Privacy Policy

Privacy Policy of Lizard Sport AG 

With the following Privacy Policy, we would like to inform you about the types of your personal data (hereinafter also referred to simply as “data”) that we process, for what purposes, and to what extent. This Privacy Policy applies to all personal data processing carried out by us, both in the course of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “Online Offering”).

As of: July 24, 2019

Table of Contents

  • Introduction
  • Controller
  • Overview of Processing Activities
  • Applicable Legal Bases
  • Security Measures
  • Transfer and Disclosure of Personal Data Data Processing in Third Countries
  • Use of Cookies
  • Commercial and Business Services
  • Use of Online Marketplaces for E-Commerce Payment Service Providers
  • Registration and Login
  • Blogs and Publication Media
  • Contacting Us
  • Communication via Messenger
  • Surveys and Questionnaires
  • Provision of the Online Offering and Web Hosting
  • Music & Podcasts
  • Newsletters and Mass Communication
  • Advertising Communication via Mail, Fax, or Telephone Sweepstakes and Contests
  • Web Analytics and Optimization
  • Online Marketing
  • Review Platforms
  • Social Media Presence
  • Plugins and Embedded Functions and Content
  • Deletion of Data
  • Changes and Updates to the Privacy Policy Rights of Data Subjects
  • Definitions

 

Controller

Lizard Sport AG
Jürg Schoch
Leugeneweg 2
2542 Pieterlen
Switzerland


Authorized Representatives: Jürg Schoch

Email address: info@lizardsport.ch

Imprint: www.cylan.ch/pages/impressum

Overview of Processing Activities

The following overview summarizes the types of data processed and the purposes for which they are processed, and identifies the data subjects concerned.

Types of Data Processed

  • Inventory data (names, addresses, etc.).
  • Content data (text entries, photographs, videos).
  • Contact data (email addresses, telephone numbers).
  • Meta/communication data (device information, IP addresses). Usage data (websites visited, interest in content, access times). Location data.
  • Contract data (subject matter of the contract, term, customer category). Payment data (bank details, invoices, payment history).

Categories of Data Subjects 

  • Business and contractual partners.
  • Prospective customers.
  • Communication partners.
  • Customers.
  • Users (website visitors, users of online services). Participants in
  • sweepstakes and contests.

Purposes of Processing

  • Provision of our Online Offering and user-friendliness.
  • Analysis of visit activity.
  • Office and organizational procedures.
  • Cross-device tracking (cross-device processing of user data for marketing purposes).
  • Direct marketing (by email or post).
  • Conducting sweepstakes and contests. Feedback (collecting feedback, e.g. via a form).
  • Interest-based and behavioral marketing.
  • Contact requests and communication.
  • Conversion measurement (measuring the effectiveness of marketing measures).
  • Profiling (creating user profiles).
  • Remarketing.
  • Reach measurement (access statistics, recognition of returning visitors).
  • Security measures.
  • Tracking (interest-/behavior-based profiling, cookies).
  • Contractual services and support.
  • Managing and responding to inquiries.
  • Audience building (identifying relevant target groups for marketing purposes or other content delivery).

Applicable Legal Bases

Below, we inform you of the legal bases under the General Data Protection Regulation (GDPR) on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply in your country of residence or establishment, or ours.

  • Consent (Art. 6(1), first sentence, point (a) GDPR) - The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, point (b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6(1), first sentence, point (c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Protection of vital interests (Art. 6(1), first sentence, point (d) GDPR) - Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
  • Legitimate interests (Art. 6(1), first sentence, point (f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

National Data Protection Regulations in Switzerland: In addition to the data protection provisions of the General Data Protection Regulation, national data protection regulations apply in Switzerland. These include, in particular, the Federal Act on Data Protection (FADP). The FADP applies in particular where no EU/EEA citizens are affected and, for example, only data of Swiss citizens is processed.

Security Measures

In accordance with legal requirements, taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, input of, disclosure of, and safeguarding the availability of data, and its separation. Furthermore, we have established procedures that ensure the exercise of data subject rights, deletion of data, and responses to threats to data. We also take the protection of personal data into account when developing or selecting hardware, software, and procedures, in accordance with the principles of data protection by design and data protection-friendly default settings.

SSL encryption (https): We use SSL encryption to protect data transmitted via our Online Offering. You can recognize encrypted connections by the https:// prefix in your browser's address bar.

Transfer and Disclosure of Personal Data

As part of our processing of personal data, data may be transferred to or disclosed to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, payment institutions in connection with payment transactions, service providers commissioned to perform IT tasks, or providers of services and content embedded in a website. In such cases, we comply with the legal requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to protect your data.

Data Processing in Third Countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if processing takes place in connection with the use of third-party services or the disclosure or transfer of data to other persons, entities, or companies, this is done only in accordance with legal requirements.

Unless there is explicit consent or a transfer is contractually or legally required, we process data, or have it processed, only in third countries with a recognized level of data protection, which include US processors certified under the “Privacy Shield,” or on the basis of specific safeguards, such as contractual commitments through the European Commission’s so-called Standard Contractual Clauses, the existence of certifications, or binding internal

 

Use of Cookies

“Cookies” are small files stored on users’ devices. Cookies can store various types of information, such as language settings on a website, login status, a shopping cart, or the point at which a video was watched.

Cookies are generally also used when a user’s interests or behavior (e.g. viewing specific content, using functions, etc.) are stored in a user profile across individual websites. These profiles are used, for example, to show users advertisements that match their potential interests. This procedure is also referred to as “tracking,” i.e. tracking users’ potential interests. We also use the term cookies to refer to other technologies that perform the same functions as cookies (e.g. when user information is stored using pseudonymous online identifiers, also known as “user IDs”).

If we use cookies or tracking technologies, we will inform you about this in our Privacy Policy.

Information on legal bases: The legal basis on which we process your personal data using cookies depends on whether we ask you for consent. If we do so and you consent to the use of cookies, the legal basis for processing your data is the consent you have given. Otherwise, data processed using cookies is processed on the basis of our legitimate interests (e.g. in the efficient operation and improvement of our Online Offering) or, where the use of cookies is necessary, to fulfill our contractual obligations.

Withdrawal and objection (opt-out): Regardless of whether processing is based on consent or legal authorization, you may withdraw any consent given or object to the processing of your data through cookie technologies at any time (collectively referred to as “opt-out”).

You may first express your objection through your browser settings, e.g. by disabling the use of cookies (although this may also restrict the functionality of our Online Offering).

An objection to the use of cookies for online marketing purposes can be made through a

number of services, especially in the case of tracking, via the US website: http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/ or generally at http://optout.aboutads.info .

You can also find further information about ways to object in the information on the respective processing activities in this Privacy Policy.

Processing of Cookie Data on the Basis of Consent: Before processing data in connection with the use of cookies, either by us or on our behalf, we ask users for consent, which may be withdrawn at any time. Before consent has been given, we may use only cookies that are necessary for the operation of our Online Offering. These are used on the basis of our interests and users’ interest in the expected functionality of our Online Offering.

  • Types of data processed: Usage data (websites visited, interest in content, access times), meta/communication data (device information, IP addresses).
  • Data subjects: Users (website visitors, users of online services).
  • Legal bases: Consent (Art. 6(1), first sentence, point (a) GDPR), legitimate interests (Art. 6(1), first sentence, point (f) GDPR).

Commercial and Business Services

We process data relating to our contractual and business partners, e.g. customers and prospective customers (collectively referred to as “contractual partners”), in the context of contractual and similar legal relationships, as well as related measures and communications with contractual partners (or prior to entering into a contract), e.g. to respond to inquiries.

We process this data to fulfill our contractual obligations, safeguard our rights, and carry out the administrative tasks and business organization associated with this information. Within the scope of applicable law, we disclose contractual partners’ data to third parties only to the extent necessary for the aforementioned purposes or to fulfill legal obligations, or where the contractual partners have given their consent (e.g. to participating telecommunications, transportation, and other auxiliary service providers and subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Contractual partners will be informed of any further processing, e.g. for marketing purposes, in this Privacy Policy.

We inform contractual partners, before or during data collection, of the data required for the aforementioned purposes, e.g. by specifically marking it (e.g. using colors) or symbols (e.g. an asterisk or similar) in online forms, or in person.

We delete data after the expiry of statutory warranty and similar obligations, generally after 4 years, unless the data is stored in a customer account or must be retained for legal archiving purposes (e.g. generally 10 years for tax purposes). In the case of data disclosed to us by a contractual partner in connection with an order, we delete the data in accordance with the terms of the order, generally upon completion of the order.

Where we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply to the relationship between users and those providers.

Economic analyses and market research: For business reasons, and in order to identify market trends and the wishes of our contractual partners and users, we analyse the data available to us concerning business transactions, contracts, enquiries, etc. The data subjects may include contractual partners, prospective customers, customers, visitors and users of our online services.

The analyses are carried out for the purposes of business evaluations, marketing and market research (e.g. to identify customer groups with different characteristics). Where available, we may take into account the profiles of registered users, including details such as the services they have used. The analyses are for our own use only and are not disclosed externally, except where they consist of anonymous analyses based on aggregated, i.e. anonymised, data. We also respect users’ privacy and process data for analytical purposes using pseudonyms wherever possible and, where feasible, anonymously (e.g. as aggregated data).

Online shop and e-commerce: We process our customers’ data to enable them to select, purchase or order the products and goods they have chosen, as well as related services, and to pay for and receive them or have them performed.

The required information is identified as such during the ordering or comparable purchasing process and includes the details necessary for delivery or provision and billing, as well as contact information in case we need to get in touch.

  • Types of data processed: Inventory data (names, addresses, etc.), payment data (bank details, invoices, payment history), contact data (email addresses, telephone numbers), contract data (subject matter of the contract, term, customer category), usage data (websites visited, interest in content, access times), metadata/communication data (device information, IP addresses).
  • Data subjects: Prospective customers, business and contractual partners, customers.
  • Purposes of processing: Contractual services and customer service, contact enquiries and communication, office and organisational procedures, administration of and response to enquiries, analysis of visitor behaviour, interest-based and behavioural marketing, profiling (creating user profiles), security measures.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Use of online marketplaces for e-commerce

We offer our services on online platforms operated by other service providers. In addition to our privacy notices, the privacy notices of the respective platforms also apply. This applies in particular to the procedures used on the platforms for measuring reach and interest-based marketing.

  • Types of data processed: Inventory data (names, addresses, etc.), payment data (bank details, invoices, payment history), contact data (email addresses, telephone numbers), contract data (subject matter of the contract, term, customer category), usage data (websites visited, interest in content, access times), metadata/communication data (device information, IP addresses).
  • Data subjects: Customers.
  • Purposes of processing: Contractual services and customer service.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Services and service providers used:

  • shopify: E-commerce platform and cloud services; Service provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; Website: https://www.shopify.de; Privacy policy: https://www.shopify.de/legal/datenschutz.

Payment service providers

In the context of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and, in addition to banks and credit institutions, use other payment service providers for this purpose (collectively, “payment service providers”).

The data processed by payment service providers includes inventory data, such as name and address; bank details, such as account or credit card numbers; passwords, TANs and verification codes; as well as contract, transaction amount and recipient details. This information is required to process transactions. However, the data entered is processed and stored only by the payment service providers. In other words, we do not receive account or credit card details, but only information confirming or declining payment. In some cases, payment service providers may transmit data to credit reference agencies. This transfer is intended to verify identity and creditworthiness. Please refer to the payment service providers’ terms and conditions and privacy notices for further details.

The terms and conditions and privacy notices of the respective payment service providers apply to payment transactions and can be accessed on the respective websites or within the transaction applications. We also refer you to these for further information and for exercising rights of withdrawal, access and other data subject rights.

  • Types of data processed: Inventory data (names, addresses, etc.), payment data (bank details, invoices, payment history), contract data (subject matter of the contract, term, customer category), usage data (websites visited, interest in content, access times), metadata/communication data (device information, IP addresses).
  • Data subjects: Customers, prospective customers.
  • Purposes of processing: Contractual services and customer service.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).
Services and service providers used:
  • Mastercard: Payment services; Service provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium; Website: https://www.mastercard.de/de-de.html; Privacy policy: https://www.mastercard.de/de-de/datenschutz.html.
  • PayPal: Payment services; Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Website: https://www.paypal.com/de; Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
  • Stripe: Payment services; Service provider: Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA; Website: https://stripe.com/de; Privacy policy: https://stripe.com/de/privacy.
  • Visa: Payment services; Service provider: Visa Europe Services Inc., London branch, 1 Sheldon Square, London W2 6TT, UK; Website: https://www.visa.de; Privacy policy: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

Registration and login

Users can create a user account. During registration, users are informed of the required mandatory information, which is processed for the purpose of providing the user account on the basis of fulfilling contractual obligations. The data processed includes, in particular, login information (name, password and email address). The data entered during registration is used for the purposes of using the user account and its functions. Users may be informed by email about information relevant to their user account, such as technical changes. If users cancel their user account, their account data will be deleted, subject to any statutory retention obligations. It is the users’ responsibility to back up their data before the end of the contract following cancellation. We are entitled to irretrievably delete all user data stored during the term of the contract.

When users make use of our registration and login functions and use their user accounts, we store their IP address and the time of each user action. This is done on the basis of our legitimate interests, as well as those of users, in protecting against misuse and other unauthorised use. As a rule, this data is not disclosed to third parties, unless disclosure is necessary to pursue our claims or we are legally obliged to do so.

  • Types of data processed: Inventory data (names, addresses, etc.), contact data (email addresses, telephone numbers), content data (text entries, photographs, videos), metadata/communication data (device information, IP addresses).
  • Data subjects: Users (website visitors, users of online services).
  • Purposes of processing: Contractual services and customer service, security measures, administration of and response to enquiries.
  • Legal bases: Consent (Art. 6(1)(a) GDPR), performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Blogs and publication media

We use blogs or similar means of online communication and publication (hereinafter “publication medium”). Readers’ data is processed for the purposes of the publication medium only insofar as necessary for its presentation and for communication between authors and readers or for security reasons. For all other matters, please refer to the information on the processing of visitors to our publication medium in this privacy notice.

Comments and contributions: If users leave comments or other contributions, their IP addresses may be stored on the basis of our legitimate interests. This is done for our security in case someone posts unlawful content in comments or contributions (insults, prohibited political propaganda, etc.). In such cases, we may be held liable for the comment or contribution and therefore have an interest in knowing the author’s identity.

We also reserve the right to process users’ information for spam detection on the basis of our legitimate interests.

On the same legal basis, we reserve the right, in the case of surveys, to store users’ IP addresses for the duration of the survey and to use cookies to prevent multiple votes.

Information about the person provided in comments and contributions, any contact and website information, and the content itself will be stored by us indefinitely until users object.

  • Types of data processed: Inventory data (names, addresses, etc.), contact data (email addresses, telephone numbers), content data (text entries, photographs, videos), usage data (websites visited, interest in content, access times), metadata/communication data (device information, IP addresses).
  • Data subjects: Users (website visitors, users of online services).
  • Purposes of processing: Contractual services and customer service, feedback (collecting feedback, e.g. via a form), security measures, administration of and response to enquiries.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR), consent (Art. 6(1)(a) GDPR), protection of vital interests (Art. 6(1)(d) GDPR).

Contact

When you contact us (e.g. via a contact form, email, telephone or social media), the information provided by the person making the enquiry is processed insofar as necessary to respond to the contact enquiry and any requested action.

We respond to contact enquiries in the context of contractual or pre-contractual relationships in order to fulfil our contractual obligations or to respond to (pre-)contractual enquiries; in other cases, we do so on the basis of our legitimate interests in responding to enquiries.

Chat function: We provide a chat function within our online services for communication and responding to enquiries. Information entered by users in the chat is processed for the purpose of responding to their enquiries.

  • Types of data processed: Inventory data (names, addresses, etc.), contact data (email addresses, telephone numbers), content data (text entries, photographs, videos), usage data (websites visited, interest in content, access times), metadata/communication data (device information, IP addresses).
  • Data subjects: Communication partners, prospective customers.
  • Purposes of processing: Contact enquiries and communication, administration of and response to enquiries.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Services and service providers used:

LiveChat

Service provider: LiveChat Inc., placeholder placeholder placeholder; Website: https://www.livechatplaceholder placeholder placeholder; Privacy policy: https://www.livechatplaceholder placeholder placeholder; Privacy Shield (guaranteeing data protection standards when processing data in the USA): https://www.privacysplaceholder placeholder placeholder.

Communication via messenger

We use messenger services for communication and therefore ask you to observe the following information concerning the functionality of messengers, encryption, the use of communication metadata and your options to object.

You can also contact us by alternative means, e.g. by telephone or email. Please use the contact options provided to you or those listed within our online services.

Where end-to-end encryption of content is used (i.e. the content of your message and attachments), please note that the communication content (i.e. the message and any attached images) is encrypted end to end. This means that the content of messages cannot be viewed, not even by the messenger providers themselves. You should always use an up-to-date version of the messenger with encryption enabled to ensure that message content is encrypted.

However, we also draw our communication partners’ attention to the fact that although the messenger providers cannot see the content, they can ascertain that and when communication partners communicate with us, and process technical information about the communication partners’ devices and, depending on their device settings, location information (so-called metadata).

Information on legal bases: If we ask communication partners for permission before communicating with them via messenger, the legal basis for processing their data is their consent. Otherwise, if we do not ask for consent and they contact us of their own accord, for example, we use messengers in our relationship with our contractual partners and in the context of initiating a contract as a contractual measure, and, in the case of other interested parties and communication partners, on the basis of our legitimate interests in fast and efficient communication and in meeting our communication partners’ needs with regard to communication via messengers. We also wish to inform you that we will not transmit the contact details provided to us to the messaging services for the first time without your consent. 

Withdrawal, objection and deletion: You may withdraw any consent you have given or object to communicating with us via messenger at any time. In the case of communication via messenger, we delete messages in accordance with our general deletion policy (i.e. for example, as described above, after the end of contractual relationships, retention requirements, etc.) and otherwise as soon as we can assume that we have answered any queries from communication partners, if no reference to a previous conversation is expected and there are no statutory retention obligations preventing deletion.

Reservation of the right to refer to other communication channels: Finally, we would like to point out that, for your security, we reserve the right not to answer inquiries via messenger. This applies, for example, if confidential contractual information is involved or a response via messenger would not meet formal requirements. In such cases, we will refer you to more appropriate communication channels.

  • Types of data processed: Contact data (email addresses, telephone numbers), usage data (websites visited, interest in content, access times), meta/communication data (device information, IP addresses).
  • Data subjects: Communication partners.
  • Purposes of processing: Contact inquiries and communication, direct marketing (by email or post).
  • Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Surveys and questionnaires

The surveys and questionnaires we conduct (hereinafter “surveys”) are evaluated anonymously. Personal data is processed only to the extent necessary to provide and technically conduct the survey (e.g. processing the IP address to display the survey in the user’s browser or using a temporary cookie (session cookie) to enable the survey to be resumed), or where users have consented.

Information on legal bases: If we ask participants to consent to the processing of their data, this consent is the legal basis for processing; otherwise, participants’ data is processed on the basis of our legitimate interests in conducting an objective survey.

  • Types of data processed: Contact data (email addresses, telephone numbers), content data (text entries, photographs, videos), usage data (websites visited, interest in content, access times), meta/communication data (device information, IP addresses).
  • Data subjects: Communication partners, users (website visitors, users ofonline services).
  • Purposes of processing: Contact inquiries and communication, direct marketing (by email or post), tracking (interest-/behavior-based profiling, cookies), feedback (collecting feedback, e.g. via a form).
  • Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Services and service providers used:

Google Forms: Google Cloud Forms; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://firebase.google.com;

Privacy policy: https://policies.google.com/privacy; Privacy Shield (safeguarding the level of data protection when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active;

Opt-out option: Opt-out plugin: http://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying advertisements: https://adssettings.google.com/authenticated.

Provision of the online offering and web hosting

To provide our online offering securely and efficiently, we use the services of one or more web hosting providers, whose servers (or servers managed by them) can be used to access the online offering. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security and technical maintenance services.

The data processed in connection with the provision of the hosting service may include all information relating to users of our online offering that arises in the course of its use and communication. This regularly includes the IP address, which is required to deliver the content of online offerings to browsers, and all entries made within our online offering or on websites.

Email sending and hosting: The web hosting services we use also include the sending, receipt and storage of emails. For these purposes, the addresses of recipients and senders, as well as other information relating to email transmission (e.g. the providers involved) and the content of the respective emails, are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails sent over the internet are generally not encrypted. As a rule, emails are encrypted in transit, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and received. We therefore cannot accept responsibility for the transmission of emails between the sender and their receipt on our server. 

  • Types of data processed: Content data (text entries, photographs, videos), usage data (websites visited, interest in content, access times), meta/communication data (device information, IP addresses).
  • Data subjects: Users (website visitors, users of online services). Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Music & podcasts

We use the hosting and analytics services of the providers listed below to make our audio content available for listening or download and to obtain statistical information about access to the audio content.

  • Types of data processed: Usage data (websites visited, interest in content, access times), meta/communication data (device information, IP addresses).
  • Data subjects: Users (website visitors, users of online services).
  • Purposes of processing: Reach measurement (access statistics, recognition of returning visitors), analysis of visitor activity, profiling (creation of user profiles).

Newsletters and mass communication

We send newsletters, emails and other electronic notifications (hereinafter “newsletters”) only with the recipients’ consent or where legally permitted. If the content of a newsletter is specifically described as part of the subscription process, it is material to the users’ consent. Otherwise, our newsletters contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name so that we can address you personally in the newsletter, or other details if these are required for the purposes of the newsletter.

Double opt-in procedure: Subscription to our newsletter generally uses a so-called double opt-in procedure. This means that after subscribing, you will receive an email asking you to confirm your subscription. This confirmation is necessary to prevent anyone from subscribing using someone else’s email address. Newsletter subscriptions are logged so that we can demonstrate that the subscription process complied with legal requirements. This includes storing the date and time of subscription and confirmation, as well as the IP address. Changes to your data stored with the email service provider are also logged.

Deletion and restriction of processing: We may retain unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to demonstrate that consent was previously given. Processing of this data is restricted to the purpose of potentially defending against claims. An individual request for deletion may be made at any time, provided that the previous existence of consent is also confirmed. If we are required to permanently respect objections, we reserve the right to store the email address on a blocklist (so-called “blacklist”) solely for this purpose.

The subscription procedure is logged on the basis of our legitimate interests for the purpose of demonstrating that it was properly carried out. If we engage a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure mailing system.

Information on legal bases: Newsletters are sent on the basis of the recipients’ consent or, if consent is not required, on the basis of our legitimate interests in direct marketing, where and to the extent permitted by law, for example in the case of marketing to existing customers. If we engage a service provider to send emails, we do so on the basis of our legitimate interests. The subscription procedure is recorded on the basis of our legitimate interests in order to demonstrate that it was conducted in accordance with the law.

Content: Information about us, our services, promotions and offers.

Performance measurement: Newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from our server when the newsletter is opened or, if we use an email service provider, from that provider’s server. During this retrieval, technical information is initially collected, such as information about your browser and system, as well as your IP address and the time of retrieval.

This information is used to technically improve our newsletter based on technical data, or based on target groups and their reading behavior, including the locations from which it is accessed (which can be determined with the help of the IP address) and access times. This analysis also determines whether newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information may be associated with individual newsletter recipients. However, neither we nor, where applicable, the email service provider seek to monitor individual users. Instead, the analyses help us identify our users’ reading habits and adapt our content accordingly or send different content based on our users’ interests.

Unless users have expressly consented, newsletter analysis and performance measurement are carried out on the basis of our legitimate interests in using a user-friendly and secure newsletter system that serves our business interests and meets users’ expectations.

Unfortunately, it is not possible to withdraw consent to performance measurement separately; in this case, the entire newsletter subscription must be cancelled or objected to.

  • Types of data processed: Inventory data (names, addresses, etc.), contact data (email addresses, telephone numbers), meta/communication data (device information, IP addresses), usage data (websites visited, interest in content, access times).
  • Data subjects: Communication partners.
  • Purposes of processing: Direct marketing (by email or post).
  • Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).
  • Opt-out option: You may unsubscribe from our newsletter at any time, i.e. withdraw your consent or object to receiving further newsletters. You will find a link to unsubscribe at the end of each newsletter, or you may use one of the contact options listed above, preferably email.

Services and service providers used:

  • Mailchimp: Email marketing platform; service provider: “Mailchimp” - Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA; website: https://mailchimp.com; privacy policy: https://mailchimp.com/legal/privacy/; Privacy Shield (safeguarding the level of data protection when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&status=Active.

Promotional communications by post, fax or telephone

We process personal data for promotional communications, which may take place through various channels, such as email, telephone, post or fax. In doing so, we comply with statutory requirements and obtain the necessary consent unless the communication is legally permitted.

Recipients have the right to withdraw any consent they have given or object to promotional communications at any time.

Following withdrawal or objection, we may retain the data required to demonstrate consent for up to three years on the basis of our legitimate interests before deleting it. Processing of this data is restricted to the purpose of potentially defending against claims. An individual request for deletion may be made at any time, provided that the previous existence of consent is also confirmed.

  • Types of data processed: Inventory data (names, addresses, etc.), contact data (email addresses, telephone numbers).
  • Data subjects: Communication partners.
  • Purposes of processing: Direct marketing (by email or post).
  • Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

 

Prize draws and competitions

We process participants’ personal data in sweepstakes and contests only in compliance with the applicable data protection regulations, insofar as processing is contractually necessary to provide, conduct and administer the sweepstakes, the participants have consented to the processing, or the processing serves our legitimate interests (e.g. the security of the sweepstakes or the protection of our interests against misuse, which may include recording IP addresses when entries are submitted).

If participants’ entries are published as part of the sweepstakes (e.g. as part of a vote or presentation of the entries or winners, or in reports about the sweepstakes), we point out that participants’ names may also be published in this context. Participants may object to this at any time

If the sweepstakes takes place on an online platform or social network (e.g. Facebook or Instagram, hereinafter referred to as an “online platform”), the terms of use and privacy policies of the respective platforms also apply. In these cases, we point out that we are responsible for the information participants provide in connection with the sweepstakes and that any inquiries relating to the sweepstakes should be addressed to us.

Participants’ data will be deleted as soon as the sweepstakes or contest has ended and the data is no longer necessary to notify the winners or because further inquiries about the sweepstakes are no longer expected. As a rule, participants’ data will be deleted no later than 6 months after the end of the sweepstakes. Winners’ data may be retained for longer, e.g. to answer questions about prizes or to fulfill prize obligations; in such cases, the retention period depends on the type of prize and may be up to three years for goods or services, for example, to process warranty claims. Participants’ data may also be stored for longer, e.g. in the form of reports about the sweepstakes in online and offline media.

If data is also collected for other purposes in connection with the sweepstakes, its processing and retention period are governed by the privacy notices for that use (e.g. if someone signs up for a newsletter as part of a sweepstakes).

  • Categories of data processed: Account and contact data (names, addresses, etc.), content data (text entries, photographs, videos).
  • Data subjects: Participants in sweepstakes and contests.
  • Purposes of processing: Conducting sweepstakes and contests.
  • Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR).19 

Web Analytics and Optimization

Web analytics (also referred to as “audience measurement”) is used to evaluate visitor traffic to our online services and may include pseudonymous data about visitors’ behavior, interests or demographic information, such as age or gender. Audience measurement enables us, for example, to identify when our online services, or their functions or content, are used most frequently or encourage repeat use, as well as which areas need optimization.

In addition to web analytics, we may also use testing procedures to test and optimize different versions of our online services or their components, for example.

For these purposes, user profiles may be created and stored in a file (a “cookie”) or by similar means, which store information about users relevant to the aforementioned analyses. This information may include, for example, content viewed, websites visited and elements used on those sites, as well as technical information such as the browser and computer system used and usage times. If users have consented to the collection of their location data, this data may also be processed, depending on the provider.

Users’ IP addresses are also stored. However, we use an existing IP masking procedure (i.e. pseudonymization by truncating the IP address) to protect users. As a rule, no directly identifying user data (such as email addresses or names) is stored as part of web analytics, A/B testing and optimization; instead, pseudonyms are used. This means that neither we nor the providers of the software used know the users’ actual identities, but only the information stored in their profiles for the purposes of the respective procedures.

Information on legal bases: If we ask users to consent to the use of third-party providers, consent is the legal basis for processing the data. Furthermore, their use may form part of our (pre-)contractual services if the use of third-party providers has been agreed in this context. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e. our interest in providing efficient, economical and user-friendly services).

  • Data subjects: Users (website visitors, users of online services).
  • Purposes of processing: Audience measurement (access statistics, identification of returning visitors), tracking (interest- and behavior-based profiling, cookies), analysis of visitor activity, profiling (creating user profiles).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Online Marketing

We process personal data for online marketing purposes, which include in particular displaying advertising and other content (collectively, “content”) based on users’ potential interests and measuring its effectiveness.

For these purposes, user profiles may be created and stored in a file (a “cookie”) or by similar means, which store information about users relevant to displaying the aforementioned content. This information may include, for example, content viewed, websites visited, online networks used, as well as communication partners and technical information such as the browser and computer system used and usage times. If users have consented to the collection of their location data, this data may also be processed.

Users’ IP addresses are also stored. However, we use existing IP masking procedures (i.e. pseudonymization by truncating the IP address) to protect users. As a rule, no directly identifying user data (such as email addresses or names) is stored as part of online marketing procedures; instead, pseudonyms are used. This means that neither we nor the providers of online marketing procedures know the users’ actual identities, but only the information stored in their profiles.

Information in profiles is generally stored in cookies or by similar means. These cookies may later be read, generally also on other websites that use the same online marketing procedure, and analyzed for the purpose of displaying content; they may also be supplemented with further data and stored on the online marketing procedure provider’s server.

In exceptional cases, directly identifying data may be associated with profiles. This may happen if users are members of a social network whose online marketing procedure we use and the network links users’ profiles with the aforementioned information. Please note that users may enter into additional agreements with providers, e.g. by giving consent during registration.

As a rule, we only have access to aggregated information about the success of our advertisements. However, as part of so-called conversion measurement, we can determine which of our online marketing procedures resulted in a conversion, e.g. the conclusion of a contract with us. Conversion measurement is used solely to analyze the success of our marketing activities.

Information on legal bases: If we ask users to consent to the use of third-party providers, consent is the legal basis for processing the data. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e. our interest in providing efficient, economical and user-friendly services).

Facebook Pixel: Facebook Pixel enables Facebook to identify visitors to our online services as a target audience for displaying ads (so-called “Facebook Ads”). Accordingly, we use Facebook Pixel to display the Facebook Ads we place only to Facebook users who have also shown an interest in our online services or who have certain characteristics (e.g. interests in particular topics or products, determined by the websites visited) that we transmit to Facebook (so-called “Custom Audiences”). We also use Facebook Pixel to ensure that our Facebook Ads match users’ potential interests and are not intrusive. Furthermore, Facebook Pixel allows us to track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users are redirected to our website after clicking on a Facebook ad (so-called “conversion measurement”).

  • Categories of data processed: Usage data (websites visited, interest in content, access times), metadata/communication data (device information, IP addresses), location data.
  • Data subjects: Users (website visitors, users of online services), prospective customers.
  • Purposes of processing: Tracking (interest- and behavior-based profiling, cookies), remarketing, analysis of visitor activity, interest- and behavior-based marketing, profiling (creating user profiles), conversion measurement (measuring the effectiveness of marketing activities), audience measurement (access statistics, identification of returning visitors), audience building (identifying relevant target groups for marketing purposes or other content distribution), cross-device tracking (processing user data across devices for marketing purposes).
  • Security measures: IP masking (pseudonymization of the IP address).
  • Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).
  • Right to object (opt-out): We refer to the privacy notices of the respective providers and the opt-out options they offer. If no explicit opt-out option is specified, you may disable cookies in your browser settings. However, this may limit the functions of our online services. We therefore also recommend the following opt-out options, which are offered for the respective regions: a) Europe: https://www.youronlinechoices.eu. b) Canada: https://www.youradchoices.ca/choices. c) USA: https://www.aboutads.info/choices. d) Cross-region: http://optout.aboutads.info.

Services and service providers used:

  • Google Analytics: Online marketing and web analytics; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://marketingplatform.google.com/intl/de/about/analytics/; privacy policy: https://policies.google.com/privacy; Privacy Shield (guaranteeing data protection standards when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active; opt-out option: opt-out plugin: http://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying advertisements: https://adssettings.google.com/authenticated.
  • Google Optimize: Use of Google Analytics data to improve areas of our online services and better align our marketing activities with users’ potential interests; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://optimize.google.com; privacy policy: https://policies.google.com/privacy; Privacy Shield (guaranteeing data protection standards when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active; opt-out option: opt-out plugin: http://tools.google.com/dlpage/gaoptout?hl=de, settings for displaying advertisements: https://adssettings.google.com/authenticated.
  • Facebook Pixel: Facebook Pixel; service provider: https://www.facebook.com, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; website: https://www.facebook.com; privacy policy: https://www.facebook.com/about/privacy; Privacy Shield (guaranteeing data protection standards when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active; opt-out option: https://www.facebook.com/settings?tab=ads.

Review Platforms

We participate in review programs to evaluate, optimize and promote our services. If users review us or otherwise provide feedback through the participating review platforms or programs, the providers’ general terms and conditions or terms of use and privacy notices also apply. As a rule, submitting a review also requires registration with the respective providers.

To ensure that reviewers have actually used our services, with customers’ consent we transmit the data required for this purpose concerning the customer and the service used to the relevant review platform (including name, email address and order or item number). This data is used solely to verify the authenticity of the user.

  • Categories of data processed: Contract data (subject matter of the contract, term, customer category), usage data (websites visited, interest in content, access times), metadata/communication data (device information, IP addresses).
  • Data subjects: Customers, users (website visitors, users of online services).
  • Purposes of processing: Feedback (collecting feedback, e.g. via a form).
  • Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Presence on Social Networks

We maintain online presences on social networks to communicate with users active there or to provide information about us.

Please note that users’ data may be processed outside the European Union. This may entail risks for users, since, for example, it could be more difficult to enforce their rights. With regard to US providers certified under the Privacy Shield or offering comparable guarantees of an adequate level of data protection, we point out that they undertake to comply with EU data protection standards.

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behavior and the interests that result from it. These usage profiles may in turn be used to display advertisements within and outside the networks that are presumed to match users’ interests. For these purposes, cookies are generally stored on users’ computers, recording their usage behavior and interests. Usage profiles may also store data independently of the devices used by users (particularly if users are members of the respective platforms and are logged in).

For a detailed description of the respective processing activities and the options for objecting (opt-out), please refer to the respective privacy policies and information provided by the operators of the respective networks.

We also point out that requests for information and the exercise of data subject rights can be handled most effectively by the providers. Only the providers have access to users’ data and can take the appropriate measures and provide information directly. However, if you need assistance, you can contact us.

  • Types of data processed: Inventory data (names, addresses, etc.), contact data (email addresses, telephone numbers), content data (text entries, photographs, videos), usage data (websites visited, interest in content, access times), meta/communication data (device information, IP addresses).
  • Data subjects: Users (website visitors, users of online services).
  • Purposes of processing: Contact requests and communication, tracking (interest- and behavior-based profiling, cookies), remarketing, reach measurement (access statistics, identification of returning visitors).
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Services and service providers used:

  • Instagram: Social network; service provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; website: https://www.instagram.com; privacy policy: http://instagram.com/about/legal/privacy.
  • Facebook: Social network; service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; website: https://www.facebook.com; privacy policy: https://www.facebook.com/about/privacy; Privacy Shield (safeguarding the level of data protection when data is processed in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active; objection option (opt-out): Ad settings: https://www.facebook.com/settings?tab=ads; Additional privacy information: Agreement on joint processing of personal data on Facebook Pages: https://www.facebook.com/legal/terms/page_controller_addendum, Privacy information for Facebook Pages: https://www.facebook.com/legal/terms/information_about_page_insights_data.
  • YouTube: Social network; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; privacy policy: https://policies.google.com/privacy; Privacy Shield (safeguarding the level of data protection when data is processed in the USA): https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active; objection option (opt-out): https://adssettings.google.com/authenticated.

Plugins and embedded functions and content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos, social media buttons and posts (hereinafter collectively referred to as “content”).

Integration always requires the third-party providers of this content to process users’ IP addresses, since they cannot send the content to users’ browsers without the IP address. The IP address is therefore required to display this content or these functions. We endeavor to use only content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on users’ devices and may include, among other things, technical information about the browser and operating system, referring websites, visit time, and other information about the use of our online offering, as well as being combined with such information from other sources.

Information on legal bases: If we ask users to consent to the use of third-party providers, the legal basis for processing data is consent. Otherwise, users’ data is processed on the basis of our legitimate interests (i.e., our interest in providing efficient, cost-effective services that are user-friendly for recipients).

  • Types of data processed: Usage data (websites visited, interest in content, access times), meta/communication data (device information, IP addresses), inventory data (names, addresses, etc.), contact data (email addresses, telephone numbers), content data (text entries, photographs, videos).
  • Data subjects: Users (website visitors, users of online services).
  • Purposes of processing: Provision of our online offering and user-friendliness, contractual services and support, security measures, administration and response to requests.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR), consent (Art. 6(1)(a) GDPR), performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).

Services and service providers used:

  • Facebook Social Plugins: Facebook Social Plugins may include, for example, content such as images, videos or text, and buttons that allow users to share content from this online offering on Facebook. The list and appearance of Facebook Social Plugins can be viewed here: https://developers.facebook.com/docs/plugins/; service provider: https://www.facebook.com, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; website: https://www.facebook.com; privacy policy: https://www.facebook.com/about/privacy; Privacy Shield (safeguarding the level of data protection when data is processed in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active; objection option (opt-out): Ad settings: https://www.facebook.com/settings?tab=ads.
  • Google Fonts: We integrate the fonts (“Google Fonts”) provided by Google, whereby users’ data is used solely to display the fonts in users’ browsers. The integration is based on our legitimate interests in the technically secure, maintenance-free and efficient use of fonts, their consistent presentation, and the consideration of any possible licensing restrictions on their integration. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://fonts.google.com/; privacy policy: https://policies.google.com/privacy; Privacy Shield (safeguarding the level of data protection when data is processed in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000TRkEAAW&status=Active.
  • Google Maps: We integrate maps from Google’s “Google Maps” service. The data processed may include, in particular, users’ IP addresses and location data, which are not collected without their consent (usually provided through their mobile device settings). Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://maps.google.de; privacy policy: https://policies.google.com/privacy; Privacy Shield (safeguarding the level of data protection when data is processed in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000TRkEAAW&status=Active; objection option (opt-out): opt-out plugin: http://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://adssettings.google.com/authenticated.
  • ReCaptcha: We integrate the “ReCaptcha” function to detect bots, for example when entries are made in online forms. Users’ behavioral information (e.g., mouse movements or queries) is analyzed to distinguish humans from bots. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.google.com/recaptcha/; privacy policy: https://policies.google.com/privacy; Privacy Shield (safeguarding the level of data protection when data is processed in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000TRkEAAW&status=Active; objection option (opt-out): opt-out plugin: http://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://adssettings.google.com/authenticated.
  • YouTube: Videos; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://www.youtube.com; privacy policy: https://policies.google.com/privacy; Privacy Shield (safeguarding the level of data protection when data is processed in the USA): https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active; objection option (opt-out): opt-out plugin: http://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://adssettings.google.com/authenticated.

Data deletion

The data we process is deleted in accordance with statutory requirements as soon as consent to its processing is withdrawn or other permissions cease to apply (e.g., when the purpose of processing the data no longer applies or the data is no longer required for that purpose).

If the data is not deleted because it is required for other legally permissible purposes, its processing is restricted to those purposes. This means that the data is blocked and is not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons, or whose storage is necessary for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person. Further information on the deletion of personal data may also be provided in the individual privacy notices in this privacy policy.

Changes and updates to the privacy policy

We ask you to regularly review the content of our privacy policy. We will amend the privacy policy as soon as changes to the data processing activities we carry out make this necessary. We will notify you as soon as the changes require your cooperation (e.g., consent) or another individual notification.

Rights of data subjects

Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is carried out pursuant to Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.

Right to withdraw consent: You have the right to withdraw consent at any time.
Right of access: You have the right to request confirmation as to whether data concerning you is being processed, and to access that data, as well as further information and a copy of the data, in accordance with statutory requirements.

Right to rectification: In accordance with statutory requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
Right to erasure and restriction of processing: In accordance with statutory requirements, you have the right to request that the relevant data be erased without undue delay or, alternatively, to request the restriction of its processing.

Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller, in accordance with statutory requirements.

Right to lodge a complaint with a supervisory authority: You also have the right, in accordance with statutory requirements, to lodge a complaint with the competent supervisory authority.

Definitions

This section provides an overview of the terms used in this privacy policy. Many of these terms are taken from legislation and are defined primarily in Art. 4 GDPR. The statutory definitions are binding. The explanations below are intended primarily to aid understanding. The terms are listed in alphabetical order. 

  • Conversion tracking: “Conversion tracking” refers to a method for determining the effectiveness of marketing measures. This generally involves storing a cookie on users’ devices on the websites where the marketing measures take place, and then retrieving it on the target website (for example, this enables us to determine whether advertisements we placed on other websites were successful).
  • Cross-device tracking: Cross-device tracking is a form of tracking in which users’ behavioral and interest information is collected across devices in so-called profiles by assigning users an online identifier. This allows user information to be analyzed independently of the browsers or devices used (e.g., mobile phones or desktop computers), generally for marketing purposes. For most providers, the online identifier is not linked to identifying data such as names, postal addresses or email addresses.
  • IP masking: “IP masking” refers to a method in which the last octet, i.e. the last two digits of an IP address, is deleted so that the IP address can no longer be used to uniquely identify a person. IP masking is therefore a means of pseudonymizing processing procedures, particularly in online marketing.
  • Interest-based and behavior-based marketing: Marketing is referred to as interest-based and/or behavior-based when users’ potential interest in ads and other content is determined as accurately as possible. This is done on the basis of information about their past behavior (e.g. visiting and spending time on certain websites, purchasing behavior, or interacting with other users), which is stored in a so-called profile. Cookies are generally used for these purposes. Conversion measurement: Conversion measurement is a method for determining the effectiveness of marketing measures. Typically, a cookie is stored on users’ devices within the websites on which the marketing measures are carried out and then retrieved again on the target website (e.g. this allows us to determine whether the ads we placed on other websites were successful).
  • Profiling: “Profiling” refers to any form of automated processing of personal data consisting of the use of such personal data to analyze, evaluate or predict certain personal aspects relating to a natural person (depending on the type of profiling, these include information concerning age, gender, location data and movement data, interactions with websites and their content, purchasing behavior, and social interactions with other people) (e.g. interests in certain content or products, click behavior on a website, or whereabouts). Cookies and web beacons are often used for profiling purposes.
  • Audience measurement: Audience measurement (also known as web analytics) is used to analyze traffic to an online service and may include visitors’ behavior or interests in certain information, such as website content. Audience analysis allows website owners, for example, to determine when visitors access their website and which content interests them. This enables them, for example, to better tailor the website content to their visitors’ needs. Pseudonymous cookies and web beacons are often used for audience analysis purposes to recognize returning visitors and thus obtain more accurate analyses of how an online service is used.
  • Remarketing: “Remarketing” or “retargeting” refers to noting, for example for advertising purposes, which products a user has shown an interest in on a website, in order to remind the user of these products on other websites, e.g. in ads.
  • Location data: Data indicating the location of an end user’s terminal device.
  • Tracking: “Tracking” refers to the ability to follow users’ behavior across multiple online services. In this context, information about behavior and interests relating to the online services used is generally stored in cookies or on the servers of the providers of tracking technologies (so-called profiling). This information can then be used, for example, to show users ads that are presumed to match their interests.
  • Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and practically encompasses any handling of data, whether collecting, evaluating, storing, transmitting or deleting it.
  • Audience creation: Audience creation (or “Custom Audiences”) refers to defining audiences for advertising purposes, e.g. displaying ads. For example, a user’s interest in certain products or topics online may be used to infer that the user is interested in ads for similar products or for the online shop where they viewed the products. “Lookalike Audiences” refers to showing content considered suitable to users whose profiles or interests are presumed to correspond to those of the users for whom the profiles were created. Cookies and web beacons are generally used to create Custom Audiences and Lookalike Audiences. Audiences may be created by processing visitors to an online service or by uploading data to the provider of an online marketing method (which is generally done in pseudonymized form 

    ).