Privacy Policy
1. An overview of data protection
General information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you could be personally identified. Detailed information on the subject of data protection can be found in our privacy policy found below.
Data collection on this website
Who is responsible for the data collection on this website?
The data processing on this website is carried out by the website operator. Their contact details can be found in the section “Information about the responsible party (referred to as the “controller” in the GDPR)” in this privacy policy.
How do we collect your data?
Some data are collected when you provide it to us. This could, for example, be data you enter into a contact form.
Other data are collected automatically by our IT systems or after you consent to its recording during your website visit. This data comprises primarily technical information (e.g., web browser, operating system, or time the page was accessed). This data is collected automatically as soon as you enter this website.
What do we use your data for?
A portion of the data is collected to ensure the proper functioning of the website. Other data may be used to analyze how visitors use the site. If contracts can be concluded or initiated via the website, the transmitted data will also be processed for contract offers, orders, or other request processing.
What rights do you have regarding your data?
You have the right to receive information about the source, recipients, and purposes of your archived personal data at any time without having to pay a fee for such disclosures. You also have the right to demand that your data be rectified or eradicated. If you have consented to data processing, you have the option to revoke this consent at any time, which shall affect all future data processing. Furthermore, you have the right to demand that the processing of your data be restricted under certain circumstances. Furthermore, you have the right to log a complaint with the competent supervising agency.
Please do not hesitate to contact us at any time if you have questions about this or any other data protection-related issues.
Analytics tools and third-party tools
When visiting this website, your surfing behavior may be statistically evaluated. This is done primarily with so-called analytics programs.
Detailed information about these analytics programs can be found in the following privacy policy.
2. Hosting
We host the content of our website with the following provider:
External Hosting
This website is hosted externally. The personal data collected on this website are stored on the servers of the host(s). These may include, but are not limited to, IP addresses, contact requests, metadata and communications, contract information, contact information, names, webpage access, and other data generated through a website.
The external hosting serves the purpose of fulfilling the contract with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR). If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar as the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time.
Our host(s) will only process your data to the extent necessary to fulfill its performance obligations and will follow our instructions with respect to such data.
We use the following host(s):
Kinsta Ltd.
International House, 142 Cromwell Road, London, SW7 4EF, UK
Data Processing Agreement (DPA)
We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.
Content Delivery Network (CDN) / Cloudflare (via Kinsta)
We use a Content Delivery Network (CDN) as part of our hosting to increase the security and delivery speed of our website and to defend against attacks (e.g., DDoS). This may involve the processing of technical access data (in particular IP address, browser/device information, referrer URL, date/time of access) to provide content and secure the website.
This processing is based on our legitimate interest in providing our online services securely, quickly, and stably (Art. 6(1)(f) GDPR). If consent has been obtained, processing is carried out additionally on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG; consent can be revoked at any time.
Cloudflare is deployed via our hosting provider or its infrastructure.
3. General notes and mandatory information
Data protection
The operators of this website and its pages take the protection of your personal data very seriously. We treat your personal data as confidential and in accordance with the statutory data protection regulations and this privacy policy.
Whenever you use this website, a variety of personal information will be collected. Personal data comprises data that can be used to personally identify you. This privacy policy explains which data we collect as well as the purposes we use this data for. It also explains how, and for which purpose the information is collected.
We herewith advise you that the transmission of data via the Internet (i.e., through e-mail communications) may be prone to security gaps. It is not possible to completely protect data against third-party access.
Information about the responsible party (Controller)
The data processing controller on this website is:
VisCircle GmbH
Vahrenwalder Strasse 207a
30165 Hannover
Phone: +49 (0)511 165 81 481
E-mail: info@viscircle.com
The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data (e.g., names, e-mail addresses, etc.).
Storage duration
Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply.
General information on the legal basis for the data processing on this website
If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, if special categories of data are processed according to Art. 9(1) GDPR. In the case of explicit consent to the transfer of personal data to third countries, data processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to the access to information in your end device (e.g., via device fingerprinting), the data processing is additionally based on § 25 (1) TDDDG. The consent can be revoked at any time. If your data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, if your data is required to fulfill a legal obligation, we process it on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest in accordance with Art. 6(1)(f) GDPR. Information on the relevant legal basis in each individual case is provided in the following paragraphs of this privacy policy.
Information on data transfer to unsafe third countries and transfer to US companies that are not DPF-certified
We use tools from companies based in unsafe third countries as well as US tools whose providers are not certified under the EU-US Data Privacy Framework (DPF). If these tools are active, your personal data may be transferred to these countries and processed there. We must point out that in unsafe third countries, a level of data protection comparable to that of the EU cannot be guaranteed.
We point out that the US, as a secure third country, generally features a level of data protection comparable to that of the EU. Data transfer to the US is therefore permitted if the recipient possesses certification under the “EU-US Data Privacy Framework” (DPF) or possesses appropriate additional guarantees. Information on transfers to third countries, including data recipients, can be found in this privacy policy.
Recipients of personal data
In the scope of our business activities, we cooperate with various external parties. In some cases, this also requires the transmission of personal data to these external parties. We only disclose personal data to external parties if this is necessary as part of the fulfillment of a contract, if we are legally obligated to do so (e.g., disclosure of data to tax authorities), if we have a legitimate interest in the disclosure pursuant to Art. 6(1)(f) GDPR, or if another legal basis permits the disclosure of this data. When using processors, we only disclose personal data of our customers on the basis of a valid contract on data processing. In the case of joint processing, a joint processing agreement is concluded.
Revocation of your consent to the processing of data
Many data processing transactions are possible only subject to your express consent. You can revoke any consent you have already given at any time. The legality of the data processing carried out before the revocation remains unaffected by the revocation.
Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR)
IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME FOR REASONS ARISING FROM YOUR UNIQUE SITUATION; THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS, ON WHICH ANY PROCESSING OF DATA IS BASED, PLEASE CONSULT THIS PRIVACY POLICY. IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA, THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING, EXERCISING OR DEFENSE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21(1) GDPR).
IF YOUR PERSONAL DATA IS PROCESSED IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR AFFECTED PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING AT ANY TIME; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).
Right to log a complaint with the competent supervisory agency
In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile, place of work or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recourses.
Right to data portability
You have the right to demand that we hand over any data we automatically process on the basis of your consent or in order to fulfill a contract be handed over to you or a third party in a commonly used, machine-readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.
Information, correction and eradication
Within the scope of the applicable statutory provisions, you have the right to at any time demand information about your archived personal data, their source and recipients as well as the purpose of the processing of your data. You may also have a right to have your data rectified or eradicated. If you have questions about this subject matter or any other questions about personal data, please do not hesitate to contact us at any time.
Right to demand processing restrictions
You have the right to demand the imposition of restrictions as far as the processing of your personal data is concerned. To do so, you may contact us at any time. The right to demand restriction of processing applies in the following cases:
- In the event that you should dispute the correctness of your data archived by us, we will usually need some time to verify this claim. During the time that this investigation is ongoing, you have the right to demand that we restrict the processing of your personal data.
- If the processing of your personal data was/is conducted in an unlawful manner, you have the option to demand the restriction of the processing of your data in lieu of demanding the eradication of this data.
- If we do not need your personal data any longer and you need it to exercise, defend or claim legal entitlements, you have the right to demand the restriction of the processing of your personal data instead of its eradication.
- If you have raised an objection pursuant to Art. 21(1) GDPR, your rights and our rights will have to be weighed against each other. As long as it has not been determined whose interests prevail, you have the right to demand a restriction of the processing of your personal data.
If you have restricted the processing of your personal data, these data – with the exception of their archiving – may be processed only subject to your consent or to claim, exercise or defend legal entitlements or to protect the rights of other natural persons or legal entities or for important public interest reasons cited by the European Union or a member state of the EU.
SSL and/or TLS encryption
For security reasons and to protect the transmission of confidential content, such as purchase orders or inquiries you submit to us as the website operator, this website uses either an SSL or a TLS encryption program. You can recognize an encrypted connection by checking whether the address line of the browser switches from “http://” to “https://” and also by the appearance of the lock icon in the browser line.
If the SSL or TLS encryption is activated, data you transmit to us cannot be read by third parties.
Rejection of unsolicited e-mails
We herewith object to the use of contact information published in conjunction with the mandatory information to be provided in our site notice (“Impressum”) to send us promotional and information material that we have not expressly requested. The operators of this website and its pages reserve the express right to take legal action in the event of the unsolicited sending of promotional information, for instance via SPAM messages.
4. Data collection on this website
Cookies
Our websites and pages use what the industry refers to as “cookies.” Cookies are small data packages that do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or they are permanently archived on your device (permanent cookies). Session cookies are automatically deleted once you terminate your visit. Permanent cookies remain archived on your device until you actively delete them, or they are automatically eradicated by your web browser.
Cookies can be issued by us (first-party cookies) or by third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services of third-party companies into websites (e.g., cookies for handling payment services).
Cookies have a variety of functions. Many cookies are technically essential since certain website functions would not work in the absence of the cookies (e.g., the shopping cart function or the display of videos). The purpose of other cookies may be the analysis of user patterns or the display of promotional messages.
Cookies, which are required for the performance of electronic communication transactions, for the provision of certain functions you want to use (e.g., for the shopping cart function) or those that are necessary for the optimization (required cookies) of the website (e.g., cookies that provide measurable insights into the web audience), shall be stored on the basis of Art. 6(1)(f) GDPR, unless a different legal basis is cited. The operator of the website has a legitimate interest in the storage of required cookies to ensure the technically error-free and optimized provision of the operator’s services. If your consent to the storage of the cookies and similar recognition technologies has been requested, processing occurs exclusively on the basis of the consent obtained (Art. 6(1)(a) GDPR and § 25 (1) TDDDG); this consent may be revoked at any time.
You have the option to set up your browser in such a manner that you will be notified any time cookies are placed and to permit the acceptance of cookies only in specific cases. You may also exclude the acceptance of cookies in certain cases or in general or activate the delete function for the automatic eradication of cookies when the browser closes. If cookies are deactivated, the functions of this website may be limited.
You can find out which cookies and services are used on this website in this privacy policy.
Contact form
If you submit inquiries to us via our contact form, the information provided in the contact form as well as any contact information provided therein will be stored by us in order to handle your inquiry and in the event that we have further questions. We will not share this information without your consent.
The processing of these data is based on Art. 6(1)(b) GDPR, if your request is related to the execution of a contract or if it is necessary to carry out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the requests addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested; the consent can be revoked at any time.
The information you have entered into the contact form shall remain with us until you ask us to eradicate the data, revoke your consent to the archiving of data or if the purpose for which the information is being archived no longer exists (e.g., after we have concluded our response to your inquiry). This shall be without prejudice to any mandatory legal provisions – in particular retention periods.
Request by e-mail, telephone, or fax
If you contact us by e-mail, telephone or fax, your request, including all resulting personal data (name, request) will be stored and processed by us for the purpose of processing your request. We do not pass these data on without your consent.
These data are processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or is required for the performance of pre-contractual measures. In all other cases, the data are processed on the basis of our legitimate interest in the effective handling of inquiries submitted to us (Art. 6(1)(f) GDPR) or on the basis of your consent (Art. 6(1)(a) GDPR) if it has been obtained; the consent can be revoked at any time.
The data sent by you to us via contact requests remain with us until you request us to delete, revoke your consent to the storage or the purpose for the data storage lapses (e.g. after completion of your request). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.
Handling of applicant data
We offer you the opportunity to apply for a job with us (e.g., via e-mail or regular mail). In the following, we will inform you about the scope, purpose, and use of your personal data collected in the context of the application process. We assure you that the collection, processing, and use of your data complies with the applicable data protection laws and all other statutory provisions and that your data will be treated in strict confidence.
Scope and purpose of data collection
If you submit a job application to us, we will process your affiliated personal data (e.g., contact and communication data, application documents, notes taken during job interviews, etc.), if they are required to make a decision concerning the establishment of an employment relationship. The legal grounds for the aforementioned are § 26 BDSG according to German Law (Negotiation of an Employment Relationship), Art. 6(1)(b) GDPR (General Contract Negotiations) and – provided you have given us your consent – Art. 6(1)(a) GDPR. You may revoke any consent given at any time. Within our company, your personal data will only be shared with individuals who are involved in the processing of your job application.
Data retention period
If we are unable to make you a job offer, or if you reject a job offer or withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application). Afterwards, the data will be deleted, and the physical application documents will be destroyed. The storage serves in particular as evidence in the event of a legal dispute (e.g., under the German General Equal Treatment Act – AGG). If it is evident that the data will be required after the expiration of the 6-month period (e.g., due to an impending or pending legal dispute), deletion will only take place when the purpose for further storage no longer applies.
Admission to the applicant pool (Talent Pool)
If we do not make you a job offer, you may be able to join our talent pool. In case of admission, all documents and information from your application will be transferred to the talent pool in order to contact you regarding appropriate vacancies. Admission to the talent pool requires your express consent via e-mail (Art. 6(1)(a) GDPR). The submission of this consent declaration is voluntary and not related to the ongoing application process. The consent declaration can be revoked at any time. Data from the talent pool will be irrevocably deleted no later than 1 year after the consent declaration was given, provided no revocation has occurred.
5. Plugins and Tools
YouTube with expanded data protection integration
Our website embeds videos of the website YouTube. The website operator is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
We use YouTube in the expanded data protection mode. According to YouTube, videos that are played in expanded data protection mode are not used to personalize browsing on YouTube. Ads that are played in the expanded data protection mode are also not personalized. No cookies are set in the expanded data protection mode. Instead, so-called local storage elements are stored in the user’s browser, which, similar to cookies, contain personal data and can be used for recognition. Details regarding the expanded data protection mode can be found here: https://support.google.com/youtube/answer/171780?hl=en.
It is possible that, after the activation of a YouTube video, further data processing operations are triggered, over which we have no control.
The use of YouTube is based on our interest in presenting our online content in an appealing manner. Pursuant to Art. 6(1)(f) GDPR, this is a legitimate interest. If corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar as the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. The consent can be revoked at any time.
For more information about data protection at YouTube, please refer to their privacy policy at: https://policies.google.com/privacy?hl=en.
The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US intended to ensure compliance with European data protection standards for data processing in the US. Any company certified under the DPF commits to complying with these data protection standards. More information can be obtained from the provider via the following link: https://www.dataprivacyframework.gov/participant/5780.
Vimeo
This website uses plugins of the video portal Vimeo. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.
If you visit one of our pages equipped with a Vimeo video, a connection to the Vimeo servers is established. Here the Vimeo server is informed about which of our pages you have visited. In addition, Vimeo will receive your IP address. This also applies if you are not logged in to Vimeo or do not have an account with Vimeo. The information recorded by Vimeo is transmitted to a Vimeo server in the US.
If you are logged into your Vimeo account, you enable Vimeo to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your Vimeo account.
For the recognition of website visitors, Vimeo uses cookies or comparable recognition technologies (e.g., device fingerprinting).
The use of Vimeo is based on our interest in an appealing presentation of our online content. This constitutes a legitimate interest pursuant to Art. 6(1)(f) GDPR. If a corresponding consent was requested, processing occurs exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar as the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.
The data transmission to the US is based on the Standard Contractual Clauses (SCC) of the European Commission and, according to Vimeo, on “legitimate business interests”. Details can be found here: https://vimeo.com/privacy.
Further information on how user data is handled can be found in Vimeo’s privacy policy at: https://vimeo.com/privacy.
The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US intended to ensure compliance with European data protection standards for data processing in the US. Any company certified under the DPF commits to complying with these data protection standards. More information can be obtained from the provider via the following link: https://www.dataprivacyframework.gov/participant/5711.
Google Fonts (local hosting)
This site uses so-called Google Fonts provided by Google for the uniform representation of fonts. The Google Fonts are installed locally. There is no connection to Google servers.
Further information on Google Fonts can be found at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy?hl=en.
Google Tag Manager
We use the Google Tag Manager. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
The Google Tag Manager is a tool that allows us to integrate and manage website tags centrally. The Google Tag Manager itself fundamentally does not create user profiles, does not store cookies for analysis purposes, and does not carry out any independent analyses. However, it may process technical information (e.g., IP address) which is necessary for the execution and delivery of the integrated tags.
The deployment of the Google Tag Manager occurs exclusively on the basis of your consent (Art. 6(1)(a) GDPR and § 25 (1) TDDDG), provided and insofar as services requiring consent (e.g., analytics or marketing tools) are integrated via the Tag Manager. This consent can be revoked at any time.
Google Analytics
This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables us to analyze the behavior of website visitors (e.g., page views, duration of visit, interactions, origin/referrer, technical information regarding the end device). For this purpose, cookies and similar technologies can be used. The information thus collected is usually transferred to a Google server and stored there.
The use of Google Analytics is based exclusively on your consent (Art. 6(1)(a) GDPR and § 25 (1) TDDDG). Consent may be revoked at any time.
We generally use Google Analytics with IP anonymization (if technically available/active in the configuration we use).
For more information on how Google Analytics handles user data, please consult Google’s privacy policy: https://policies.google.com/privacy?hl=en.
Google reCAPTCHA
We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on this website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
The purpose of reCAPTCHA is to determine whether data entered on this website (e.g., information entered into a contact form) is being provided by a human user or by an automated program. To determine this, reCAPTCHA analyzes the behavior of the website visitors based on a variety of parameters. This analysis is triggered automatically as soon as the website visitor enters the site. For this analysis, reCAPTCHA evaluates a variety of data (e.g., IP address, time the website visitor spent on the site or cursor movements initiated by the user). The data tracked during such analyses are forwarded to Google.
The reCAPTCHA analyses run entirely in the background. Website visitors are not alerted that such an analysis is underway.
Data are stored and analyzed on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the protection of the operator’s websites against abusive automated spying and against SPAM. If corresponding consent was requested, processing occurs exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar as the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.
For more information about Google reCAPTCHA, please refer to the Google Privacy Policy and the Google Terms of Service under the following links: https://policies.google.com/privacy?hl=en and https://policies.google.com/terms?hl=en.
The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US intended to ensure compliance with European data protection standards for data processing in the US. Any company certified under the DPF commits to complying with these data protection standards. More information can be obtained from the provider via the following link: https://www.dataprivacyframework.gov/participant/5780.
Wordfence
We have integrated Wordfence on this website. The provider is Defiant Inc., Defiant, Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA (hereinafter “Wordfence”).
Wordfence is designed to protect our website against unwanted access or malicious cyberattacks. To this end, our website establishes a permanent connection to the Wordfence servers so that Wordfence can compare and possibly block its databases against the accesses made to our website.
The use of Wordfence occurs on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the most effective protection of their website against cyberattacks. If corresponding consent was requested, processing occurs exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TDDDG, insofar as the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.
The transfer of data to the US is based on the Standard Contractual Clauses (SCC) of the European Commission. Details can be found here: https://www.wordfence.com/help/general-data-protection-regulation/.
Data Processing Agreement (DPA)
We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract mandated by data privacy laws that guarantees that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR.
6. Our social media appearances
Data processing by social networks
We maintain publicly available profiles in social networks. The individual social networks we use can be found below. Social networks such as Facebook, Instagram, etc. can generally analyze your user behavior comprehensively if you visit their website or a website with integrated social media content (e.g., like buttons or banner ads). Visiting our social media presences triggers numerous data protection-relevant processing operations.
If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. Under certain circumstances, your personal data may also be recorded if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection takes place, for example, via cookies stored on your device or by recording your IP address.
Using the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way you can see interest-based advertising inside and outside of the respective social media presence.
Please note that we cannot retrace all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and privacy policy of the respective social media portals.
Legal basis
Our social media appearances should ensure the widest possible presence on the Internet. This is a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The analysis processes initiated by the social networks may be based on divergent legal bases to be specified by the operators of the social networks (e.g., consent within the meaning of Art. 6(1)(a) GDPR).
Controller and assertion of rights
If you visit one of our social media sites (e.g., Facebook or Instagram), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. You can basically assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) both vis-à-vis us as well as vis-à-vis the operator of the respective social media portal (e.g., vis-à-vis Facebook).
Please note that despite the joint controllership with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options are determined by the company policy of the respective provider.
Storage duration
The data collected directly by us via the social media presence will be deleted from our systems as soon as the purpose for their storage lapses, you ask us to delete them, you revoke your consent to the storage or the purpose for the data storage lapses. Stored cookies remain on your device until you delete them. Mandatory statutory provisions – in particular, retention periods – remain unaffected.
We have no influence on the storage duration of your data that are stored by the operators of social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g., in their privacy policy, see below).
Social networks in detail
We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. According to Meta’s statement the collected data will also be transferred to the USA and to other third-party countries.
We have signed an agreement with Meta on joint controllership for the processing of data (Controller Addendum). This agreement determines which data processing operations we or Meta are responsible for when you visit our Facebook Page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.
Details on how they handle your personal data can be found in Facebook’s privacy policy: https://www.facebook.com/about/privacy/.
We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
We have signed an agreement with Meta on joint controllership for the processing of data (Controller Addendum). This regulates the responsibilities for data processing when you visit our Instagram profile.
Details on how they handle your personal data can be found in Instagram’s privacy policy: https://help.instagram.com/519522125107875.
We have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.
If you wish to disable LinkedIn advertising cookies, please use the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
We have also concluded an agreement with LinkedIn on joint controllership (Page Insights Joint Controller Addendum). Further details on data processing can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.
ArtStation
We have a profile on ArtStation. The provider of this service is Epic Games, Inc., 620 Crossroads Blvd., Cary, NC 27518, USA.
Details on how they handle your personal data can be found in the privacy policy of Epic Games: https://legal.epicgames.com/en-US/epicgames/privacy-policy.
Source: https://www.e-recht24.de