Privacy Policy

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as “data”) we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”).

The terms used are not gender-specific.

Last updated: January 6, 2026

Table of Contents

Controller

Michael Keplinger
Feldstrasse 20
4061 Pasching, Austria

Email: hello@michaelkeplinger.com
Phone: +43 699 10 70 74 24
Legal notice: https://michaelkeplinger.com/impressum

Overview of Processing Activities

The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects.

Types of Data Processed

  • Inventory data.
  • Employee data.
  • Payment data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta-, communication and procedural data.
  • Image and/or video recordings.
  • Audio recordings.
  • Event data (Facebook).
  • Log data.

Categories of Data Subjects

  • Service recipients and clients.
  • Prospective customers.
  • Communication partners.
  • Users.
  • Competition and contest participants.
  • Business and contractual partners.
  • Participants.
  • Persons depicted.
  • Third parties.

Purposes of Processing

  • Provision of contractual services and fulfillment of contractual obligations.
  • Communication.
  • Security measures.
  • Direct marketing.
  • Reach measurement.
  • Tracking.
  • Office and organizational procedures.
  • Remarketing.
  • Conversion measurement.
  • Click tracking.
  • Target group formation.
  • Affiliate tracking.
  • Organizational and administrative procedures.
  • Conducting competitions and contests.
  • Feedback.
  • Surveys and questionnaires.
  • Marketing.
  • Profiles with user-related information.
  • Cross-device tracking.
  • Provision of our online offering and user-friendliness.
  • Information technology infrastructure.
  • Public relations and information purposes.
  • Public relations.
  • Sales promotion.
  • Business processes and business management procedures.
  • Artificial intelligence (AI).

Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your country of residence.

  • Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

National data protection regulations in Austria: In addition to the data protection regulations of the GDPR, national regulations apply in Austria, in particular the Austrian Data Protection Act (DSG). The DSG contains special regulations on the right to information, the right to rectification or erasure, the processing of special categories of personal data, processing for other purposes, transmission and automated individual decision-making.

Note on the applicability of the GDPR and the Swiss FDPA: These data protection notices serve both to provide information pursuant to the Swiss Federal Act on Data Protection (FDPA/DSG) and pursuant to the GDPR. For this reason, please note that the terms of the GDPR are used throughout for reasons of broader applicability and comprehensibility.

Security Measures

We take appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk.

The measures include in particular securing the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input of, disclosure of, securing of and separation of the data. Furthermore, we have established procedures to ensure the exercise of data subject rights, the deletion of data and responses to data threats. We also take the protection of personal data into account during the development or selection of hardware, software and processes, in accordance with the principle of data protection by design and by default.

IP address shortening: If IP addresses are processed by us or by the service providers and technologies we use, and the processing of a complete IP address is not necessary, the IP address is shortened (also referred to as “IP masking”). The last two digits, or the last part of the IP address after a full stop, are removed or replaced by wildcards. IP masking is intended to prevent or significantly hinder the identification of a person by their IP address.

Securing online connections with TLS/SSL encryption technology (HTTPS): To protect the data of users transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user’s browser, protecting the data from unauthorized access. TLS, the more modern and secure version of SSL, ensures that all data transmissions conform to the highest security standards. When a website is secured with SSL/TLS, this is indicated by the display of HTTPS in the URL.

International Data Transfers

Data processing in third countries: If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this is only done in accordance with the legal requirements.

For data transfers to the USA, we primarily rely on the EU-U.S. Data Privacy Framework (DPF), which was established by an adequacy decision of the European Commission. Every company certified under the DPF undertakes to comply with European data protection standards. Information on companies certified under the DPF can be found at https://www.dataprivacyframework.gov/.

This dual security ensures comprehensive protection of your data: the DPF forms the primary legal basis and standard contractual clauses serve as a backup mechanism. Together, these instruments ensure that your data is processed in accordance with European data protection standards even when transferred to the USA.

For data transfers to other third countries, corresponding security measures apply, in particular standard contractual clauses (SCCs). Further information: EU Commission – International Data Protection.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consents are revoked or other permissions lapse. If the data is not deleted because it is required for other and legally permissible purposes, its processing is restricted to these purposes.

Data that must be retained for commercial or tax reasons, or whose storage is necessary for the assertion, exercise or defense of legal claims or for the protection of the rights of another natural or legal person, must be retained. Our privacy notices contain additional information on the retention and deletion of data. In the case of multiple retention periods, the longest period always applies.

Retention and deletion of data – general time limits under Austrian law:

  • 10 years – Books and records, annual financial statements, inventories, management reports, opening balance sheets and related documents, received and sent commercial letters, accounting receipts, and comparable documents from other EU Member States (§ 132 BAO).
  • 6 years – Other business documents: received commercial or business letters, copies of sent commercial or business letters, and other documents insofar as they are relevant as evidence (§ 132 BAO).
  • 3 years – Data required to consider potential warranty and compensation claims or similar contractual claims, stored for the duration of the regular limitation period (§§ 1478, 1480 ABGB).

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, in particular from Articles 15 to 21 of the GDPR:

  • Right to object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. Where personal data are processed for direct marketing purposes, you have the right to object at any time to such processing.
  • Right to withdraw consent: You have the right to withdraw consents granted at any time.
  • Right of access: You have the right to obtain confirmation as to whether data in question is being processed and to receive further information and a copy of the data in accordance with the legal requirements.
  • Right to rectification: You have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
  • Right to erasure and restriction of processing: You have the right to demand that data concerning you be deleted immediately, or alternatively to demand restriction of the processing of the data, in accordance with the legal requirements.
  • Right to data portability: You have the right to receive the data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transfer to another controller.
  • Right to lodge a complaint: You have the right to lodge a complaint with the competent supervisory authority.

Business Services

We process data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as “contractual partners”), in the context of contractual and comparable legal relationships as well as related measures and in the context of communication with contractual partners, e.g. to answer inquiries.

We use this data to fulfill our contractual obligations. This includes in particular the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other service disruptions. Furthermore, we use the data to protect our rights and for administrative tasks associated with these obligations and company organization.

We delete the data after expiry of statutory warranty and comparable obligations. The necessity of retaining the data is reviewed every three years; in the case of legal archiving obligations, deletion takes place after their expiry.

Processed data types: Inventory data; Contract data; Payment data; Usage data; Communication data.
Data subjects: Service recipients and clients; Prospective customers; Business and contractual partners.
Legal bases: Contract performance (Art. 6(1)(b) GDPR); Legal obligation (Art. 6(1)(c) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Further note: We process the data of our customers to enable them to select, purchase or order the selected services or works, as well as their payment and delivery or execution. If necessary for the execution of an order, we use service providers, in particular postal, forwarding and shipping companies, to carry out the delivery or execution to our customers.

Use of Online Platforms for Offers and Sales

We offer our services on online platforms operated by other service providers. In addition to our privacy notices, the privacy notices of the respective platforms apply.

Legal bases: Contract performance (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • Pic-Time – Provision of online galleries and a sales shop; Provider: Pic-Time Ltd., 1000 N West Street, Suite 1200, Wilmington, Delaware 19801, USA. Privacy policy: https://pic-time.com/privacy.

Providers and Services Used in Business Operations

In the course of our business activities, we use additional services, platforms and software from other providers in compliance with the legal requirements. Their use serves the purposes stated in this privacy policy.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • sevDesk – Online software for invoicing, accounting, banking and tax filing with receipt storage; Provider: sevDesk GmbH, Hauptstrasse 115, 77652 Offenburg, Germany. Privacy policy: https://sevdesk.de/datenschutz. Data Privacy Framework certified.

Payment Methods

In the context of contractual and other legal relationships, due to legal obligations or on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and use additional payment service providers for this purpose.

The data processed by the payment service providers includes inventory data such as name and address, bank data such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, total amounts and recipient-related information. The terms and conditions and privacy notices of the respective payment service providers apply to payment transactions.

Legal bases: Contract performance (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

Provision of Online Offering and Web Hosting

We process the data of users in order to be able to provide them with our online services. For this purpose, we process the IP address of the user, which is necessary to transmit the content and functions of our online services to the user’s browser or end device.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further notes on processing:

  • Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files”. Server log files may include the address and name of the web pages and files accessed, the date and time of access, the data volumes transferred, the message about successful retrieval, the browser type and version, the operating system, the referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files can be used for security purposes, e.g. to avoid overloading the servers and to ensure their stability.
  • Email dispatch: The web hosting services we use also include the dispatch, receipt and storage of emails. For these purposes, the addresses of the recipients as well as the senders and further information concerning the email dispatch (e.g., the providers involved) as well as the contents of the respective emails are processed.
  • Content Delivery Network (CDN): We use a Content Delivery Network (CDN). A CDN is a service with the help of which the content of an online offering, in particular large media files such as graphics or program scripts, can be delivered faster and more securely with the help of regionally distributed and internet-connected servers.

Use of Cookies

The term “cookies” refers to functions that store and read information on the user’s end devices. Cookies can serve various purposes, e.g. for the functionality, security and convenience of online offerings as well as the creation of analyses of visitor flows. We use cookies in accordance with the statutory provisions. Where required, we obtain the prior consent of users.

Notes on legal bases: Whether we process personal data using cookies depends on consent. If users consent, the legal basis is their consent. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests or, if the use of cookies is necessary to fulfill our contractual obligations, on the basis of contract performance.

Storage duration:

  • Session cookies (temporary cookies): Temporary cookies are deleted at the latest after a user has left the online offering and closed their browser or end device.
  • Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, the login status can be saved or preferred content can be displayed directly when the user revisits a website.

General notes on revocation and objection (opt-out): Users can revoke the consents they have given at any time and also object to processing in accordance with the legal requirements, including via the privacy settings of their browser.

Services used:

  • Consent Management: We use a consent management solution for recording user consent to the use of cookies and the processing operations and providers named within it. Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Blogs and Publication Media

We use blogs or comparable means of online communication and publication (hereinafter “publication media”). Readers’ data is processed for the purposes of the publication medium only to the extent necessary for its presentation and communication between authors and readers or for security reasons.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Contact and Inquiry Management

When contacting us (e.g. by post, contact form, email, telephone or via social media) and in the context of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to respond to the contact requests and any requested measures.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Services used:

  • Contact form: When contacting us via our contact form, email or other communication channels, we process the data communicated to us to answer and process the respective request.
  • LeadConnector: We use the LeadConnector software (Provider: LeadConnector LLC, 100 Congress Ave., 22nd Floor, Austin, TX 78701, USA) for customer relationship management and marketing automation. Privacy policy: https://www.gohighlevel.com/privacy-policy. Data Privacy Framework certified.

Communication via Messenger

We use messenger services for communication purposes. If we ask users for consent before communicating with them via messenger, the legal basis for processing is their consent. If users contact us on their own initiative, we use messenger as a contractual measure or on the basis of our legitimate interests in efficient communication.

We point out that the providers of the messenger services may disclose data to advertising partners or use it for their own business purposes. We have no influence on this.

Revocation, objection and deletion: You can revoke your consent at any time and object to communication with us via messenger at any time. In the case of communication via messenger, we delete messages in accordance with our general deletion policies.

Legal bases: Consent (Art. 6(1)(a) GDPR); Contract performance (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • WhatsApp – Text messages, voice messages and video calls, group conversations; Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy policy: https://www.whatsapp.com/legal/privacy-policy.
  • Instagram Direct – Messaging via the Instagram social network; Provider: Meta Platforms Ireland Limited. Privacy policy: https://privacycenter.instagram.com/policy.
  • Facebook Messenger – Text messages, voice and video calls, group chats; Provider: Meta Platforms Ireland Limited. Privacy policy: https://www.facebook.com/privacy/policy.
  • Signal – Signal Messenger with end-to-end encryption; Provider: Privacy Signal Messenger, LLC 650 Castro Street, Suite 120-223, Mountain View, CA 94041, USA. Privacy policy: https://signal.org/legal.
  • Telegram – Cloud-based messaging service; Privacy policy: https://telegram.org/privacy.
  • iMessage – Apple’s messaging service; Provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. Privacy policy: https://www.apple.com/legal/privacy.
  • Microsoft Teams – Video calls, voice calls, instant messaging, file sharing, screen sharing; Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Privacy policy: https://privacy.microsoft.com/privacystatement. Data Privacy Framework certified.

Chatbots and Chat Functions

We offer online chats and chatbot functions as a communication option (collectively “chat services”). A chat is a real-time online communication in which users can exchange messages with each other. In the context of chatbots, users receive automated responses.

We use chat services for the purpose of responding to user inquiries more quickly and efficiently and for marketing purposes. You can revoke your consent or object to the processing of your data in the context of our chat services at any time.

Legal bases: Consent (Art. 6(1)(a) GDPR); Contract performance (Art. 6(1)(b) GDPR).

Artificial Intelligence (AI)

We use artificial intelligence (AI), in which personal data is processed. Our AI systems are used in strict compliance with the legal requirements, including data protection regulations, transparency obligations and, where required, obtaining the necessary consents.

When using external AI systems, we carefully select their providers and conclude the necessary data processing agreements with them to ensure your data is processed in accordance with applicable data protection regulations.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • Adobe Firefly / Adobe AI – AI-powered tools and functions in Adobe products supporting creative processes; Provider: Adobe Inc., 345 Park Avenue, San Jose, CA 95110-2704, USA. Privacy policy: https://www.adobe.com/privacy/policy.html. Data Privacy Framework certified.
  • ChatGPT / OpenAI – AI-based service for natural language processing; Provider: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Privacy policy: https://openai.com/policies/privacy-policy.
  • Claude / Anthropic – AI-powered system for advanced language and image processing; Provider: Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. Privacy policy: https://www.anthropic.com/privacy.

Video Conferences, Online Meetings, Webinars and Screen Sharing

We use platforms and applications from other providers (hereinafter referred to as “conference platforms”) for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings.

When participating in a conference, conference platforms process the following data: IP address, device and hardware information, operating system, browser settings, microphone and camera settings, first and last name, email address, and profile picture if applicable. Communications content such as text data, voice, video and screen shares may also be processed.

If text inputs, participation results or video/audio recordings are logged, this will be communicated transparently to the participants and – where required – their consent will be obtained.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • Google Meet – Conference and communication software; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy. Data Privacy Framework certified.
  • Zoom – Video conferences, online meetings, webinars, screen sharing; Provider: Zoom Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA. Privacy policy: https://zoom.us/privacy. Data Privacy Framework certified.
  • Microsoft Teams – Messenger and conference software; Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Privacy policy: https://privacy.microsoft.com/privacystatement. Data Privacy Framework certified.

Audio Content

We use hosting services from service providers to offer our audio content for listening and download. Service providers may process data, in particular the IP address of users, for the purpose of transmission of the content, access measurement and market research.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • Anchor / Spotify – Podcast hosting, distribution and analysis; Provider: Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Sweden. Privacy policy: https://www.spotify.com/legal/privacy-policy.
  • Apple Podcasts – Podcast hosting, publication and management, analysis of listening behavior; Provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. Privacy policy: https://www.apple.com/legal/privacy.

Cloud Services

We use software services accessible via the internet and running on the servers of their providers (so-called “cloud services” or “Software as a Service”) for the following purposes: document storage and management, calendar management, email transmission and management, spreadsheets and presentations, exchange of documents, content and information with specific recipients or publication of websites, forms or other content and information, as well as chats and participation in audio and video conferences.

In this context, personal data may be processed and stored on the servers of the providers to the extent that this is part of communication processes with us or is otherwise processed by us as set out in this privacy notice.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • Adobe Creative Cloud – Cloud storage, cloud infrastructure services and cloud-based application software, including for photo editing, design and creative projects; Provider: Adobe Inc., 345 Park Avenue, San Jose, CA 95110-2704, USA. Privacy policy: https://www.adobe.com/privacy/policy.html. Data Privacy Framework certified.
  • iCloud – Cloud storage service; Provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. Privacy policy: https://www.apple.com/legal/privacy. Data Privacy Framework certified.
  • Google Cloud / Firebase – Cloud infrastructure services and cloud-based application software; Provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Privacy policy: https://policies.google.com/privacy. Data Privacy Framework certified.
  • Google Drive / Google Workspace – Cloud storage, cloud infrastructure and cloud-based application software; Provider: Google Cloud EMEA Limited. Privacy policy: https://policies.google.com/privacy. Data Privacy Framework certified.
  • Microsoft 365 / OneDrive – Cloud-based application software (e.g. word processing, spreadsheets, calendar and contact management, email) and cloud storage; Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Privacy policy: https://privacy.microsoft.com/privacystatement. Data Privacy Framework certified.

Newsletters and Electronic Notifications

We send newsletters, emails and other electronic notifications (hereinafter “newsletter”) only with the consent of the recipients or a legal permission. If the contents of a newsletter are specifically described in the context of a registration, they are decisive for the consent of the users. Otherwise our newsletters contain information about our services, offers, promotions and our company.

Deletion and restriction of processing: We may retain unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove a previously given consent.

Newsletter contents: Information about us, our services, promotions and offers.

Legal bases: Consent (Art. 6(1)(a) GDPR).

Further note: The newsletters contain a so-called “web beacon”, i.e., a pixel-sized file that is retrieved from our server when the newsletter is opened. Within the scope of this retrieval, technical information such as information about the browser, system, IP address and the time of retrieval are collected. This information is used for the technical improvement of our newsletter on the basis of technical data or the target groups and their reading behavior.

Advertising Communication via Email, Post, Fax or Telephone

We process personal data for the purposes of advertising communication, which may be carried out via various channels such as email, telephone, post or fax, in accordance with the legal requirements.

Recipients have the right to revoke consents granted at any time or to object to advertising communication at any time. After revocation or objection, we may store the data necessary to prove the previous authorization for contacting for up to three years after the end of the year of revocation or objection.

Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Competitions and Contests

We process personal data of participants of competitions and contests only in compliance with the relevant data protection regulations, insofar as the processing is contractually necessary for the provision, execution and handling of the competition, participants have consented to the processing, or the processing serves our legitimate interests.

If participants publish their contributions as part of competitions (e.g. in the context of a vote or evaluation), we point out that their names may also be published. Participants can object to this at any time. The data of the participants will be deleted as soon as the competition or contest is over and the data is no longer required.

Legal bases: Contract performance (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Surveys and Questionnaires

We conduct surveys and questionnaires to gather information for the respectively communicated survey purpose. The surveys we conduct are evaluated anonymously. Personal data is only processed insofar as this is necessary for the provision and technical execution of the survey (e.g., processing of the IP address in order to display the survey in the user’s browser) or users have consented.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • Google Forms – Creation and evaluation of online forms, surveys and feedback forms; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy. Data Privacy Framework certified.

Web Analytics, Monitoring and Optimization

Web analytics (also referred to as “reach measurement”) is used to evaluate the flow of visitors to our online offering and may include behavior, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognize at what time our online offering or its functions or content is most frequently used, as well as which areas require optimization.

IP addresses of users are also stored, but processed using an IP masking procedure (pseudonymization by shortening the IP address). Generally, no clear data of the users (such as email addresses or names) is stored in the context of web analytics, but pseudonyms.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for processing is consent. Otherwise, user data is processed on the basis of our legitimate interests.

Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • Google Analytics 4 – We use Google Analytics for measuring and analyzing the use of our online offering on the basis of a pseudonymous user identification number. This identification number does not contain unique data such as names or email addresses. It is used to assign analysis information to an end device in order to recognize which content the users have accessed within one or various usage processes, which search terms they have used, and when they have accessed our online offering. Google Analytics does not log or store individual IP addresses. Analytics provides only aggregated, anonymous data about groups of users. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy. Data Privacy Framework certified. Opt-out: https://tools.google.com/dlpage/gaoptout.
  • Google Signals – We use Google Analytics to display ads delivered through Google advertising services and its partners only to users who have also enabled personalized advertising in their Google account settings. Google Analytics additionally uses Google data and own modeled data to improve measurement. Legal basis: Consent (Art. 6(1)(a) GDPR).
  • Google Tag Manager – Software that enables us to integrate so-called web tags (small code sections) into our website and manage them via an interface, without itself using cookies or storing any personal data. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy. Data Privacy Framework certified.

Online Marketing

We process personal data for the purpose of online marketing, which includes in particular the marketing of advertising space or the display of promotional and other content based on potential user interests and the measurement of their effectiveness.

For these purposes, user profiles are created and stored in a file (so-called “cookie”) or similar procedures are used, by means of which the information about the user relevant for the display of the aforementioned content is stored. IP addresses of users are also stored, but processed using available IP masking procedures.

Notes on revocation and objection: We refer to the privacy notices of the respective providers and the opt-out options indicated for the providers. Opt-out options by region:

Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • Meta Pixel / Facebook Pixel – With the help of the Meta Pixel, Meta is able to determine the visitors of our online offering as a target group for the presentation of ads (so-called “Facebook Ads”). Accordingly, we use the Meta Pixel to display the Facebook Ads we place only to those Meta users who have also shown an interest in our online offering. Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy policy: https://www.facebook.com/privacy/policy. Data Privacy Framework certified.
  • Facebook Ads – Placement of advertisements within the Facebook platform and evaluation of ad results; Provider: Meta Platforms Ireland Limited. Data Privacy Framework certified.
  • Google Ad Manager – Used to place ads in the Google advertising network (e.g. in search results, in videos, on websites). Ads are displayed in real time based on presumed user interests. Provider: Google Ireland Limited. Data Privacy Framework certified.
  • Google Ads – Online marketing procedure for the purpose of placing content and ads within the advertising network of the service provider. Provider: Google Ireland Limited. Data Privacy Framework certified.
  • Google Remarketing – Technology with which users who have visited an online offering in the past are recognized and displayed with advertising for the online offering on other websites within the Google advertising network. Provider: Google Ireland Limited. Data Privacy Framework certified.
  • Google Conversion Tracking – Measurement of the effectiveness of Google Ads. A cookie is set on the user’s computer if the user has clicked on a Google ad. Provider: Google Ireland Limited. Data Privacy Framework certified.
  • Google AdSense (personalized) – Display of personalized ads within our online offering. Provider: Google Ireland Limited. Data Privacy Framework certified.
  • Google AdSense (non-personalized) – Display of non-personalized ads within our online offering. Provider: Google Ireland Limited. Data Privacy Framework certified.
  • Instagram Ads – Placement of advertisements within the Instagram platform and evaluation of ad results. Provider: Meta Platforms Ireland Limited. Data Privacy Framework certified.
  • Pinterest Tag – Code executed when our online offering is visited, enabling the measurement of website activities and the building of target groups. Provider: Pinterest Europe Ltd., 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland. Privacy policy: https://policy.pinterest.com/en/privacy-policy.

Affiliate Programs and Affiliate Links

In our online offering, we include so-called affiliate links or other references to the offers and services of third-party providers. If users follow the affiliate links or subsequently make use of the offers, we may receive a commission or other benefits from these third-party providers.

In order to be able to track whether users have made use of the offers of an affiliate link used by us, it is necessary that the respective third-party providers know that the users have followed an affiliate link within our online offering. The assignment of affiliate links to business transactions or other actions is used solely for the purpose of commission settlement and will be cancelled as soon as it is no longer necessary for this purpose.

Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

Customer Reviews and Rating Procedures

We participate in review and rating procedures in order to evaluate, optimize and promote our services. If users rate us via the participating rating platforms or methods, the general terms and conditions and the privacy notices of the providers also apply. In order to ensure that the persons providing ratings have actually used our services, we transmit, with the consent of the customers, the necessary data in relation to the customer and the service used to the respective rating platform (this includes name, email address and order number or article number).

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • Google Customer Reviews – Service for obtaining and/or displaying customer satisfaction and customer opinions; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy. Data Privacy Framework certified.

Digital Badges

Digital badges, also referred to as open badges, are digital certificates or verifications that document skills, qualifications, achievements or participations in events or courses. Badges are used as visual recognition in digital environments, e.g. on websites, social media or in professional networks.

If badges are issued individually for specific persons, the personal data stored in the badges is intended to enable these persons to verify and share their qualifications or achievements. Badges are used for marketing and public relations purposes.

Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Presences in Social Networks (Social Media)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We point out that user data may be processed outside the European Union. This may entail risks for the users because it could, for example, make it more difficult to enforce the rights of the users. Furthermore, the data of users within social networks is generally processed for market research and advertising purposes.

For a detailed presentation of the respective forms of processing and the options for objection (opt-out), we refer to the privacy notices and information provided by the operators of the respective networks. Also in the case of requests for information and the assertion of data subject rights, we point out that these can be most effectively asserted with the providers.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Consent (Art. 6(1)(a) GDPR).

Services used:

  • Instagram – Social network enabling sharing of photos and videos, commenting and favoriting of posts, direct messaging; Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy policy: https://privacycenter.instagram.com/policy. Data Privacy Framework certified.
  • Facebook Pages – Profile within the social network Facebook. The controller is jointly responsible with Meta Platforms Ireland Limited; Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy policy: https://www.facebook.com/privacy/policy. Data Privacy Framework certified.
  • Facebook Groups – We use the “Groups” function of the Facebook platform to create interest groups within which content can be exchanged and discussed among users.
  • Facebook Events – We use the “Events” function of the Facebook platform to create and manage events, invite participants and coordinate event-related activities.
  • Pinterest – Social network enabling sharing of photos, commenting, favoriting and curating of posts (pins); Provider: Pinterest Europe Ltd., 2nd Floor, Palmerston House, Fenian Street, Dublin 2, Ireland. Privacy policy: https://policy.pinterest.com/en/privacy-policy.
  • TikTok – Social network enabling sharing of short videos, commenting and favoriting; Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland. Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en.
  • Threads – Social network enabling sharing of photos and text posts; Provider: Meta Platforms Ireland Limited. Privacy policy: https://www.facebook.com/privacy/policy. Data Privacy Framework certified.
  • Vimeo – Platform for the provision and delivery of video content; Provider: Vimeo Inc., 555 West 18th Street, New York, NY 10011, USA. Privacy policy: https://vimeo.com/privacy. Data Privacy Framework certified.
  • YouTube – Social network and video platform; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy. Data Privacy Framework certified.
  • WhatsApp Groups – Group messaging within the WhatsApp platform enabling multiple users to exchange messages; Provider: Meta Platforms Ireland Limited.
  • WhatsApp (Messenger) – Messaging service for sending and receiving text messages, voice messages, images, videos and files; Provider: Meta Platforms Ireland Limited.
  • WhatsApp Channels – Communication service within the WhatsApp platform used for one-way information distribution from administrators to subscribers; Provider: Meta Platforms Ireland Limited.

Plug-ins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may be, for example, graphics, videos or city maps.

The integration always requires that the third-party providers of this content process the IP address of the user, since without the IP address they could not send the content to the user’s browser.

Legal bases: Consent (Art. 6(1)(a) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • Google Fonts (self-hosted) – Provision of font files for a user-friendly display of our online offering. The font files are stored on our own servers and are not transmitted to Google. Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
  • Google Fonts (web service) – Procurement of fonts (and symbols) for the purpose of a technically secure, maintenance-free and efficient use of fonts and symbols. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy. Data Privacy Framework certified.
  • YouTube Videos – Video content; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy. Data Privacy Framework certified.

Management, Organization and Utility Tools

We use services, platforms and software from other providers (hereinafter referred to as “third-party providers”) for the purposes of organizing, administering, planning and providing our services. When selecting third-party providers and their services, we comply with the legal requirements.

In this context, personal data may be processed and stored on the servers of third-party providers. Various data may be affected that we process in accordance with this privacy notice.

Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Services used:

  • Google Workspace APIs – We use the Google Workspace APIs to provide our services contractually. The Google Workspace APIs are used exclusively to improve the user experience and are not used to develop, improve or train general AI/ML models. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://policies.google.com/privacy. Data Privacy Framework certified.

Changes and Updates

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as the changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy notice, please note that the addresses may change over time and please check the information before contacting us.