Privacy Policy

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offering").

The terms used are not gender-specific.

Last updated: November 14, 2024

Table of Contents

• Preamble
• Controller
• Overview of Processing Operations
• Relevant Legal Bases
• Security Measures
  • reCAPTCHA
• Transfer of Personal Data
• International Data Transfers
• General Information on Data Storage and Deletion
• Rights of Data Subjects
• Business Services
• Payment Procedures
• Provision of Online Offering and Web Hosting
• Use of Cookies
• Contact and Inquiry Management
• Newsletter and Electronic Notifications
• Web Analytics, Monitoring and Optimization
• Online Marketing
• Plugins and Embedded Functions and Content

Controller

Data Protection Officer
Johannes Pecher

Email address: info@parkmeister.co

Overview of Processing Operations

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of Data Processed

• Inventory data.
• Payment data.
• Location data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication and procedural data.
• Log data.

Categories of Data Subjects

• Service recipients and clients.
• Prospective customers.
• Communication partners.
• Users.
• Business and contractual partners.

Purposes of Processing

• Provision of contractual services and fulfillment of contractual obligations.
• Communication.
• Security measures.
• Direct marketing.
• Reach measurement.
• Tracking.
• Office and organizational procedures.
• Audience building.
• Organizational and administrative procedures.
• Feedback.
• Marketing.
• Profiles with user-related information.
• Provision of our online offering and user-friendliness.
• Information technology infrastructure.
• Business processes and economic procedures.

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. If more specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6(1)(a) GDPR) - The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6(1)(c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1)(f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. This includes in particular the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG). The BDSG contains special regulations on the right to information, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision-making in individual cases including profiling. Furthermore, the data protection laws of the individual federal states may apply.

Note on applicability of GDPR and Swiss DPA: This privacy notice serves to provide information in accordance with both the Swiss DPA and the General Data Protection Regulation (GDPR). For this reason, please note that due to the broader territorial application and comprehensibility, the terms of the GDPR are used. In particular, instead of the terms used in the Swiss DPA such as "processing" of "personal data", "overriding interest" and "particularly sensitive personal data", the terms used in the GDPR, namely "processing" of "personal data" as well as "legitimate interest" and "special categories of data" are used. However, the legal meaning of the terms continues to be determined under Swiss DPA within its scope of application.

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing as well as the different likelihood of occurrence and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input, disclosure, availability assurance and separation thereof. Furthermore, we have established procedures to ensure the exercise of data subject rights, deletion of data and response to data threats. Furthermore, we already consider the protection of personal data during the development or selection of hardware, software and procedures in accordance with the principle of data protection through technology design and data protection-friendly default settings.

reCAPTCHA

To protect against automated requests and abuse, we use Google reCAPTCHA Enterprise on our login pages. reCAPTCHA analyzes user behavior to distinguish whether it is a human or an automated bot. The following data may be processed: IP address, browser information, operating system, time spent and mouse movements. Data processing is based on our legitimate interests in protecting our systems from abuse and automated attacks (Art. 6(1)(f) GDPR). For more information about Google reCAPTCHA, please see the Google Privacy Policy and the Google Terms of Service.

Transfer of Personal Data

In the course of our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organizational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and in particular conclude corresponding contracts or agreements that serve to protect your data with the recipients of your data.

International Data Transfers

Data processing in third countries: If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of using third-party services or the disclosure or transfer of data to other persons, bodies or companies, this only takes place in accordance with legal requirements. If the level of data protection in the third country has been recognized by means of an adequacy decision (Art. 45 GDPR), this serves as the basis for the data transfer. Otherwise, data transfers only take place if the level of data protection is otherwise assured, in particular through standard contractual clauses (Art. 46(2)(c) GDPR), express consent or in the case of contractual or legally required transfer (Art. 49(1) GDPR). We also inform you of the basis for third country transfers for individual third country providers, whereby adequacy decisions take precedence as the basis. Information on third country transfers and existing adequacy decisions can be found in the EU Commission's information service: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en. Under the so-called "Data Privacy Framework" (DPF), the EU Commission has also recognized the level of data protection for certain companies from the USA as safe under the adequacy decision of July 10, 2023. The list of certified companies as well as further information on the DPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/. We inform you in the privacy notices which of the service providers we use are certified under the Data Privacy Framework.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with legal provisions as soon as the underlying consents are revoked or no further legal grounds for processing exist. This applies to cases where the original processing purpose ceases to exist or the data is no longer needed. Exceptions to this rule exist if legal obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons or whose storage is necessary for legal prosecution or protection of the rights of other natural or legal persons must be archived accordingly.

Where there are multiple specifications for retention periods or deletion deadlines for a datum, the longest period always applies.

If a period does not expressly begin on a specific date and is at least one year, it automatically starts at the end of the calendar year in which the triggering event occurred. In the case of ongoing contractual relationships in the context of which data is stored, the triggering event is the time when the termination takes effect or other termination of the legal relationship.

Data that is no longer stored for its originally intended purpose but due to legal requirements or other reasons is processed exclusively for the reasons that justify its retention.

Data retention and deletion: The following general periods apply to retention and archiving under German law:

• 10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets as well as the work instructions and other organizational documents necessary for their understanding, accounting vouchers and invoices (§ 147(3) in conjunction with (1) Nos. 1, 4 and 4a AO, § 14b(1) UStG, § 257(1) Nos. 1 and 4, (4) HGB).
• 6 years - Other business documents: received commercial or business letters, copies of sent commercial or business letters, other documents insofar as they are relevant for taxation, e.g., hourly wage slips, operating cost statements, calculation documents, price markings, but also payroll documents insofar as they are not already accounting vouchers and cash register strips (§ 147(3) in conjunction with (1) Nos. 2, 3, 5 AO, § 257(1) Nos. 2 and 3, (4) HGB).
• 3 years - Data required to consider potential warranty and compensation claims or similar contractual claims and rights and to process related inquiries, based on previous business experience and standard industry practices, is stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB).

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15-21 GDPR:

• Right to object: You have the right, on grounds relating to your particular situation, at any time to object to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw consent at any time.
• Right of access: You have the right to obtain confirmation as to whether data is being processed and to access this data as well as further information and a copy of the data in accordance with legal requirements.
• Right to rectification: You have the right in accordance with legal requirements to request the completion of data concerning you or the rectification of inaccurate data concerning you.
• Right to erasure and restriction of processing: You have the right in accordance with legal requirements to request that data concerning you be deleted immediately or, alternatively, to request restriction of processing of the data in accordance with legal requirements.
• Right to data portability: You have the right to receive data concerning you which you have provided to us in a structured, commonly used and machine-readable format in accordance with legal requirements or to request its transfer to another controller.
• Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the requirements of the GDPR.

Business Services

We process data of our contractual and business partners, e.g., customers and prospective customers (collectively referred to as "contractual partners"), in the context of contractual and comparable legal relationships and related measures and in the context of communication with the contractual partners (or pre-contractually), for example, to answer inquiries.

We use this data to fulfill our contractual obligations. This includes in particular the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other service disruptions. In addition, we use the data to safeguard our rights and for the purpose of administrative tasks associated with these obligations as well as corporate organization. Furthermore, we process the data on the basis of our legitimate interests in proper and business management as well as security measures to protect our contractual partners and our business operations against misuse, endangerment of their data, secrets, information and rights (e.g., for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of applicable law, we only disclose data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed of further forms of processing, e.g., for marketing purposes, in this privacy policy.

We inform contractual partners before or during data collection, e.g., in online forms, by means of special marking (e.g., colors) or symbols (e.g., asterisks or similar), or personally, which data is required for the aforementioned purposes.

We delete the data after the expiry of statutory warranty and comparable obligations, i.e., generally after four years, unless the data is stored in a customer account, e.g., as long as it must be retained for legal archiving reasons (e.g., for tax purposes, usually ten years). Data disclosed to us by the contractual partner within the scope of an order is deleted in accordance with the specifications and generally after the end of the order.

• Processed data types: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Payment data (e.g., bank details, invoices, payment history); Contact data (e.g., postal and email addresses or phone numbers); Contract data (e.g., subject matter of contract, term, customer category); Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved).
• Data subjects: Service recipients and clients; Prospective customers. Business and contractual partners.
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; Security measures; Communication; Office and organizational procedures; Organizational and administrative procedures. Business processes and economic procedures.
• Retention and deletion: Deletion in accordance with information in the section "General Information on Data Storage and Deletion".
• Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legal obligation (Art. 6(1)(c) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing procedures, processes and services:

Online shop, order forms, e-commerce and delivery: We process the data of our customers to enable them to select, purchase or order the selected products, goods and related services, as well as their payment and delivery or execution. If necessary for the execution of an order, we use service providers, in particular postal, freight and shipping companies, to carry out the delivery or execution to our customers. For the processing of payment transactions, we use the services of banks and payment service providers. The required information is marked as such in the context of the order or comparable acquisition process and includes the information required for delivery or provision and billing as well as contact information to enable any queries to be made; Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Payment Procedures

In the context of contractual and other legal relationships, due to legal obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and use other service providers in addition to banks and credit institutions (collectively "payment service providers").

The data processed by payment service providers includes inventory data, such as name and address, bank data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, total and recipient-related information. The information is necessary to carry out the transactions. However, the data entered is only processed and stored by the payment service providers. I.e., we do not receive any account or credit card-related information, but only information with confirmation or negative information about the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit agencies. This transmission is intended to verify identity and creditworthiness. In this regard, we refer to the terms and conditions and privacy notices of the payment service providers.

The terms and conditions and privacy notices of the respective payment service providers apply to payment transactions and can be accessed within the respective websites or transaction applications. We also refer to these for further information and assertion of revocation, information and other data subject rights.

• Processed data types: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Payment data (e.g., bank details, invoices, payment history); Contract data (e.g., subject matter of contract, term, customer category); Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved).
• Data subjects: Service recipients and clients; Business and contractual partners. Prospective customers.
• Purposes of processing: Provision of contractual services and fulfillment of contractual obligations. Business processes and economic procedures.
• Retention and deletion: Deletion in accordance with information in the section "General Information on Data Storage and Deletion".
• Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing procedures, processes and services:

Stripe: Payment services (technical integration of online payment methods); Service provider: Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA; Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://stripe.com; Privacy policy: https://stripe.com/privacy. Basis for third country transfers: Data Privacy Framework (DPF).

Provision of Online Offering and Web Hosting

We process user data in order to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or terminal device.

• Processed data types: Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved). Log data (e.g., log files concerning logins or retrieval of data or access times).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: Provision of our online offering and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)). Security measures.
• Retention and deletion: Deletion in accordance with information in the section "General Information on Data Storage and Deletion".
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing procedures, processes and services:

Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files". Server log files may include the address and name of the web pages and files accessed, date and time of access, data volumes transferred, message about successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and generally IP addresses and the requesting provider. Server log files can be used for security purposes, e.g., to prevent server overload (especially in the case of abusive attacks, so-called DDoS attacks), and to ensure server utilization and stability; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Data deletion: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is exempt from deletion until final clarification of the respective incident.

Use of Cookies

The term "cookies" refers to functions that store and read information on users' devices. Cookies may also be used for various purposes, e.g., for purposes of functionality, security and comfort of online offerings and for creating analyses of visitor flows. We use cookies in accordance with legal requirements. We obtain prior consent from users where required. If consent is not necessary, we rely on our legitimate interests. This applies if the storage and reading of information is essential to provide expressly requested content and functions. This includes, for example, the storage of settings and ensuring the functionality and security of our online offering. Consent can be revoked at any time. We provide clear information about its scope and which cookies are used.

Notes on data protection legal bases: Whether we process personal data using cookies depends on consent. If consent is given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage duration: With regard to storage duration, the following types of cookies are distinguished:

• Temporary cookies (also: session or session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their device (e.g., browser or mobile application).
• Permanent cookies: Permanent cookies remain stored even after the device is closed. For example, the login status can be stored and preferred content displayed directly when the user visits a website again. Similarly, user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information about the type and storage duration of cookies (e.g., when obtaining consent), they should assume that these are permanent and that the storage duration can be up to two years.

General information on revocation and objection (opt-out): Users can revoke the consent they have given at any time and also lodge an objection to processing in accordance with legal requirements, also by means of their browser's privacy settings.

• Processed data types: Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved).
• Data subjects: Users (e.g., website visitors, users of online services).
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Consent (Art. 6(1)(a) GDPR).

Further information on processing procedures, processes and services:

Processing of cookie data on the basis of consent: We use a consent management solution in which consent of users to the use of cookies or to the procedures and providers named in the consent management solution is obtained. This procedure serves to obtain, log, manage and revoke consents, particularly with regard to the use of cookies and comparable technologies used to store, read and process information on users' devices. In the context of this procedure, consent of users for the use of cookies and the associated processing of information, including the specific processing and providers named in the consent management procedure, is obtained. Users also have the option to manage and revoke their consents. Consent declarations are stored to avoid repeated queries and to be able to prove consent in accordance with legal requirements. Storage takes place server-side and/or in a cookie (so-called opt-in cookie) or by means of comparable technologies in order to be able to assign consent to a specific user or their device. Unless specific information on consent management service providers is available, the following general information applies: The duration of storage of consent is up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of consent (e.g., relevant categories of cookies and/or service providers) as well as information about the browser, system and device used; Legal bases: Consent (Art. 6(1)(a) GDPR).

Contact and Inquiry Management

When contacting us (e.g., by post, contact form, email, telephone or via social media) and in the context of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to respond to the contact inquiries and any requested measures.

Processed data types: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or phone numbers); Content data (e.g., textual or pictorial messages and contributions as well as information relating thereto, such as information about authorship or time of creation); Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved).
• Data subjects: Communication partners.
• Purposes of processing: Communication; Organizational and administrative procedures; Feedback (e.g., collecting feedback via online form). Provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with information in the section "General Information on Data Storage and Deletion".
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Further information on processing procedures, processes and services:

Contact form: When contacting us via our contact form, by email or other means of communication, we process the personal data transmitted to us to respond to and process the respective inquiry. This usually includes information such as name, contact information and, where applicable, other information that is communicated to us and is required for appropriate processing. We use this data exclusively for the stated purpose of contact and communication; Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR), Legitimate interests (Art. 6(1)(f) GDPR).

Newsletter and Electronic Notifications

We send newsletters, emails and other electronic notifications (hereinafter "newsletter") only with the consent of the recipients or on the basis of a legal basis. If the contents of the newsletter are specifically described in the context of registration, they are decisive for the consent of users. Registration for our newsletter usually only requires the provision of your email address. However, in order to provide you with a personalized service, we may ask you to provide your name for a personal salutation in the newsletter or other information if necessary for the purpose of the newsletter.

Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them to be able to prove formerly given consent. The processing of this data is limited to the purpose of a potential defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a blocklist.

The logging of the registration process is based on our legitimate interests for the purpose of proving its proper course. If we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure sending system.

Contents:

Information about us, our services, promotions and offers.

• Processed data types: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or phone numbers); Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved). Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions).
• Data subjects: Communication partners.
• Purposes of processing: Direct marketing (e.g., by email or mail).
• Legal bases: Consent (Art. 6(1)(a) GDPR).
• Opt-out option: You can cancel receipt of our newsletter at any time, i.e., revoke your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter or you can otherwise use one of the contact options stated above, preferably email.

Further information on processing procedures, processes and services:

Measurement of open and click rates: Newsletters contain a so-called "web beacon", i.e., a pixel-sized file that is retrieved from our server or, if we use a mailing service provider, from their server when the newsletter is opened. In the context of this retrieval, both technical information, such as information about your browser and system, as well as your IP address and time of retrieval are initially collected. This information is used for technical improvement of our newsletter based on technical data or target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times. This analysis also includes determining whether and when newsletters are opened and which links are clicked. The information is assigned to individual newsletter recipients and stored in their profiles until deletion. The evaluations serve to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. Measurement of open and click rates and storage of measurement results in user profiles; Legal bases: Consent (Art. 6(1)(a) GDPR).

Web Analytics, Monitoring and Optimization

Web analytics (also referred to as "reach measurement") serves to evaluate the visitor flows of our online offering and may include behavior, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognize at what time our online offering or its functions or content are most frequently used or invite reuse. We can also understand which areas require optimization.

In addition to web analytics, we may also use test procedures, e.g., to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e., data summarized for a usage process, can be created for these purposes and information can be stored in a browser or in a device and then read from it. The information collected includes in particular websites visited and elements used thereon and technical information, such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data to us or to the providers of the services we use, location data may also be processed.

In addition, the IP addresses of users are stored. However, we use an IP masking procedure (i.e., pseudonymization by truncating the IP address) to protect users. Generally, no clear user data (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimization, but pseudonyms. This means that we as well as the providers of the software used do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors); Profiles with user-related information (creating user profiles). Provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with information in the section "General Information on Data Storage and Deletion". Storage of cookies of up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal bases: Consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing procedures, processes and services:

Google Analytics: We use Google Analytics to measure and analyze the use of our online offering on the basis of a pseudonymous user identification number. This identification number does not contain any unique data, such as names or email addresses. It is used to assign analysis information to a device in order to recognize what content users have accessed within one or more usage processes, what search terms they have used, have accessed again or have interacted with our online offering. The time of use and its duration are also stored, as well as the sources of users who refer to our online offering and technical aspects of their devices and browsers. Pseudonymous profiles of users with information from the use of different devices are created, whereby cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. However, Analytics provides coarse geographic location data by deriving the following metadata from IP addresses: city (and derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). For EU traffic, IP address data is used solely for this derivation of geolocation data before being immediately deleted. It is not logged, is not accessible and is not used for further purposes. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers before traffic is forwarded to Analytics servers for processing; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com/intl/en/about/analytics/; Security measures: IP masking (pseudonymization of the IP address); Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Basis for third country transfers: Data Privacy Framework (DPF); Opt-out option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout, Settings for the display of advertisements: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (types of processing and data processed).

Online Marketing

We process personal data for online marketing purposes, which may include in particular the marketing of advertising space or the display of advertising and other content (collectively referred to as "content") based on the potential interests of users and the measurement of their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (the so-called "cookie") or similar methods are used, by means of which information about the user relevant for the display of the aforementioned content is stored. This information may include, for example, content viewed, websites visited, online networks used, as well as communication partners and technical information, such as the browser used, the computer system used and information on usage times and functions used. If users have consented to the collection of their location data, this may also be processed.

In addition, users' IP addresses are stored. However, we use available IP masking procedures (i.e., pseudonymization by truncating the IP address) for user protection. Generally, no clear user data (such as email addresses or names) is stored in the context of online marketing procedures, but pseudonyms. This means that we as well as the providers of online marketing procedures do not know the actual user identity, but only the information stored in their profiles.

The statements in the profiles are generally stored in cookies or by means of similar methods. These cookies can later generally also be read on other websites that use the same online marketing procedure, analyzed for the purpose of displaying content and supplemented with further data and stored on the server of the online marketing procedure provider.

Exceptionally, it is possible to assign clear data to the profiles, primarily when the users are, for example, members of a social network whose online marketing procedures we use and the network links the user profiles with the aforementioned information. We ask you to note that users may make additional agreements with the providers, e.g., by consent in the context of registration.

In principle, we only receive access to aggregated information about the success of our advertisements. However, within the scope of so-called conversion measurements, we can check which of our online marketing procedures has led to a so-called conversion, i.e., for example, to the conclusion of a contract with us. Conversion measurement is used solely to analyze the success of our marketing measures.

Unless otherwise stated, please assume that cookies used are stored for a period of two years.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is permission. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

Notes on revocation and objection:

We refer to the privacy notices of the respective providers and the objection options stated for the providers (so-called "opt-out"). If no explicit opt-out option has been stated, there is on the one hand the possibility that you can deactivate cookies in your browser settings. However, this may restrict functions of our online offering. We therefore additionally recommend the following opt-out options, which are offered in summary for the respective areas:

• Europe: https://www.youronlinechoices.eu.
• Canada: https://www.youradchoices.ca/choices.
• USA: https://www.aboutads.info/choices.
• Cross-regional: https://optout.aboutads.info.

• Processed data types: Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors); Tracking (e.g., interest/behavior-based profiling, use of cookies); Audience building; Marketing. Profiles with user-related information (creating user profiles).
• Retention and deletion: Deletion in accordance with information in the section "General Information on Data Storage and Deletion". Storage of cookies of up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal bases: Consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

Plugins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may be, for example, graphics, videos or city maps (hereinafter uniformly referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the users, since without the IP address they could not send the content to their browser. The IP address is thus required for the display of this content or functions. We endeavor to use only content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, visiting time and other information about the use of our online offering, as well as be linked with such information from other sources.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is permission. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions); Meta, communication and procedural data (e.g., IP addresses, timestamps, identification numbers, persons involved). Location data (information about the geographic position of a device or person).
• Data subjects: Users (e.g., website visitors, users of online services).
• Purposes of processing: Provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with information in the section "General Information on Data Storage and Deletion". Storage of cookies of up to 2 years (unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years).
• Legal bases: Consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing procedures, processes and services:

Google Fonts (retrieval from Google server): Retrieval of fonts (and symbols) for the purpose of a technically secure, maintenance-free and efficient use of fonts and symbols with regard to timeliness and loading times, their uniform display and consideration of possible licensing restrictions. The provider of the fonts is informed of the user's IP address so that the fonts can be made available in the user's browser. In addition, technical data (language settings, screen resolution, operating system, hardware used) is transmitted, which is necessary for the provision of fonts depending on the devices used and the technical environment. This data may be processed on a server of the font provider in the USA - When visiting our online offering, the users' browsers send their browser HTTP requests to the Google Fonts Web API (i.e., a software interface for retrieving the fonts). The Google Fonts Web API provides users with the Cascading Style Sheets (CSS) of Google Fonts and then the fonts specified in the CCS. These HTTP requests include (1) the IP address used by the respective user to access the Internet, (2) the requested URL on the Google server and (3) the HTTP headers, including the user agent, which describes the browser and operating system versions of website visitors, as well as the referrer URL (i.e., the web page on which the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers and they are not analyzed. The Google Fonts Web API logs details of HTTP requests (requested URL, user agent and referrer URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wants to load fonts. This data is logged so that Google can determine how often a particular font family is requested. With the Google Fonts Web API, the user agent must customize the font generated for the respective browser type. The user agent is primarily logged for debugging and used to generate aggregate usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the Google Fonts "Analytics" page. Finally, the referrer URL is logged so that data can be used for production maintenance and an aggregated report on top integrations based on the number of font requests can be generated. Google states that it does not use any of the information collected by Google Fonts to create profiles of end users or to display targeted advertisements; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://fonts.google.com/; Privacy policy: https://policies.google.com/privacy; Basis for third country transfers: Data Privacy Framework (DPF). Further information: https://developers.google.com/fonts/faq/privacy.

Google Maps: We integrate the maps of the "Google Maps" service from the provider Google. The processed data may include in particular IP addresses and location data of the users; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://policies.google.com/privacy. Basis for third country transfers: Data Privacy Framework (DPF).

Advertising with Meta Services (WhatsApp, Instagram and Facebook)

As part of our advertising activities, we use, among others, the services of Meta Services, in particular WhatsApp, Instagram and Facebook, to be able to offer you personalized advertising. In doing so, data such as usage data, interaction and communication data is processed, which enables us to tailor the advertising to your interests and preferences.

The processing of this data is based either on your explicit consent or to safeguard our legitimate interests if no consent is given. We attach great importance to compliance with applicable data protection regulations.

For more information on the privacy practices of the respective platforms, please see the corresponding privacy notices:

• Facebook: Facebook Privacy Policy
• Instagram: Instagram Privacy Policy
• WhatsApp: WhatsApp Privacy Policy

If you wish to object to the processing of your data for advertising purposes, you can revoke your consent at any time or adjust your preferences in the settings of the respective platforms.