Privacy Policy

All personal data is treated confidentially. Our data protection practices are in line with the German Federal Data Protection Act (BDSG) and the General Data Protection Regulation (GDPR). Below we inform you about the details of data protection:

1. Controller within the Meaning of the GDPR and the BDSG

die Bäderwerkstatt GmbH
Innere Flosser Str. 6
92660 Neustadt, Germany
Phone: +49 (0) 9602 939 123 0
Email: info@baederwerkstatt-new.de

2. Reasons for Data Processing

We collect and process your data in order to provide our website and to give you the best possible service through convenient access to our services.

3. Collection, Processing and Use of Personal Data

3.1 Visiting Our Website

When you access our websites, our servers automatically collect information of a general nature, in particular for the purposes of establishing the connection, functionality and system security. This includes the type of browser used, the operating system used, the domain name of the internet service provider, the connection data of the computer used (IP address), the website from which you visit us (referrer URL), the pages you visit on our site and the date and duration of the visit. Due to pseudonymisation, it is not possible for us to draw conclusions about specific individuals from this data. This data is not merged with other data sources.

The legal basis for the processing is our legitimate interest in making our website available to interested persons pursuant to Art. 6 (1) sentence 1 lit. f) GDPR.

3.2 Contact Form

If you contact us via the contact form, you must provide your name, your email address and your message to us. The data is stored for the purpose of processing your enquiry. We delete the data arising in this context once storage is no longer necessary, or we restrict its processing if statutory retention obligations exist.

The legal basis for processing your personal data is Art. 6 (1) sentence 1 lit. b) GDPR if you contact us in the context of concluding a contract, because of an interest in concluding a contract, or in the context of performing a contract that has been concluded. Otherwise, it is our legitimate interest to answer your enquiries, so that in this case Art. 6 (1) sentence 1 lit. f) GDPR is the legal basis.

3.3 Job Applications

We offer you the opportunity to apply to us (for example by email, by post or via the online application form). Below we inform you about the scope, purpose and use of your personal data collected in the course of the application process. We assure you that your data is collected, processed and used in accordance with applicable data protection law and all other statutory provisions, and that your data will be treated in the strictest confidence.

If you send us an application, we process your related personal data (for example contact and communication data, application documents, notes taken during interviews, etc.) insofar as this is necessary to decide on establishing an employment relationship.

The legal basis for this is the initiation of an employment relationship, Section 26 BDSG, or Art. 6 (1) sentence 1 lit. b) GDPR. If you have given your consent, for example to the permanent storage of your application and its inclusion in the applicant pool, the legal basis may also be your consent pursuant to Art. 6 (1) lit. a) GDPR. You can withdraw your consent at any time with effect for the future.

Personal data concerning you is passed on within our company exclusively to persons and departments involved in processing your application. If the application is successful, the data you submitted will be stored in our data processing systems on the basis of Section 26 BDSG and Art. 6 (1) sentence 1 lit. b) GDPR for the purpose of carrying out the employment relationship.

If we are unable to make you a job offer, you decline a job offer or you withdraw your application, we reserve the right to retain the data you have submitted for up to 6 months from the end of the application process on the basis of our legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f) GDPR. The data will then be deleted and the physical application documents destroyed. Retention serves in particular as evidence in the event of a legal dispute. If it is apparent that the data will be required after the retention period has expired (in particular because of an impending or pending legal dispute), deletion will only take place once the purpose for further retention no longer applies. Longer retention may also take place if statutory retention obligations preclude deletion.

We would like to evaluate all applicants solely on the basis of their qualifications and therefore ask that you refrain as far as possible from providing information in your application about racial and ethnic origin, political opinions, religious or philosophical beliefs or any trade union membership, genetic data, biometric data for the unique identification of a natural person, health data or data concerning sex life or sexual orientation.

3.4 Prize Draws

From time to time you have the opportunity to take part in prize draws on our website. In the context of these prize draws, personal data (email address, name, address and, where applicable, further data necessary for the prize draw) may also be collected and stored for the purpose of running the prize draw. The personal details you provide to us are used exclusively for running the prize draw (e.g. for determining the winner, notifying the winner and handing over the prize). In individual cases, the data is passed on to the retailer you name to us when taking part in the prize draw, who hands over the prizes. In the context of a prize draw, we will inform the participants specifically about any data processing in connection with that particular prize draw. After our prize draws have ended, the participants' data is deleted.

The legal basis for the data processing is the contract for carrying out the prize draw within the meaning of Art. 6 (1) sentence 1 lit. b) GDPR. If you give your consent in the context of the prize draw to the disclosure or other use of your personal data, the legal basis is your consent within the meaning of Art. 6 (1) sentence 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future, for which purpose you can contact us or our data protection officer. Data processing carried out until the withdrawal remains lawful.

3.5 Appointment Bookings via Our Website

You can book or request a consultation appointment directly via our website. The data you enter in the form is transmitted and stored. As a rule, this is the time and date of the desired consultation appointment, your name and your email address, so that we can reply to you regarding the requested appointment. Providing a telephone number for any follow-up questions is voluntary.

The data is stored and processed for the purpose of handling your enquiry. The legal basis for processing your personal data is Art. 6 (1) sentence 1 lit. b) GDPR if you contact us in the context of concluding a contract or initiating a contract. Otherwise, the legal basis is our legitimate interest in answering your enquiry pursuant to Art. 6 (1) sentence 1 lit. f) GDPR.

We delete the data collected in this context as soon as storage is no longer necessary. If statutory retention obligations exist, we restrict processing as soon as the data is no longer required for the purpose for which it was originally collected and delete the data after the statutory retention periods have expired.

3.6 Consultation Request ("Start Your Kitchen Purchase from Home")

With the function "Start Your Kitchen Purchase from Home" you have the opportunity to tell our advisors directly via our website, in advance, about your ideas and your requirements for the kitchen you want. The data you enter in the form is transmitted. As a rule, this is the kitchen layout, the preferred kitchen style and preferred colour, details about the room, wishes regarding functionality, details about household size, the time frame and occasion for the kitchen planning, and the budget. For the purpose of getting back to you, your name and your email address are also requested. Providing a telephone number and further comments, as well as submitting documents relevant to the planning, is voluntary.

The data is stored and processed for the purpose of handling your enquiry and preparing a consultation. The legal basis for processing your personal data is Art. 6 (1) sentence 1 lit. b) GDPR if you contact us in the context of concluding a contract or initiating a contract. Otherwise, the legal basis is our legitimate interest in answering your enquiry pursuant to Art. 6 (1) sentence 1 lit. f) GDPR.

We delete the data stored in this context as soon as storage is no longer necessary. If statutory retention obligations exist, we restrict processing as soon as the data is no longer required for the purpose for which it was originally collected and delete the data after the statutory retention periods have expired.

3.7 Comments on Our Blog

On our blog, in which we publish various posts on topics related to our activities, you can leave public comments. Your comment is published with the user name you have given alongside the post. We recommend using a pseudonym instead of your real name. Providing a user name and an email address is required; all other information is voluntary. When you post a comment, we also store your IP address, which we delete after one week. Storage is necessary so that we can defend ourselves against liability claims in the event that unlawful content is published. We need your email address in order to contact you if a third party objects to your comment as unlawful.

The legal basis for storage is Art. 6 (1) sentence 1 lit. b) GDPR insofar as the initial storage and public display of your comment are concerned; the basis is then the contract concluded for use of the comment function. Insofar as the storage of further data is concerned, the legal basis is our legitimate interest in informing you if third parties object to your comment pursuant to Art. 6 (1) sentence 1 lit. f) GDPR.

Comments are not reviewed before publication. We reserve the right to delete comments if third parties object to them as unlawful.

3.8 Third-Party Services

Below we list which third-party services may be used on this website.

3.8.1 Google Tag Manager

We use the "Google Tag Manager" service on our website, which is offered by Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, or, if you are based or resident in the EU, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

The service allows us to manage website tags via an online interface. This allows us to centrally manage and set up further services named in this privacy policy and to integrate them or change their configuration without changes to the source code of our website. The service is delivered via a domain that does not itself collect any personal data. Although the service takes care of integrating further services, it does not receive access to this data.

The legal basis for using the Tag Manager is our legitimate interest in the simple and efficient management of services that are integrated on our website (in particular with your consent, as described in this privacy policy). The legal basis for the data processing is therefore Art. 6 (1) sentence 1 lit. f) GDPR.

The legal basis for the transfer of personal data to the USA is either standard data protection clauses concluded with Google within the meaning of Art. 46 (2) lit. c) GDPR or an adequacy decision of the EU Commission within the meaning of Art. 45 GDPR, namely the EU-U.S. Data Privacy Framework (DPF), for which Google is certified and which can therefore be used as the legal basis for a data transfer to the USA. You can obtain further information on this using the contact details given in section 1.

You can find Google's privacy policy at the following link:
https://policies.google.com/privacy?hl=en

You can find Google's cookie policy at this link:
https://policies.google.com/technologies/cookies?hl=en

3.8.2 Google Maps

On this website we use the "Google Maps" service, operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

This allows us to display interactive maps directly on the website and enables you to use the map function conveniently. By visiting the website, Google receives the information that you have accessed the corresponding subpage of our website. In addition, the IP address, date and time of the request, time zone difference from Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, the amount of data transferred, the website from which the request comes (so-called referrer), the type and version of the browser used including the language version, and the type and version of the operating system including its interface are transmitted. This information (including your IP address) is transmitted by your browser directly to a Google server in the USA and stored there.

The transmission takes place regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data is assigned directly to your account. If you do not want the data to be assigned to your Google profile, you must log out of your Google profile before using our website. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation takes place in particular (also for users who are not logged in) in order to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact Google in order to exercise this right.

You can find further information on the purpose and scope of the data collection and its processing by YouTube in the privacy policy. There you will also find further information on your rights and setting options to protect your privacy:
https://policies.google.com/privacy?hl=en&gl=en

The legal basis for the collection and processing of data is your consent within the meaning of Art. 6 (1) sentence 1 lit. a) GDPR, which you may have given us when you first visited our website. You can withdraw the consent given to data processing at any time with effect for the future. To do so, please contact our data protection officer using the contact details given, or use the link for managing your consents, which you will find in the "Cookies" section of this privacy policy. Withdrawing your consent does not affect the lawfulness of the data processing carried out until the withdrawal.

The legal basis for the transfer of personal data to the USA is either standard data protection clauses concluded with Google within the meaning of Art. 46 (2) lit. c) GDPR or an adequacy decision of the EU Commission within the meaning of Art. 45 GDPR, namely the EU-U.S. Data Privacy Framework (DPF), for which Google is certified and which can therefore be used as the legal basis for a data transfer to the USA. You can obtain further information on this using the contact details given in section 1.

You can find Google's privacy policy at the following link:
https://policies.google.com/privacy?hl=en

You can find Google's cookie policy at this link:
https://policies.google.com/technologies/cookies?hl=en

3.8.3 YouTube Videos

On our website we use the "YouTube" service, operated by Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, or, if you are based or resident in the EU, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

YouTube videos are integrated into our online offering in such a way that the content stored on https://www.youtube.com can be played directly from our website. No data is transmitted to YouTube if you have not consented to the display of videos. By visiting the website, YouTube then receives the information that you have accessed the corresponding subpage of our website. The IP address, date and time of the request, time zone difference from Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, the amount of data transferred, the website from which the request comes (so-called referrer), the type and version of the browser used including the language version, and the type and version of the operating system including its interface are transmitted.

This takes place regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data is assigned directly to your account. If you do not want the data to be assigned to your YouTube profile, you must log out of YouTube and Google before activating the video on our website.

YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation takes place in particular (also for users who are not logged in) in order to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact Google in order to exercise this right.

The legal basis for the collection and processing of data is your consent within the meaning of Art. 6 (1) sentence 1 lit. a) GDPR, which you may have given us when you first visited our website. You can withdraw the consent given to data processing at any time with effect for the future. To do so, please contact our data protection officer using the contact details given, or use the link for managing your consents, which you will find in the "Cookies" section of this privacy policy. Withdrawing your consent does not affect the lawfulness of the data processing carried out until the withdrawal.

The legal basis for the transfer of personal data to the USA is either standard data protection clauses concluded with Google within the meaning of Art. 46 (2) lit. c) GDPR or an adequacy decision of the EU Commission within the meaning of Art. 45 GDPR, namely the EU-U.S. Data Privacy Framework (DPF), for which Google is certified and which can therefore be used as the legal basis for a data transfer to the USA. You can obtain further information on this using the contact details given in section 1.

You can find Google's privacy policy at the following link:
https://policies.google.com/privacy?hl=en

You can find Google's cookie policy at this link:
https://policies.google.com/technologies/cookies?hl=en

3.8.4 Vimeo Videos

On our website we use the video service "Vimeo", operated by Vimeo LLC, 555 West 18th Street, New York, New York 10011, USA ("Vimeo").

The service allows us to integrate videos on our website that are not stored on our servers but on the servers of Vimeo, which ensures more efficient and effective display and transmission of the video files and allows videos to be stored centrally. When a video stored on Vimeo is called up, your browser directly accesses the services or pages of Vimeo and loads content from the servers there. Vimeo videos are not integrated and activated before you have given your consent to the use of Vimeo.

When videos are called up or played on Vimeo, metadata about the connection between your end device and the Vimeo servers is collected. The data collected includes the IP address, the browser type and further information (such as language), information about the end device used, the website from which Vimeo was called up (so-called referrer URL), pages visited on Vimeo, the operating system of the end device used, search queries on Vimeo and information that you provide or enter on the website.

The legal basis for the collection and processing of data (with the exception of the immediately preceding paragraph) is your consent within the meaning of Art. 6 (1) sentence 1 lit. a) GDPR, which you may have given us when you first visited our website. You can withdraw the consent given to data processing at any time with effect for the future. To do so, please contact our data protection officer using the contact details given, or use the link for managing your consents, which you will find in the "Cookies" section of this privacy policy. Withdrawing your consent does not affect the lawfulness of the data processing carried out until the withdrawal.

The legal basis for the transfer of personal data to the USA is standard data protection clauses concluded with Vimeo within the meaning of Art. 46 (2) lit. c) GDPR. You can obtain further information on this using the contact details given in section 1.

You can find Vimeo's privacy policy at the following link:
https://vimeo.com/privacy

You can find Vimeo's cookie policy at the following link:
https://vimeo.com/cookie_policy

3.8.5 Instagram Feed

On our website we use the "Instagram feed" of the social network Instagram, operated by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are based or resident in the EU or the EEA, Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Dublin, Ireland (together "Meta").

By integrating the Instagram feed, we have the opportunity to also show posts that we publish on the social network on our website. This serves to present our services and the products we sell. The Instagram feed is only integrated once you have given your consent.

When the Instagram feed is loaded, metadata about the connection between your end device and the Meta servers is collected. The data collected includes the IP address, the browser type and further information (such as language), information about the end device used, the website on which the Instagram feed is integrated (so-called referrer URL), posts viewed on Instagram and the operating system of the end device used.

The legal basis for the use of the Instagram feed on our website is Art. 6 (1) sentence 1 lit. a) GDPR, insofar as you have given us your consent to this when you first accessed the site. You can withdraw the consent given to data processing at any time with effect for the future. To do so, please contact our data protection officer using the contact details given, or use the link for managing your consents, which you will find in the "Cookies" section of this privacy policy. Withdrawing your consent does not affect the lawfulness of the data processing carried out until the withdrawal.

With regard to the data processing, we are jointly responsible with Meta. We have therefore concluded an agreement on joint responsibility within the meaning of Art. 26 GDPR with Meta, in which Meta also undertakes to protect your personal data and not to pass it on to third parties for purposes other than those mentioned above. The agreement can be viewed at the following link:
https://de-de.facebook.com/legal/terms/page_controller_addendum

The legal basis for the transfer of personal data to the USA is either standard data protection clauses concluded with Meta within the meaning of Art. 46 (2) lit. c) GDPR or an adequacy decision of the EU Commission within the meaning of Art. 45 GDPR, namely the EU-U.S. Data Privacy Framework (DPF), for which Meta is certified and which can therefore be used as the legal basis for a data transfer to the USA. You can obtain further information on this using the contact details given in section 1.

You can find the option to object to the use of personalised advertising (opt-out) as follows; to use the opt-out option you must be logged in with your Facebook account:
https://www.facebook.com/settings?tab=ads

You can find Meta's privacy notices at the following link:
https://www.facebook.com/about/privacy/

3.8.6 ProvenExpert.com Widget

On our website we use "Proven Expert", which is offered by Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin, Germany ("Expert Systems").

With Proven Expert we can integrate customer reviews directly on our website. This gives you, as a customer, the opportunity to rate services on our website. When you write a review, Expert Systems collects and stores your email address as well as technical data in an associated log file, such as your IP address and information about the web browser you use. In addition, Expert Systems also stores further voluntary information if you provide it.

We use Proven Expert to give you the opportunity to rate services on our website. At the same time, the use of Proven Expert serves quality assurance and optimisation purposes. To ensure the authenticity of a review and to prevent misuse of the review system, for example through spam or multiple reviews by the same user, the processing and storage of the aforementioned data by Expert Systems is necessary; in this respect, the use of Proven Expert therefore serves to safeguard the security and integrity of our information technology systems. This is also our legitimate interest in processing the above information, so that in this case the legal basis is Art. 6 (1) sentence 1 lit. f) GDPR.

The legal basis for the collection and processing of data (with the exception of the immediately preceding paragraph) is your consent within the meaning of Art. 6 (1) sentence 1 lit. a) GDPR, which you may have given us when you first visited our website. You can withdraw the consent given to data processing at any time with effect for the future. To do so, please contact our data protection officer using the contact details given, or use the link for managing your consents, which you will find in the "Cookies" section of this privacy policy. Withdrawing your consent does not affect the lawfulness of the data processing carried out until the withdrawal.

You can find information on data protection at Expert Systems at the following link:
https://www.provenexpert.com/en-gb/privacy-policy/

3.8.7 Issuu Media

On our website we use the "Issuu Media" service, operated by Issuu Inc., 131 Lytton Ave, Palo Alto, CA 94301, USA ("Issuu").

This service allows us to publish and distribute magazines and catalogues. For this purpose, Issuu provides a so-called "flip catalogue" or "e-paper", which imitates the feel of a paper catalogue on your end device. The magazines and magazine excerpts that we have deposited on Issuu are displayed exclusively on the Issuu website. As soon as you call up one of our web pages that is linked to Issuu, you are automatically forwarded to the Issuu website. As soon as you view the e-papers we provide, data indicating the time and duration of use is transmitted to the Issuu server. When you visit one of our pages equipped with an Issuu plugin, a connection to the Issuu servers is established. In particular, the following data is transmitted to the Issuu servers: IP address, pages visited, referrer URL (i.e. the URL from which you access Issuu), downloads, date and time of the visit, and data on the browser, end device and operating system used.

If you are logged in to your Issuu account, you enable Issuu to assign your usage behaviour directly to your personal profile. You can prevent this by logging out of your Issuu account. The legal basis for this link to your profile is your consent given to Issuu, if applicable, and you must contact Issuu directly regarding its withdrawal.

We only use Issuu after your prior consent, which you may have given us when you first visited this website via our consent management tool. The legal basis for the data processing is therefore Art. 6 (1) sentence 1 lit. a) GDPR. Consents given can be withdrawn at any time with effect for the future. To do so, please contact our data protection officer using the contact details given, or use the link for managing your consents, which you will find in the "Cookies" section of this privacy policy. Withdrawing your consent does not affect the lawfulness of the data processing carried out until the withdrawal.

The legal basis for the transfer of personal data to the USA is standard data protection clauses concluded with Issuu within the meaning of Art. 46 (2) lit. c) GDPR. You can obtain further information on this using the contact details given in section 1.

You can find Issuu's privacy notices at the following link:
https://issuu.com/legal/privacy

You can find Issuu's notices on its use of cookies at the following link:
https://issuu.com/legal/cookies

3.8.8 Google Analytics

On this website we use the "Google Analytics" service, operated by Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, or, if you are based or resident in the EU, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Analytics uses so-called "cookies". Cookies are text files that are stored on your computer and that make it possible to distinguish individual users and individual sessions of a user. During your visit to the website, your user behaviour is recorded and stored in the form of "events" through the use of Google Analytics. The events stored may include: page views, first visit to the website, start of the session, interactions with the website (also in the form of scrolling on the page), clicks on external links, internal search queries, interaction with videos, file downloads, ads viewed/clicked and language setting. In addition to the events, Google Analytics also stores the approximate location (region), the IP address (in anonymised form), technical information about the browser and end device used (such as language setting and screen resolution), as well as the internet provider and the referrer URL.

On the basis of the aforementioned data, Google evaluates your use of our website and compiles reports on website activity for us, which serve the purpose of analysing website use.

We only use Google Analytics after your prior consent, which you may have given us when you first visited this website via our consent management tool. The legal basis for the data processing is therefore Art. 6 (1) sentence 1 lit. a) GDPR. Consents given can be withdrawn at any time with effect for the future. To do so, please contact our data protection officer using the contact details given, or use the link for managing your consents, which you will find in the "Cookies" section of this privacy policy. Withdrawing your consent does not affect the lawfulness of the data processing carried out until the withdrawal.

You can prevent the storage of cookies by setting your browser accordingly. In this case, you may not be able to use all functions of our website to their full extent.

You have the option of deactivating the "personalised ads" function in your Google account settings and thus switching off cross-device analysis. To do so, follow the instructions on this page:
https://support.google.com/ads/answer/2662922?hl=en

The legal basis for the transfer of personal data to the USA is either standard data protection clauses concluded with Google within the meaning of Art. 46 (2) lit. c) GDPR or an adequacy decision of the EU Commission within the meaning of Art. 45 GDPR, namely the EU-U.S. Data Privacy Framework (DPF), for which Google is certified and which can therefore be used as the legal basis for a data transfer to the USA. You can obtain further information on this using the contact details given in section 1.

You can find Google's privacy policy at the following link:
https://policies.google.com/privacy?hl=en

You can find Google's cookie policy at this link:
https://policies.google.com/technologies/cookies?hl=en

3.8.9 Facebook Pixel

On our website we use the so-called "Facebook Pixel" of the social network Facebook, operated by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are based or resident in the EU or the EEA, Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Dublin, Ireland (together "Meta").

The Facebook Pixel makes it possible, on the one hand, for Facebook to identify you as a visitor to our online range as a target group for the display of ads ("Facebook Ads"). We therefore use the Facebook Pixel to show the Facebook Ads placed by us only to those Facebook users who have also shown a potential interest in our services or products. This information is forwarded to Meta and forms so-called "Custom Audiences". On the other hand, we use the Facebook Pixel to ensure that our Facebook Ads match your presumed interests. In addition, with the Facebook Pixel we can check the effectiveness of our Facebook Ads for statistical and market research purposes by seeing whether you, as a user, were forwarded to our website after clicking on a Facebook Ad (so-called "conversion").

The legal basis for the use of the Facebook Pixel with "Custom Audiences" and for the storage of "conversion cookies" is Art. 6 (1) sentence 1 lit. a) GDPR, insofar as you have given us your consent to this when you first accessed the site. You can withdraw the consent given to data processing at any time with effect for the future. To do so, please contact our data protection officer using the contact details given, or use the link for managing your consents, which you will find in the "Cookies" section of this privacy policy. Withdrawing your consent does not affect the lawfulness of the data processing carried out until the withdrawal.

With regard to the data processing, we are jointly responsible with Meta. We have therefore concluded an agreement on joint responsibility within the meaning of Art. 26 GDPR with Meta, in which Meta also undertakes to protect your personal data and not to pass it on to third parties for purposes other than those mentioned above. The agreement can be viewed at the following link:
https://de-de.facebook.com/legal/terms/page_controller_addendum

The legal basis for the transfer of personal data to the USA is either standard data protection clauses concluded with Meta within the meaning of Art. 46 (2) lit. c) GDPR or an adequacy decision of the EU Commission within the meaning of Art. 45 GDPR, namely the EU-U.S. Data Privacy Framework (DPF), for which Meta is certified and which can therefore be used as the legal basis for a data transfer to the USA. You can obtain further information on this using the contact details given in section 1.

You can find Meta's privacy notices at the following link:
https://www.facebook.com/about/privacy/

You can find the option to object to the use of personalised advertising (opt-out) as follows; to use the opt-out option you must be logged in with your Facebook account:
https://www.facebook.com/settings?tab=ads

3.8.10 Pinterest Tag

On our website we use the "Pinterest Tag", a service offered jointly by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland and Pinterest, Inc., 651 Brannan St., San Francisco, CA 94107, USA.

The Pinterest Tag enables us to measure the effects of the advertising we place and to ensure that relevant advertising is only shown to people who also have a potential interest in our services or products. This information is forwarded to Pinterest. In addition, with the Pinterest Tag we can check the effectiveness of our advertisements on Pinterest for statistical and market research purposes by seeing whether you, as a user, were forwarded to our website after clicking on advertising displayed there (so-called "conversion").

The legal basis for the use of the Pinterest Tag is Art. 6 (1) sentence 1 lit. a) GDPR, insofar as you have given us your consent to this when you first accessed the site. You can withdraw the consent given to data processing at any time with effect for the future. To do so, please contact our data protection officer using the contact details given, or use the link for managing your consents, which you will find in the "Cookies" section of this privacy policy. Withdrawing your consent does not affect the lawfulness of the data processing carried out until the withdrawal.

The legal basis for the transfer of personal data to the USA is standard data protection clauses concluded with Issuu within the meaning of Art. 46 (2) lit. c) GDPR. You can obtain further information on this using the contact details given in section 1.

You can find Pinterest's privacy notices at the following link:
https://policy.pinterest.com/en/privacy-policy

4. Cookies and Third-Party Services / Consent Management Tool (CMT)

So that the use of our websites can be made attractive for all visitors, cookies and third-party services are used, as set out above.

Cookies are text files that are created on your hard drive in order to identify the browser when you visit our website again or during a session. Cookies are used, for example, to store your choice of language. Certain cookies are technically necessary for the proper operation of our site, while other cookies enable certain functions or make our offering more attractive to you.

For cookies and services that are not technically necessary, we ask for your permission when you visit our site via our consent management tool (CMT). You can withdraw your permission at any time with effect for the future. Data processing and data transfers carried out until the withdrawal remain lawful. You can find further information on which types of cookies and web services we use in this privacy policy and in our CMT, which you can call up at any time via the corresponding link in the footer of the website.

You can prevent cookies from being stored on your hard drive by changing your browser settings accordingly. Cookies that have already been set can be deleted at any time. Please refer to your browser's instructions for how to delete cookies or prevent them from being stored. If you do not accept cookies, this may impair the use of our website.

4.1 Consent Management Tool

To manage your consents, we use the "Borlabs" tool, which is installed exclusively on our own systems or on systems operated on our behalf. Borlabs is a so-called "consent management tool", because consents to the transfer of data to third parties can be given and withdrawn through this tool. There are various types of services, which we present below. If a consent that was initially given is withdrawn, it is technically necessary for the website to be reloaded so that the service for which consent was withdrawn is no longer active.

The consent management tool itself stores your settings and the consents you have declared in its own cookie on your end device. The legal basis for this is our legal obligation to document and observe your consents within the meaning of Art. 6 (1) sentence 1 lit. c) GDPR, as well as our legitimate interest in making our website as convenient as possible to use and the storage of your consents until your next website visit that this requires within the meaning of Art. 6 (1) sentence 1 lit. f) GDPR. Your consents are deemed withdrawn vis-à-vis us if you delete the cookies on your end device and no existing consents can be identified when the website is called up. The consent management tool is then displayed again.

You can also call up the consent management tool and the privacy settings via the following link:
Individual privacy settings

4.2 Essential (Technically Necessary)

Essential services and cookies are required to enable the basic functions of our website, such as providing a secure login or the choice of language. The legal basis for their use is Art. 6 (1) sentence 1 lit. f) GDPR. Our legitimate interest lies in providing the website in a technically flawless manner.

4.3 External Media

These services and media are used to display external content to you, for example map services or externally embedded videos. Content in this category is blocked by default. If you have consented to the use of external media, access to this content no longer requires manual consent in individual cases. The legal basis for the integration of external media and services is Art. 6 (1) sentence 1 lit. a) GDPR, provided that you have declared your consent to the use of cookies and services. You can withdraw your consent at any time with effect for the future; an email to the contact address above or deleting the cookies in your browser is sufficient for this. Data processing carried out until the withdrawal remains lawful.

4.4 Statistics and Analysis (Marketing)

These services and cookies allow us to analyse the use of our website in order to evaluate and improve our services. They can also be used to enable a better customer experience on our website. This category also lists services and cookies that relate to marketing activities. The legal basis for their use is Art. 6 (1) sentence 1 lit. a) GDPR, provided that you have declared your consent to the use of cookies and services. If no consent has been given, the services are not used. You can withdraw your consent at any time with effect for the future. An email to the contact details given above, deleting cookies on your end device or the corresponding selection via the "Privacy settings" linked in the footer of this website is sufficient for this. Data processing carried out until the withdrawal remains lawful.

5. Facebook Presence

The social network Facebook is operated by Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are based or resident in the EU, Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Facebook").

When you visit our online presences on social media, your data may be automatically collected and stored for market research and advertising purposes. Using pseudonyms, so-called usage profiles are created from this data. These can be used, for example, to place advertisements inside and outside the platforms that presumably match your interests. For this purpose, cookies are generally used on your end device. Information about how cookies work is provided in our privacy notice, so please refer to the corresponding information there. The visitor behaviour and the interests of users are stored in these cookies.

The legal basis for the collection and processing of data is your consent within the meaning of Art. 6 (1) sentence 1 lit. a) GDPR, which you may have given to Facebook when calling up the websites there. You can withdraw the consent given to data processing at any time with effect for the future; to do so, please contact Facebook directly. Withdrawing your consent does not affect the lawfulness of the data processing carried out until the withdrawal.

For detailed information on the processing and use of data by Facebook, as well as a means of contact and your rights and setting options to protect your privacy in this regard, in particular options to object (opt-out), please refer to Facebook's privacy notices at:
https://www.facebook.com/about/privacy/

You can find the option to object to the use of personalised advertising (opt-out) as follows; to use the opt-out option you must be logged in with your Facebook account:
https://www.facebook.com/settings?tab=ads

Statistics are also compiled from the data collected by Facebook, which give us an insight into which groups of people are interested in the Facebook presence we offer and thus presumably also in the services we offer (Page Insights). Facebook only provides us with the data in aggregated or anonymised form, so that no conclusions can be drawn about individual persons. The data processing for Page Insights takes place on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR, which you can view at the following link:
https://www.facebook.com/legal/terms/page_controller_addendum

When using Facebook, data may also be transferred to the USA. The legal basis for the data transfer may be standard contractual clauses of the EU Commission under data protection law within the meaning of Art. 46 (2) lit. c) GDPR, which you can obtain from our data protection officer. Furthermore, Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF), which constitutes an adequacy decision of the EU Commission within the meaning of Art. 45 (3) GDPR.

6. Transfer of Personal Data to Third Countries

We use various service providers that provide us with technologies and/or products. Many of them use servers in third countries, i.e. outside the European Union or the European Economic Area, for which the EU Commission has not determined, by way of an adequacy decision, a level of data protection fundamentally equivalent to European data protection law. The associated transfer of personal data must be permissible under Art. 44 et seq. GDPR. To ensure the requirements for transfers to third countries, we agree the standard data protection clauses issued by the EU Commission with service providers that process personal data in a third country for which the EU Commission has not determined sufficiently equivalent data protection law.

For some service providers, so-called approved codes of conduct (Binding Corporate Rules – "BCR") also exist, which ensure that European data protection standards are observed within the company. Where these exist, we do not agree separate standard contractual clauses with the service providers subject to the respective BCR. The BCR are in each case reviewed by one of the European data protection supervisory authorities and approved on a case-by-case basis.

Nevertheless, it may happen that, despite contractual and technical safeguards, the level of data protection in the third country does not correspond to that in the European Union. For these cases, we ask for your consent, where necessary, during your visit to the website or when individual services on our website are called up, to the transfer of personal data to the third country pursuant to Art. 49 (1) lit. a) GDPR.

This is relevant in particular in the case of intended data processing in the USA or where data can be accessed from the USA: There, authorities and intelligence services such as the National Security Agency (NSA) may have access rights and the ability to read personal data, without us as the data exporter or you as the data subject learning of this, and without suitable legal remedies being available to prevent such access or to take action against it. However, some of our service providers undertake to exercise and exhaust the legal remedies available to you under US law against any access by authorities to your data. Some of them additionally publish transparency reports in which – as far as legally possible – requests from authorities and responses to them are listed. In July 2023, the EU Commission also adopted a new adequacy decision for data transfers to the USA with the "EU-U.S. Data Privacy Framework" (DPF), which, however, only applies to service providers that submit to special rules and legal remedies for data subjects by way of self-certification. Whether a provider is certified under the DPF can be checked on the DPF website at https://www.dataprivacyframework.gov/s/participant-search.

For the individual services, we state in this privacy policy whether we base the data transfer to a third country on standard contractual clauses, BCR, the DPF or other legal bases.

In our consent management tool, which is linked in the "Cookies" section of this privacy policy, you will find further information about the service providers from third countries that we use, as well as the legal basis and purpose of the data transfer.

7. Deletion

Personal data is deleted or blocked as soon as the purpose of storage no longer applies or you request deletion. Data is also deleted when a storage period prescribed by the relevant provision expires, unless further storage of the data is necessary for the conclusion or performance of a contract or you have given your consent to this.

8. Data Security

We protect our website and other systems by technical and organisational measures against loss, destruction, access, alteration or distribution of your data by unauthorised persons. Depending on the browser used, data is transmitted with 128-bit to 256-bit SSL encryption. Despite regular checks and continuous improvement of our security measures, complete protection against all risks is not possible.

9. Rights of the Data Subject

If personal data about you is processed, you are a data subject within the meaning of the GDPR and you have the following rights against the controller:

9.1 Right of Access

You can request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you can request the following information from the controller:

• the purposes for which the personal data is processed;
• the categories of personal data that are processed;
• the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
• the planned duration of storage of the personal data concerning you or, if specific information on this is not possible, criteria for determining the storage period;
• the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to this processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• all available information about the origin of the data if the personal data is not collected from the data subject.

9.2 Right to Rectification

You have a right to rectification and/or completion vis-à-vis the controller if the processed personal data concerning you is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

9.3 Right to Restriction of Processing

You can request the restriction of the processing of personal data concerning you under the following conditions:

• you contest the accuracy of the personal data concerning you, for a period that enables the controller to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
• the controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims, or
• you have objected to the processing pursuant to Art. 21 (1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.

If the processing of personal data concerning you has been restricted, this data may – apart from being stored – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

9.4 Right to Erasure

9.4.1 Obligation to Erase

You can request that the controller erase the personal data concerning you without undue delay, and the controller is obliged to erase this data without undue delay where one of the following grounds applies:

• The personal data concerning you is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
• You withdraw your consent on which the processing was based pursuant to Art. 6 (1) sentence 1 lit. a) or Art. 9 (2) lit. a) GDPR, and there is no other legal ground for the processing.
• You object to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.
• The personal data concerning you has been unlawfully processed.
• The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or Member State law to which the controller is subject.
• The personal data concerning you has been collected in relation to the offer of information society services pursuant to Art. 8 (1) GDPR.

9.4.2 Information to Third Parties

If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Art. 17 (1) GDPR, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you, as the data subject, have requested the erasure by such controllers of any links to, or copy or replication of, that personal data.

9.4.3 Exceptions

The right to erasure does not apply to the extent that processing is necessary

• for exercising the right of freedom of expression and information;
• for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• for reasons of public interest in the area of public health in accordance with Art. 9 (2) lit. h) and i) and Art. 9 (3) GDPR;
• for the establishment, exercise or defence of legal claims.

9.5 Right to Be Informed

If you have exercised the right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to communicate the rectification or erasure of the data or the restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients by the controller.

9.6 Right to Data Portability

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data was provided, where

• the processing is based on consent pursuant to Art. 6 (1) sentence 1 lit. a) GDPR or Art. 9 (2) lit. a) GDPR or on a contract pursuant to Art. 6 (1) sentence 1 lit. b) GDPR and
• the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This must not adversely affect the freedoms and rights of others.

9.7 Right to Object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6 (1) sentence 1 lit. e) and/or lit. f) GDPR; this also applies to profiling based on those provisions. The controller shall no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for those purposes.

In connection with the use of information society services – and notwithstanding Directive 2002/58/EC – you have the possibility to exercise your right to object by automated means using technical specifications.

9.8 Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

• is necessary for entering into, or the performance of, a contract between you and the controller,
• is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
• is based on your explicit consent.

However, these decisions must not be based on special categories of personal data pursuant to Art. 9 (1) GDPR, unless Art. 9 (2) lit. a) and/or lit. g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

9.9 Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

10. Updates to This Privacy Policy

Our website is subject to technical changes from time to time. As a result, the subject matter of the data processing may also change. It may therefore be advisable to review this privacy policy at intervals. You can tell whether there is a new version of the privacy policy from the date stated below.