps prior to entering into a contract, this is the case when the data is no longer required for the performance of the contract. Even after the contract has been concluded, it may be necessary to store personal data of the contractual partner in order to comply with contractual or legal obligations. 7.6 Right to object and removal As a user, you can cancel your registration at any time. You can have the data stored about you changed at any time. If the data is required for the performance of a contract or for taking steps prior to entering into a contract, early erasure of the data is only possible insofar as no contractual or legal obligations prevent erasure. 8. Contact form and e-mail contact 8.1 Description and scope of data processing Our website contains a contact form that can be used to get in touch with us electronically. If a user makes use of this option, the data entered in the input form is transmitted to us and stored. Only relevant data is collected, e.g. contact details (surname, first name, e-mail addresses etc.) or content data. At the time the message is sent, the following data is also stored: The user’s IP address Date and time of sending Your consent to the processing of the data is obtained during the sending process, with reference to this privacy policy. Alternatively, you can contact us via the e-mail address provided. In this case, the user’s personal data transmitted with the e-mail is stored. Data is only disclosed to third parties in the cases listed in section 8.4. The data is used exclusively for the purposes stated in section 8.3. 8.2 Legal basis for data processing The legal basis for processing the data is Art. 6(1)(a) GDPR, provided the user has given consent. The legal basis for processing data transmitted in the course of sending an e-mail is Art. 6(1)(f) GDPR. If the e-mail contact aims at the conclusion of a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. 8.3 Purpose of data processing We process the personal data from the input form to handle the enquiry as well as for customer care and quality management. In the case of contact by e-mail, this also constitutes the necessary legitimate interest in processing the data. Otherwise, the user’s consent is required. The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our IT systems. 8.4 Disclosure of data to third parties An order or a request by the user for a quotation or individual contact may result in the data being forwarded to a partner company. In this case, the user is explicitly informed of the possible disclosure and the corresponding consent is obtained. Where necessary, data is disclosed to: Affiliated sales partners Hotels and restaurants for events and training courses Logistics partners 8.5 Publication of data When success stories are submitted, the data collected is published on the website, naming the user. In this case, the user is explicitly informed of the publication and the corresponding consent (Art. 6(1)(a) GDPR) is obtained. 8.6 Storage period The data is erased as soon as it is no longer required to achieve the purpose for which it was collected, the purpose ceases to apply or the user has withdrawn consent. The additional personal data collected during the sending process is erased after a period of six months at the latest. 8.7 Right to object and removal The user may withdraw consent to the processing of personal data at any time. If the user contacts us by e-mail, the user may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. In this case, all personal data stored in the course of the contact will be erased. 9. Job advertisements / online applications 9.1 Description and scope of data processing We collect and process application data electronically for the purpose of handling the application process. Various data is processed in this context, e.g. name, telephone number, e-mail address etc. This data is generally used for contacting and communicating with you. Characteristics that must not be taken into account under the German General Equal Treatment Act (AGG) (ethnic origin, gender, religion or belief, disability, age or sexual identity) are not considered in our selection decision. Please also do not submit information on illnesses, pregnancy, ethnic origin, political opinions, philosophical or religious beliefs, trade union membership, physical or mental health or sex life. The same applies to content that may infringe the rights of third parties (e.g. copyrights, press law or general rights of third parties). If an application is followed by the conclusion of an employment contract, the data submitted may be stored by us in a personnel file for the purpose of the usual organisational and administrative processes, in compliance with the relevant legal provisions. 9.2 Legal basis for data processing The legal basis for processing your application data is Art. 6(1)(b) GDPR (taking steps prior to entering into a possible employment relationship). If you consent to longer storage, for example in our talent pool, the legal basis is Art. 6(1)(a) GDPR. Retention for the defence against possible legal claims is based on Art. 6(1)(f) GDPR. 9.3 Purpose of data processing We process your application data solely to carry out the application process and to recruit employees. 9.4 Storage period If an application is rejected, the data submitted is automatically erased five months after notification of the decision. This does not apply if longer storage is required due to legal requirements (for example the burden of proof under the German General Equal Treatment Act) or if you have expressly consented to longer storage in our talent pool. 9.5 Right to object and removal The user may withdraw consent to the processing of personal data at any time. Unless legitimate interests of the controller or the user stand in the way, the data will be erased immediately. In the cases provided for by law, erasure may be replaced by a restriction of processing. 10. Blog systems, mailing lists and discussion platforms 10.1 Description and scope of data processing Within these systems, it is possible to post comments, write guest articles or take part in a discussion. Only relevant data is collected, e.g. contact details (surname, first name, e-mail addresses etc.) or content data. At the time of registration, the following data is also stored: The user’s IP address Date and time of registration If comments are posted, other users can subscribe to them. Other users are notified at the time a comment is posted. No personal data that allows direct identification is transmitted in the comments. Furthermore, on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR, we reserve the right to process users’ details for the purpose of spam detection or to delete posts that infringe the personal rights of third parties. The data provided in comments and posts is stored by us permanently until the user objects. 10.2 Legal basis for data processing The legal basis for processing the data is your consent pursuant to Art. 6(1)(a) GDPR or the legitimate interests of the controller pursuant to Art. 6(1)(f) GDPR. 10.3 Purpose of data processing We operate the systems mentioned above for marketing purposes, for recruiting employees and customers and for providing general information. The focus is on providing relevant user groups with general information from the controller’s field of business. 10.4 Storage period The content and communication data provided within the systems is stored by us permanently until the user objects. Log data is erased after six months at the latest. 10.5 Right to object and removal The user may withdraw consent to the processing of personal data at any time. We may store unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests (Art. 6(1)(f) GDPR) before erasing them, in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of a possible defence against claims. An individual request for erasure is possible at any time, provided that the former existence of consent is confirmed at the same time. 11. Events: ticket sales and personal schedule 11.1 Ticket sales via pretix 11.1.1 Description and scope of data processing We use the pretix ticketing system to sell tickets for our events. When you place an order, we process the details from the order form, in particular name, e-mail address, billing address and, where applicable, company, the tickets selected and the attendee data requested for the respective event. Mandatory fields are marked as such in the order form. Payment is processed via the payment service providers listed in section 13. Where we use an external service provider to operate the ticketing system, this provider processes the data exclusively on our behalf and in accordance with our instructions on the basis of a data processing agreement (Art. 28 GDPR). 11.1.2 Legal basis for data processing The legal basis is Art. 6(1)(b) GDPR (performance of the contract for participation in the event) and, for retention required by law, Art. 6(1)(c) GDPR. 11.1.3 Purpose of data processing We process the data in order to handle your order, issue invoices and tickets, organise admission to the event and inform you of organisational changes to the event. 11.1.4 Storage period The data is erased as soon as it is no longer required for running the event. Data subject to statutory retention obligations is erased once these have expired (see section 12.4). 11.1.5 Right to object and removal As the data is required for the performance of the contract, early erasure is only possible insofar as no contractual or legal obligations prevent it. Your rights under section 15 remain unaffected. 11.2 Personal schedule 11.2.1 Description and scope of data processing On the websites of our events, you can put together a personal schedule. Using this function is voluntary. If you use it, we store the following data: your e-mail address, which you have to confirm after entering it the sessions you have starred your feedback on sessions, if you provide any 11.2.2 Legal basis for data processing The legal basis for processing your e-mail address and starred sessions is Art. 6(1)(b) GDPR, as this allows us to provide the function you requested. Providing feedback is voluntary; the legal basis for this is your consent pursuant to Art. 6(1)(a) GDPR. 11.2.3 Purpose of data processing We process this data to make your personal schedule available on all your devices, to provide your starred sessions as a calendar feed that you can add to your calendar application, and to pass on your feedback to the organisers. Confirming your e-mail address ensures that only you can access your schedule. 11.2.4 Storage period Unconfirmed e-mail addresses are deleted after 48 hours. All other data, i.e. confirmed e-mail addresses, starred sessions and feedback, is deleted 90 days after the end of the respective event. 11.2.5 Right to object and removal You can delete all data stored for your personal schedule yourself at any time using the “Delete my data” button. You can withdraw your consent to the processing of your feedback at any time with effect for the future. Your rights under section 15 remain unaffected. 12. Order processing in the online shop and customer account We process our customers’ data in the context of orders placed in our online shop in order to enable them to select and order the chosen products and services, as well as to pay for them and have them delivered or performed. 12.1 Processing of data The data processed includes master data, communication data, contract data and payment data; the persons affected by the processing include our customers, prospective customers and other business partners. Processing is carried out for the purpose of providing contractual services in the context of operating an online shop, invoicing, delivery and customer service. We use session cookies to store the contents of the shopping cart and permanent cookies to store the login status. 12.2 Legal basis for data processing Processing is based on Art. 6(1)(b) (processing of orders) and (c) (archiving required by law) GDPR. The details marked as mandatory are required to conclude and perform the contract. We only disclose the data to third parties in the context of delivery, payment or within the scope of legal permissions and obligations towards legal advisors and authorities. Data is only processed in third countries if this is necessary for the performance of the contract (e.g. at the customer’s request for delivery or payment). 12.3 Storage of data Users can optionally create a user account, in which they can in particular view their orders. During registration, users are informed of the required mandatory details. User accounts are not public and cannot be indexed by search engines. If users have terminated their user account, their data relating to the user account is deleted, unless its retention is necessary for commercial or tax law reasons pursuant to Art. 6(1)(c) GDPR. Details in the customer account remain until it is deleted, with subsequent archiving in the event of a legal obligation. It is the users’ responsibility to back up their data before the end of the contract in the event of termination. In the context of registration, renewed logins and use of our online services, we store the IP address and the time of the respective user activity. This storage is based on our legitimate interests and those of the users in protection against misuse and other unauthorised use (Art. 6(1)(f) GDPR). As a matter of principle, this data is not disclosed to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6(1)(c) GDPR. 12.4 Storage period Data is erased after the expiry of statutory warranty and comparable obligations; the necessity of retaining the data is reviewed every three years. In the case of statutory archiving obligations, erasure takes place after their expiry (6, 8 or 10 years depending on the document, pursuant to Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)). 13. External payment service providers We use external payment service providers through whose platforms users and we can carry out payment transactions. In the context of performing contracts, we use the payment service providers on the basis of Art. 6(1)(b) GDPR. Otherwise, we use external payment service providers on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR in order to offer our users effective and secure payment options. 13.1 Data processed The data processed by the payment service providers includes master data such as name and address, bank data such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract-, amount- and recipient-related information. This information is required to carry out the transactions. However, the data entered is only processed and stored by the payment service providers. This means that we do not receive any account- or credit card-related information, but only confirmation or a negative report on the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit agencies. The purpose of this transmission is to verify identity and creditworthiness. In this regard, please refer to the terms and conditions and privacy notices of the payment service providers. The terms and conditions and privacy notices of the respective payment service providers, which can be accessed on their websites or transaction applications, apply to payment transactions. We also refer to these for further information and for asserting rights of withdrawal, access and other data subject rights: PayPal and Computop. 14. Use of third-party services We only use the services described in this section for analytics, marketing and convenience purposes if you have consented to them via the cookie settings (Section 25 (1) TDDDG in conjunction with Art. 6(1)(a) GDPR). Gravatar and Akismet are exempt; the legal basis stated for each of them applies. You can withdraw your consent at any time with effect for the future. Some providers are based in the USA or process data there. For companies certified under the EU-U.S. Data Privacy Framework, an adequacy decision of the European Commission applies (Art. 45 GDPR). Otherwise, data is transferred on the basis of the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). 14.1 Google Analytics This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). It is used only with your consent on the basis of Art. 6(1)(a) GDPR and Section 25 (1) TDDDG. Google Analytics uses cookies, text files that are stored on your computer and enable an analysis of your use of the website. 14.1.1 Storage of data The following information generated by the cookie about your use of the website is usually transmitted to a Google server in the USA and stored there: Browser type/version Operating system used Referrer URL (the previously visited page) Host name of the accessing computer (IP address) Time of the server request The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data. In Google Analytics 4, IP addresses are not logged or stored by Google; they are only used to derive approximate location data and then discarded. The data collected is therefore pseudonymous, but not anonymous. 14.1.2 Evaluation of data On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website and internet use to the website operator. You can prevent cookies from being stored by adjusting your browser software accordingly; however, please note that in this case you may not be able to use all functions of this website to their full extent. 14.1.3 Prevention of processing You can also prevent the collection of the data generated by the cookie and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: tools.google.com/dlpage/gaoptout As an alternative to the browser add-on, in particular for browsers on mobile devices, you can prevent collection by Google Analytics by not giving or by withdrawing your consent in the cookie settings of this website. We also use Google Analytics to evaluate data from Google advertising cookies and from Google Ads for statistical purposes. If you do not want this, you can deactivate it via “My Ad Center” https://myadcenter.google.com/home Further information on data protection in connection with Google Analytics can be found in Google’s privacy policy: https://policies.google.com/privacy 14.2 Google Ads We also use the Google advertising tool “Google Ads” (formerly Google AdWords) to promote our website. In this context, we use the analytics service “Conversion Tracking” of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter “Google”, on our website. It is used only with your consent (Art. 6(1)(a) GDPR, Section 25 (1) TDDDG). 14.2.1 Storage of data If you have reached our website via a Google ad, a cookie is placed on your computer. Cookies are small text files that your web browser places and stores on your computer. These “conversion cookies” expire after a limited period and are not used to identify you personally. If you visit certain pages of our website and the cookie has not yet expired, we and Google can recognise that you as a user clicked on one of our ads placed with Google and were redirected to our site. 14.2.2 Processing of data The information obtained with the help of the “conversion cookies” is used by Google to compile visit statistics for our website. These statistics tell us the total number of users who clicked on our ad and which pages of our website were subsequently visited by each user. However, neither we nor other advertisers using Google Ads receive any information that could be used to identify users personally. 14.2.3 Prevention of processing You can prevent “conversion cookies” from being installed by adjusting your browser settings accordingly, e.g. settings that generally deactivate the automatic setting of cookies or specifically block only cookies from the domain “googleadservices.com”. Google’s privacy policy in this regard can be found at the following link: https://policies.google.com/technologies/ads?hl=en 14.3 Google Maps We use the “Google Maps” component of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter “Google”, on our site. Each time the “Google Maps” component is called up, Google sets a cookie in order to process user settings and data when displaying the page on which the “Google Maps” component is integrated. 14.3.1 Processing of data As a rule, this cookie is not deleted when the browser is closed, but expires after a certain period of time unless you delete it manually beforehand. 14.3.2 Prevention of processing If you do not agree to this processing of your data, you can deactivate the “Google Maps” service and thus prevent data from being transmitted to Google. To do so, you can refuse or withdraw your consent in the cookie settings or deactivate JavaScript in your browser. Please note, however, that in this case you will not be able to use “Google Maps” or only to a limited extent. The use of “Google Maps” and of the information obtained via “Google Maps” is subject to the Google Terms of Service https://policies.google.com/terms?hl=en and the additional terms of service for “Google Maps” https://www.google.com/intl/en/help/terms_maps.html 14.4 Google Fonts We use the “Google Fonts” component of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter “Google”, on our site. 14.4.1 Processing of data Where fonts are not loaded locally from our servers, your browser connects to Google’s servers when a page is accessed in order to load the required fonts. In the process, in particular your IP address, information about your browser and the page accessed are transmitted to Google. Google logs these requests and evaluates them in aggregated form, for example to determine how widely individual font families are used. Further information on collection and processing can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=en 14.4.2 Prevention of processing If you do not agree to this processing of your data, you can refuse or withdraw your consent in the cookie settings. Your browser will then use a standard font, so the website may look different. 14.5 Reddit On this website, we use the conversion tracking (“Reddit Pixel”) of Reddit, Inc., USA, for marketing, market research and optimisation purposes. It is used only with your consent (Art. 6(1)(a) GDPR, Section 25 (1) TDDDG). This loads JavaScript code from Reddit that records information about your visit, such as pages viewed and interactions. The information collected is hashed and thus pseudonymised; however, it cannot be ruled out that Reddit links it to an existing Reddit account. 14.5.1 Processing and storage of data The data stored in connection with Reddit® is deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent its deletion. 14.5.2 Prevention of processing You can prevent the processing by refusing or withdrawing your consent in the cookie settings, by generally deactivating cookies in your browser or by specifically blocking cookies from Reddit. 14.6 Meta Pixel (Facebook and Instagram) We use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) on our website. This allows us to measure the effectiveness of our ads on Facebook and Instagram and to show ads specifically to people who have shown an interest in our offerings. It is used only with your consent (Art. 6(1)(a) GDPR, Section 25 (1) TDDDG). We are jointly responsible with Meta for the collection of the data and its transmission to Meta (Art. 26 GDPR); Meta is solely responsible for any further processing. 14.6.1 Storage of data When you visit our pages, the Meta Pixel transmits in particular your IP address, information about your browser and device, the pages visited and certain actions on our website, such as a registration or an order, to Meta. For this purpose, cookies are stored on your device. If you are logged in to Facebook or Instagram, Meta can link this information to your account. We ourselves only receive aggregated reports that do not allow conclusions to be drawn about individual persons. Meta also processes data in the USA; Meta is certified under the EU-U.S. Data Privacy Framework. 14.6.2 Prevention of processing You can prevent the processing by refusing or withdrawing your consent in the cookie settings. In your Facebook or Instagram account, you can also specify whether Meta may use information from other websites for advertising. Further information on data processing by Meta can be found in Meta’s privacy policy: https://www.facebook.com/privacy/policy/ 14.7 LinkedIn We use components of the LinkedIn network on our site. LinkedIn is a service of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Each time one of our web pages equipped with such a component is accessed, this component causes the browser you are using to download a corresponding representation of the component from LinkedIn. 14.7.1 Storage of data Through this process, LinkedIn is informed which specific page of our website is currently being visited. If you click the LinkedIn “Share” button while logged in to your LinkedIn account, you can link the content of our pages on your LinkedIn profile. This enables LinkedIn to associate the visit to our pages with your LinkedIn user account. 14.7.2 Prevention of processing If you do not want LinkedIn to associate your data with your account, you must log out of LinkedIn before visiting our website. For information on the purpose and scope of data collection and the further processing and use of data by LinkedIn, as well as settings to protect your privacy, please refer to the LinkedIn privacy policy. 14.8 Gravatar (profile pictures) Within our online services, and in particular in the blog, we use the Gravatar service of Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. 14.8.1 Storage of data Gravatar is a service where users can register and store profile pictures and their e-mail addresses. If users leave posts or comments with the respective e-mail address on other online presences (above all in blogs), their profile pictures can be displayed next to the posts or comments. For this purpose, the e-mail address provided by the user is transmitted to Gravatar in the form of a hash value to check whether a profile is stored for it. This is the sole purpose of transmitting the e-mail address; it is not used for any other purpose and is deleted afterwards. Gravatar is used on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR, as Gravatar allows us to offer authors of posts and comments the opportunity to personalise their contributions with a profile picture. By displaying the images, Gravatar learns the IP address of the users, as this is necessary for communication between a browser and an online service. Further information on the collection and use of data by Gravatar can be found in Automattic’s privacy policy: https://automattic.com/privacy/ 14.8.2 Prevention of processing If users do not want a user picture linked to their e-mail address at Gravatar to appear in the comments, they should use an e-mail address for commenting that is not registered with Gravatar. We would also like to point out that it is possible to use an anonymous e-mail address or no e-mail address at all if users do not want their own e-mail address to be sent to Gravatar. Users can prevent the transmission of data completely by not using our comment system. 14.9 Akismet (anti-spam check) Our online services use the Akismet service provided by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. It is used on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. 14.9.1 Storage of data This service distinguishes comments by real people from spam comments. For this purpose, all details of a comment are sent to a server in the USA, where they are analysed and stored for four days for comparison purposes. If a comment has been classified as spam, the data is stored beyond this period. These details include the name entered, the e-mail address, the IP address, the content of the comment, the referrer, information about the browser and computer system used and the time of the entry. Further information on the collection and use of data by Akismet can be found in Automattic’s privacy policy: https://automattic.com/privacy/ 14.9.2 Prevention of processing Users are welcome to use pseudonyms or to refrain from entering their name or e-mail address. Users can prevent the transmission of data completely by not using our comment system. 15. Rights of the data subject If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller: 15.1 Right of access You can request confirmation from the controller as to whether personal data concerning you is being processed. If such processing takes place, you can request the following information from the controller: the purposes for which the personal data is processed the categories of personal data being processed the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed the planned period for which the personal data concerning you will be stored or, if specific information on this is not possible, the criteria used to determine the storage period the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing the existence of a right to lodge a complaint with a supervisory authority all available information on the source of the data if the personal data is not collected from the data subject the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you can request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer. 15.2 Right to rectification You have a right to rectification and/or completion vis-à-vis the controller if the personal data processed concerning you is inaccurate or incomplete. The controller must carry out the rectification without undue delay. 15.3 Right to restriction of processing You can request the restriction of the processing of personal data concerning you under the following conditions: if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead; the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims, or if you have objected to processing pursuant to Art. 21(1) GDPR, pending verification whether the legitimate grounds of the controller override your grounds. Where processing of the personal data concerning you has been restricted, such data may – with the exception of storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If processing has been restricted under the above conditions, you will be informed by the controller before the restriction is lifted. 15.4 Right to erasure 15.4.1 Obligation to erase You can request the controller to erase the personal data concerning you without undue delay, and the controller is obliged to erase this data without undue delay if one of the following grounds applies: The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed. You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing. You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR. The personal data concerning you has been processed unlawfully. The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject. The personal data concerning you has been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR. 15.4.2 Information to third parties If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Art. 17(1) GDPR, the controller shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers processing the personal data that you as the data subject have requested the erasure by them of any links to, or copies or replications of, this personal data. 15.4.3 Exceptions The right to erasure does not apply to the extent that processing is necessary: for exercising the right of freedom of expression and information for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR, insofar as the right referred to in section 15.4.1 is likely to render impossible or seriously impair the achievement of the objectives of that processing for the establishment, exercise or defence of legal claims 15.5 Right to notification If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients. 15.6 Right to data portability You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data was provided, where the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out by automated means. In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others. The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 15.7 Right to object You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications. 15.8 Right to withdraw consent under data protection law You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. 15.9 Automated individual decision-making, including profiling You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision is necessary for entering into, or performance of, a contract between you and the controller, is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or is based on your explicit consent. However, these decisions must not be based on special categories of personal data referred to in Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR applies and suitable measures to safeguard the rights and freedoms and your legitimate interests are in place. In the cases referred to above, the controller shall implement suitable measures to safeguard the rights and freedoms and your legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision. 15.10 Right to lodge a complaint with a supervisory authority Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. 16. Age of majority and legal capacity Our online services are not intended for persons under the age of 16. Pursuant to Art. 8 GDPR, you can only give valid consent yourself to the processing of your data in connection with information society services once you have reached the age of 16; before that, the consent of your parent or guardian is required. Concluding contracts, such as orders in the online shop or ticket purchases, generally requires you to be of legal age and to have full legal capacity. If you are not yet 16 years old, we cannot store your data in our online systems. However, we do not want to miss out on you as an applicant and will be happy to welcome you at our office to receive your application in person. 17. Security measures During your visit to the website, we use the widespread TLS (Transport Layer Security) protocol in conjunction with the highest level of encryption supported by your browser. As a rule, this is 256-bit encryption. We also use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.