Pri­va­cy pol­i­cy

1. Data pro­tec­tion at a glance

Gen­er­al infor­ma­tion

The fol­low­ing infor­ma­tion pro­vides a sim­ple overview of what hap­pens to your per­son­al data when you vis­it this web­site. Per­son­al data is any data that can be used to iden­ti­fy you per­son­al­ly. Detailed infor­ma­tion on the sub­ject of data pro­tec­tion can be found in our data pro­tec­tion dec­la­ra­tion list­ed below this text.

Data col­lec­tion on this web­site

Who is respon­si­ble for data col­lec­tion on this web­site? Data pro­cess­ing on this web­site is car­ried out by the web­site oper­a­tor. You can find the oper­a­tor’s con­tact details in the “Infor­ma­tion on the con­troller” sec­tion of this pri­va­cy pol­i­cy.

How do we col­lect your data?

On the one hand, your data is col­lect­ed when you pro­vide it to us. This may, for exam­ple, be data that you enter in a con­tact form. Oth­er data is col­lect­ed by our IT sys­tems auto­mat­i­cal­ly or with your con­sent when you vis­it the web­site. This is pri­mar­i­ly tech­ni­cal data (e.g. inter­net brows­er, oper­at­ing sys­tem or time of page view). This data is col­lect­ed auto­mat­i­cal­ly as soon as you enter this web­site.

What do we use your data for?

Some of the data is col­lect­ed to ensure that the web­site is pro­vid­ed with­out errors. Oth­er data may be used to ana­lyze your user behav­ior. If con­tracts can be con­clud­ed or ini­ti­at­ed via the web­site, the trans­mit­ted data will also be processed for con­tract offers, orders or oth­er order inquiries.

What rights do you have with regard to your data?

You have the right to receive infor­ma­tion about the ori­gin, recip­i­ent and pur­pose of your stored per­son­al data free of charge at any time. You also have the right to request the cor­rec­tion or dele­tion of this data. If you have giv­en your con­sent to data pro­cess­ing, you can revoke this con­sent at any time for the future as at: 12.02.2026 PHI­NEO gAG Page 2 of 14 You also have the right to request the restric­tion of the pro­cess­ing of your per­son­al data under cer­tain cir­cum­stances. You also have the right to lodge a com­plaint with the com­pe­tent super­vi­so­ry author­i­ty. You can con­tact us at any time if you have any fur­ther ques­tions on the sub­ject of data pro­tec­tion.

Analy­sis tools and tools from third-par­ty providers

When you vis­it this web­site, your surf­ing behav­ior may be sta­tis­ti­cal­ly eval­u­at­ed. This is done pri­mar­i­ly with so-called analy­sis pro­grams. Detailed infor­ma­tion on these analy­sis pro­grams can be found in the fol­low­ing pri­va­cy pol­i­cy.

2. Host­ing

We use the fol­low­ing provider(s) to host the con­tent of our web­site:

Het­zn­er

The provider is Het­zn­er Online GmbH, Indus­triestr. 25, 91710 Gun­zen­hausen (here­inafter referred to as Het­zn­er). Details can be found in Het­zn­er’s pri­va­cy pol­i­cy: https://www.hetzner.com/de/legal/privacy-policy/.

The use of Het­zn­er is based on Art. 6 para. 1 lit. f GDPR. We have a legit­i­mate inter­est in dis­play­ing our web­site as reli­ably as pos­si­ble. If a cor­re­spond­ing con­sent has been request­ed, the pro­cess­ing is car­ried out exclu­sive­ly on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, inso­far as the con­sent includes the stor­age of cook­ies or access to infor­ma­tion in the user’s ter­mi­nal device (e.g. device fin­ger­print­ing) with­in the mean­ing of the TDDDG. Con­sent can be revoked at any time.

Order pro­cess­ing

We have con­clud­ed an order pro­cess­ing agree­ment (AVV) for the use of the above-men­tioned ser­vice. This is a con­tract pre­scribed by data pro­tec­tion law, which guar­an­tees that it process­es the per­son­al data of our web­site vis­i­tors only in accor­dance with our instruc­tions and in com­pli­ance with the GDPR.

netcup

The provider is netcup GmbH, Emmy-Noe­ther-Straße 10, 76131 Karl­sruhe (here­inafter referred to as netcup). Details can be found in Het­zn­er’s pri­va­cy pol­i­cy: https://www.netcup.com/de/kontakt/datenschutzerklaerung.

The use of netcup is based on Art. 6 para. 1 lit. f GDPR. We have a legit­i­mate inter­est in dis­play­ing our web­site as reli­ably as pos­si­ble. If a cor­re­spond­ing con­sent has been request­ed, the pro­cess­ing is car­ried out exclu­sive­ly on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, inso­far as the con­sent includes the stor­age of cook­ies or access to infor­ma­tion in the user’s ter­mi­nal device (e.g. device fin­ger­print­ing) with­in the mean­ing of the TDDDG. Con­sent can be revoked at any time.

Order pro­cess­ing

We have con­clud­ed a data pro­cess­ing agree­ment (DPA) for the use of the above-men­tioned ser­vice. This is a con­tract pre­scribed by data pro­tec­tion law, which ensures that it process­es the per­son­al data of our web­site vis­i­tors only in accor­dance with our instruc­tions and in com­pli­ance with the GDPR.

3. Gen­er­al notes and manda­to­ry infor­ma­tion

Data pro­tec­tion

The oper­a­tors of these pages take the pro­tec­tion of your per­son­al data very seri­ous­ly. We treat your per­son­al data con­fi­den­tial­ly and in accor­dance with the statu­to­ry data pro­tec­tion reg­u­la­tions and this pri­va­cy pol­i­cy. When you use this web­site, var­i­ous per­son­al data is col­lect­ed. Per­son­al data is data that can be used to iden­ti­fy you per­son­al­ly. This pri­va­cy pol­i­cy explains what data we col­lect and what we use it for. It also explains how and for what pur­pose this is done. We would like to point out that data trans­mis­sion over the Inter­net (e.g. when com­mu­ni­cat­ing by email) may be sub­ject to secu­ri­ty vul­ner­a­bil­i­ties. Com­plete pro­tec­tion of data against access by third par­ties is not pos­si­ble.

Note on the respon­si­ble body

The con­troller respon­si­ble for data pro­cess­ing on this web­site is:

PHI­NEO gemein­nützige AG
Anna-Louisa-Karsch-Str. 2
10178 Berlin
Tel: +49 (0)30 520 065 400
E‑Mail: info@phineo.org

The con­troller is the nat­ur­al or legal per­son who alone or joint­ly with oth­ers deter­mines the pur­pos­es and means of the pro­cess­ing of per­son­al data (e.g. names, email address­es, etc.).f

Stor­age peri­od

Unless a more spe­cif­ic stor­age peri­od has been spec­i­fied in this pri­va­cy pol­i­cy, your per­son­al data will remain with us until the pur­pose for data pro­cess­ing no longer applies. If you assert a jus­ti­fied request for dele­tion or revoke your con­sent to data pro­cess­ing, your data will be delet­ed unless we have oth­er legal­ly per­mis­si­ble rea­sons for stor­ing your per­son­al data (e.g. reten­tion peri­ods under tax or com­mer­cial law); in the lat­ter case, the dele­tion will take place after these rea­sons no longer apply.

Gen­er­al infor­ma­tion on the legal basis for data pro­cess­ing on this web­site

If you have con­sent­ed to data pro­cess­ing, we process your per­son­al data on the basis of Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, inso­far as spe­cial cat­e­gories of data are processed in accor­dance with Art. 9 para. 1 GDPR. In the event of express con­sent to the trans­fer of per­son­al data to third coun­tries, data pro­cess­ing is also car­ried out on the basis of Art. 49 para. 1 lit. a GDPR. If you have con­sent­ed to the stor­age of cook­ies or access to infor­ma­tion in your end device (e.g. via device fin­ger­print­ing), the data pro­cess­ing is also car­ried out on the basis of Sec­tion 25 (1) TDDDG. Con­sent can be revoked at any time. If your data is required to ful­fill the con­tract or to car­ry out pre-con­trac­tu­al mea­sures, we process your data on the basis of Art. 6 para. 1 lit. b GDPR. Fur­ther­more, we process your data if this is nec­es­sary to ful­fill a legal oblig­a­tion on the basis of Art. 6 para. 1 lit. c GDPR. Data pro­cess­ing may also be car­ried out on the basis of our legit­i­mate inter­est in accor­dance with Art. 6 para. 1 lit. f GDPR. Infor­ma­tion on the rel­e­vant legal bases in each indi­vid­ual case is pro­vid­ed in the fol­low­ing para­graphs of this pri­va­cy pol­i­cy.

Data Pro­tec­tion Offi­cer

We have appoint­ed a data pro­tec­tion offi­cer. You can reach him at the above address with the addi­tion — Data Pro­tec­tion Offi­cer — or at the fol­low­ing e‑mail address.

E‑mail: datenschutz@phineo.org

Note on the trans­fer of data to third coun­tries that are not secure under data pro­tec­tion law and the trans­fer to US com­pa­nies that are not DPF-cer­ti­fied

Among oth­er things, we use tools from com­pa­nies based in third coun­tries that are not secure under data pro­tec­tion law and US tools whose providers are not cer­ti­fied under the EU-US Data Pri­va­cy Frame­work (DPF). If these tools are active, your per­son­al data may be trans­ferred to these coun­tries and processed there. We would like to point out that a lev­el of data pro­tec­tion com­pa­ra­ble to that in the EU can­not be guar­an­teed in third coun­tries that are not secure under data pro­tec­tion law.

We would like to point out that the USA, as a safe third coun­try, gen­er­al­ly has a lev­el of data pro­tec­tion com­pa­ra­ble to that of the EU. Data trans­fer to the USA is there­fore per­mit­ted if the recip­i­ent is cer­ti­fied under the “EU-US Data Pri­va­cy Frame­work” (DPF) or has suit­able addi­tion­al guar­an­tees. Infor­ma­tion on trans­fers to third coun­tries, includ­ing data recip­i­ents, can be found in this pri­va­cy pol­i­cy.

Recip­i­ents of per­son­al data

As part of our busi­ness activ­i­ties, we work togeth­er with var­i­ous exter­nal bod­ies. In some cas­es, it is also nec­es­sary to trans­fer per­son­al data to these exter­nal bod­ies. We only pass on per­son­al data to exter­nal bod­ies if this is nec­es­sary for the ful­fill­ment of a con­tract, if we are legal­ly oblig­ed to do so (e.g. pass­ing on data to tax author­i­ties), if we have a legit­i­mate inter­est in the trans­fer in accor­dance with Art. 6 para. 1 lit. f GDPR or if anoth­er legal basis per­mits the trans­fer of data. When using proces­sors, we only pass on our cus­tomers’ per­son­al data on the basis of a valid con­tract for order pro­cess­ing. In the case of joint pro­cess­ing, a joint pro­cess­ing agree­ment is con­clud­ed.

Revo­ca­tion of your con­sent to data pro­cess­ing

Many data pro­cess­ing oper­a­tions are only pos­si­ble with your express con­sent. You can with­draw your con­sent at any time. The legal­i­ty of the data pro­cess­ing car­ried out until the revo­ca­tion remains unaf­fect­ed by the revo­ca­tion.

Right to object to the col­lec­tion of data in spe­cial cas­es and to direct mar­ket­ing (Art. 21 GDPR)

IF THE DATA PRO­CESS­ING IS BASED ON ART. 6 ABS. 1 LIT. E OR F GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PRO­CESS­ING OF YOUR PER­SON­AL DATA AT ANY TIME ON GROUNDS RELAT­ING TO YOUR PAR­TIC­U­LAR SIT­U­A­TION; THIS ALSO APPLIES TO PRO­FIL­ING BASED ON THESE PRO­VI­SIONS. THE RESPEC­TIVE LEGAL BASIS ON WHICH PRO­CESS­ING IS BASED CAN BE FOUND IN THIS PRI­VA­CY POL­I­CY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PER­SON­AL DATA CON­CERNED UNLESS WE CAN DEMON­STRATE COM­PELLING LEGIT­I­MATE GROUNDS FOR THE PRO­CESS­ING WHICH OVER­RIDE YOUR INTER­ESTS, RIGHTS AND FREE­DOMS OR THE PRO­CESS­ING SERVES THE ESTAB­LISH­MENT, EXER­CISE OR DEFENSE OF LEGAL CLAIMS (OBJEC­TION PUR­SUANT TO ART. 21 PARA. 1 GDPR).

IF YOUR PER­SON­AL DATA ARE PROCESSED FOR THE PUR­POSE OF DIRECT MAR­KET­ING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PRO­CESS­ING OF PER­SON­AL DATA CON­CERN­ING YOU FOR THE PUR­POSE OF SUCH MAR­KET­ING; THIS ALSO APPLIES TO PRO­FIL­ING TO THE EXTENT THAT IT IS RELAT­ED TO SUCH DIRECT MAR­KET­ING. IF YOU OBJECT, YOUR PER­SON­AL DATA WILL SUB­SE­QUENT­LY NO LONGER BE USED FOR THE PUR­POSE OF DIRECT MAR­KET­ING (OBJEC­TION PUR­SUANT TO ART. 21 PARA. 2 GDPR).

Right to lodge a com­plaint with the com­pe­tent super­vi­so­ry author­i­ty

In the event of breach­es of the GDPR, data sub­jects have the right to lodge a com­plaint with a super­vi­so­ry author­i­ty, in par­tic­u­lar in the Mem­ber State of their habit­u­al res­i­dence, place of work or place of the alleged infringe­ment. The right to lodge a com­plaint is with­out prej­u­dice to oth­er admin­is­tra­tive or judi­cial reme­dies.

Right to data porta­bil­i­ty

You have the right to have data that we process auto­mat­i­cal­ly on the basis of your con­sent or in ful­fill­ment of a con­tract hand­ed over to you or to a third par­ty in a com­mon, machine-read­able for­mat. If you request the direct trans­fer of the data to anoth­er con­troller, this will only take place if it is tech­ni­cal­ly fea­si­ble.

Infor­ma­tion, cor­rec­tion and dele­tion

With­in the frame­work of the applic­a­ble legal pro­vi­sions, you have the right to free infor­ma­tion about your stored per­son­al data, its ori­gin and recip­i­ents and the pur­pose of the data pro­cess­ing and, if nec­es­sary, a right to cor­rec­tion or dele­tion of this data at any time. You can con­tact us at any time if you have fur­ther ques­tions on the sub­ject of per­son­al data.

Right to restric­tion of pro­cess­ing

You have the right to request the restric­tion of the pro­cess­ing of your per­son­al data. You can con­tact us at any time to do this. The right to restric­tion of pro­cess­ing exists in the fol­low­ing cas­es:

If you dis­pute the accu­ra­cy of your per­son­al data stored by us, we gen­er­al­ly need time to check this. You have the right to request the restric­tion of the pro­cess­ing of your per­son­al data for the dura­tion of the review.

If the pro­cess­ing of your per­son­al data was/​is car­ried out unlaw­ful­ly, you can request the restric­tion of data pro­cess­ing instead of era­sure.

If we no longer need your per­son­al data, but you need it for the exer­cise, defense or asser­tion of legal claims, you have the right to request the restric­tion of the pro­cess­ing of your per­son­al data instead of dele­tion.

If you have lodged an objec­tion pur­suant to Art. 21 (1) GDPR, a bal­ance must be struck between your inter­ests and ours. As long as it has not yet been deter­mined whose inter­ests pre­vail, you have the right to request the restric­tion of the pro­cess­ing of your per­son­al data.

If you have restrict­ed the pro­cess­ing of your per­son­al data, this data — apart from its stor­age — may only be processed with your con­sent or for the estab­lish­ment, exer­cise or defense of legal claims or for the pro­tec­tion of the rights of anoth­er nat­ur­al or legal per­son or for rea­sons of impor­tant pub­lic inter­est of the Euro­pean Union or of a Mem­ber State.

SSL or TLS encryp­tion

This site uses SSL or TLS encryp­tion for secu­ri­ty rea­sons and to pro­tect the trans­mis­sion of con­fi­den­tial con­tent, such as orders or inquiries that you send to us as the site oper­a­tor. You can rec­og­nize an encrypt­ed con­nec­tion by the fact that the address line of the brows­er changes from “http://” to “https://” and by the lock sym­bol in your brows­er line.

If SSL or TLS encryp­tion is acti­vat­ed, the data you trans­mit to us can­not be read by third par­ties.

Objec­tion to adver­tis­ing emails

We here­by object to the use of con­tact data pub­lished as part of our oblig­a­tion to pro­vide a legal notice for the pur­pose of send­ing unso­licit­ed adver­tis­ing and infor­ma­tion mate­r­i­al. The oper­a­tors of this web­site express­ly reserve the right to take legal action in the event of the unso­licit­ed send­ing of adver­tis­ing infor­ma­tion, such as spam e‑mails.

4. Data col­lec­tion on this web­site

Cook­ies

Our Inter­net pages use so-called “cook­ies”. Cook­ies are small data pack­ets and do not cause any dam­age to your end device. They are stored on your device either tem­porar­i­ly for the dura­tion of a ses­sion (ses­sion cook­ies) or per­ma­nent­ly (per­ma­nent cook­ies). Ses­sion cook­ies are auto­mat­i­cal­ly delet­ed at the end of your vis­it. Per­ma­nent cook­ies remain stored on your end device until you delete them your­self or they are auto­mat­i­cal­ly delet­ed by your web brows­er.

Cook­ies may orig­i­nate from us (first-par­ty cook­ies) or from third-par­ty com­pa­nies (so-called third-par­ty cook­ies). Third-par­ty cook­ies enable the inte­gra­tion of cer­tain ser­vices from third-par­ty com­pa­nies with­in web­sites (e.g. cook­ies for pro­cess­ing pay­ment ser­vices).

Cook­ies have var­i­ous func­tions. Many cook­ies are tech­ni­cal­ly nec­es­sary, as cer­tain web­site func­tions would not work with­out them (e.g. the shop­ping cart func­tion or the dis­play of videos). Oth­er cook­ies can be used to eval­u­ate user behav­ior or for adver­tis­ing pur­pos­es.

Cook­ies that are required to car­ry out the elec­tron­ic com­mu­ni­ca­tion process, to pro­vide cer­tain func­tions that you have request­ed (e.g. for the shop­ping cart func­tion) or to opti­mize the web­site (e.g. cook­ies to mea­sure the web audi­ence) (nec­es­sary cook­ies) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless anoth­er legal basis is spec­i­fied. The web­site oper­a­tor has a legit­i­mate inter­est in the stor­age of nec­es­sary cook­ies for the tech­ni­cal­ly error-free and opti­mized pro­vi­sion of its ser­vices. If con­sent to the stor­age of cook­ies and com­pa­ra­ble recog­ni­tion tech­nolo­gies has been request­ed, the pro­cess­ing is car­ried out exclu­sive­ly on the basis of this con­sent (Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG); the con­sent can be revoked at any time.

You can set your brows­er so that you are informed about the set­ting of cook­ies and only allow cook­ies in indi­vid­ual cas­es, exclude the accep­tance of cook­ies for cer­tain cas­es or in gen­er­al and acti­vate the auto­mat­ic dele­tion of cook­ies when clos­ing the brows­er. If cook­ies are deac­ti­vat­ed, the func­tion­al­i­ty of this web­site may be restrict­ed.

You can find out which cook­ies and ser­vices are used on this web­site in this pri­va­cy pol­i­cy.

Serv­er log files

The provider of the pages auto­mat­i­cal­ly col­lects and stores infor­ma­tion in so-called serv­er log files, which your brows­er auto­mat­i­cal­ly trans­mits to us. These are

• Brows­er type and brows­er ver­sion
• Oper­at­ing sys­tem used
• Refer­rer URL
• Host name of the access­ing com­put­er
• Time of the serv­er request IP address

This data is not merged with oth­er data sources.

This data is col­lect­ed on the basis of Art. 6 para. 1 lit. f GDPR. The web­site oper­a­tor has a legit­i­mate inter­est in the tech­ni­cal­ly error-free pre­sen­ta­tion and opti­miza­tion of its web­site — the serv­er log files must be record­ed for this pur­pose.

Request by e‑mail, tele­phone or fax

If you con­tact us by e‑mail, tele­phone or fax, we will store and process your inquiry, includ­ing all per­son­al data (name, inquiry), for the pur­pose of pro­cess­ing your request. We will not pass on this data with­out your con­sent.

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is relat­ed to the per­for­mance of a con­tract or is nec­es­sary for the imple­men­ta­tion of pre-con­trac­tu­al mea­sures. In all oth­er cas­es, the pro­cess­ing is based on our legit­i­mate inter­est in the effec­tive pro­cess­ing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your con­sent (Art. 6 para. 1 lit. a GDPR) if this has been request­ed; con­sent can be revoked at any time.

The data you send to us via con­tact requests will remain with us until you ask us to delete it, revoke your con­sent to stor­age or the pur­pose for data stor­age no longer applies (e.g. after your request has been processed). Manda­to­ry statu­to­ry pro­vi­sions — in par­tic­u­lar statu­to­ry reten­tion peri­ods — remain unaf­fect­ed.

Con­tact form

If you send us inquiries via the con­tact form, your details from the inquiry form, includ­ing the con­tact details you pro­vide there, will be stored by us for the pur­pose of pro­cess­ing the inquiry and in the event of fol­low-up ques­tions. We will not pass on this data with­out your con­sent.

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is relat­ed to the per­for­mance of a con­tract or is nec­es­sary for the imple­men­ta­tion of pre-con­trac­tu­al mea­sures. In all oth­er cas­es, the pro­cess­ing is based on our legit­i­mate inter­est in the effec­tive pro­cess­ing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your con­sent (Art. 6 para. 1 lit. a GDPR) if this has been request­ed; con­sent can be revoked at any time.

We will retain the data you pro­vide on the con­tact form until you request its dele­tion, revoke your con­sent for its stor­age, or the pur­pose for its stor­age no longer per­tains (e.g. after ful­fill­ing your request). Manda­to­ry statu­to­ry pro­vi­sions — in par­tic­u­lar reten­tion peri­ods — remain unaf­fect­ed.

We use the fol­low­ing provider(s) to con­tact us via the con­tact form:

Con­tact Form 7

If you con­tact us via the con­tact form pro­vid­ed on the web­site (Con­tact Form 7), the data you enter (e.g. name, email address, mes­sage) will be stored by us for the pur­pose of pro­cess­ing your inquiry and in the event of fol­low-up ques­tions.

Reg­is­tra­tion on this web­site

You can reg­is­ter on this web­site in order to use addi­tion­al func­tions on the site. We will only use the data you enter for the pur­pose of using the respec­tive offer or ser­vice for which you have reg­is­tered. The manda­to­ry infor­ma­tion request­ed dur­ing reg­is­tra­tion must be pro­vid­ed in full. Oth­er­wise we will refuse your reg­is­tra­tion.

In the event of impor­tant changes, for exam­ple to the scope of the offer or tech­ni­cal­ly nec­es­sary changes, we will use the e‑mail address pro­vid­ed dur­ing reg­is­tra­tion to inform you in this way.

The data entered dur­ing reg­is­tra­tion is processed for the pur­pose of imple­ment­ing the user rela­tion­ship estab­lished by the reg­is­tra­tion and, if nec­es­sary, for the ini­ti­a­tion of fur­ther con­tracts (Art. 6 para. 1 lit. b GDPR).

The data col­lect­ed dur­ing reg­is­tra­tion will be stored by us for as long as you are reg­is­tered on this web­site and will then be delet­ed. Statu­to­ry reten­tion peri­ods remain unaf­fect­ed.

5. Analy­sis tools and adver­tis­ing

We use the fol­low­ing provider(s) to ana­lyze user behav­ior and for adver­tis­ing:

Mato­mo

This web­site uses the open source web analy­sis ser­vice Mato­mo.

With the help of Mato­mo, we are able to col­lect and ana­lyze data about the use of our web­site by web­site vis­i­tors. This allows us to find out, among oth­er things, when which pages were accessed and from which region. We also record var­i­ous log files (e.g. IP address, refer­rer, brows­er and oper­at­ing sys­tem used) and can mea­sure whether our web­site vis­i­tors per­form cer­tain actions (e.g. clicks, pur­chas­es, etc.).

This analy­sis tool is used on the basis of Art. 6 para. 1 lit. f GDPR. The web­site oper­a­tor has a legit­i­mate inter­est in the analy­sis of user behav­ior in order to opti­mize both its web­site and its adver­tis­ing. If a cor­re­spond­ing con­sent has been request­ed, the pro­cess­ing is car­ried out exclu­sive­ly on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, inso­far as the con­sent includes the stor­age of cook­ies or access to infor­ma­tion in the user’s ter­mi­nal device (e.g. device fin­ger­print­ing) with­in the mean­ing of the TDDDG. Con­sent can be revoked at any time.

IP anonymiza­tion

We use IP anonymiza­tion for the analy­sis with Mato­mo. Your IP address is short­ened before the analy­sis so that it can no longer be clear­ly assigned to you.

Cook­ie­less analy­sis

We have con­fig­ured Mato­mo so that Mato­mo does not store any cook­ies in your brows­er.

Host­ing

We host Mato­mo exclu­sive­ly on our own servers so that all analy­sis data remains with us and is not passed on.

6. Newslet­ter

Newslet­ter data

If you would like to receive the newslet­ter offered on the web­site, we require an e‑mail address from you as well as infor­ma­tion that allows us to ver­i­fy that you are the own­er of the e‑mail address pro­vid­ed and that you agree to receive the newslet­ter.

We use the fol­low­ing provider(s) to process and send our newslet­ter:

Hub­spot

Hub­Spot is an inte­grat­ed soft­ware solu­tion that can be used to imple­ment var­i­ous online mar­ket­ing mea­sures. Hub­Spot is head­quar­tered in the USA and has a branch in Ire­land.

Hub­Spot can be used to col­lect per­son­al data, e.g. the IP address. This data and the con­tent of our web­site are stored on Hub­Spot servers in Ire­land. We use Hub­Spot to ana­lyze the use of our web­site. This enables us to con­stant­ly opti­mize our web­site and make it more user-friend­ly. We also deter­mine which offers are of inter­est to newslet­ter sub­scribers so that we can con­tact them with suit­able offers.

We only use the IP address of a vis­i­tor in a short­ened ver­sion. This means that the IP address is short­ened by Hub­Spot with­in mem­ber states of the Euro­pean Union or in oth­er sig­na­to­ry states to the Agree­ment on the Euro­pean Eco­nom­ic Area. Only in excep­tion­al cas­es will the full IP address be trans­mit­ted to a Hub­Spot serv­er in the USA and short­ened there. The cook­ies have a stan­dard lifes­pan of 13 months. In addi­tion, we delete the per­son­al data col­lect­ed via Hub­Spot as soon as the pur­pose for which it was col­lect­ed has been achieved, unless statu­to­ry reten­tion peri­ods pre­vent dele­tion. The infor­ma­tion gen­er­at­ed by cook­ies about the use of the online offer can (the­o­ret­i­cal­ly) also be trans­ferred to a Hub­Spot serv­er in the USA and stored there.

Data pro­cess­ing is car­ried out on the basis of express con­sent in accor­dance with Art. 6 para. 1 sen­tence 1 lit. a GDPR. Con­sent can be revoked at any time with effect for the future. You can find more infor­ma­tion about how this works in Hub­Spot’s pri­va­cy pol­i­cy.

Newslet­ter

When you reg­is­ter for our newslet­ter, your e‑mail address will be used until you unsub­scribe. You will receive reg­u­lar infor­ma­tion by e‑mail on cur­rent top­ics as well as e‑mails on spe­cial occa­sions, such as spe­cial pro­mo­tions. The e‑mails may be per­son­al­ized and indi­vid­u­al­ized based on our infor­ma­tion about you.

Unless you have giv­en us your con­sent in writ­ing, we use the so-called dou­ble opt-in pro­ce­dure to sub­scribe to our newslet­ter, i.e. we will only send you a newslet­ter by e‑mail if you have express­ly con­firmed to us before­hand that we should acti­vate the newslet­ter dis­patch. We will then send you a noti­fi­ca­tion e‑mail and ask you to con­firm that you wish to receive our newslet­ter by click­ing on a link con­tained in this e‑mail.

The legal basis for the pro­cess­ing of your data is your con­sent in accor­dance with Art. 6 Abs. 1 lit. a) DSG­VO if you have express­ly reg­is­tered for the newslet­ter.

If you no longer wish to receive newslet­ters from us, you can revoke your con­sent at any time with effect for the future or object to the fur­ther receipt of the newslet­ter with­out incur­ring any costs oth­er than the trans­mis­sion costs accord­ing to the basic rates. Sim­ply use the unsub­scribe link con­tained in every newslet­ter or send a mes­sage to us or our data pro­tec­tion offi­cer.

7. Plu­g­ins and tools

We use the fol­low­ing provider(s) for the use of plu­g­ins and oth­er tools on our web­site:

YouTube with enhanced data pro­tec­tion

This web­site inte­grates videos from the YouTube web­site. The oper­a­tor of the web­site is Google Ire­land Lim­it­ed (“Google”), Gor­don House, Bar­row Street, Dublin 4, Ire­land.

When you vis­it one of these web­sites on which YouTube is inte­grat­ed, a con­nec­tion to the YouTube servers is estab­lished. The YouTube serv­er is informed which of our pages you have vis­it­ed. If you are logged into your YouTube account, you enable YouTube to assign your surf­ing behav­ior direct­ly to your per­son­al pro­file. You can pre­vent this by log­ging out of your YouTube account.

We use YouTube in extend­ed data pro­tec­tion mode. Accord­ing to YouTube, videos that are played in extend­ed data pro­tec­tion mode are not used to per­son­al­ize surf­ing on YouTube. Ads that are played in extend­ed data pro­tec­tion mode are also not per­son­al­ized. No cook­ies are set in extend­ed data pro­tec­tion mode. Instead, so-called local stor­age ele­ments are stored in the user’s brows­er, which con­tain per­son­al data sim­i­lar to cook­ies and can be used for recog­ni­tion. Details on the extend­ed data pro­tec­tion mode can be found here: https://support.google.com/youtube/answer/171780.

After acti­vat­ing a YouTube video, fur­ther data pro­cess­ing oper­a­tions may be trig­gered over which we have no influ­ence.

The use of YouTube is in the inter­est of an appeal­ing pre­sen­ta­tion of our online offers. This con­sti­tutes a legit­i­mate inter­est with­in the mean­ing of Art. 6 para. 1 lit. f GDPR. If a cor­re­spond­ing con­sent has been request­ed, the pro­cess­ing is car­ried out exclu­sive­ly on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, inso­far as the con­sent includes the stor­age of cook­ies or access to infor­ma­tion in the user’s ter­mi­nal device (e.g. device fin­ger­print­ing) with­in the mean­ing of the TDDDG. Con­sent can be revoked at any time.

You can find more infor­ma­tion about data pro­tec­tion at YouTube in their pri­va­cy pol­i­cy at: https://policies.google.com/privacy?hl=de.

The com­pa­ny is cer­ti­fied in accor­dance with the “EU-US Data Pri­va­cy Frame­work” (DPF). The DPF is an agree­ment between the Euro­pean Union and the USA that is intend­ed to ensure com­pli­ance with Euro­pean data pro­tec­tion stan­dards for data pro­cess­ing in the USA. Every com­pa­ny cer­ti­fied under the DPF under­takes to com­ply with these data pro­tec­tion stan­dards. Fur­ther infor­ma­tion on this can be obtained from the provider at the fol­low­ing link: https://www.dataprivacyframework.gov/participant/5780.

Com­pli­ance

We use the Com­pli­anz plu­g­in to make the inte­gra­tion of YouTube videos com­pli­ant with data pro­tec­tion reg­u­la­tions.

The provider of the tool is Com­pli­anz B.V., CoC 717814475, Kalmar­weg 14–5, 9723 JG Gronin­gen, Nether­lands. Com­pli­anz ensures that con­tent from YouTube is only loaded after you have giv­en your express con­sent. This means that no per­son­al data (such as your IP address) is trans­ferred to YouTube in advance.

Sta­tus of this pri­va­cy pol­i­cy: Feb­ru­ary 12, 2026