Privacy policy

10 years

Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, and the working instructions and other organisational documents required for their understanding (Section 147(1) No. 1 in conjunction with (3) of the German Fiscal Code (AO), Section 14b(1) of the German VAT Act (UStG), Section 257(1) No. 1 in conjunction with (4) of the German Commercial Code (HGB)).

8 years

Accounting documents, such as invoices and expense receipts (Section 147(1) Nos. 4 and 4a in conjunction with (3) sentence 1 AO and Section 257(1) No. 4 in conjunction with (4) HGB).

6 years

Other business documents: received commercial or business letters, copies of sent commercial or business letters, other documents insofar as they are relevant for taxation, e.g. wage slips, operating statements, calculation documents, price labels, as well as payroll documents insofar as they are not already accounting documents, and till receipts (Section 147(1) Nos. 2, 3, 5 in conjunction with (3) AO, Section 257(1) Nos. 2 and 3 in conjunction with (4) HGB).

3 years

Data required to address potential warranty and compensation claims or similar contractual claims and rights and to handle related inquiries, based on prior business experience and common industry practice, is stored for the duration of the regular statutory limitation period of three years (Sections 195, 199 of the German Civil Code (BGB)).

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.

Right to withdraw consent

You have the right to withdraw consent you have given at any time.

Right of access

You have the right to request confirmation as to whether data concerning you is being processed and to obtain information about such data and further information and a copy of the data in accordance with legal requirements.

Right to rectification

You have the right, in accordance with legal requirements, to request the completion of data concerning you or the rectification of inaccurate data concerning you.

Right to erasure and restriction of processing

You have the right, in accordance with legal requirements, to request that data concerning you be erased without undue delay, or alternatively, in accordance with legal requirements, to request restriction of the processing of such data.

Right to data portability

You have the right to receive data concerning you that you have provided to us in a structured, commonly used, and machine-readable format in accordance with legal requirements, or to request its transmission to another controller.

Complaint to a supervisory authority

In accordance with legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

Types of data processed

Master data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); contract data (e.g. subject matter of contract, term, customer category); usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).

Data subjects

Service recipients and clients; prospective customers. Business and contractual partners.

Purposes of processing

Provision of contractual services and fulfilment of contractual obligations; security measures; communication; office and organisational procedures; organisational and administrative procedures. Business processes and commercial procedures.

Retention and deletion

Deletion in accordance with the section “General information on data storage and deletion”.

Legal bases

Performance of a contract and pre-contractual requests (Art. 6(1)(1)(b) GDPR); legal obligation (Art. 6(1)(1)(c) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

Online shop, order forms, e-commerce, and fulfilment of services

We process our customers' data to enable them to select, purchase, or order the chosen products, goods, and related services, as well as their payment and provision, delivery, or execution. Where necessary for the fulfilment of an order, we use service providers, in particular postal, freight, and shipping companies, to carry out delivery or execution for our customers. For processing payment transactions, we use the services of banks and payment service providers. Required information is marked as such in the order or comparable purchase process and includes the details needed for delivery or provision and billing, as well as contact information to enable follow-up communication.

Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(1)(b) GDPR).

Types of data processed

Master data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and posts, as well as related information such as authorship details or time of creation); contract data (e.g. subject matter of contract, term, customer category); log data (e.g. log files relating to logins, retrieval of data, or access times); usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).

Data subjects

Service recipients and clients; prospective customers; communication partners; business and contractual partners; third parties; users (e.g. website visitors, users of online services). Employees (e.g. employees, applicants, temporary staff, and other staff members).

Purposes of processing

Provision of contractual services and fulfilment of contractual obligations; office and organisational procedures; business processes and commercial procedures; communication; marketing; sales promotion; public relations. Financial and payment management. Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)).

Retention and deletion

Deletion in accordance with the section “General information on data storage and deletion”.

Legal bases

Performance of a contract and pre-contractual requests (Art. 6(1)(1)(b) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR). Legal obligation (Art. 6(1)(1)(c) GDPR).

Contact management and contact maintenance

Procedures required in the context of organising, maintaining, and securing contact information (e.g. setting up and maintaining a central contact database, regular updates of contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, performing backups and restorations of contact data, training staff in the effective use of contact management software, regular review of communication history, and adjustment of contact strategies).

Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).

General payment transactions

Procedures required when carrying out payment transactions, monitoring bank accounts, and controlling payment flows (e.g. creating and reviewing transfers, processing direct debits, checking account statements, monitoring incoming and outgoing payments, managing returned direct debits, account reconciliation, cash management).

Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).

Accounting, accounts payable, and accounts receivable

Procedures required for recording, processing, and controlling business transactions in accounts payable and accounts receivable (e.g. creating and reviewing incoming and outgoing invoices, monitoring and managing open items, carrying out payment transactions, handling dunning procedures, account reconciliation in respect of receivables and payables, accounts payable accounting, and accounts receivable accounting).

Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(1)(b) GDPR), legal obligation (Art. 6(1)(1)(c) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).

Financial accounting and taxes

Procedures required for recording, managing, and controlling financially relevant business transactions, as well as calculating, reporting, and paying taxes (e.g. posting and booking business transactions, preparing quarterly and annual financial statements, carrying out payment transactions, handling dunning procedures, account reconciliation, tax advice, preparing and submitting tax returns, handling tax matters).

Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(1)(b) GDPR), legal obligation (Art. 6(1)(1)(c) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).

Marketing, advertising, and sales promotion

Procedures required in the context of marketing, advertising, and sales promotion (e.g. market analysis and target group identification, developing marketing strategies, planning and running advertising campaigns, designing and producing advertising materials, online marketing including SEO and social media campaigns, event marketing and trade fair participation, customer loyalty programmes, sales promotion measures, performance measurement and optimisation of marketing activities, budget management and cost control).

Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Public relations

Procedures required in the context of public relations (e.g. developing and implementing communication strategies, planning and running PR campaigns, creating and distributing press releases, maintaining media contacts, monitoring and analysing media coverage, organising press conferences and public events, crisis communication, creating content for social media and company websites, managing corporate branding).

Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Types of data processed

Master data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and posts, as well as related information such as authorship details or time of creation). Contract data (e.g. subject matter of contract, term, customer category).

Data subjects

Service recipients and clients; prospective customers; business and contractual partners. Members.

Purposes of processing

Provision of contractual services and fulfilment of contractual obligations; office and organisational procedures. Business processes and commercial procedures.

Retention and deletion

Deletion in accordance with the section “General information on data storage and deletion”.

Legal bases

Legitimate interests (Art. 6(1)(1)(f) GDPR).

Lexware

Software for invoicing, accounting, banking, and tax filing with receipt storage.

Service provider: Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany

Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR)

Website: https://www.lexoffice.de/datenschutz/

Privacy policy: https://datenschutz.lexware.de/

Types of data processed

Usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication, and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved); log data (e.g. log files relating to logins, retrieval of data, or access times). Content data (e.g. textual or visual messages and posts, as well as related information such as authorship details or time of creation).

Data subjects

Users (e.g. website visitors, users of online services).

Purposes of processing

Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)). Security measures.

Retention and deletion

Deletion in accordance with the section “General information on data storage and deletion”.

Legal bases

Legitimate interests (Art. 6(1)(1)(f) GDPR).

Provision of the online offering on rented storage space

To provide our online offering, we use storage space, computing capacity, and software that we rent or otherwise obtain from a corresponding server provider (also referred to as a “web host”).

Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Collection of access data and log files

Access to our online offering is logged in the form of so-called “server log files”. Server log files may include the address and name of the web pages and files accessed, the date and time of access, data volumes transferred, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page), and as a rule IP addresses and the requesting provider. Server log files may be used on the one hand for security purposes, e.g. to prevent server overload (particularly in the case of abusive attacks, so-called DDoS attacks), and on the other hand to ensure server load and stability.

Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further retention is required for evidential purposes is excluded from deletion until the respective incident has been finally clarified.

Hetzner

Services in the field of providing information technology infrastructure and related services (e.g. storage space and/or computing capacity).

Service provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR)

Website: https://www.hetzner.com

Privacy policy: https://www.hetzner.com/de/rechtliches/datenschutz

Data processing agreement: https://docs.hetzner.com/de/general/general-terms-and-conditions/data-privacy-faq/

Temporary cookies (also: session cookies)

Temporary cookies are deleted at the latest after a user leaves an online offering and closes their end device (e.g. browser or mobile application).

Permanent cookies

Permanent cookies remain stored even after the end device is closed. For example, login status can be stored and preferred content displayed directly when the user visits a website again. Likewise, user data collected by means of cookies may be used for reach measurement. Unless we provide users with explicit information about the type and storage duration of cookies (e.g. in the context of obtaining consent), they should assume that these are permanent and that the storage duration may be up to two years.

Types of data processed

Meta, communication, and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).

Data subjects

Users (e.g. website visitors, users of online services).

Legal bases

Legitimate interests (Art. 6(1)(1)(f) GDPR).

Types of data processed

Master data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and posts, as well as related information such as authorship details or time of creation); usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).

Data subjects

Users (e.g. website visitors, users of online services).

Purposes of processing

Feedback (e.g. collecting feedback via online form). Provision of our online offering and user-friendliness.

Retention and deletion

Deletion in accordance with the section “General information on data storage and deletion”.

Legal bases

Legitimate interests (Art. 6(1)(1)(f) GDPR).

Types of data processed

Master data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and posts, as well as related information such as authorship details or time of creation); usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).

Data subjects

Communication partners.

Purposes of processing

Communication; organisational and administrative procedures; feedback (e.g. collecting feedback via online form). Provision of our online offering and user-friendliness.

Retention and deletion

Deletion in accordance with the section “General information on data storage and deletion”.

Legal bases

Legitimate interests (Art. 6(1)(1)(f) GDPR). Performance of a contract and pre-contractual requests (Art. 6(1)(1)(b) GDPR).

Contact form

When you contact us via our contact form, by email, or through other communication channels, we process the personal data you provide in order to respond to and handle the respective request. This typically includes details such as name, contact information, and, where applicable, further information you provide that is necessary for appropriate handling. We use this data solely for the stated purpose of contact and communication.

Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).

Types of data processed

Content data (e.g. textual or visual messages and posts, as well as related information such as authorship details or time of creation). Usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).

Data subjects

Users (e.g. website visitors, users of online services). Third parties.

Purposes of processing

Artificial intelligence (AI).

Retention and deletion

Deletion in accordance with the section “General information on data storage and deletion”.

Types of data processed

Usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).

Data subjects

Users (e.g. website visitors, users of online services).

Purposes of processing

Reach measurement (e.g. access statistics, recognition of returning visitors). Profiles with user-related information (creation of user profiles).

Retention and deletion

Deletion in accordance with the section “General information on data storage and deletion”. Storage of cookies for up to 2 years (unless stated otherwise, cookies and similar storage methods may be stored on users' devices for a period of two years).

Security measures

IP masking (pseudonymisation of the IP address).

Legal bases

Consent (Art. 6(1)(1)(a) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

plausible.io

Reach measurement and web analytics; no use of cookies or comparable persistent online identifiers; recognition of returning visitors is carried out using a pseudonymous identifier that is deleted after one day; otherwise, no personal data is stored (https://plausible.io/data-policy); processing takes place on our server; no data is transferred to third parties.

Service provider: Operation on servers and/or computers under our own data protection responsibility

Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR)

Website: https://plausible.io/

Privacy policy: https://plausible.io/privacy

Types of data processed

Contract data (e.g. subject matter of contract, term, customer category); usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).

Data subjects

Prospective customers. Users (e.g. website visitors, users of online services).

Purposes of processing

Affiliate tracking.

Retention and deletion

Deletion in accordance with the section “General information on data storage and deletion”.

Legal bases

Consent (Art. 6(1)(1)(a) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

financeAds

Affiliate marketing partner programme.

Service provider: financeAds GmbH & Co. KG, Karlstraße 9, 90403 Nürnberg, Germany

Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR)

Website: https://www.financeads.net/

Privacy policy: https://www.financeads.net/datenschutz/

Types of data processed

Contract data (e.g. subject matter of contract, term, customer category); usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Log data (e.g. log files relating to logins, retrieval of data, or access times).

Data subjects

Users (e.g. website visitors, users of online services). Business and contractual partners.

Purposes of processing

Provision of contractual services and fulfilment of contractual obligations. Affiliate tracking.

Retention and deletion

Deletion in accordance with the section “General information on data storage and deletion”.

Legal bases

Legitimate interests (Art. 6(1)(1)(f) GDPR).

Affiliate tracking

In the context of affiliate tracking, links by means of which linking websites refer users to websites with product or other offerings are logged. The operators of the respective linking websites may receive a commission if users follow these so-called affiliate links and subsequently take up the offerings (e.g. purchase goods or use services). For this purpose, providers must be able to track whether users who are interested in certain offerings subsequently take them up on the basis of affiliate links. Therefore, for affiliate links to function, they must be supplemented by certain values that become part of the link or are otherwise stored, e.g. in a cookie. The values include in particular the originating website (referrer), the time, an online identifier of the operators of the website on which the affiliate link was located, an online identifier of the respective offering, an online identifier of the user, as well as tracking-specific values such as advertising material ID, partner ID, and categorisations.

Employees

Employees are persons in an employment relationship, whether as staff, employees, or in similar positions. An employment relationship is a legal relationship between an employer and an employee established by an employment contract or agreement. It includes the employer's obligation to pay the employee remuneration while the employee provides their work performance. The employment relationship comprises various phases, including establishment, in which the employment contract is concluded, performance, in which the employee carries out their work activity, and termination, when the employment relationship ends, whether by notice, termination agreement, or otherwise. Employee data is all information relating to these persons in the context of their employment. This includes aspects such as personal identification data, identification numbers, salary and bank data, working hours, holiday entitlements, health data, and performance appraisals.

Master data

Master data comprises essential information necessary for the identification and management of contractual partners, user accounts, profiles, and similar assignments. This data may include, among other things, personal and demographic details such as names, contact information (addresses, telephone numbers, email addresses), dates of birth, and specific identifiers (user IDs). Master data forms the basis for any formal interaction between persons and services, institutions, or systems by enabling clear assignment and communication.

Content data

Content data comprises information generated in the course of creating, editing, and publishing content of all kinds. This category of data may include texts, images, videos, audio files, and other multimedia content published on various platforms and media. Content data is not limited to the content itself, but also includes metadata that provides information about the content, such as tags, descriptions, author information, and publication dates.

Contact data

Contact data is essential information that enables communication with persons or organisations. It includes, among other things, telephone numbers, postal addresses, and email addresses, as well as communication channels such as social media handles and instant messaging identifiers.

Artificial intelligence (AI)

The purpose of processing data through artificial intelligence (AI) includes the automated analysis and processing of user data to recognise patterns, make predictions, and improve the efficiency and quality of our services. This includes collecting, cleaning, and structuring data, training and applying AI models, and continuously reviewing and optimising results, and takes place exclusively with users' consent or on the basis of statutory permissions.

Meta, communication, and procedural data

Meta, communication, and procedural data are categories that contain information about how data is processed, transmitted, and managed. Metadata, also known as data about data, includes information describing the context, origin, and structure of other data. It may include details on file size, creation date, document author, and change histories. Communication data captures the exchange of information between users via various channels, such as email traffic, call logs, messages on social networks, and chat histories, including the persons involved, timestamps, and transmission paths. Procedural data describes processes and workflows within systems or organisations, including workflow documentation, logs of transactions and activities, and audit logs used to track and review operations.

Usage data

Usage data refers to information that captures how users interact with digital products, services, or platforms. This data includes a broad range of information showing how users use applications, which functions they prefer, how long they remain on particular pages, and which paths they take through an application. Usage data may also include frequency of use, timestamps of activities, IP addresses, device information, and location data. It is particularly valuable for analysing user behaviour, optimising user experiences, personalising content, and improving products or services. In addition, usage data plays a key role in recognising trends, preferences, and potential problem areas within digital offerings.

Personal data

“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Profiles with user-related information

The processing of “profiles with user-related information”, or briefly “profiles”, comprises any type of automated processing of personal data consisting of using such personal data to analyse, evaluate, or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may concern different information regarding demographics, behaviour, and interests, such as interaction with websites and their content, etc.). For profiling purposes, cookies and web beacons are frequently used.

Log data

Log data is information about events or activities recorded in a system or network. This data typically includes information such as timestamps, IP addresses, user actions, error messages, and other details about the use or operation of a system. Log data is often used to analyse system problems, for security monitoring, or to create performance reports.

Reach measurement

Reach measurement (also referred to as web analytics) is used to evaluate visitor flows to an online offering and may include the behaviour or interests of visitors in particular information, such as website content. With the help of reach analysis, operators of online offerings can, for example, determine at what times users visit their websites and which content they are interested in. This enables them, for example, to adapt website content better to the needs of their visitors. For reach analysis, pseudonymous cookies and web beacons are frequently used to recognise returning visitors and thereby obtain more accurate analyses of use of an online offering.

Controller

“Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processing

“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data, whether collecting, evaluating, storing, transmitting, or deleting it.

Contract data

Contract data is specific information relating to the formalisation of an agreement between two or more parties. It documents the conditions under which services or products are provided, exchanged, or sold. This category of data is essential for managing and fulfilling contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data may include start and end dates of the contract, the type of services or products agreed, price arrangements, payment terms, termination rights, renewal options, and special conditions or clauses. It serves as the legal basis for the relationship between the parties and is crucial for clarifying rights and obligations, enforcing claims, and resolving disputes.

Payment data

Payment data comprises all information required to process payment transactions between buyers and sellers. This data is of decisive importance for e-commerce, online banking, and any other form of financial transaction. It includes details such as credit card numbers, bank details, payment amounts, transaction dates, verification numbers, and billing information. Payment data may also include information on payment status, chargebacks, authorisations, and fees.