Data protection

Processing of Your Data in the Context of the Agency Services Provided by Us

We offer agency services. If you are our customer or business partner or are interested in our services, the type, scope, and purpose of the processing of your data depend on the contractual or pre-contractual services existing between us. These include conceptual and strategic consulting, software and design development, consulting and support services in this area, planning and implementation of campaigns, IT and server administration, as well as other consulting and training services. In this sense, the data processed by us includes all the data that is provided or has been provided by you for the purpose of using the contractual or pre-contractual services and that is necessary for processing your request or the contract concluded between us. Unless otherwise stated in the following information in this privacy policy, the processing of your data and its disclosure to third parties is limited to the data that is necessary and appropriate for answering your inquiries and/or fulfilling the contract concluded between you and us, safeguarding our rights, as well as fulfilling legal obligations. We will inform you about the data required for this purpose before or during the data collection process. If we use third-party providers to provide our services, the data protection notices of the respective third-party providers apply.

Types of data processed:

• Inventory data (e.g., names, addresses)
• Payment data (e.g., bank details, invoices)
• Contact data (e.g., email address, telephone number, postal address)
• Contract data (e.g., contract subject, contract duration)

Persons affected: Customers, prospective customers, business and contractual partners

Purpose of processing: Processing of contractual services, communication, and response to contact inquiries, office and organizational procedures

Legal basis: Fulfillment of the contract and pre-contractual inquiries, Art. 6(1)(b) GDPR; legal obligation, Art. 6(1)(c) GDPR; legitimate interest, Art. 6(1)(f) GDPR

Processing of Your Data in the Context of Educational and Training Services Provided by Us

If you participate in our educational and training services or are interested in our services, the type, scope, and purpose of the processing of your data depend on the contractual or pre-contractual relationships existing between us. In this sense, the data processed by us includes all the data that is provided or has been provided by you for the purpose of using the contractual or pre-contractual services and that is necessary for processing your request or the contract concluded between us. This includes performance evaluation and the evaluation of our services and teaching staff. Unless otherwise stated in the following information in this privacy policy, the processing of your data and its disclosure to third parties is limited to the data that is necessary and appropriate for answering your inquiries and/or fulfilling the contract concluded between you and us, safeguarding our rights, as well as fulfilling legal obligations. We will inform you about the data required for this purpose before or during the data collection process. If we use third-party providers to provide our services, the data protection notices of the respective third-party providers apply.

Special Categories of Data

If you participate in our training and educational services or make an inquiry because you are interested in the training and educational services we offer, so-called special categories of data may also be affected by the data processing. These may include information about your health, as well as information from which your political opinions or religious or philosophical beliefs may emerge (Art. 9(1) GDPR). We process this data exclusively for training services, to protect your health, social protection, or your vital interests. If we need the aforementioned information for purposes other than those mentioned above, we will inform you in detail before processing this data and subsequently obtain your express consent.

If it is necessary to fulfill the contract concluded between us, for training services, to protect your health, social protection, or your vital interests, we may also disclose your data to third parties, such as authorities or tax consultants.

Types of data processed:

• Inventory data (e.g., names, addresses)
• Payment data (e.g., bank details, invoices)
• Contact data (e.g., email address, telephone number, postal address)
• Contract data (e.g., contract subject, contract duration)

Special categories of personal data:

• Health data
• Data revealing religious or political beliefs

Persons affected: Students, apprentices, students, prospective customers, business and contractual partners

Purpose of processing: Processing of contractual services, communication, and response to contact inquiries, office and organizational procedures

Legal basis: Fulfillment of the contract and pre-contractual inquiries, Art. 6(1)(b) GDPR; legal obligation, Art. 6(1)(c) GDPR; legitimate interest, Art. 6(1)(f) GDPR

Your Rights under the GDPR

Under the GDPR, you have the following rights, which you can exercise at any time by contacting the data controller mentioned in section 1 of this privacy policy:

• Right to information: You have the right to request information from us about whether and which data we process about you.
• Right to rectification: You have the right to request the correction of incorrect or completion of incomplete data.
• Right to erasure: You have the right to request the erasure of your data.
• Right to restriction: In certain cases, you have the right to request that we only process your data to a limited extent.
• Right to data portability: You have the right to request that we transfer your data to yourself or to another controller in a structured, commonly used, and machine-readable format.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is the one at your usual place of residence, your place of work, or our company headquarters.

Right of withdrawal

You have the right to withdraw your consent to the processing of your data at any time.

Right to object

You have the right to object at any time to the processing of your data based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. If you exercise your right to object, we ask you to explain the reasons. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms.

Regardless of the above, you have the right to object to the processing of your personal data for the purposes of advertising and data analysis at any time.

Please direct your objection to the contact address of the data controller mentioned above.

When do we delete your data?

We delete your data when we no longer need it or when you instruct us to do so. This means that - unless otherwise stated in the individual data protection information in this privacy policy - we delete your data,

• when the purpose of data processing no longer exists and the respective legal basis mentioned in the individual data protection information no longer applies, for example,
  • after termination of the existing contractual or membership relationship between us (Art. 6(1)(a) GDPR) or
  • after our legitimate interest in further processing or storage of your data ceases to exist (Art. 6(1)(f) GDPR),
• when you exercise your right of withdrawal and no other legal basis for processing within the meaning of Art. 6(1)(b-f) GDPR applies,
• when you exercise your right to object and there are no compelling legitimate grounds for processing that override your interests.

However, if we still need to retain (certain parts of) your data for other purposes because, for example, statutory retention periods (usually 6 years for business correspondence or 10 years for booking documents) or the assertion, exercise, or defense of legal claims from contractual relationships (up to four years) require this, or if the data is needed to protect the rights of another natural or legal person, we will only delete (part of) your data after these periods have expired. Until these periods have expired, we restrict the processing of this data to these purposes (fulfillment of retention obligations).

Webhosting

We use a provider to host our website, on whose server our website is stored and made available on the Internet (hosting). In this process, the provider may process all data that arises when you use our website and is transmitted via the browser you are using. This includes, in particular, your IP address, which the provider needs to deliver our online offer to the browser you are using, as well as any entries you make via our website. Additionally, the provider we use may collect the following information:

• Date and time of access to our website
• Time zone difference to Greenwich Mean Time (GMT)
• Access status (HTTP status)
• Amount of data transferred
• Internet service provider of the accessing system
• Type of browser and its version
• Operating system used
• Website from which you may have accessed our website
• Pages or sub-pages you visit on our website

The above data is stored as log files on the servers of our hosting provider. This is necessary to ensure the stability and security of the operation of our website.

Email Communication: In addition to hosting our website, we have also commissioned our hosting provider to send, receive, and store our emails. For this purpose, our hosting provider processes the email addresses of senders and recipients, as well as other data that arises during email communication (metadata such as time, IP address) and the content of the respective emails. We would like to point out that emails are generally sent without encryption. Therefore, we assume no responsibility for the transmission of emails between the sender and receipt on our server.

Data affected:

• Content data (e.g., posts, photos, videos)
• Usage data (e.g., access times, visited web pages)
• Communication data (e.g., information about the device used, IP address)

Persons affected: Users of our website

Purpose of processing: Provision of our web pages, ensuring the operation of our web pages

Legal basis: Legitimate interest, Art. 6(1)(f) GDPR

Web hosting providers we use:

DOMAINFACTORY

Service provider: DomainFactory GmbH; c/o WeWork; Neuturmstrasse 5, 80331 Munich, Germany
Website: https://www.df.eu//
Privacy policy: https://www.df.eu/de/datenschutz/

Contact

If you contact us by email, social media, telephone, fax, post, our contact form, or any other means and provide us with personal data such as your name, telephone number, or email address, or provide additional information about yourself or your request, we will process this data to respond to your inquiry within the scope of our pre-contractual or contractual relationship.

Data affected:

• Master data (e.g., names, addresses)
• Contact data (e.g., email address, telephone number, postal address)
• Content data (e.g., texts, photos, videos)
• Contract data (e.g., subject matter of the contract, duration of the contract)

Persons affected: Prospects, customers, business and contractual partners

Purpose of processing: Communication and response to contact inquiries, office and organizational procedures

Legal basis: Contract fulfillment and pre-contractual inquiries, Art. 6(1)(b) GDPR, legitimate interest, Art. 6(1)(f) GDPR

Handling of Your Data in the Application Process

If you apply to us, we process the personal data you transmit to us in the application process, such as your name, address, place of residence, age, application photo, email, and telephone number, as well as your professional career including schools, education, and studies. If you send the data by email or via a contact form on our online presence, the processing is done electronically. If you send your application via the contact form, the transmission of your data is encrypted according to the state of the art. However, please note that the transmission of data by email usually takes place without encryption. If an employment contract is concluded after the application process, we store your data for the purpose of processing the employment relationship in compliance with legal regulations.

Data affected:

• Master data (e.g., names, addresses)
• Payment data (e.g., bank details, invoices)
• Contact data (e.g., email address, telephone number, postal address)
• Contract data (e.g., subject matter of the contract, duration of the contract)

Persons affected: Applicants

Purpose of processing: Processing of the application process

Legal basis: Contract fulfillment and pre-contractual inquiries, Art. 6(1)(b) GDPR, legal obligation, Art. 6(1)(c) GDPR

Deletion: If an employment contract is not concluded, your data will be deleted after the completion of the application process or at the latest 2 months after its completion. This does not apply if legal provisions prevent deletion or if further storage of your data is necessary for evidentiary purposes, for example, in proceedings under the General Equal Treatment Act (AGG). The application process is considered completed when the rejection is sent to you.

Email, Postal, and Telephone Advertising

For our advertising communication via email, postal mail, or telephone, we process personal data. You can object to receiving our advertising measures at any time or revoke the previously given consent to receive our advertising communication at any time. In order to be able to prove, in case of doubt, that your consent was given, we may store your data for up to 4 years after your objection/revocation. We no longer use your data for further purposes after your objection/revocation. If you want us to delete your data earlier, we will do so after you have confirmed that you originally gave us your consent.

Data affected:

• Contact data (e.g., email, telephone number, postal address)
• Master data (e.g., names, addresses)

Persons affected: Communication partners

Purpose of processing: Direct advertising measures (marketing) via email, postal mail, or telephone

Legal basis: Consent, Art. 6(1)(a) GDPR, legitimate interest, Art. 6(1)(f) GDPR

Web Analytics and Statistics

To track visitor flows on our website and analyze them statistically, we use web analytics services. Such services collect data about the website from which you accessed our website (referrer), the pages of our website you accessed, the duration of your visit to our pages, and the interactions you made there. In addition, data about the browser, computer system, and device type you used may be collected. Furthermore, demographic information such as age or gender may be collected as pseudonymous values through such a service. If you have consented to the collection of your location data, depending on the provider, this data can also be processed.

In order to collect and store this data, the web analytics service we use places a cookie on the device you use, which also collects your associated IP address. However, this IP address is shortened using a method called IP masking, so that it can no longer be associated with your visit to our website. No clear data such as names or email addresses are stored by either us or the analytics service provider. Neither we nor the analytics service provider know the identity of visitors to our website.

Please note that depending on the country of residence of the service provider mentioned below, the data collected through the service may be transferred and processed outside the European Union. In this case, there is a risk that the level of data protection prescribed by the GDPR will not be met and that the enforcement of your rights may not or only be possible with difficulty.

Data affected:

• Usage data (e.g., access times, visited web pages)
• Communication data (e.g., information about the device used, IP address)

Persons affected: Users of our online offerings

Purpose of processing: Reach measurement, campaign success monitoring, remarketing, as well as interest- and behavior-based marketing

Legal basis: If we have asked for your consent before using the respective service, this constitutes the legal basis, Art. 6(1)(a) GDPR. Otherwise, we use the respective service based on our legitimate interest to analyze the visitor flows on our website in order to continuously improve the functions, offers, and user experience, Art. 6(1)(f) GDPR.

We use the following web analytics services:

Our Online Presence on Social Networks

We maintain online presences on the social networks listed below. When you visit one of these presences, the respective provider collects and processes the data listed in more detail below. Usually, this data is collected for advertising and market research purposes and is used to create usage profiles. Data can be stored in the usage profiles regardless of the device you are using. This is particularly the case if you are a member of the respective platform and are logged in there. The usage profiles can be used by the providers to display personalized advertising to you. You have the right to object to the creation of user profiles. To exercise this right, you must contact the respective provider.

If you have an account with one of the providers listed below and are logged in when you visit our website, the respective provider may collect data about your usage behavior on our website. To prevent such linking of your data, you can log out of the provider's service before visiting our site.

You can find the purpose and scope of data collection by the provider as well as further information in the provider's privacy policies linked below.

Please note that depending on the country of residence of the provider listed below, the data collected through their platform may be transferred and processed outside the European Union. In this case, there is a risk that the level of data protection prescribed by the GDPR will not be met and that the enforcement of your rights may not or only be possible with difficulty.

Data affected:

• Master data and contact details (e.g., name, address, telephone number, email address)
• Content data (e.g., posts, photos, videos)
• Usage data (e.g., access times, visited web pages)
• Communication data (e.g., information about the device used, IP address).

Purpose of processing: Communication and marketing, tracking and analyzing user behavior

Legal basis: Consent, Art. 6(1)(a) GDPR, legitimate interest, Art. 6(1)(f) GDPR

Options for objection: Please refer to the respective provider's information linked below for options for objection (opt-out).

We have online presences on the following social networks:

Facebook

Service provider: Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA
EU headquarters: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Website: https://www.facebook.com/
Privacy policy: https://www.facebook.com/about/privacy/
Privacy policy for Facebook Pages: https://www.facebook.com/legal/terms/information_about_page_insights_data

Instagram

Service provider: Instagram Inc., 1601 Willow Road, Menlo Park CA 94025, USA
Parent company: Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA
EU headquarters: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
Website: https://www.instagram.com/
Privacy policy: http://instagram.com/about/legal/privacy

LinkedIn

Service provider: LinkedIn Corporation, 1000 W Maude, Sunnyvale, CA 94085, USA
Location in Germany: LinkedIn, Hofstatt 4th Floor, Sendlinger Str. 12, 80331 Munich
Website: https://www.linkedin.com/?trk=nav_logo
Privacy policy: https://www.linkedin.com/legal/privacy-policy?trk=uno-reg-guest-home-privacy-policy

Twitter

Service provider: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA
Website: https://twitter.com/?lang=de
Privacy policy: https://twitter.com/de/privacy

WhatsApp

Service provider: WhatsApp Inc., 1601 Willow Road Menlo Park, California 94025, USA
EU headquarters: Whatsapp Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Parent company: Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA
Website: https://www.whatsapp.com/
Privacy policy: https://www.whatsapp.com/legal/?eea=1#privacy-policy

Online Meetings, Video Conferences, and Screen Sharing

We use third-party services to enable online meetings, video and/or audio conferences, as well as online seminars with employees, interested parties, or customers. When you communicate with us via such a service, the data collected in this communication process is processed both by us and by the third-party provider. The data that may arise in such a communication process includes, in particular, your registration and contact data, contributions in the chat window, your video and audio contributions, and shared screen content. The data processed by the third-party provider we use primarily includes user data and metadata (e.g., IP address, computer system information). The third-party providers usually process this data to check and ensure the security of the service. Furthermore, insights from the data processing are intended to be used to optimize the third-party provider's service and carry out corresponding marketing measures. Please note the privacy policies of the respective third-party provider regarding this matter.

Please note that depending on the country of residence of the service provider mentioned below, the data collected through their service may be transferred and processed outside the European Union. In this case, there is a risk that the level of data protection prescribed by the GDPR will not be met and that the enforcement of your rights may not or only be possible with difficulty.

Data affected:

• Master data (e.g., names, addresses)
• Contact information (e.g., email address, telephone number)
• Shared content (e.g., photos, videos, texts, audio recordings)
• User data (e.g., access times, visited web pages, interest in content)
• Meta and communication data (e.g., IP address, computer system information)

Affected individuals: Prospects, customers, communication partners

Purpose of processing: Processing of contact inquiries, internal and external communication with employees as well as interested parties and customers, fulfillment of our contractual services, service offering

Legal basis: Consent, Art. 6(1)(a) GDPR, contract performance and pre-contractual inquiries, Art. 6(1)(b) GDPR, legitimate interest, Art. 6(1)(f) GDPR

Services we use:

Skype

Offered services: Instant messaging, video conferencing, voice conferencing
Service provider: Skype Communications SARL, 23-29 Rives de Clausen, L-2165 Luxembourg, Luxembourg
Parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA
Website: https://www.skype.com/de/
Privacy policy: https://privacy.microsoft.com/de-de/privacystatement

Twitch

Offered services: Live streaming, chat
Service provider: Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA
Website: https://www.twitch.tv/
Privacy policy: https://www.twitch.tv/p/de-de/legal/privacy-notice/

Zoom

Offered services: Video conferencing, voice conferencing, chat
Service provider: Zoom Video Communications, Inc., 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA
Website: https://zoom.us/de-de/meetings.html
Privacy policy: https://zoom.us/de-de/privacy.html

Content Services

We use certain services to display specific content or graphics (videos, images, music, fonts, maps) on our website. The services we use process the IP address assigned to you at the time of your visit to our website in order to display the respective content in the browser you are using. In addition, the providers of these services may set additional cookies on your device to collect information about your usage behavior, interests, the device and browser you are using, as well as the timing and duration of your session. These data are regularly used by the providers for analysis, statistics, and marketing purposes. Furthermore, this information may be combined with information from other sources, especially if you have an account with the service provider and are logged in during your visit to our website.

Please note that depending on the country of residence of the service provider mentioned below, the data mentioned in more detail below may be transferred and processed on servers outside the European Union. In this case, there is a risk that the level of data protection prescribed by the GDPR will not be complied with and that the enforcement of your rights may be difficult or impossible.

Data affected:

• Usage data (e.g., access times, visited web pages)
• Communication data (e.g., information about the device used, IP address)

Affected individuals: Users of our website

Purpose of processing: Displaying our website, offering content, ensuring the operation of our website

Legal basis: Consent via cookie consent banner, Art. 6(1)(a) GDPR, legitimate interests, Art. 6(1)(f) GDPR

We use the following content services:

Google Maps

We use Google Maps on our website. Google collects and processes the visitor's IP address. When you visit a website that includes Google Maps, your IP address and, if applicable, your location data (usually not without your consent) are transmitted to Google, regardless of whether you actually use Google Maps or are logged into your Google Account. Your IP address is associated with your Google Account if you are logged in to it during your visit to our website.

Service provider: Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
EU headquarters: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Website: https://www.google.de/maps
Privacy policy: https://policies.google.com/privacy
Opt-out option: https://tools.google.com/dlpage/gaoptout?hl=de

Google Web Fonts

We use Google Web Fonts to integrate fonts (web fonts) into the design of our website and to display them correctly in your browser when you visit our website. The integration of these web fonts is done by making a server call to Google. The fonts are compressed by Google and then sent to your browser, where they are unpacked. The server is usually located in the United States. When you visit one of our pages that includes Google Fonts, Google is informed about which of our web pages you have visited.

Service provider: Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
EU headquarters: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Website: https://fonts.google.com/
Privacy policy: https://policies.google.com/privacy

Soundcloud

We use Soundcloud on this website. Soundcloud is an online music service where we store and play our podcasts. The podcasts are uploaded to Soundcloud's servers and then embedded and offered on our website using a "widget," a control element. When a podcast is accessed, Soundcloud receives information about which podcast it is and how long it has been listened to. Soundcloud sets a cookie for this purpose. The cookie is used to create pseudonymous usage profiles that we use to analyze user behavior and optimize our website. Soundcloud collects listening information and associates it with your Soundcloud account if you are logged in to Soundcloud during your visit to our website.

Service provider: SoundCloud Limited, Rheinsberger Str. 76/77, 10115 Berlin, Germany
Website: https://soundcloud.com/
Privacy policy: https://soundcloud.com/pages/privacy

Vimeo

We use components from Vimeo on this website to embed videos that can be played through your internet browser when you visit our website. This process requires Vimeo to process your IP address, as the content cannot be sent to the browser without it. Vimeo recognizes when you visit one of our pages that includes an embedded Vimeo video, even if you do not click on the Vimeo video or are not logged in to Vimeo. This information is transmitted to Vimeo and is associated with your Vimeo account.

Service provider: Vimeo LLC, 555 West 18th Street, New York 10011, USA
Website: https://vimeo.com/de/
Privacy policy: https://vimeo.com/privacy

YouTube

We use components from YouTube on this website to embed videos that can be played through your internet browser when you visit our website. During your visit to our website, both YouTube and Google are informed about which page or subpage you accessed by transmitting your IP address to Google's external servers in the USA. This information is transmitted regardless of whether the displayed videos are actually viewed or clicked on, or whether you are logged in to your YouTube or Google Account. This information is collected and associated with your Google Account if you are logged in to it when you visit our website.

Service provider: YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA
Website: https://www.youtube.com/
Privacy policy: https://policies.google.com/privacy
Opt-out option: https://tools.google.com/dlpage/gaoptout?hl=de

Security Measures

We implement technical and organizational security measures in accordance with the state of the art to comply with the provisions of data protection laws and to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties.

Up-to-Dateness and Amendment of this Privacy Policy

This privacy policy is currently valid and has the status of February 2021. Due to changed legal or official requirements, it may become necessary to amend this privacy policy.

This privacy policy was created with the assistance of the privacy policy generator from SOS Recht. SOS Recht is a service provided by Mueller.legal Rechtsanwälte Partnerschaft based in Berlin.