Privacy Policy

Introduction and overview

We have prepared this privacy policy (version 29.09.2022-112174282) to comply with the requirements of General Data Protection Regulation (EU) 2016/679 and to explain applicable national laws regarding which personal data (in short, data) we – and the order processors commissioned by us (e.g., providers) – will process in the future, and what lawful options you have. The terms used are to be understood to be gender-neutral.
In short: We inform you comprehensively about the data we process about you.

Data privacy statements usually sound very technical and use legal jargon. This privacy policy, however, aims to describe the most important things as simply and transparently as possible. Where it is beneficial for transparency, technical Terms explained in a reader-friendly way, Offers links to further information and Graphics We are informing you in clear and simple language that within the framework of our business activities, we only process personal data when a corresponding legal basis exists. That is certainly not possible when you provide as concise, unclear and legally technical explanations as is often the standard on the internet when it comes to data protection. I hope you find the following explanations interesting and informative, and perhaps some of the information will be of use to you that you did not know before.
If you still have questions, we kindly ask you to contact the responsible party mentioned below or in the legal notice, follow the available links and look for further information on third-party websites. Our contact details are of course also included in the legal notice.

Scope of application

This privacy policy applies to all personal data processed by us within the company and to all personal data processed by companies commissioned by us (processors). By personal data we mean information within the meaning of Article 4(1) GDPR such as a person’s name, email address and postal address. The processing of personal data ensures that we can offer and bill for our services and products, whether online or offline. The scope of this privacy policy includes:

• all online platforms (websites, online shops) that we operate
• Social Media Appearances and Email Communication
• Mobile apps for smartphones and other devices

In short: The privacy policy applies to all areas where personal data is structuredly processed within the company via the aforementioned channels. Should we enter into legal relations with you outside of these channels, we will inform you separately if necessary.

Legal basis

In the following privacy policy, we provide you with transparent information about the legal principles and regulations, i.e., the legal bases of the General Data Protection Regulation, which allow us to process personal data.
As far as EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can of course view this EU Data Protection Basic Regulation online at EUR-Lex, the access point to EU law, under https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679 Read on.

We process your data only if at least one of the following conditions applies:

1. Consent (Article 6 paragraph 1 letter a GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of your entered data in a contact form.
2. Contract (Article 6 paragraph 1 letter b GDPR): To fulfill a contract or pre-contractual obligations with you, we process your data. For example, if we conclude a purchase contract with you, we need personal information in advance.
3. Legal obligation (Article 6 paragraph 1 letter c GDPR): When we are subject to a legal obligation, we process your data. For example, we are legally obliged to cancel invoices for accounting purposes. These usually contain personal data.
4. Legitimate interests (Article 6 paragraph 1 letter f GDPR): In the event of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data in order to operate our website securely and economically efficiently. This processing is therefore a legitimate interest.

Further conditions such as the perception of recordings in the public interest and the exercise of public authority, as well as the protection of vital interests, generally do not apply to us. Where such a legal basis should be relevant, it will be indicated in the appropriate place.

In addition to the EU regulation, there are also national laws:

• In Austria is this the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data protection law), shortly DSG.
• In Germany does that apply Federal Data Protection Act, shortly BDSG.

If any additional regional or national laws apply, we will inform you about this in the following sections.

Contact details of the responsible person

If you have any questions about data protection or the processing of personal data, you can find the contact details of the responsible person or body below:
Judith Weberstorfer
Mitterndorf 2
A-4801 Traunkirchen
Authorized representative: Judith Weberstorfer
Email: office@inve.at
Phone: +43(0)7617 20013
Imprint: https://www.inve.at/?page_id=208

Storage duration

The fact that we store personal data only for as long as is absolutely necessary for the provision of our services and products is considered a general criterion with us. This means that we delete personal data as soon as the reason for the data processing no longer exists. In some cases, we are legally obliged to store certain data even after the original purpose has ceased to exist, for example for accounting purposes.

If you wish to have your data deleted or revoke your consent to data processing, the data will be deleted as quickly as possible and unless there is a legal obligation to retain it.

We will inform you about the specific duration of the respective data processing further down if we have further information on this matter.

Rights under the General Data Protection Regulation

In accordance with Article 13, 14 GDPR, we inform you about the following rights that you are entitled to, so that data processing can take place in a fair and transparent manner:

• According to Article 15 of the GDPR, you have the right to request information about whether we process data about you. If this applies, you are entitled to receive a copy of the data and the following information:
  • for what purpose we process the data;
  • the categories, i.e. the types of data that are processed;
  • who receives this data and when the data is transferred to third countries; how the security can be guaranteed;
  • how long the data will be stored;
  • the existence of the right to rectification, deletion or restriction of processing and the right to object to processing;
  • that you can complain to a supervisory authority (links to these authorities can be found below);
  • the origin of the data, if we did not collect it from you;
  • whether profiling is carried out, that is, whether data is automatically analyzed to create a personal profile of you.
• According to Article 16 of the GDPR, you have the right to have your data corrected, which means that we must correct the data if you find errors.
• According to Article 17 of the GDPR, you have the right to erasure („right to be forgotten“), which means that you may request the deletion of your data.
• According to Article 18 of the GDPR, you have the right to restrict the processing, which means that we are only allowed to store the data but not to use it further.
• According to Article 20 of the GDPR, you have the right to data portability, which means that we will provide you with your data in a commonly used format upon request.
• According to Article 21 of the GDPR, you have the right to object, which, if exercised, entails a change to the processing.
  • If the processing of your data is based on Article 6(1)(e) (public interest, exercise of public authority) or Article 6(1)(f) (legitimate interest), you may object to the processing. We will then examine as quickly as possible whether we can comply with this objection legally.
  • If data is used to conduct direct marketing, you can object to this type of data processing at any time. We may no longer use your data for direct marketing thereafter.
  • If data is used to conduct profiling, you can object to this type of data processing at any time. We may no longer use your data for profiling thereafter.
• According to Article 22 of the GDPR, you may have the right not to be subject to a decision based solely on automated processing (for example, profiling).
• According to Article 77 of the GDPR, you have the right to file a complaint. This means that you can file a complaint with the data protection authority at any time if you believe that the processing of personal data violates the GDPR.

In short: You have rights – do not hesitate to contact the responsible body listed above with your questions!

If you believe that the processing of your data violates data protection law or that your data protection rights have otherwise been violated, you can file a complaint with the supervisory authority. This is the data protection authority for Austria, whose website you can find at https://www.dsb.gv.at/ Find it. In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Information Freedom (BfDI) For our company, the following local data protection authority is responsible:

Austrian Data Protection Authority

Manager: Mag. Dr. Andrea Jelinek
Address: Barichgasse 40-42, 1030 Vienna
Phone number: +43 1 52 152-0
Email address: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

Data transmission to third countries

We only transfer or process data to countries outside the EU (third countries) if you agree to this processing, if it is legally required or necessary under contract, and in any case only to the extent that is generally permitted. In most cases, your consent is the most important reason why we process data in third countries. Processing personal data in third countries such as the USA, where many software manufacturers offer services and have their server locations, can mean that personal data is processed and stored in unexpected ways.

We explicitly point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. The processing of data by US services (such as Google Analytics) may mean that data may not be processed and stored in an anonymous manner where applicable. Furthermore, US government authorities may have access to individual data. In addition, it may be the case that collected data is linked with data from other services of the same provider, provided that you have a corresponding user account. Where possible, we strive to use server locations within the EU, if this is offered.

We inform you, in the appropriate places in this privacy policy, more specifically about data transmission to third countries, if applicable.

Communication

Communication Summary 👥 Affected: Everyone who communicates with us by phone, email or online form 📓 Processed data: e.g. phone number, name, email address, entered form data. More details can be found for each contact method used. 🤝 Purpose: Managing communication with customers, business partners, etc. 📅 Duration: Duration of the business case and legal regulations ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (legitimate interests)

When you contact us by phone, email or online form, personal data may be processed.

The data is processed for the processing and handling of your question and the related business transaction. The data is stored for as long as required by law.

Affected persons

All of the aforementioned processes are affected by those who seek contact with us via the communication channels provided by us.

Phone

When you call us, the call data is stored pseudonymously on the respective end device and with the telecommunications provider used. In addition, data such as name and phone number can be sent by email afterwards and stored for answering the request. The data is deleted as soon as the business case has ended and legal requirements allow.

Email

If you communicate with us via email, data will be stored on the respective end device (computer, laptop, smartphone, etc.) and data will be stored on the email server. The data will be deleted as soon as the business case has been completed and if the legal requirements allow it.

Online forms

When you communicate with us using an online form, data is stored on our web server and, if necessary, forwarded to an email address provided by us. The data will be deleted as soon as the business case has been completed and if legal requirements allow.

Legal basis

The processing of data is based on the following legal bases:

• Art. 6(1)(a) GDPR (Consent): You give us your consent to store your data and use it for business-related purposes;
• Art. 6(1)(b) GDPR (Contract): There is a need to fulfill a contract with you or with a processor such as the telephone provider, or we need to process the data for pre-contractual activities, such as preparing an offer;
• Art. 6(1)(f) GDPR (Legitimate interests): We want to conduct customer inquiries and business communications in a professional manner. To do this, certain technical facilities such as email programs, exchange servers, and mobile operators are necessary to enable efficient communication.

Contractual processing agreement (AVV)

In this section, we would like to explain what an order processing agreement is and why it is needed. Because the word “order processing agreement” is a bit of a mouthful, we will also often use the acronym “AVV” in the text. Like most companies, we do not work alone; we also use the services of other companies or individuals for processing purposes. By including various companies or service providers, we may need to share personal data for processing. These partners then act as order processors with whom we enter into a contract, the so-called order processing agreement (AVV). The most important thing for you to know is that the processing of your personal data takes place exclusively in accordance with our instructions and must be governed by the AVV.

Who are the contract processors?

We are responsible as a company and website owner for all the data we process from you. In addition to the responsible parties, there may also be so-called order processors. This includes any company or person who processes personal data on our behalf. To be more precise, and according to the GDPR definition, any natural or legal person, authority, institution or other body that processes personal data on our behalf is considered an order processor. Order processors can therefore be service providers such as hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

For better understanding of the terminology used here, here is an overview of the three roles in the GDPR:

Affected person (You as a customer or interested party) → Responsible (us as a company and client) → Contracting processor (Service providers such as web hosts or cloud providers)

Content of a contract for the processing of orders

As mentioned above, we have concluded a DPA with our partners who act as processors. This agreement stipulates, first and foremost, that the processor processes the data to be processed exclusively in accordance with the GDPR. The contract must be concluded in writing, however, in this context, electronic contract conclusion also qualifies as „written“. Only on the basis of the contract does the processing of personal data take place. The contract must contain the following:

• Commitment to us as the responsible party
• Responsibilities and rights of the responsible party
• Categories of affected persons
• Type of personal data
• Nature and purpose of data processing
• Object and duration of data processing
• Place of data processing

Furthermore, the contract contains all the obligations of the order processor. The most important obligations are:

• Measures to ensure data security
• to take possible technical and organizational measures to protect the rights of the person concerned
• to maintain a data processing directory
• to cooperate with the data protection supervisory authority upon its request
• to carry out a risk analysis regarding the personal data obtained
• Sub-contractors may only be commissioned with written permission from the responsible party.

You can find out, for example, what a typical AVV looks like at https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-mustervertrag-auftragsverarbeitung.html view. A sample contract is presented here.

Cookies

Cookies Summary 👥 Affected: Website visitors 🤝 Purpose: Depending on the specific cookie. For more details, see below or the manufacturer of the software that sets the cookie. 📓 Processed data: Depending on the cookie used. For more details, see below or the manufacturer of the software that sets the cookie. 📅 Storage duration: depending on the specific cookie, it can vary from hours to years ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What are cookies?

Our website uses HTTP cookies to store user-specific data.
Below, we explain what cookies are and why they are used, so that you can better understand the following privacy policy.

Whenever you browse the Internet, you use a browser. Popular browsers include Chrome, Safari, Firefox, Internet Explorer, and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.

One thing is undeniable: Cookies are really useful helpers. Almost all websites use cookies. More specifically, they are HTTP cookies, as there are also other cookies for other applications. HTTP cookies are small files that are stored on your computer by our website. These cookie files are automatically placed in the cookie folder, which is practically your browser’s “brain”. A cookie consists of a name and a value. When defining a cookie, one or more attributes must also be specified.

Cookies store certain user data about you, such as language or personal page settings. When you return to our site, your browser sends the „user-related“ information back to our site. Thanks to the cookies, our website knows who you are and offers you the settings you are accustomed to. In some browsers, each cookie has its own file; in others, such as Firefox, all cookies are stored in a single file.

The following graphic shows a possible interaction between a web browser such as Chrome and the web server. In this case, the web browser requests a website and receives a cookie from the server, which the browser uses again when another page is requested.

There are both first-party cookies and third-party cookies. First-party cookies are created directly by our site, while third-party cookies are created by partner websites (e.g., Google Analytics). Each cookie is unique and must be evaluated individually; each cookie stores different data. The expiration time of a cookie also varies from a few minutes to several years. Cookies are not software programs and do not contain viruses, Trojans, or other „malware.“ Cookies cannot also access information on your PC.

For example, cookie data can look like this:

Name: _ga
Value: GA1.2.1326744211.152112174282-9
Purpose of use: Distinguishing the website visitors
Expiration date: after 2 years

These minimum sizes should be supported by a browser:

• At least 4096 bytes per cookie
• At least 50 cookies per domain
• At least 3000 cookies in total

What types of cookies are there?

The question of which cookies we specifically use depends on the services used and is explained in the following sections of the privacy policy. At this point, we would like to briefly discuss the different types of HTTP cookies.

There are 4 types of cookies:

Indispensable cookies
These cookies are necessary to ensure basic functions of the website. For example, these cookies are needed when a user adds a product to the shopping cart, then navigates to other pages and only later goes to the checkout. These cookies do not delete the shopping cart, even if the user closes their browser window.

Appropriate cookies
These cookies collect information about the user's browsing behavior and whether the user receives any error messages. Additionally, these cookies also measure the loading time and the website's behavior across different browsers.

Targeted cookies
These cookies ensure better user-friendliness. For example, entered locations, font sizes, or form data are stored.

Advertising cookies
These cookies are also called targeting cookies. They are used to deliver individually tailored advertising to the user. This can be very convenient, but also very annoying.

Usually, when you visit a website for the first time, you are asked which of these cookie types you would like to allow. And of course, this decision is also stored in a cookie.

If you would like to learn more about cookies and are not afraid to read technical documentation, we recommend: https://datatracker.ietf.org/doc/html/rfc6265,The Request for Comments of the Internet Engineering Task Force (IETF) titled “HTTP State Management Mechanism”.

Purpose of processing via cookies

The purpose ultimately depends on the specific cookie. For more details, please see below or contact the manufacturer of the software that sets the cookie.

What data are processed?

Cookies are small helpers for many different tasks. Unfortunately, we cannot generalize about the data that is stored in cookies; however, we will inform you about the data that is processed or stored within the framework of the following privacy policy.

Duration of cookie storage

The storage duration depends on the specific cookie and is further specified. Some cookies are deleted after less than an hour, while others can remain stored on a computer for several years.

You also have influence over the storage duration yourself. You can manually delete all cookies via your browser at any time (see also below “Right to object”). Furthermore, cookies that are based on consent will be deleted at the latest after your consent is withdrawn, without affecting the legality of the storage until then.

Right to object – how can I delete cookies?

You decide yourself how and whether you want to use cookies. Regardless of which service or website the cookies come from, you always have the option to delete, disable, or only partially allow cookies. For example, you can block third-party cookies but allow all other cookies.

If you want to know which cookies have been stored in your browser when you change or delete cookie settings, you can find this in your browser settings:

Chrome: Delete, enable, and manage cookies in Chrome

Safari: Managing cookies and website data with Safari

Firefox: Delete cookies to remove data that websites have stored on your computer

Internet Explorer: Delete and manage cookies

Microsoft Edge: Delete and manage cookies

If you do not generally want to have cookies, you can set your browser to always notify you when a cookie is to be set. This way, you can decide for yourself whether to allow the cookie or not. The procedure varies depending on the browser. The best way is to search for the instructions in Google using the search term “clear cookies Chrome” or “disable cookies Chrome” in the case of a Chrome browser.

Legal basis

Since 2009, there have been the so-called „Cookie Guidelines“. These stipulate that the storage of cookies is permitted. Consent (Article 6(1)(a) GDPR) requested by you. However, within the EU countries there are still very different reactions to these guidelines. In Austria, however, the implementation of this guideline was carried out in § 96(3) of the Telecommunications Act (TKG). In Germany, the cookie guidelines were not implemented as national law. Instead, the implementation of this guideline was largely carried out in § 15(3) of the Telemedia Act (TMG).

For strictly necessary cookies, even if no consent is given, there are exceptions. legitimate interests (Article 6(1)(f) GDPR), which in most cases are of a commercial nature. We want to provide visitors to the website with a pleasant user experience, and for this purpose certain cookies are often absolutely necessary.

Unless strictly necessary cookies are used, this is only done with your consent. The legal basis in this regard is Article 6(1)(a) GDPR.

In the following sections you will be informed in more detail about the use of cookies, provided that software used uses cookies.

Web Analytics Introduction

Web Analytics Privacy Policy Summary 👥 Affected: Website visitors 🤝 Purpose: Analysis of visitor information to optimize the web offering. 📓 Processed Data: Access statistics that include data such as the locations of the accesses, device data, access duration and time, navigation behavior, click behavior, and IP addresses. For more details, please refer to the web analytics tool used. 📅 Storage duration: depends on the web analytics tool used ⚖️ Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is web analytics?

We use software on our website to analyze the behavior of website visitors, known as web analytics or web analysis. Data is collected and stored by the respective analytics tool provider (also known as a tracking tool). The data is used to create analyses of user behavior on our website and is provided to us as the website operator. In addition, most tools offer various testing options. For example, we can test which offers or content will best appeal to our visitors. To do this, we show you two different offers for a limited period of time. After the test (so-called A/B test), we know which product or content our website visitors find more interesting. For such testing methods, as well as for other analytics methods, user profiles can also be created and the data stored in cookies.

Why do we use web analytics?

With our website, we have a clear goal in mind: we want to provide the best web experience in the market for our industry. To achieve this goal, we want to offer the best and most interesting content on our website, while also ensuring that you feel completely comfortable on our website. With the help of web analytics tools, we can take a closer look at the behavior of our website visitors and then improve our web offerings accordingly for you and us. For example, we can see how old our visitors are on average, where they come from, when our website is most visited, or which content or products are particularly popular. All of this information helps us optimize the website and thus adapt it to your needs, interests, and preferences.

What data are processed?

The exact data that is stored depends, of course, on the analysis tools used. However, as a rule, it is stored, for example, which content you view on our website, which buttons or links you click, when you visit a page, what browser you use, with which device (PC, tablet, smartphone, etc.) you visit the website, or which computer system you use. If you agreed that location data may also be collected, these can also be processed by the web analytics tool provider.

In addition, your IP address is also stored. According to the General Data Protection Regulation (GDPR), IP addresses are personal data. However, your IP address is usually stored pseudonymously (i.e., in an unrecognizable and abbreviated form). For the purpose of testing, web analysis, and web optimization, no direct data such as your name, age, address, or email address is generally stored. All of this data is stored pseudonymously, so that you cannot be identified as a person.

The following example schematically shows how Google Analytics works as an example of client-based web tracking using Java script code.

How long the respective data is stored depends always on the provider. Some cookies store data only for a few minutes or until you leave the website, while other cookies can store data for several years.

Duration of data processing

We will inform you further down about the duration of data processing if we have further information on this. In general, we process personal data only for as long as is absolutely necessary for the provision of our services and products. If, as is the case, for example in the case of accounting, it is required by law, this storage period can also be exceeded.

Right of objection

You also have the right and the option at any time to revoke your consent to the use of cookies or third-party providers. This can be done either through our cookie management tool or through other opt-out functions. For example, you can also prevent the collection of data through cookies by managing, disabling, or deleting cookies in your browser.

Legal basis

The use of web analytics requires your consent, which we have obtained with our cookie pop-up. According to Art. 6(1)(a) GDPR (Consent) the legal basis for the processing of personal data, as may occur during collection by web analytics tools.

In addition to consent, we have a legitimate interest in analyzing the behavior of website visitors in order to improve our offering both technically and economically. Through web analytics, we identify errors on the website, can identify attacks, and can improve the profitability. The legal basis for this is Art. 6(1)(f) GDPR (Legitimate interests). We only use the tools, however, to the extent that they have given their consent.

Since web analytics tools use cookies, we also recommend that you read our general cookie policy. To learn exactly what data is stored and processed by the respective tools, you should read the privacy policies of those tools.

Information about specific web analytics tools can be found – if available – in the following sections.

Google Analytics Privacy Policy

Google Analytics Privacy Policy Summary 👥 Affected: Website visitors 🤝 Purpose: Analysis of visitor information to optimize the web offering. 📓 Processed Data: Access statistics that include data such as the locations of the accesses, device data, access duration and time, navigation behavior, click behavior, and IP addresses. For more details, see below in this privacy policy. 📅 Storage duration: depends on the properties used ⚖️ Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is Google Analytics?

We use the analysis tracking tool Google Analytics (GA) on our website from the American company Google Inc. For the European region, the company is Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland). Google Analytics collects data about your actions on our website. For example, if you click on a link, this action is stored in a cookie and sent to Google Analytics. Using the reports we receive from Google Analytics, we can better adapt our website and service to your needs. Below, we will go into more detail about the tracking tool and inform you, in particular, about what data is stored and how you can prevent it.

Google Analytics is a tracking tool that serves to analyze the traffic on our website. To make Google Analytics work, a tracking code is embedded in the code of our website. When you visit our website, this code records various actions you perform on our website. As soon as you leave our website, this data is sent to the Google Analytics servers and stored there.

Google processes the data and we receive reports about your usage behavior. These reports can include, among other things, the following:

• Target group reports: Through target group reports, we get to know our users better and learn more about who is interested in our service.
• Ad reports: Through ad reports, we can more easily analyze and improve our online advertising.
• Acquisition reports: Acquisition reports provide us with helpful information about how we can attract more people to our service.
• Behavioral reports: Here we learn how you interact with our website. We can track which path you take on our site and which links you click.
• Conversion reports: Conversion is the process by which you take a desired action based on a marketing message. For example, when you go from being a mere website visitor to a buyer or newsletter subscriber. With these reports, we learn more about how our marketing efforts are reaching you. This is our way to increase our conversion rate.
• Real-time reports: Here we always immediately learn what is happening on our website right now. For example, we see how many users are currently reading this text.

Why do we use Google Analytics on our website?

Our goal with this website is clear: we want to offer you the best possible service. The statistics and data from Google Analytics help us achieve this goal.

The statistically analyzed data provides us with a clear picture of the strengths and weaknesses of our website. On the one hand, we can optimize our site so that it is easier for interested people to find it on Google. On the other hand, the data help us better understand you as a visitor. This way, we know exactly what we need to improve on our website to provide you with the best possible service. The data also serve us to carry out our advertising and marketing efforts more individually and cost-effectively. After all, it only makes sense to show our products and services to people who are interested in them.

What data is stored by Google Analytics?

Google Analytics creates a random, unique ID using a tracking code that is linked to your browser cookie. This way, Google Analytics recognizes you as a new user. The next time you visit our site, you will be recognized as a „returning“ user. All collected data is stored together with this user ID. This is the only way to be able to evaluate pseudonymized user profiles at all.

To be able to analyze our website with Google Analytics, a property ID must be inserted into the tracking code. The data is then stored in the corresponding property. For every newly created property, the Google Analytics 4 property is standard. Alternatively, you can also create the Universal Analytics property. Depending on the property used, data is stored for a different length of time.

Through tags such as cookies and app instance IDs, your interactions on our website are measured. Interactions are all kinds of actions you perform on our website. If you also use other Google systems (such as a Google account), data generated by Google Analytics can be linked to third-party cookies. Google does not share Google Analytics data unless we, as website operators, authorize it to do so. Exceptions may occur if required by law.

The following cookies are used by Google Analytics:

Name: _ga
Value: 2.1326744211.152112174282-5
Purpose of use: By default, analytics.js uses the _ga cookie to store the user ID. Basically, it serves to distinguish website visitors.
Expiration date: after 2 years

Name: _gid
Value: 2.1687193234.152112174282-1
Purpose of use: The cookie is also used to distinguish website visitors.
Expiration date: after 24 hours

Name: _gat_gtag_UA_
Value: 1
Purpose of use: Is used to lower the request rate. If Google Analytics is provided through the Google Tag Manager, this cookie is named _dc_gtm_ .
Expiration date: after 1 minute

Name: AMP_TOKEN
Value: No information available
Purpose of use: The cookie has a token that can be used to retrieve a user ID from the AMP client ID service. Other possible values indicate a logout, a request, or an error.
Expiration date: 30 seconds to a year

Name: __utma
Value: 1564498958.1564498958.1564498958.1
Purpose of use: This cookie allows us to track your behavior on the website and measure its performance. The cookie is updated every time information is sent to Google Analytics.
Expiration date: after 2 years

Name: __utmt
Value: 1
Purpose of use: The cookie is called _gat_gtag_UA_ Used to throttle the request rate.
Expiration date: after 10 minutes

Name: __utmb
Value: 3.10.1564498958
Purpose of use: This cookie is used to determine new sessions. It is updated every time new data or information is sent to Google Analytics.
Expiration date: after 30 minutes

Name: __utmc
Value: 167421564
Purpose of use: This cookie is used to establish new sessions for repeat visitors. It is a session cookie and is only stored until you close the browser.
Expiration date: After closing the browser

Name: __utmz
Value: m|utmccn=(referral)|utmcmd=referral|utmcct=/
Purpose of use: The cookie is used to identify the source of visitor traffic on our website. That means that the cookie stores where you came from to our website. This could have been another page or an advertisement.
Expiration date: after 6 months

Name: __utmv
Value: no indication
Purpose of use: The cookie is used to store custom user data. It is always updated when information is sent to Google Analytics.
Expiration date: after 2 years

Note: This list cannot claim to be exhaustive, as Google constantly changes the choice of its cookies.

Here we provide you with an overview of the most important data collected by Google Analytics:

Heatmaps: Google creates so-called heatmaps. With heatmaps, you can see exactly the areas you click on. This way we get information about where you are on our site while you are „on the go“.

Session duration: Google refers to session duration as the time you spend on our site without leaving it. If you were inactive for 20 minutes, the session will automatically end.

Bounce rate (bouncerate): A bounce occurs when you only view one page on our website and then leave our website again.

Account creation: When you create an account on our website or place an order, Google Analytics collects this data.

IP address: The IP address is displayed only in abbreviated form so that a clear association cannot be made.

Location: The country and your approximate location can be determined based on the IP address. This process is also referred to as IP location determination.

Technical information: The technical information includes, among other things, your browser type, your internet provider, or your screen resolution.

Source of origin: Google Analytics, and of course us, are also interested in knowing which website or which advertisement led you to our page.

Other data includes contact information, any reviews, playing of media (e.g., when you play a video through our site), sharing of content via social media, or adding to your favorites. The list is not exhaustive and serves only as a general guide to the data storage by Google Analytics.

How long and where are the data stored?

Google has distributed its servers around the world. Most of the servers are located in America, and as a result, your data is usually stored on American servers. You can find out exactly where Google's data centers are located here: https://www.google.com/about/datacenters/locations/?hl=de

Your data is distributed across various physical data carriers. This has the advantage that the data is more quickly accessible and is better protected against manipulation. In every Google data center there are emergency programs for your data. For example, if the hardware at Google fails or natural disasters disrupt the servers, the risk of service interruption at Google remains low.

The retention period for data depends on the properties used. When using the newer Google Analytics 4 properties, the retention period for your user data is set to 14 months. For other so-called event data, we have the option to choose a retention period of 2 months or 14 months.

In Universal Analytics properties, Google Analytics has a default retention period of 26 months for user data. After that, your user data is deleted. However, we have the option to choose the retention period for user data ourselves. There are five options available to us:

• Deletion after 14 months
• Deletion after 26 months
• Deletion after 38 months
• Deletion after 50 months
• No automatic deletion

In addition, there is also the option that data will only be deleted if you no longer visit our website within the period we have chosen. In this case, the retention period is reset each time you visit our website within the specified period.

Once the set period has expired, the data is deleted once a month. This retention period applies to your data that is linked to cookies, user identification, and advertising IDs (e.g., DoubleClick domain cookies). Reporting results are based on aggregated data and are stored independently of user data. Aggregated data is a consolidation of individual data into a larger unit.

How can I delete my data or prevent data storage?

Under the data protection law of the European Union, you have the right to obtain information about your data, to update it, to delete it or to restrict its use. Using the browser add-on to disable Google Analytics JavaScript (ga.js, analytics.js, dc.js), you prevent Google Analytics from using your data. You can find the browser add-on here. https://tools.google.com/dlpage/gaoptout?hl=de Download and install. Please note that this add-on only disables data collection by Google Analytics.

If you wish to disable, delete, or manage cookies in general, you can find the appropriate links to the respective instructions for the most popular browsers in the „Cookies“ section.

Legal basis

The use of Google Analytics requires your consent, which we have obtained with our cookie pop-up. According to Art. 6(1)(a) GDPR (Consent) the legal basis for the processing of personal data, as may occur during collection by web analytics tools.

In addition to consent, we have a legitimate interest in analyzing the behavior of website visitors in order to improve our offerings technically and economically. With the help of Google Analytics, we identify errors on the website, can identify attacks, and can improve its profitability. The legal basis for this is Art. 6(1)(f) GDPR (Legitimate interests). We nevertheless only use Google Analytics if you have given your consent.

Google also processes data from you, among other things, in the USA. We point out that according to the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can lead to various risks for the legality and security of data processing.

As a basis for data processing for recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, i.e., in particular the USA), or for data transfer to such countries, Google uses so-called standard contractual clauses (= Art. 46, paragraphs 2 and 3 of the GDPR). Standard contractual clauses (Standard Contractual Clauses – SCCs) are model templates provided by the EU Commission and are intended to ensure that your data also complies with European data protection standards when transferred and stored in third countries (such as the USA). Through these clauses, Google undertakes to maintain the European data protection level when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. The decision and the corresponding standard contractual clauses can be found, among other places, here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found here. https://business.safety.google/intl/de/adsprocessorterms/.

We hope we have been able to provide you with the most important information regarding the data processing by Google Analytics. If you would like to learn more about the tracking service, we recommend these two links: https://marketingplatform.google.com/about/analytics/terms/de/ and https://support.google.com/analytics/answer/6004245?hl=de.

Contract for the processing of data (AVV) Google Analytics

In accordance with Article 28 of the General Data Protection Regulation (GDPR), we have concluded a contract with Google for the processing of orders (AVV). You can read more about what an AVV is exactly and what must be included in an AVV in our general section „Contractual Processing Agreement (AVV)“.

This contract is legally required because Google processes personal data on our behalf. It clarifies that Google may only process data it receives from us in accordance with our instructions and must comply with the GDPR. The link to the contract data processing terms can be found here. https://business.safety.google/intl/de/adsprocessorterms/

Google Analytics in consent mode

Depending on your consent, personal data is processed by Google Analytics in the so-called consent mode (or „Consent Mode“). You can choose whether to accept Google Analytics cookies or not. This also allows you to choose which data Google Analytics may process from you. This collected data is mainly used to measure website traffic, to display targeted advertising, and to provide web analytics reports. As a rule, you consent to the data processing by Google via a cookie consent tool. If you do not consent to the data processing, only aggregated data will be collected and processed. This means that data cannot be assigned to individual users and no user profile can be created from you. You can also only consent to the statistical measurement. No personal data is processed and therefore not used for advertising or advertising success.

Google Analytics IP anonymization

We have implemented IP address anonymization by Google Analytics on this website. This function was developed by Google so that this website can comply with the applicable data protection regulations and recommendations of the local data protection authorities when they prohibit the storage of the full IP address. The IP address is anonymized or masked as soon as the IP addresses arrive in the Google Analytics data collection network and before any data is stored or processed.

More information about IP anonymization can be found at https://support.google.com/analytics/answer/2763052?hl=de.

Email marketing introduction

Email Marketing Summary 👥 Affected: Newsletter subscribers 🤝 Purpose: Direct advertising via email, notification of system-related events 📓 Processed data: However, the entered data in the registration must include at least the email address. For more details, please refer to the respective email marketing tool used. 📅 Duration: Duration of the subscription's existence ⚖️ Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is email marketing?

To keep you informed at all times, we also use the opportunity of email marketing. In this case, provided that you have consented to receiving our emails or newsletters, data from you will also be processed and stored. Email marketing is a sub-category of online marketing. In this case, news or general information about a company, products, or services is sent via email to a specific group of people who are interested in it.

If you would like to participate in our email marketing (usually via newsletters), you simply need to sign up with your email address. To do this, fill out an online form and send it. However, it may also happen that we ask you for your first name and surname so that we can contact you personally.

Basically, signing up for newsletters using the so-called „double opt-in“ procedure works. After you have signed up for our newsletter on our website, you will receive an email through which you confirm your subscription to the newsletter. This ensures that the email address belongs to you and that no one has signed up with a different email address. We or a notification tool we use log each individual sign-up. This is necessary to be able to prove the legally correct sign-up process. In general, the time of the sign-up, the time of the confirmation of the sign-up, and your IP address are stored. Additionally, we also log when you make changes to your stored data.

Why do we use email marketing?

Of course, we want to stay in contact with you and always present you with the most important news about our company. For this purpose, we use email marketing – often simply referred to as “newsletters” – as an essential component of our online marketing. If you agree to this or it is legally permitted, we will send you newsletters, system emails, or other notifications via email. When we use the term „newsletter“ in the following text, we primarily mean regularly sent emails. Of course, we do not want to bother you in any way with our newsletters. Therefore, we are always striving to offer only relevant and interesting content. For example, you will learn more about our company, our services, or products through our newsletters. As we are always improving our offerings, you will also always know when there are new updates or we are currently offering special, lucrative promotions through our newsletter. If we hire a service provider that offers a professional shipping tool for our email marketing, we do so in order to offer you quick and secure newsletters. The purpose of our email marketing is basically to inform you about new offers and also to get closer to our business goals.

What data are processed?

If you become a subscriber to our newsletter through our website, you confirm your membership in an email list by sending an email. In addition to your IP address and email address, your first name, last name, address and phone number can also be stored. However, only if you agree to this data storage. The data marked as such is necessary for you to be able to participate in the service offered. The information provided is voluntary; however, failure to provide it will prevent you from using the service. Additionally, information about your device or your preferred content on our website may also be stored. For more information about data storage when you visit a website, please see the section “Automatic Data Storage”. We record your consent so that we can always prove that this complies with our laws.

Duration of data processing

If you opt out of our email/newsletter distribution list, we may store your address for up to three years based on our legitimate interests, so that we can still demonstrate your prior consent. We may process this data only if we have to defend ourselves against any claims.

However, if you confirm that you have given us your consent to sign up for the newsletter, you can at any time submit an individual request for deletion. If you permanently object to the consent, we reserve the right to store your email address in a blocking list. As long as you have voluntarily subscribed to our newsletter, we will of course also keep your email address.

Right of objection

You have the option to cancel your newsletter subscription at any time. To do so, you simply need to revoke your consent to the newsletter subscription. This usually only takes a few seconds or one or two clicks. You will usually find a link at the very end of each email to cancel the newsletter subscription. If the link is not actually found in the newsletter, please contact us by email and we will cancel your newsletter subscription immediately.

Legal basis

The sending of our newsletter is based on your consent. Consent (Article 6(1)(a) GDPR). That means we may only send you a newsletter if you have previously actively signed up for it. If necessary, we may also send you promotional messages based on § 7(3) UWG, provided that you have become our customer and have not objected to the use of your email address for direct marketing.

Information about specific email marketing services and how they process personal data can be found – where available – in the following sections.

Payment provider Introduction

Payment provider privacy policy summary 👥 Affected: Website visitors 🤝 Purpose: Facilitating and optimizing the payment process on our website 📓 Processed data: Data such as name, address, bank details (account number, credit card number, passwords, TANs, etc.), IP address, and contract details More details can be found in the payment provider tool used in each case. 📅 Storage duration: depends on the payment provider used ⚖️ Legal basis: Art. 6(1)(b) GDPR (performance of a contract)

What is a payment provider?

We use online payment systems on our website that allow us and you to have a secure and smooth payment process. Among other things, personal data can be sent to the respective payment provider and stored and processed there. Payment providers are online payment systems that allow you to place an order via online banking. The payment processing is then carried out by the payment provider of your choice. We then receive information about the payment made. This method can be used by any user who has an active online banking account with PIN and TAN. There are hardly any banks that do not offer or accept such payment methods.

Why do we use payment providers on our website?

Of course, we want to provide the best possible service with our website and our integrated online store, so that you feel comfortable on our site and can take advantage of our offers. We know that your time is valuable and that payment processing in particular must be quick and smooth. For these reasons, we offer various payment providers. You can choose your preferred payment provider and pay in the usual way.

What data are processed?

The exact data that is processed depends, of course, on the respective payment provider. However, in principle, data such as name, address, bank details (account number, credit card number, passwords, TANs, etc.) are stored. These are necessary data to be able to carry out a transaction at all. Furthermore, any contractual data and user data, such as when you visit our website, what content you are interested in, or which subpages you click on, can also be stored. Your IP address and information about your computer used are also stored by most payment providers.

The data is usually stored and processed on the payment providers' servers. We, as the website operator, do not receive this data. We are only informed whether the payment was successful or not. For identity and credit checks, it may be the case that payment providers forward data to the appropriate party. For all payment transactions, the terms and conditions of the respective provider always apply. Therefore, please always also check the general terms and conditions and the privacy policy of the payment provider. You also have the right to, for example, delete or correct data at any time. Please contact the respective service provider regarding your rights (right of withdrawal, right of access and right to be informed).

Duration of data processing

We will inform you about the duration of data processing below if we have further information on this. In general, we only process personal data for as long as it is absolutely necessary for the provision of our services and products. If, for example, as required by law in the case of accounting, this storage period may be exceeded. In this way, we retain booking documents (invoices, contract documents, account statements, etc.) belonging to a contract for 10 years (§ 147 AO) and other relevant business documents for 6 years (§ 247 HGB) after the end of the year.

Right of objection

You always have the right to access, correct, and delete your personal data. If you have any questions, you can also contact the responsible party of the payment provider used at any time. You can find the contact details either in our specific privacy policy or on the website of the relevant payment provider.

Cookies that payment providers use for their functions can be deleted, disabled, or managed in your browser. Depending on which browser you use, this works in different ways. However, please note that the payment process may then no longer work.

Legal basis

We therefore offer the processing of contractual and legal relationships (Art. 6(1)(b) GDPR)In addition to traditional banking and credit institutions, other payment service providers are also involved. The privacy policies of individual payment providers (such as Amazon Payments, Apple Pay, or Discover) provide you with a detailed overview of data processing and data storage. Furthermore, you can always contact the responsible parties if you have any questions regarding data protection-related issues.

Information about the specific payment providers can be found – if available – in the following sections.

Rating platforms Introduction

Rating platforms Summary 👥 Affected parties: Visitors to the website or a review platform 🤝 Purpose: Feedback on our products and/or services 📓 Processed data: Among other things, IP address, email address, name. More details can be found below or in the respective evaluation platforms used. 📅 Storage duration: depending on the respective platform ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests),

What are rating platforms?

On various rating platforms, you can rate our products or services. We are participants in some of these platforms so that we can receive feedback from you and thus optimize our offerings. When you rate us through a rating platform, the privacy policy and the general terms and conditions of the respective rating service apply. Very often you also have to register to submit a rating. Rating technologies (widgets) can also be integrated into our website. The use of such integrated tools also transfers data to the relevant provider, is processed and stored.

Many of these integrated programs operate on a similar principle. After you have ordered a product or used a service with us, you will be asked to provide a review via email or on the website. You will usually be directed to a review page via a link, where you can easily and quickly create a review. Some review systems also offer an interface to various social media channels to make the feedback accessible to multiple people.

Why do we use rating platforms?

Rating platforms collect feedback and reviews about our offerings. Through your reviews, we receive appropriate feedback quickly and can improve our products and/or services much more efficiently. The reviews therefore serve us on the one hand to optimize our offerings, and on the other hand they give you and all our future customers a good overview of the quality of our products and services.

What data are processed?

With your consent, we transmit information about you and the services you have used to the relevant evaluation platform. We do this to ensure that you have actually used one of our services. Only then can you provide real feedback. The data transmitted serves solely for user recognition. What data is actually stored and processed depends, of course, on the providers used. Most often, personal data such as IP address, email address, or your name are also provided to the evaluation platforms. After submitting your review, order information such as the order number of an item purchased is also forwarded to the corresponding platform. If your email address is provided, this is done so that the evaluation platform can send you an email after the purchase of a product. In order to be able to include your review in our website, we also inform the providers that you have visited our site. The responsible party for the collected personal data is the used review platform.

How long and where are the data stored?

For more information about the duration of data processing, please refer to the relevant privacy policy of the provider below, provided that we have further information on this matter. In general, we process personal data only for as long as it is absolutely necessary for the provision of our services and products. Personal data mentioned in an assessment is usually anonymized by employees of the platform used and is therefore visible only to administrators of the company. The collected data is stored on the providers’ servers and deleted after the end of the assignment for most providers.

Right of objection

You also have the right and the option at any time to revoke your consent to the use of cookies or third-party providers. This can be done either through our cookie management tool or through other opt-out functions. For example, you can also prevent the collection of data through cookies by managing, disabling, or deleting cookies in your browser.

Legal basis

If you have consented to the use of an evaluation platform, the legal basis for the corresponding data processing is that consent. According to Art. 6(1)(a) GDPR (Consent), this consent constitutes the legal basis for the processing of personal data, as may occur when data is collected through an evaluation platform.

We also have a legitimate interest in using a rating platform to optimize our online service. The legal basis for this is Article 6(1)(f) GDPR (Legitimate Interests). We will only use a rating platform if you have given your consent.

We hope we have been able to provide you with the most important general information about the data processing by rating platforms. For more information, please see the privacy texts below or the company’s linked privacy statements.

Explanation of terms used

We always strive to make our privacy policy as clear and understandable as possible. However, this is not always quite easy when it comes to technical and legal issues. It often makes sense to use legal terms (such as personal data) or certain technical terms (such as cookies, IP address). However, we do not want to use these without explanation. The following is an alphabetical list of important terms used that we may not have addressed sufficiently in the previous privacy policy. If these terms were taken from the GDPR and they are definitions of terms, we will also provide the GDPR texts here and add our own explanations if necessary.

Contracting processor

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

„Contract processor“ a natural or legal person, authority, institution or other body that processes personal data on behalf of the controller;

Explanation: We are responsible as a company and website owner for all the data we process from you. In addition to the responsible parties, there may also be so-called order processors. This includes any company or person who processes personal data on our behalf. Order processors may therefore, in addition to service providers such as tax advisors, also be hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

Consent

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

„Consent“ the affected person has given any freely given, informed and unambiguous expression of will for the specific case, in the form of a declaration or other unequivocal confirmatory act, with which the affected person indicates that they agree to the processing of the personal data concerning them;

Explanation: As a rule, websites obtain such consent through a cookie consent tool. You are probably familiar with this. Whenever you visit a website for the first time, you are usually asked via a banner whether you agree to the data processing or consent to it. Most often, you can also make individual settings and thus decide for yourself which data processing you allow and which you do not. If you do not consent, no personal data may be processed from you. In principle, consent can of course also be given in writing, i.e., not via a tool.

Personal data

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

„personal data“ any information relating to an identified or identifiable natural person (hereinafter „data subject“); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier or one or more specific characteristics that are an expression of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Explanation: Personal data is therefore all data that can identify you as a person. This usually includes data such as:

• Name
• Address
• Email address
• Postal address
• Phone number
• Date of birth
• Identity numbers such as social security number, tax identification number, national identity card number or registration number
• Bank details such as account number, credit information, account balances, etc.

According to the European Court of Justice (ECJ), yours also counts IP address among the personal data. IT experts can, based on your IP address, at least determine the approximate location of your device and subsequently identify you as the connection owner. Therefore, storing an IP address also requires a legal basis within the meaning of the GDPR. There are also so-called „special categories“ personal data that is also particularly sensitive. These include:

• racial and ethnic origin
• political opinions
• religious or philosophical beliefs
• union membership
• genetic data, such as data obtained from blood or saliva samples
• biometric data (that is, information about psychological, physical or behavioral characteristics that can identify a person).
  Health data
• Data on sexual orientation or sexual life

Profiling

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

„Profiling“ any type of automated processing of personal data that consists of using such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects related to that natural person's work performance, economic situation, health, personal preferences, interests, reliability, behavior, place of residence or place of change of residence;

Explanation: Profiling involves collecting various information about an individual in order to learn more about that person. In the online environment, profiling is often used for advertising purposes or for credit checks. Web or advertising analytics programs, for example, collect data about your behavior and interests on a website. This results in a specific user profile, with the help of which advertising can be targeted to a specific audience.

Responsible

Definition according to Article 4 of the GDPR

For the purposes of this Regulation, the term:

„Responsible person“ the natural or legal person, authority, institution or other body that alone or jointly with others decides on the purposes and means of processing personal data; if the purposes and means of such processing are prescribed by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for under Union law or the law of the Member States;

Explanation: In our case, we are responsible for processing your personal data and are therefore the “controller”. If we transfer collected data for processing to other service providers, they are “contract processors”. For this, a “contract processing agreement (AVV)” must be signed.

All texts are protected by copyright.

Source: Created with the Data Protection Generator by AdSimple