Privacy policy

Thank you for visiting our website. This privacy policy also applies to our other services and online presences, such as our social media presences. Below, we inform you in detail about the type, scope and purpose of the personal data we collect, use and process and inform you about your rights as a data subject.

We reserve the right to change the privacy policy at any time with effect for the future. When you visit our website again, the updated and published privacy policy will apply. The current version of the privacy policy can be accessed, saved and printed out on our website at any time.

With regard to the terms used (e.g. personal data, person responsible), we refer to the definitions of the General Data Protection Regulation (GDPR).

  I. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States as well as other data protection provisions is:

BidX GmbH
Gräfenhäuser Straße 85B
64293 Darmstadt
E-Mail: privacy@bidx.io
Phone: +49 6151 1524060

 II. Name and address of the data protection officer

The data protection officer of the controller is:

IITR Datenschutz GmbH

Dr. Sebastian Kraska
Marienplatz 2
80331 München
E-Mail: email@iitr.de
Phone: +49 89 18917360

III. General information on data processing

Scope of processing

As a matter of principle, we collect and use personal data only insofar as this is necessary for the provision of a functional website and our content and services, you have given your consent or the processing of the data is permitted by a statutory regulation.

The basis for the processing of personal data

Insofar as we obtain your consent for the processing of personal data, Art. 6 (1) sentence 1 lit. a GDPR serves as the basis for the processing of personal data.

When processing personal data that is necessary for the performance of a contract to which you are a party, Article 6 (1) sentence 1 lit. b GDPR serves as the basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.

Insofar as the processing of personal data is necessary for the fulfilment of a legal obligation to which our company is subject, Art. 6 (1) sentence 1 lit. c GDPR serves as the basis.

If the processing is necessary to protect a legitimate interest of our company or a third party and your interests, basic rights and fundamental freedoms do not outweigh the first-mentioned interest, Art. 6 (1) sentence 1 lit. f GDPR serves as the basis for the processing.

Legitimate interests in the processing

If the processing of your personal data is based on Art. 6 (1) sentence 1 lit. f GDPR, our legitimate interest, unless otherwise stated, is the performance of our business activities. In addition, we have indicated our purposes and interests in the context of the above list of processing in each case.

Data deletion and storage period

Your personal data will be erased or made unavailable as soon as the purpose of the storage no longer applies or you withdraw your consent. In addition, storage may take place if this has been provided for by the European or national legislator in union regulations, laws or other provisions to which the controller is subject. If the purpose of storage ceases to apply, if you withdraw your consent or if a storage period prescribed by the European Directive and Regulation Maker or another competent legislator expires, the personal data will be routinely made unavailable or deleted in accordance with the statutory provisions, unless there is a necessity for further storage of the data for the conclusion or performance of a contract.

Recipients of the collected data / data transmission

The recipients of the data collected via our website are primarily us as the responsible company. In addition, processors (web hoster, IT service provider, etc.) may have access to the data collected via our website. In this respect, however, compliance with the legal regulations is guaranteed by a data processing agreement that we conclude with our processors based in the EU. Data is only transferred to so-called third countries outside the EU if and insofar as this has been pointed out below.

Data transfer and processing to third countries

We only transfer data to a third country, i.e. a country outside the European Union (EU) and the European Economic Area (EEA), or have data processed via the use of third-party services in a third country, if this is a third country with a recognized level of data protection, we have concluded a so-called standard contractual clause or there are certifications or binding corporate rules.

Necessity of the disclosure of personal data

You can visit our website without personal data being collected. However, if you wish to make use of our services, the provision of personal data is mandatory contract execution

Existence of automated decision making

We do not carry out automatic decision-making or profiling within the meaning of Art. 22 GDPR.

Data security

We secure our website and other systems through comprehensive technical and organizational measures against loss, destruction, access, modification or distribution of your data by unauthorized persons. These measures are subject to constant review and improvement in order to ensure state-of-the-art technology.

IV. Data processing when using our website and making use of our services

Hosting via Amazon Web Services

We host our website on servers operated by Amazon Web Services Inc, 410 Terry Avenue North Seattle WA 981009, USA ("AWS").

Through AWS, we provide a technical infrastructure to offer our products and services to customers, prospects and business partners.

When you use our website, your (anonymized) IP and the duration of your visit to our website are transmitted to AWS.

AWS also automatically stores access data in so-called server log files each time you call up our website. This includes date and time of access, browser used and its version, IP address, referrer URL (URL you visited immediately before).

The temporary storage of the IP address by the system is necessary to enable delivery of the website to your terminal device. For this purpose, your IP address must remain stored for the duration of the session. We only use servers located in the EU, so your data is only hosted and processed within the EU.

The basis for the temporary storage of your data and the log files is our legitimate interest Art. 6 (1) sentence 1 lit. f GDPR.

The aforementioned data is evaluated exclusively to ensure the permanent and trouble-free operation of our website and the security of our information technology systems. For this purpose, the above-mentioned data is stored for a maximum of 7 days.

The collection of data for the provision of the website and the storage of the data in log files is mandatory for the operation of our website. Therefore, there is no possibility to object.

Further information on data protection can be found in the privacy policy of AWS https://aws.amazon.com/de/compliance/data-privacy/.

Use of Cookies

In order to make visiting our website more attractive and to enable the use of certain functions, we use so-called "cookies" on our website. These are small text files that are stored on your end device via a browser.

Many cookies contain a so-called cookie ID. It consists of a string of characters by which websites and servers can be assigned to a specific browser in which the respective cookie was stored.

We set the following cookies:

Technically necessary cookies are required to operate our website. In addition, there are also cookies that analyze user behavior so that we can constantly improve our website

The purpose of using technically necessary cookies is to enable you to use our website (e.g. your log-in data is stored). Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that your browser is recognized even after a page change. If technically necessary cookies are deactivated, the functionality of our website may be limited.

The basis for the processing of personal data using necessary cookies is Art. 6 (1) sentence 1 lit. f GDPR. The basis for the processing of personal data using cookies, which are not necessary for the operation of our website, is Art. 6 (1) sentence 1 lit. a GDPR in the presence of your consent in this regard.

When you access our website, you will be informed about the use of cookies. You can declare your consent to the processing of personal data used in this context within the framework of the so-called cookie banner. In this context, there is also a reference to this privacy policy. You can withdraw your consent at any time with effect for the future.

To analyze your surfing behavior (so-called tracking), the third-party services we integrate also use cookies (so-called third-party cookies). Please refer to the websites of the respective providers for information on the respective mode of operation and data processing. The third-party services used by us can be found in this privacy policy.

Cookies are stored on your terminal device and transmitted to our website. You therefore have control over the use of cookies. You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them or exclude the acceptance of cookies for certain cases or in general or set it so that the setting of cookies is prevented and thus permanently object to the setting of cookies. In addition, you can delete cookies that have already been set at any time via your browser. A comprehensive objection to online marketing cookies can also be declared via http://www.youronlinechoices.com/, among other places. This also applies to all third-party cookies listed below.

Data collection and use during registration and use of our services/utilization of our services

You have the option to register on our website. When you create an account or register, you must provide certain mandatory information to access and manage your account ("mandatory information"). Mandatory information within the scope of registration is marked with an asterisk and are required for the conclusion of the user agreement. Which data is collected can be seen from the respective input form. In the context of registration these are: Your e-mail address. In addition, you must create a password. If you do not provide this data, you will not be able to create an account.

If you sign up for a paid subscription, we also need your name, (company) address, VAT ID and company name. If you want to use our services by linking your Amazon account to our service, we also collect your Amazon ID.

We use the information you provide to authenticate you when you log in and to follow up on password reset requests, to verify your eligibility to manage the account, to enforce the Website Terms of Use and all related rights and obligations, and to contact you to send you technical or legal notices, updates, security alerts, or other messages, such as those related to the management of the account.

We also use your information to bill you for our services. Accordingly, we use the data you provide only to process the contract and provide our services to you under the contract. We may also pass on your data to one or more processors (e.g. payment service providers), who will also use your data exclusively for internal use on our behalf.

The basis for the processing of your data is the performance of our contract with you according to Art. 6 (1) sentence 1 lit. b GDPR .

We also store your IP address and the date and time of registration to prevent misuse of our website and the services offered on it and to clarify any criminal offences that may have been committed. The storage of this data is therefore necessary for our own protection. The basis for this processing of personal data is Art. 6 (1) sentence 1 lit. f GDPR. In the aforementioned purposes also lies our legitimate interest in the data processing.

After complete processing of the contract or deletion of your account, your data will initially be made unavailable for further use and deleted after expiry of the statutory retention periods, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you below.

You have the option to object to the processing at any time and to delete your account. In such a case, the contractual relationship with you cannot be continued.

Order via Amazon

You also have the option to order our services via Amazon.co.uk, a service of Amazon Europe Core SARL, Société à, responsabilité limitée, 38 avenue John F. Kennedy, L-1855 Luxembourg ("Amazon").

In this case, we process your data as described in the section "Data collection and use when registering and using our services/using our services".

The Privacy Policy https://www.amazon.de/gp/help/customer/display.html/ref=footer_privacy?ie=UTF8&nodeId=201909010 and the Terms of Use https://www.amazon.de/gp/help/customer/display.html/ref=hp_left_v4_sib?ie=UTF8&nodeId=GLSBYFE9MGKKQXXM of Amazon apply in addition.

Login via Google Single Sign-On

You can also sign up for our services via Google Single Sign-On. Google Single Sign-On is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). If you use Google Single Sign-On, there is no need for additional registration.

You can only use Google Single Sign-On if you have set up an user account at Google. During registration, you enter the existing login details for your Google user account or, if you are already logged in, confirm the sign up with a click.

By signing up, your profile on Google and our services will be linked. The link will result in authentication in the course of which we will automatically receive a user ID from Google that confirms that you are logged in to Google. We will also receive your email address and username and, depending on your Google settings, other information such as profile pictures.

The authentication information is required to register and identify you. The legal basis for the processing of your personal data is therefore the fulfillment of our contract with you Art. 6 para. 1 sentence 1 lit. b GDPR. In addition, we process your data based on our and your interest in a fast and secure registration process Art. 6 para. 1 sentence 1 lit. f GDPR.

You can delete the link between Google Single Sign-On and our service at any time in your Google account. In this case, you will need another sign-in method to continue using our services. You must set up the alternative sign-in method in your account before deleting the link to Google Single Sign-On, otherwise we will no longer be able to assign you to your account.

For more information about Google Single Sign-On, please refer to Google's privacy policy at https://policies.google.com/privacy.

In all other respects, the same provisions on withdrawal and deletion periods apply as for registration via our website, as explained above under “Data collection and use when registering and using our services/using our services”.

Use of Facebook Remarketing

We use a "Custom Audience" remarketing function on our website provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Facebook").

To implement the "Custom Audience" functions, we have implemented Facebook's remarketing pixel on our website. This pixel establishes a direct connection to the Facebook servers when you visit our website. This transmits to the Facebook server which sub-page of our website you have visited. Facebook assigns this information to your personal Facebook user account.

This feature allows us to target you with advertising by displaying personalized, interest-based Facebook ads when you visit the social network Facebook (accessible at www.facebook.com). The purpose of remarketing is to be able to show you targeted products in advertisements that are of interest to you.

We are jointly responsible with Facebook for collecting or receiving data that Facebook collects through the Pixel. We are also jointly responsible for submitting data to display content and advertising information that matches your presumed interests, to deliver commercial and transactional messages, and to improve ad delivery and personalization of features and content.

For this purpose, we have reached the following agreement with Facebook on joint cooperation as responsible parties: https://www.facebook.com/legal/controller_addendum.

Since Facebook has agreed to fulfill your data subject rights, you can contact Facebook directly for inquiries and information.

In all other instances, Facebook will only act as our processor.

The basis for the processing of personal data is Art. 6 (1) sentence 1 lit. a GDPR if you have given your consent.

You can give your consent via our cookie banner and withdraw it in the settings at any time with effect for the future.

For more information on the collection and use of data by Facebook, your rights in this regard and options for protecting your privacy, please refer to Facebook's privacy policy at https://www.facebook.com/about/privacy/. If you do not want Facebook to assign the collected information directly to your Facebook user account, you can deactivate the remarketing function "Custom Audience" here https://www.facebook.com/settings/?tab=fcebokads#_=_. To do this, you must be logged in to Facebook.

LinkedIn Insight-Tag

We use the conversion tracking technology and the retargeting function of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn") on our website.

The LinkedIn Insight Tag is integrated on our website, and a cookie is also set on your end device by LinkedIn. This informs LinkedIn that you have visited our website. In this process, your IP address, the time of the call of the respective subpage and so-called events, such as page views, are collected. This allows us to recognize via which LinkedIn display or interaction on LinkedIn you came to our website. With the help of this data, we can statistically evaluate the use of our website and continuously optimize our website and better play our advertising.

LinkedIn assigns the named data to your personal LinkedIn user account. If you are logged in to LinkedIn, you can deactivate the data collection at any time using the following link: https://www.linkedin.com/psettings/enhanced-advertising.

For more information on data protection, please refer to LinkedIn's privacy policy https://de.linkedin.com/legal/privacy-policy.

Google Tag Manager

We use the Google Tag Manager, of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Tag Manager aggregates most tracking pixels and scripts to help you, the user, load our website faster. The Google Tag Manager is a solution with which we can manage so-called website tags via an interface and thus integrate, for example, Google Analytics and other Google marketing services into our online offer. Which data is processed within the scope of the other Google services can be found in the information in this privacy policy. Google only learns your IP address, which is necessary to run the Google Tag Manager. However, no personal data of yours will be processed.

For more information on the Google Tag Manager, please refer to the Terms of Use of the Tag Manager https://www.google.com/intl/de/tagmanager/use-policy.html.

Google Analytics

We used Google Analytics on our website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses methods that enable an analysis of your use of the website, in particular from which internet page you came to our website (so-called referrer), which sub-page you access or how often and for how long you view a sub-page. Google Analytics uses cookies for this purpose. Each time you call up a page of our website on which Google Analytics has been integrated, your browser on your end device is automatically caused to transmit data to Google Analytics for the purpose of analysis.

By activating IP anonymization on our website, the IP address is shortened before transmission within the Member States of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The anonymized IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.

Google will use this information on our behalf for the purpose of evaluating your use of our website and that of our other users, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage.

The basis for the processing of personal data in the presence of your consent in this regard is Art. 6 (1) sentence 1 lit. a GDPR.

You can give your consent via our cookie banner and revoke it in the settings at any time with effect for the future.

The terms of use and privacy policy of Google and Google Analytics can be found here https://policies.google.com/privacy and here http://www.google.com/analytics/terms/de.html.

Google Ads with Remarketing Pixel

We used Google Ads on our website, an online service that enables the placement of advertisements on third-party sites, which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Ads is based on an algorithm that selects the advertisements displayed on our website to match our content. Google Ads allows an interest-based targeting of all visitors, which is done by creating individual user profiles. Google uses cookies for this purpose. By each individual call of a page of our website on which a component of Google Ads has been integrated, your browser on your end device is automatically caused to transmit data to Google Ads for the purpose of online advertising and the settlement of commissions. In this way, Google obtains knowledge of personal data that Google uses to determine the type of advertising to be played and to be able to track the clicks on this advertising. Among other things, Google can recognize that you have clicked on the advertising on this website.

Google also uses tracking pixels, a miniature graphic that is embedded in websites, to enable log file recording and log file analysis, whereby a statistical evaluation can be performed. Based on the embedded tracking pixel, Google can see if and when a website was opened and which links were clicked. We only learn the total number of users who clicked on our ad and were redirected to a page tagged with a conversion tracking tag. However, we do not receive any information with which users can be personally identified.

The basis for the processing of personal data is Art. 6 (1) sentence 1 lit. a GDPR if you have given your consent in this regard.

You can give your consent via our cookie banner and revoke it in the settings at any time with effect for the future.

For more information on data protection, please refer to the privacy policy of Google https://policies.google.com/privacy.

Indeed Conversion Tracking

We use Indeed conversion tracking on our website, a service provided by Indeed Ireland Operations Limited at 124 St. Stephen's Green, Dublin 2, Ireland ("Indeed").

For conversion tracking, a cookie is set on your terminal device when you click on a job ad placed by us at https://de.indeed.com/. The cookie is used to send information to Indeed when you complete your application. Via the cookie, information is transmitted to the conversion tracker when the application is completed, which counts the number of applications received. The information obtained using the conversion cookie is used to create conversion statistics for us. We learn the total number of users who clicked on our ad and completed an application. However, we do not receive any information that can be used to personally identify users.

The basis for the processing of personal data is Art. 6 (1) sentence 1 lit. a GDPR if you have given your consent in this regard.

You can give your consent via our cookie banner and revoke it in the settings at any time with effect for the future.

The cookies set lose their validity after 30 days and are not used for personal identification.

Further information on data protection can be found in the privacy policy of Indeed https://hrtechprivacy.com/de/brands/about-indeed#privacypolicy.

Hotjar

We used the analytics and user feedback collection service Hotjar, of Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta ("Hotjar") on our website.

With the help of Hotjar, we can better understand your user behavior and get your feedback through tools such as heatmaps, session recordings, and surveys. To do this, Hotjar collects your usage data (e.g. web pages visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses). Hotjar uses cookies for this purpose. Each time you call up a page of our website on which Hotjar has been integrated, your browser on your terminal device is automatically caused to transmit data to Hotjar for the purpose of analysis.

Hotjar will use this information on our behalf to evaluate the use of our website by you and our other users, for reach measurement (e.g. access statistics, recognition of returning visitors), for tracking (e.g. interest/behavior-based profiling, use of cookies), for visit action evaluation, profiling, click tracking, for A/B testing, to collect feedback e.g. via online form, to create heat maps and to create surveys and questionnaires. This data is stored by Hotjar in a pseudonymized user profile.

The basis for the processing of personal data is Art. 6 (1) sentence 1 lit. a GDPR if you have given your consent in this regard.

You can give your consent via our cookie banner and revoke it in the settings at any time with effect for the future.

Please note that the deactivation of Hotjar must be done separately for each browser or end device.

The data will be deleted by Hotjar after one year at the latest.

Further information on data protection can be found in the privacy policy of Hotjar https://www.hotjar.com/legal/policies/privacy/.

LeadRebel

We analyze the data of visitors to our website and pass on the data obtained in the course of this IP research to leadREBEL, a service of Pulserio AG, Schellenrainstrasse 13, 6210 Sursee, Switzerland ("leadREBEL").

In this context, we process your contact data for lead generation.

The basis for the processing of personal data is Art. 6 (1) sentence 1 lit. a GDPR if you have given your consent in this regard.

Otherwise, the data is processed on the basis of our legitimate interest Art. (1) sentence 1 lit. f GDPR. Our legitimate interest here is lead generation through analysis of the data obtained with the help of the IP search.

Via the following link, leadREBEL offers you an opt-out option: https://leadrebel.io/optout. In the event of an opt-out, your data will no longer be collected by leadREBEL.

For further information on data protection, please refer to leadREBEL's privacy policy https://leadrebel.io/de/privacy.

Expandi

We use the Expandi tool, which is operated by ProfitSoft B.V., Meerenakkerplein 51, Eindhoven, 5652BJ, the Netherlands ("Expandi.io"), to automate our lead generation via the LinkedIn.com platform.

Through Expandi.io, we can automate lead generation processes on LinkedIn.com. In this course, we process the data published by you on the LinkedIn platform as well as the data exchanged by you within the communication with us.

The basis for the processing of personal data is our legitimate interest Art. 6 (1) sentence 1 lit. GDPR. Our legitimate interest is the expansion of our business model and the generation of new business contacts.

For further information on data protection, please refer to Expandi.io's privacy policy https://expandi.io/privacy-notice/.

HubSpot

We use Hubspot on our websites, a service of Hubspot Inc, a software company from the USA with a European branch under HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland ("Hubspot").

We use HubSpot to contact users of our website and to determine which of our company's services are of interest to you. We therefore use HubSpot for analysis purposes as well as for marketing purposes.

The basis for the processing of personal data is Art. 6 (1) sentence 1 lit. a GDPR if you have given your consent.

You can give your consent via our cookie banner and withdraw it in the settings at any time with effect for the future.

For more information, please see Hubspot's privacy policy https://legal.hubspot.com/de/privacy-policy.

Aircall

We use the service of the provider Aircall SAS, 11 Rue Saint-Georges 75009 Paris, France, (“Aircall”) for an efficient and fast handling of service requests.

Aircall is a telephone system for processing customer requests. Through Aircall, we process your customer data stored with us, as well as the data of your call, such as call time and number at which you contact us, as well as the data you provide to us during your call. We use the personal data you provide exclusively for processing your specific request.

The basis for processing the data is Art. 6 (1) sentence 1 lit. f GDPR. If the purpose of contacting you is to conclude a contract, the additional basis for processing is Art. 6 (1) sentence 1 lit. b GDPR.

The data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. This is the case when the respective conversation with you has ended. The conversation is ended when the circumstances indicate that the matter in question has been conclusively clarified. If you are a customer of ours, we will store your data during the entire contractual relationship with you until the expiry of any claim periods.

If you contact us, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued.

Further information can be found in the privacy policy of Aircall https://aircall.io/privacy/.

ClickUp

We use for internal organization and structuring the CRM management tool ClickUp, of Mango Technologies Inc, 363 Fifth Ave. Suite 300, San Diego, CA 92101 ("ClickUp").

As part of ClickUp, we process your contact and master data, as well as data relating to your orders and the contractual relationship with you, as well as data relating to communication with us.

The basis for the processing of your data is the fulfillment of our contract with you pursuant to Art. 6 (1) sentence 1 lit. b GDPR. Otherwise, the basis for the processing of the data is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in the effective processing of our contract with you.

Further information on data protection can be found in the privacy policy of ClickUp https://clickup.com/privacy. 

Social Media

In addition to this website, we also maintain presences in various social networks. If you visit such a presence, personal data may be transmitted to the provider of the social network. It is possible that in addition to the storage of the specific data entered by you in this social network, further information will also be processed by the provider of the social network. For example, your data will usually be processed for market research and advertising purposes, including to create corresponding usage profiles and to display personalized advertising to you. For this purpose, the provider of the social network usually stores cookies on your terminal device in which your usage behaviour and interests are saved. In addition, the provider of the social network may process the most important data of the computer system from which you visit it - for example, your IP address, the processor type and browser version used, including plugins.

If you are logged in with your personal user account of the respective network while visiting such a network, this network can assign the visit to your account. If you do not wish such an assignment, you must log out of your account and delete the cookies before visiting our social media presence.

The basis for the processing of personal data is Art. 6 (1) sentence 1 lit. f GDPR. If you have given your consent to the processing to the respective provider of the social network, the basis for the processing of your data is Art. 6 (1) sentence 1 lit. a GDPR

We maintain presences in the respective social networks to be able to communicate with you there and to inform you about our services. These purposes are also our legitimate interest in processing the personal data in accordance with Art. 6 (1) sentence 1 lit. f GDPR.

For further information on the purpose and scope of data collection as well as on the further processing and use of your data and the possibility of opting out, please refer to the data protection provisions of the respective network:

Facebook

Facebook is operated by Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We have concluded a data sharing agreement with Facebook in accordance with Art. 26 GDPR. We are jointly responsible with Facebook for collecting the data of visitors to our Facebook page (so-called "fan page"). However, Facebook is the sole controller for processing data. Further information on joint data processing can be found in Facebook's terms and conditions under "Things you and others do and provide" in Facebook's privacy policy.

Privacy policy: https://www.facebook.com/about/privacy/

Opt-Out: https://www.facebook.com/settings?tab=ads

Instagram

Instagram is operated by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA.

Privacy policy and opt-out: http://instagram.com/about/legal/privacy/

X

X is operated by X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.

Privacy policy: https://twitter.com/de/privacy

Opt-Out: https://twitter.com/personalization

Google / YouTube

Google and Youtube are operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Privacy policy: https://policies.google.com/privacy

Opt-Out: https://adssettings.google.com/authenticated

LinkedIn

LinkedIn is operated by LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland.

Privacy policy: https://www.linkedin.com/legal/privacy-policy

Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Integration of Youtube

We embed videos from the social network youtube.com on our website, which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

When you visit our website, a direct connection to the YouTube servers is established via your browser. Your browser is automatically prompted by the respective video embedded on our website to download a representation of the corresponding component from YouTube. As part of this technical process, YouTube receives information about which specific sub-page of our website you are visiting.

If you use the videos, the corresponding information - e.g. pressing the play button - is transmitted from your browser to YouTube, possibly linked to your user account and stored.

The basis for the use of your data is Art. 6 (1) sentence 1 lit. f GDPR.

Our legitimate interest in data processing pursuant to Art. 6 (1) sentence 1 lit. f GDPR lies in the optimization and economic operation of our website.

If you are logged in with your personal Google account while visiting our website, YouTube can associate your visit and the specific sub-pages of our website you visit with your account.

If you do not have a Google account, there is still a possibility that YouTube will store your IP address.

If you do not wish such processing, you must log out of your Google account and delete your cookies before visiting our website.

You can object to the use of your data by Google at any time by clicking on the following link: https://adssettings.google.com/authenticated

For further information on data protection, please refer to YouTube's privacy policy https://policies.google.com/privacy.

E-Mail

Due to legal regulations, we provide information on our website that enables a quick electronic contact to us as well as direct communication with us. This includes, in particular, our e-mail address. If you contact us by e-mail, the personal data you send us will be stored automatically.

The basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 (1) sentence 1 lit. f GDPR. If the purpose of the contact is to conclude a contract, the additional the basis for the processing is Art. 6 (1) sentence 1 lit. b GDPR.

However, we use the personal data you provide exclusively for processing your specific enquiry. The data provided will always be treated confidentially.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data sent by e-mail, this is the case when the respective conversation with you has ended. The conversation is ended when the circumstances indicate that the matter in question has been conclusively clarified. If you are a customer of ours, we will store your data throughout the contractual relationship with you until the expiry of any claim periods.

If you contact us, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued.

Payment service provider

We use the payment service providers PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg ("PayPal") and Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland ("Stripe") to process payments.

You transmit to the respective payment service provider via the input form your inventory data, such as first name, last name, address, date of birth, e-mail address, IP address, telephone number, cell phone number, as well as your bank data, insofar as they are necessary for payment processing, such as account numbers, credit card numbers, passwords, TANs, verification numbers, validity date and CVC code. In order to process the payment, data related to your respective order, such as prices and tax charges or information on previous ordering behavior, will also be transmitted to the respective payment service provider.

The transmission of the data is solely for the purpose of processing the payment. The basis for the transmission of data to the respective payment service provider is therefore Art. (1) sentence 1 lit. b GDPR, insofar as the payment serves to fulfill a contract. Furthermore, we use external payment service providers on the basis of our legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f. GDPR in order to offer you effective and secure payment options. If you already have a separate contractual relationship with the payment service provider, the payment service provider acts as the responsible party and not as our processor.

We do not receive access to the data entered, these are processed and stored exclusively by the payment service provider. We only receive information about whether the payment was successful or not. The payment service providers may transmit your data to credit agencies for identity and credit checks as well as for fraud prevention.

The terms and conditions of the respective payment service provider apply to payment transactions. For further information on data protection, please refer to the respective privacy policy of PayPal https://www.paypal.com/de/webapps/mpp/ua/privacy-full and Stripe https://stripe.com/de/privacy#translation.

Billing via FastBill

We use FastBill GmbH, Wildunger Str. 6, 60487 Frankfurt am Main ("FastBill"), to bill our services.

For the billing of our services, we collect your name and billing data such as address, amount and term as well as a transaction number. Based on this data, our services are billed via FastBill.

The basis is Art. 6 (1) sentence 1 lit. b. GDPR, insofar as the payment serves to fulfill a contract. Furthermore, we use external payment service providers on the basis of our legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f. GDPR in order to offer you effective and secure billing for our services.

Your data will be stored by us until the expiry of statutory retention periods and then deleted.

For more information on data protection, please refer to Fastbill's privacy policy https://www.fastbill.com/datenschutz.

Internal organization

For our internal organization and provision of our services, in particular for our communication and for the storage of files and documents, we use the following services

Google Drive, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, ("Google"),

Slack Messenger, a service of Slack Technologies Limited, One Park Place, Upper Hatch Street, Dublin 2, Ireland, ("Slack"),

Confluence, Jira and Trello, services of Atlassian, Level 6, 341 George Street, Sydney, NSW. 2000, Australia ("Atlassian").

In the course of using the aforementioned services, your personal data may be processed and stored on the servers of the aforementioned providers. This includes, in particular, your master data and contact data, data relating to internal processes, data relating to our contract with you, data relating to our communication with you and other internal processes.

The basis for the processing of your data is the fulfillment of our contract with you Art. 6 (1) sentence 1 lit. b GDPR. The basis is also our legitimate interest in the internal administration and provision of our services to you Art. 6 (1) sentence 1 lit. f GDPR.

The providers may also process your data and the collected metadata for their own security purposes, for service optimization or for marketing purposes.

You can find further information in the privacy policy  

of Google www.google.com/policies/privacy/,

of Slack https://slack.com/intl/de-de/trust/privacy/privacy-policy and

from Atlassian https://www.atlassian.com/de/legal/privacy-policy.

Application process / Recruitment with Personio

You have the option of applying to us by mail, e-mail or via our online form.

We can only carry out the application process if you provide us with the necessary applicant data. The necessary applicant data is either marked or results from the respective job description. The necessary applicant data basically includes personal details, postal and contact addresses as well as the documents belonging to the application, such as cover letter, curriculum vitae and certificates. You may also voluntarily provide us with additional information.

By submitting your application to us, you consent to the processing of your data for the purposes of the application process.

The basis for the processing of personal data is the fulfillment of our (pre)contractual obligations in the context of the application process within the meaning of Art. 6 (1) sentence 1 lit. b. GDPR. Furthermore, the basis is our legitimate interest Art. 6 (1) lit. f. GDPR insofar as the data processing becomes necessary for us, e.g. in the context of legal proceedings. If you voluntarily provide us with special categories of personal data within the meaning of Art. 9 (1) GDPR as part of the application process (e.g. health data, severely disabled status or ethnic origin), the basis for processing is Art. 9 (2) lit. GDPR. If we request special categories of personal data from you within the meaning of Art. 9 (1) GDPR as part of the application process (e.g. health data), the basis for processing is Art. 9 (2) a GDPR.

If you send us applications by e-mail, we would like to expressly point out that e-mails are generally not sent encrypted and ask you to encrypt your e-mails yourself. Otherwise, we recommend that you use an online form or send your application by post.

We use the software of Personio GmbH, Rundfunkplatz 4, 80335 Munich ("Personio") to transmit applications via our online form. If you send us your application via our online form, we collect the above-mentioned data.

For further information on data protection, please refer to the Personio privacy policy https://www.personio.de/datenschutzerklaerung/.

The data provided by you as part of the application process may, in the event of a successful application, be further processed by us for the purposes of the employment relationship.

If your application is not successful, your data will be deleted after six months so that we can answer any follow-up questions about the application and meet our obligations to provide evidence under the Equal Treatment Act. Your data will also be deleted if you withdraw your application. Invoices for any reimbursement of travel expenses will be archived in accordance with tax law requirements.

V.        Data subjetcs‘ rights

If your personal data are processed, you have the following rights as a data subject within the meaning of the GDPR:

Right of access (Art. 15 GDPR)

You have the right to request confirmation as to whether we are processing data relating to you. You also have the right to obtain from us, at any time and free of charge, information about the personal data stored about you and a copy of this data in accordance with the legal requirements.

Right to rectification (Art. 16 GDPR)

You have the right to request the immediate rectification and/or completion of inaccurate or incomplete personal data concerning you. We shall carry out the correction without delay.

Right to restriction of processing (Art. 18 GDPR)

You have the right to demand that we restrict processing if one of the legal requirements is met.

Right to erasure (Art. 17 GDPR)

You have the right to request that we delete the personal data concerning you without delay, provided that one of the legal grounds applies and insofar as the processing is not necessary.

Right to information

If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom the personal data relating to you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed about these recipients.

Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, common and machine-readable format in accordance with the legal requirements. You also have the right to transfer this data to another data controller without hindrance from us in accordance with the legal requirements. You also have the right, in accordance with the law, to have the personal data transferred directly from us to another data controller, insofar as this is technically feasible and insofar as this does not affect the rights and freedoms of other persons.

Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data relating to you which is carried out on the basis of Article 6 (1) sentence 1 lit. e or f GDPR. This also applies to profiling based on these provisions.

We will no longer process the personal data in the event of objection, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If we process your personal data for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such marketing. This also applies to profiling, insofar as it is connected with such direct marketing. If you object to us processing your personal data for direct marketing purposes, we will no longer process your personal data for these purposes.

You can contact us at any time to exercise your right to object.

Right of withdrawal in case of consent

You have the right to withdraw your consent to the processing of personal data at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.

Right to automated decisions in individual cases including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, provided that the decision is

• is not necessary for the conclusion or performance of a contract between you and us, or
• is permitted under Union or Member State legislation to which we are subject and that legislation contains appropriate measures to safeguard your rights and freedoms and your legitimate interests; or
• is done with your express consent.

Is the decision

• necessary for the conclusion or performance of a contract between you and us or
• it is done with your express consent,

we take reasonable steps to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain the intervention of a person on our part, to express our own point of view and to contest the decision.

Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

STAND: October 2023