Datenschutzerklärung

Terminology Used

"Personal data" refers to any information that relates to an identified or identifiable natural person (hereinafter referred to as the "data subject"); a natural person is considered identifiable if they can be directly or indirectly identified, in particular by association with an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or one or more specific characteristics that express the physical, physiological, genetic, psychological, economic, cultural, or social identity of that natural person.

"Processing" refers to any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data.

"Pseudonymization" refers to the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures that ensure the personal data cannot be assigned to an identified or identifiable natural person.

"Profiling" refers to any type of automated processing of personal data that involves using the data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

The term "Controller" refers to the natural or legal person, public authority, agency, or other body that alone or jointly with others determines the purposes and means of processing personal data.

"Processor" refers to a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.

Relevant Legal Bases

In accordance with Article 13 GDPR, we inform you of the legal bases for our data processing activities. For users within the scope of the General Data Protection Regulation (GDPR), i.e., the EU and the EEA, the following applies unless the legal basis is specifically stated in this Privacy Policy:

The legal basis for obtaining consent is Article 6(1)(a) and Article 7 GDPR;
The legal basis for processing to fulfill our services and carry out contractual measures as well as responding to inquiries is Article 6(1)(b) GDPR;
The legal basis for processing to fulfill our legal obligations is Article 6(1)(c) GDPR;
In the event that vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) GDPR serves as the legal basis.
The legal basis for processing required to perform a task carried out in the public interest or in the exercise of official authority vested in the controller is Article 6(1)(e) GDPR.
The legal basis for processing to safeguard our legitimate interests is Article 6(1)(f) GDPR.
Processing of data for purposes other than those for which they were collected is determined in accordance with Article 6(4) GDPR.
The processing of special categories of data (in accordance with Article 9(1) GDPR) is determined in accordance with Article 9(2) GDPR.

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, implementation costs, the nature, scope, circumstances, and purposes of the processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons, to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical access to the data, as well as access, input, transmission, availability, and separation of the data itself. Furthermore, we have established procedures to ensure the exercise of data subjects' rights, the deletion of data, and responses to data breaches. Additionally, we consider the protection of personal data already during the development or selection of hardware, software, and processes, in accordance with the principle of data protection by design and by default.

Collaboration with Processors, Joint Controllers, and Third Parties

If we disclose, transmit, or otherwise grant access to data to other individuals and companies (processors, joint controllers, or third parties) in the course of our processing, this will only be done on the basis of a legal permission (e.g., if the transmission of data to third parties, such as payment service providers, is necessary for contract fulfillment), if users have consented, if a legal obligation provides for it, or on the basis of our legitimate interests (e.g., when using agents, web hosts, etc.).

If we disclose, transmit, or otherwise grant access to data to other companies within our corporate group, this is done for administrative purposes based on our legitimate interests and, additionally, on a legally compliant basis.

Transfers to Third Countries

If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA), or the Swiss Confederation) or this is done in the context of using third-party services or disclosure or transmission of data to other individuals or companies, this will only occur if it is necessary to fulfill our (pre-)contractual obligations, based on your consent, due to a legal obligation, or on the basis of our legitimate interests.

Subject to legal or contractual permissions, we process or allow data to be processed in a third country only if the legal requirements are met. That is, processing occurs, for example, on the basis of special guarantees, such as an officially recognized level of data protection equivalent to that of the EU, or compliance with officially recognized specific contractual obligations.