Preamble:

With the following privacy policy, we aim to inform you about the types of your personal data (hereinafter also referred to briefly as "Data") that we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the provision of our services and especially on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the "Online Offering").

​

The terms used are not gender-specific.

 

As of: August 15, 2023

​

Data Controller

International Society of Nucleic Acid Immunity
62, Avenue de la Liberté
L-1930, Luxembourg

​

Authorized Representatives

• Board members as referenced in the Impressum.

• Email: contact[at]nai-society.com

​

Relevant Legal Foundations

Relevant legal foundations under the GDPR: Below, you will find an overview of the legal foundations of the GDPR on which we base the processing of personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or establishment. If more specific legal foundations are applicable in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6(1)(a) GDPR): The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.

• Contractual Performance and Pre-contractual Inquiries (Art. 6(1)(b) GDPR): Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.

• Legal Obligation (Art. 6(1)(c) GDPR): Processing is necessary for compliance with a legal obligation to which the controller is subject.

• Legitimate Interests (Art. 6(1)(f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

​

Overview of Processing

The following overview summarizes the types of processed data, the purposes of their processing, and refers to the affected individuals.

 

Types of Processed Data

• Inventory data.

• Payment data.

• Contact data.

• Content data.

• Contract data.

• Usage data.

• Meta-, communication, and process data.

 

Categories of Affected Individuals

• Customers.

• Prospects.

• Communication partners.

• Users.

• Members.

• Business and contractual partners.

• Pupils/Students/Participants.

• Participants.

 

Purposes of Processing

• Provision of contractual services and fulfillment of contractual obligations.

• Contact inquiries and communication.

• Security measures.

• Direct marketing.

• Reach measurement.

• Office and organizational procedures.

• Conversion measurement.

• Administration and response to inquiries.

• Server monitoring and error detection.

• Feedback.

• Marketing.

• Profiles with user-related information.

• Provision of our online offering and user-friendliness.

• Information technology infrastructure.

​

Security Measures

In accordance with legal requirements, taking into account the technical state of the art, implementation costs, the nature of the scope, the circumstances, and the purposes of the processing, as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection commensurate with the risk.

 

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, input, disclosure, availability, and separation thereof. Furthermore, we have established procedures to ensure the exercise of data subjects' rights, data deletion, and responses to data threats. Additionally, we consider the protection of personal data in accordance with the principle of data protection during the development or selection of hardware, software, and procedures, through technology design and privacy-friendly settings.

 

TLS Encryption (https): To protect data transmitted via our online offering, we utilize TLS encryption. You can identify such encrypted connections by the prefix https:// in the address bar of your browser.

​

Transmission of Personal Data

As part of our processing of personal data, there are instances where the data is transmitted to other entities, companies, legally independent organizational units, or individuals or disclosed to them. Recipients of this data may include, for example, service providers assigned with IT tasks or providers of services and content integrated into a website. In such cases, we adhere to legal requirements and, in particular, enter into corresponding contracts or agreements with the recipients of your data to ensure the protection of your data.

 

Data Transmission within the Organization: We may transmit personal data to other entities within our organization or grant them access to this data. If this transfer is for administrative purposes, the disclosure of data is based on our legitimate business and operational interests or occurs if it is necessary for the fulfillment of our contract-related obligations or if there is consent from the data subjects or legal permission.

​

International Data Transfers

Data Processing in Third Countries: In the event that we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if processing occurs in connection with the use of third-party services or the disclosure or transmission of data to other individuals, entities, or companies, such activities are carried out in accordance with legal requirements.

 

Subject to explicit consent or transmission required by contract or law (see Art. 49 GDPR), we process or allow data processing only in third countries with a recognized level of data protection (Art. 45 GDPR), provided there is compliance with contractual obligations through the EU Commission's standard contractual clauses (Art. 46 GDPR), or in the presence of certifications or binding corporate rules (see Art. 44 to 49 GDPR, information page of the EU Commission: International dimension of data protection).

 

EU-US Trans-Atlantic Data Privacy Framework: As part of the "Data Privacy Framework" (DPF), the EU Commission has also recognized the level of data protection as secure for certain companies in the United States, through an adequacy decision dated July 10, 2023. The list of certified companies and additional information about the DPF can be found on the website of the U.S. Department of Commerce at Data Privacy Framework. We will inform you in our privacy notices which service providers we use are certified under the Data Privacy Framework.

​

Deletion of Data

The data processed by us will be deleted in accordance with legal requirements as soon as the consents granted for processing are revoked or other permissions are no longer applicable (e.g. when the purpose of processing such data has ceased to exist or they are no longer necessary for the purpose). If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to those purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons, or whose storage is necessary for the assertion, exercise, or defense of legal claims or to protect the rights of another natural or legal person.

Our privacy notices may also provide additional details regarding the retention and deletion of data, which take precedence for the respective processing activities.

​

Usage of Cookies 

Cookies are small text files or other storage markers that store information on end devices and retrieve information from end devices. For example, to store login status in a user account, cart contents in an e-shop, accessed content, or functions used in an online offering. Cookies can also be used for various purposes, such as functionality, security, and convenience of online offerings, as well as for creating analyses of visitor flows.

 

Consent Information: We use cookies in accordance with legal regulations. Therefore, we obtain prior consent from users, unless legally not required. Consent is particularly not necessary if storing and retrieving information, including cookies, is absolutely necessary to provide users with a Telemedia service expressly desired by them (i.e., our online offering). Essential cookies usually include cookies with functions related to displaying and running the online offering, load balancing, security, storing user preferences, and similar purposes related to providing the main and ancillary functions of the online offering requested by users. Revocable consent is clearly communicated to users and includes information on the respective cookie usage.

 

Information on Data Protection Legal Bases: The legal basis for processing users' personal data using cookies depends on whether we ask users for consent. If users consent, the legal basis for processing their data is the declared consent. Otherwise, data processed through cookies is based on our legitimate interests (e.g., in the economic operation and improvement of usability of our online offering) or, if this is done in fulfilling our contractual obligations when the use of cookies is necessary to fulfill our contractual obligations. The purposes for which we process cookies are explained in this privacy policy or as part of our consent and processing processes.

 

Storage Duration: Regarding storage duration, the following types of cookies are distinguished:

• Temporary Cookies (also: Session or Session Cookies): Temporary cookies are deleted at the latest after a user leaves an online offering and closes their end device (e.g., browser or mobile application).

• Permanent Cookies: Permanent cookies remain stored even after closing the end device. For example, login status can be stored or preferred content can be displayed directly when a user revisits a website. Additionally, data collected from users via cookies can be used for reach measurement. 

 

These cookies are used on this website and described by [Cookie Name], [Purpose], [Duration], and [Cookie Type]:

• XSRF-TOKEN, Used for security reasons, Session, Essential

• hs, Used for security reasons, Session, Essential

• svSession, Used in connection with user login, 12 months, Essential

• SSR-caching, Used to indicate the system from which the site was rendered, 1 minute, Essential

• _wixCIDX, Used for system monitoring/debugging, 3 months, Essential

• _wix_browser_sess, Used for system monitoring/debugging, session, Essential

• consent-policy, Used for cookie banner parameters, 12 months, Essential

• smSession, Used to identify logged in site members, Session, Essential

• TS*, Used for security and anti-fraud reasons, Session, Essential

• bSession, Used for system effectiveness measurement, 30 minutes, Essential

• fedops.logger.X, Used for stability/effectiveness measurement, 12 months, Essential

• wixLanguage, Used on multilingual websites to save user language preference, 12 months, Functional

 

General Notes on Revocation and Objection (so-called "Opt-Out"): Users can revoke their given consents at any time and object to processing in accordance with legal requirements. Users can, among other things, restrict the use of cookies in their browser settings (though this may also limit the functionality of our online offering). Objection to the use of cookies for online marketing purposes can also be declared through the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

 

Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

 

Additional Information on Processing Processes, Procedures, and Services:

• Processing of Cookie Data Based on Consent: We use a procedure for cookie consent management, within which consents of users for the use of cookies or for processing and providers named within the cookie consent management procedure are obtained, managed, and revoked by users. The consent declaration is stored to avoid repeated requests and to be able to prove consent in accordance with legal obligations. Storage can be done server-side and/or in a cookie (so-called Opt-In cookie, or using comparable technologies) to assign consent to a user or their device. Subject to individual information on providers of cookie management services, the following notes apply: The storage duration of consent can be up to two years. A pseudonymous user identifier is created, and the time of consent, information on the scope of consent (e.g., which categories of cookies and/or service providers) as well as the browser, system, and device used are stored; Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR).

• An individual user ID, language, types of consent, and the time of their submission are stored server-side and in the cookie on the user's device.

​

Performance of Duties Pursuant to Articles of Association or Rules of Procedure

We process the data of our members, supporters, prospective members, business partners, or other individuals (collectively referred to as "Data Subjects") when we are in a membership or other business relationship with them and perform our duties as well as receive services and donations. Additionally, we process the data of Data Subjects based on our legitimate interests, such as for administrative tasks or public relations.

​

The processed data, its nature, scope, purpose, and the necessity of its processing are determined by the underlying membership or contractual relationship, which also dictates the necessity of providing certain data (we otherwise indicate required data).

​

We delete data that is no longer necessary for the fulfillment of our statutory and business purposes. This determination is made in accordance with the respective tasks and contractual relationships. We retain data for as long as it is required for business transactions, as well as in consideration of any warranty or liability obligations based on our legitimate interest in regulating them. The necessity of data retention is regularly reviewed; otherwise, legal retention obligations apply.

​

• Processed Data Types: Master data (e.g., names, addresses); Payment data (e.g., bank details, invoices, payment history); Contact details (e.g., email, phone numbers); Contractual data (e.g., contract subject, duration, customer category).

• Data Subjects: Users (e.g., website visitors, users of online services); Members; Business and contractual partners.

• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; Handling of contact inquiries and communication; Administration and response to inquiries.

• Legal Bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

​

NAI Society Services

We process data of our contract and business partners, such as customers and prospects (collectively referred to as "Contract Partners"), within the framework of contractual and comparable legal relationships, as well as associated measures and in the context of communication with the Contract Partners (or pre-contractually), for example, to respond to inquiries.

 

We process this data to fulfill our contractual obligations. This includes, in particular, obligations to provide the agreed-upon services, any update requirements, and remedy for warranty and other performance disruptions. Furthermore, we process the data to safeguard our rights and for the purpose of administrative tasks associated with these obligations and corporate organization. Additionally, we process the data based on our legitimate interests in proper and business-oriented management, as well as security measures to protect our Contract Partners and our business operations from misuse, jeopardizing their data, secrets, information, and rights (e.g., involving telecommunications, transport, and other auxiliary services, as well as subcontractors, banks, tax and legal advisors, payment service providers, or financial authorities). In accordance with applicable law, we only disclose the data of Contract Partners to third parties to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contract Partners will be informed about additional forms of processing, such as for marketing purposes, within the scope of this privacy policy.

 

We communicate to Contract Partners, prior to or during data collection, which data is necessary for the aforementioned purposes, for example, through online forms, special markings (e.g., colors), symbols (e.g., asterisks), or personally.

 

We delete the data after the expiration of statutory warranty and similar obligations, i.e., generally after 4 years, unless the data is stored in a customer account, for example, as long as it must be retained for archiving purposes due to legal reasons. The legal retention period is ten years for tax-relevant documents and for commercial books, inventories, opening balances, annual financial statements, instructions for understanding these documents, and other organizational documents, as well as booking records. For received commercial and business letters and copies of sent commercial and business letters, the retention period is six years. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance, the annual financial statement, or the management report was prepared, the commercial or business letter was received or sent, or the booking record was created, and the recording or other documents were made.

 

To the extent that we use third-party providers or platforms to provide our services, the terms and privacy policies of the respective third-party providers or platforms apply in the relationship between users and providers.

• Processed Data Types: Master data (e.g., names, addresses); Payment data (e.g., bank details, invoices, payment history); Contact details (e.g., email, phone numbers); Contractual data (e.g., contract subject, duration, customer category).

• Data Subjects: Prospects; Business and contractual partners; Students/Participants; Customers.

• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; Handling of contact inquiries and communication; Office and organizational procedures; Administration and response to inquiries.

• Legal Bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legal obligation (Art. 6(1)(c) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

 

Additional Information on Processing Procedures, Processes, and Services:

• Educational and Training Services: We process the data of participants in our educational and training programs (uniformly referred to as "trainees") to provide them with our training services. The processed data, its nature, scope, purpose, and the necessity of its processing are determined by the underlying contractual and training relationship. Processing methods include performance evaluation and the assessment of our services and those of the instructors. In the course of our activities, we may also process special categories of data, particularly information about the health of the trainees, as well as data revealing ethnic origin, political opinions, and religious or philosophical beliefs. For this, we obtain explicit consent from the trainees if necessary, and we process special categories of data only when required for the provision of training services, health care purposes, social protection, or protection of the vital interests of the trainees; Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

• Events and Activities: We process the data of participants in events, gatherings, and similar activities offered or organized by us (hereinafter uniformly referred to as "participants" and "events") to enable their participation in events and to provide them with associated services or promotions. If we process health-related data, religious, political, or other special categories of data within this framework, it is done transparently (e.g., in the case of thematically oriented events or for health care, safety, or with the consent of the individuals concerned). The required information is marked as such during the order, booking, or similar conclusion of the contract and includes details necessary for service provision and invoicing, as well as contact information for any necessary communication. When we have access to information about end customers, employees, or other individuals, we process this in accordance with legal and contractual requirements; Legal bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

​

Use of Online Platforms for Offering and Sales Purposes:

We offer our services on online platforms operated by other service providers. In this context, in addition to our privacy notices, the privacy notices of the respective platforms apply. This is especially relevant regarding the execution of payment transactions and the methods employed on the platforms for reach measurement and interest-based marketing.

• Processed Data Types: Master data (e.g., names, addresses); Payment data (e.g., bank details, invoices, payment history); Contact details (e.g., email, phone numbers); Contractual data (e.g., contract subject, duration, customer category); Usage data (e.g., visited web pages, interest in content, access times); Meta-, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).

• Data Subjects: Customers.

• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; Marketing.

• Legal Basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

​

Payment Procedures:

In the context of contractual and other legal relationships, based on legal obligations, or otherwise on the basis of our legitimate interests, we offer efficient and secure payment options to the individuals concerned. In doing so, we employ additional service providers alongside banks and financial institutions (collectively referred to as "payment service providers").

 

The data processed by payment service providers includes master data such as names and addresses, bank data such as account numbers or credit card numbers, passwords, TANs, and checksums, as well as contract-related, sum-related, and recipient-related information. This information is necessary to carry out transactions. However, the entered data is processed and stored solely by the payment service providers. This means we do not receive account- or credit card-related information, only information confirming or denying the payment. In some cases, data may be transmitted to credit reporting agencies by the payment service providers for identity and credit checks. For further details, please refer to the terms and privacy notices of the payment service providers.

 

The terms and privacy notices of the respective payment service providers, which are accessible within their respective websites or transaction applications, apply to payment transactions. We also refer to them for additional information and to assert withdrawal, information, and other data subject rights.

• Processed Data Types: Master data (e.g., names, addresses); Payment data (e.g., bank details, invoices, payment history); Contractual data (e.g., contract subject, duration, customer category); Usage data (e.g., visited web pages, interest in content, access times); Meta-, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).

• Data Subjects: Customers, Prospective customers.

• Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations.

• Legal Basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

 

Further Information on Processing Procedures, Processes, and Services:

• PayPal: Payment services (technical integration of online payment methods) (e.g., PayPal, PayPal Plus, Braintree); Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.paypal.com/de; Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

• Visa: Payment services (technical integration of online payment methods); Service provider: Visa Europe Services Inc., Branch London, 1 Sheldon Square, London W2 6TT, GB; Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://www.visa.de; Privacy Policy: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

​

Provision of the Online Offering and Web Hosting:

We process user data to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

• Processed Data Types: Usage data (e.g., visited web pages, interest in content, access times); Meta-, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).

• Data Subjects: Users (e.g., website visitors, users of online services).

• Purposes of Processing: Provision of our online offering and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); Security measures; Range measurement (e.g., access statistics, detection of recurring visitors); Conversion measurement (measurement of the effectiveness of marketing measures); Server monitoring and error detection.

• Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

 

Additional Information on Processing Procedures, Processes, and Services:

• Collection of Access Data and Log Files: Access to our online offering is logged in the form of so-called "server log files." Server log files may include the address and name of the accessed websites and files, date and time of access, transferred data volumes, notification of successful access, browser type, and version, the user's operating system, referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. Server log files can be used for security purposes, such as avoiding server overload (especially in the case of abusive attacks, so-called DDoS attacks), and ensuring server utilization and stability; Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR). Data Deletion: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is necessary for evidentiary purposes is exempt from deletion until the final clarification of the respective incident.

• IONOS: Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacities); Service provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.ionos.com; Privacy Policy: https://www.ionos.com/terms-gtc/terms-privacy/. Data Processing Agreement: https://www.ionos.com/help/index.php?id=12367.

• Wix: Wix offers Software as a Service for the creation and hosting of websites; Service provider: Wix.com Ltd., Namal 40, 6350671 Tel Aviv, Israel; Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.wix.com; Privacy Policy: https://www.wix.com/about/privacy; Data Processing Agreement: https://www.wix.com/about/dpa. Basis for Third-Country Transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.wix.com/about/dpa).

​

Contact and Inquiry Management:

When contacting us (e.g., by mail, contact form, email, phone, or via social media) and within existing user and business relationships, the information of the inquiring individuals is processed to the extent necessary to respond to contact inquiries and any requested measures.

• Processed Data Types: Contact data (e.g., email, phone numbers); Content data (e.g., entries in online forms); Usage data (e.g., visited web pages, interest in content, access times); Meta-, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).

• Data Subjects: Communication partners.

• Purposes of Processing: Contact inquiries and communication; Management and response to inquiries; Feedback (e.g., collecting feedback via online forms); Provision of our online offering and user-friendliness.

• Legal Bases: Legitimate interests (Art. 6(1)(f) GDPR); Contract fulfillment and pre-contractual inquiries (Art. 6(1)(b) GDPR).

 

Additional Information on Processing Procedures, Processes, and Services:

• Contact Form: When users contact us via our contact form, email, or other communication channels, we process the data communicated to us in this context for the purpose of handling the stated concern; Legal Bases: Contract fulfillment and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

​

Newsletter and Electronic Notifications:

We only send newsletters, emails, and other electronic notifications (hereinafter "newsletter") with the consent of the recipients or legal permission. If the contents of the newsletter are specifically described during the registration, they are decisive for the consent of the users. In addition, our newsletters contain information about our services and us.

​

To subscribe to our newsletters, it is generally sufficient to provide your email address. However, we may ask you to provide a name for personal address in the newsletter or additional information if necessary for the purposes of the newsletter.

​​

Deletion and Restriction of Processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them to prove a previously given consent. The processing of this data is limited to the purpose of a possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a blocklist.

​

The logging of the registration process is based on our legitimate interests for the purpose of proving its proper course. If we commission a service provider with the dispatch of emails, this is done based on our legitimate interests in an efficient and secure dispatch system.

Contents: Information about us, our services, actions, and offers.

• Processed Data Types: Master data (e.g., names, addresses); Contact data (e.g., email, phone numbers); Meta-, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status); Usage data (e.g., visited web pages, interest in content, access times).

• Data Subjects: Communication partners.

• Purposes of Processing: Direct marketing (e.g., by email or postal).

• Legal Basis: Consent (Art. 6(1)(a) GDPR).

• Objection Option (Opt-Out): You can cancel the receipt of our newsletter at any time, i.e., revoke your consent or object to further receipt. You will find a link to unsubscribe from the newsletter either at the end of each newsletter or you can use one of the contact options given above, preferably by email.

​

Advertising Communication via Email, Mail, Fax, or Phone:

We process personal data for the purpose of advertising communication, which can take place through various channels such as email, phone, mail, or fax, in accordance with legal requirements.

​

Recipients have the right to revoke granted consents at any time or to object to advertising communication at any time.

​

After revocation or objection, we store the data necessary to prove the previous authorization for contacting or sending information for up to three years after the end of the year of revocation or objection based on our legitimate interests. The processing of this data is limited to the purpose of a possible defense against claims. Based on the legitimate interest of permanently considering the user's revocation or objection, we also store the data necessary to avoid renewed contact (e.g., depending on the communication channel, the email address, phone number, name).

• Processed Data Types: Master data (e.g., names, addresses); Contact data (e.g., email, phone numbers).

• Data Subjects: Communication partners.

• Purposes of Processing: Direct marketing (e.g., by email or postal).

• Legal Bases: Consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).

​

Surveys and Questionnaires:

We conduct surveys and questionnaires to collect information for the communicated survey or questionnaire purpose. The surveys conducted by us (hereinafter "surveys") are evaluated anonymously. Processing of personal data only occurs to the extent necessary for the provision and technical implementation of the surveys (e.g., processing of IP addresses to display the survey in the user's browser or using a cookie to enable the resumption of the survey).

• Processed Data Types: Contact data (e.g., email, phone numbers); Content data (e.g., entries in online forms); Usage data (e.g., visited websites, interest in content, access times). Meta-, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).

• Data Subjects: Communication partners. Participants.

• Purposes of Processing: Feedback (e.g., collecting feedback via online form).

• Legal Bases: Legitimate interests (Art. 6(1)(f) GDPR).

 

Web Analysis, Monitoring, and Optimization:

Web analysis (also referred to as "reach measurement") serves to evaluate visitor flows to our online offering and may include pseudonymous values such as behavior, interests, or demographic information about visitors, such as age or gender. Through reach analysis, we can recognize, for example, when our online offering or its functions or content are most frequently used or invite reuse. We can also identify areas that require optimization.

 

In addition to web analysis, we may use test procedures to test and optimize different versions of our online offering or its components.

 

Unless otherwise stated below, profiles, i.e., data summarized for a usage process, can be created and information stored and read from a browser or device for these purposes. The data collected includes, in particular, visited websites and elements used there, as well as technical information such as the browser used, the operating system used, and information about usage times. If users have consented to the collection of their location data by us or the providers of the services we use, location data may also be processed.

 

The IP addresses of users are also stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. In general, clear user data (such as email addresses or names) is not stored during web analysis, A/B testing, and optimization; instead, pseudonyms are used. This means that we and the providers of the software used do not know the actual identity of the users, only the information stored in their profiles for the purposes of the respective procedures.

• Processed Data Types: Usage data (e.g., visited websites, interest in content, access times). Meta-, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).

• Data Subjects: Users (e.g., website visitors, users of online services).

• Purposes of Processing: Reach measurement (e.g., access statistics, recognition of recurring visitors); Profiles with user-related information (creation of user profiles). Provision of our online offering and user-friendliness.

• Security Measures: IP masking (pseudonymization of the IP address).

• Legal Bases: Legitimate interests (Art. 6(1)(f) GDPR).

 

Further Information on Processing Processes, Procedures, and Services:

• Google Analytics 4: We use Google Analytics to measure and analyze the use of our online offering based on a pseudonymous user identification number. This identification number does not contain unique data such as names or email addresses. It is used to assign analysis information to a device to recognize which content users have accessed within one or more usage processes, and which search terms they have used, accessed again, or interacted with our online offering. The time of use and its duration are also stored, as well as the sources of users referring to our online offering and the technical aspects of their devices and browsers. Pseudonymous profiles of users with information from the use of different devices can be created, with cookies possibly being used. Google Analytics does not log and store individual IP addresses for EU users. However, Analytics provides rough geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). In EU data traffic, IP address data is used exclusively for this derivation of geolocation data before being immediately deleted. They are not logged, are not accessible, and are not used for any other purpose. When Google Analytics collects measurement data, all IP queries are performed on EU-based servers before traffic is forwarded to Analytics servers for processing.

• Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

• Legal Bases: Legitimate interests (Art. 6(1)(f) GDPR).

• Website: https://marketingplatform.google.com/intl/de/about/analytics/; 

• Privacy Policy: https://policies.google.com/privacy; 

• Data Processing Agreement: https://business.safety.google/adsprocessorterms/; 

• Basis for Third-Country Data Transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses(https://business.safety.google/adsprocessorterms)Opt-Out Options: Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Setting for Displaying Advertisements: https://adssettings.google.com/authenticated. Additional Information: https://privacy.google.com/businesses/adsservices (Types of Processing and Processed Data)

​

Social Media Presence: 

We maintain online presences within social networks and process user data in this context to communicate with active users or provide information about us. Please note that user data may be processed outside the European Union, which may pose risks to users as it could complicate the enforcement of their rights.

 

User data within social networks is typically processed for market research and advertising purposes. User behavior and resulting interests can be used to create user profiles, which, in turn, may be used to display ads inside and outside the networks that likely match users' interests. For these purposes, cookies are usually stored on users' devices, containing information about users' behavior and interests. Additionally, data in user profiles may be stored independently of the devices used by users (especially if users are members of the respective platforms and are logged in). 

 

For a detailed presentation of the processing methods and opt-out options, please refer to the privacy policies and information provided by the operators of the respective networks.

 

In case of inquiries and the exercise of data subject rights, we emphasize that these are most effectively addressed to the providers. Only the providers have access to user data and can take appropriate measures and provide information directly. If you still need assistance, you can contact us.

• Processed Data Types: Contact data (e.g., email, phone numbers), content data (e.g., entries in online forms), usage data (e.g., visited websites, interest in content, access times), meta-, communication-, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).

• Affected Persons: Users (e.g., website visitors, users of online services).

• Processing Purposes: Contact requests and communication, feedback (e.g., collecting feedback via online form), and marketing.

• Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

 

Additional Information on Processing Processes, Procedures, and Services:

• LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: LinkedIn; Privacy Policy: LinkedIn Privacy Policy; Data Processing Agreement: LinkedIn DPA; Basis for Third-Country Data Transfer: Standard Contractual Clauses (LinkedIn DPA); Opt-Out: LinkedIn Ad Settings.

• X (Twitter): Social network; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Privacy Policy: Twitter Privacy Policy; Settings: Twitter Personalization Settings.

 

Modification and Update of the Privacy Policy: 

We ask you to regularly inform yourself about the content of our privacy policy. We adjust the privacy policy as soon as changes to the data processing carried out by us make this necessary. We will inform you as soon as your cooperation (e.g., consent) or other individual notification is required due to the changes.

 

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time, and we ask you to check the information before contacting us.

 

Definition of Terms: 

In this section, you get an overview of the terms used in this privacy policy. Where the terms are legally defined, their legal definitions apply. The explanations below are primarily intended to aid understanding.

• Conversion Measurement: The process of determining the effectiveness of marketing measures. It usually involves storing a cookie on users' devices within the websites where the marketing measures take place and retrieving it again on the target website. For example, we can track whether the ads we placed on other websites were successful.

• Personal Data: All information relating to an identified or identifiable natural person. An identifiable person is considered one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or one or more special characteristics expressing the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

• Profiles with User-Related Information: The automated processing of personal data to analyze, evaluate, or predict certain personal aspects related to a natural person. Profiling is often used for purposes such as analyzing interests, behavior, or interactions with websites and their content.

• Reach Measurement: The evaluation of visitor flows to an online offer, encompassing the behavior or interests of visitors in specific information, such as website content. Pseudonymous cookies and web beacons are often used for reach analysis.

• Server Monitoring and Error Detection: Ensuring the availability and integrity of our online offer through server monitoring and error detection. Processed data includes performance, utilization, and similar technical values that provide information about the stability and any anomalies of our online offer.

• Controller: The natural or legal person, authority, institution, or other body that alone or jointly with others determines the purposes and means of processing personal data.

• Processing: Any operation or set of operations performed on personal data, with or without automated procedures. The term includes practically any handling of data, whether collecting, evaluating, storing, transmitting, or deleting.