Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

ZEP GmbH

Stuttgarter Str. 41

71254 Ditzingen

Phone: +49 7156 / 43623-0

Email: support@zep.de

2. Data Protection Officer

You can contact our data protection officer as follows:

Kertos GmbH

Brienner Str. 41

80333 München

Germany

dsb@kertos.io

+49 151 525 797 93

3. What is personal data?

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, information such as your name, age, address, telephone number, date of birth, email address or IP address. Information that we cannot link to you as a person (or can do so only with disproportionate effort), e.g. because the information has been anonymised, is not personal data. The processing of personal data (e.g. its collection, retrieval, use, storage or transmission) always requires a legal basis, such as your consent.

4. Data processing on our website

Provision and use of the website

Scope and purpose of data processing

We collect and use our users’ personal data only to the extent technically necessary to provide a functional website and our content and services or information. When you access and use our website, we collect personal data that your browser automatically transmits to our server. This information is temporarily stored in what is known as a log file.

The following information is recorded without any action on your part and stored until it is automatically deleted:

• IP address of the requesting computer,
• date and time of access,
• name and URL of the file retrieved,
• website from which access is made (referrer URL),
• the browser used and, where applicable, your computer’s operating system and the name of your access provider.

We process the aforementioned data for the following purposes:

• Ensuring a smooth connection to the website
• Ensuring convenient use of our website
• For IT security purposes

Legal basis

Art. 6(1)(f) GDPR serves as the legal basis. The processing of the aforementioned data is necessary to provide a website and to enable its secure and convenient use, and therefore serves to safeguard a legitimate interest of our company.

Storage period and data erasure

As soon as the aforementioned data is no longer required for displaying the website, it is deleted (after 30 days at the latest). The collection of data for the provision of the website and the storage of data in log files is strictly necessary for the operation of the website. The user therefore has no option to object. Further storage takes place in individual cases where required by law.

Third parties

We use an external service provider to host the website, Webflow, Inc, 398 11th St., Floor 2, San Francisco, CA 94103 (hereinafter: “Webflow”). Your personal data is passed on to Webflow in order to provide the services. Webflow’s servers are located in the United States, so it is possible that the personal data collected will be transferred to the United States. There is an adequacy decision of the EU Commission for data transfers to the USA, the EU-U.S. Data Privacy Framework. “Webflow” is certified under this framework, which is why such transfers are based on the legal basis of Art. 45 GDPR.

Further information can be found in Webflow’s privacy policy:

https://webflow.com/legal/eu-privacy-policy

Contact by email

Scope and purpose of data processing

On our website, we offer you the opportunity to contact us by email. If you contact us, the personal data you provide, such as your title, name, the content of the email and your email address, will be processed. We process this data in order to be able to handle your enquiry properly. If you contact us by email, your personal data will not be passed on to third parties.

Legal basis

The data processing described above for the purpose of contacting us is carried out on the basis of Art. 6(1)(f) GDPR, on the basis of our legitimate interest in being able to handle your enquiry. If your enquiry serves to prepare the conclusion of a contract, Art. 6(1)(b) GDPR is an additional legal basis.

Storage period and data erasure

As soon as your enquiry has been dealt with and the matter has been conclusively resolved, your personal data processed via the contact form will be deleted. Further storage may take place in individual cases if this is required by law or necessary for the performance of a contract.

Contact form

Scope and purpose of data processing

On our website, we offer you the opportunity to contact us via a contact form, e.g. for a consultation. For this purpose, we use “Webflow” of Webflow, Inc. 398 11th St., Floor 2, San Francisco, CA 94103 (hereinafter: “Webflow”). Your personal data is passed on to Webflow in order to provide the services. Webflow’s servers are located in the United States, so it is possible that the personal data collected will be transferred to the United States. There is an adequacy decision of the EU Commission for data transfers to the USA, the EU-U.S. Data Privacy Framework. “Webflow” is certified under this framework, which is why such transfers are based on the legal basis of Art. 45 GDPR.

If you contact us using this form, the following personal data will be processed:

• Name
• Email address
• Telephone number
• Nationality
• Reason for the enquiry

We process this data in order to be able to handle your enquiry properly. When you use the contact form, your personal data will not be passed on to third parties.

Legal basis

The data processing described above for the purpose of contacting us is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in being able to handle your enquiry. If your enquiry serves to prepare the conclusion of a contract, Art. 6(1)(b) GDPR is an additional legal basis.

Storage period and data erasure

As soon as your enquiry has been dealt with and the matter has been conclusively resolved, your personal data processed via the contact form will be deleted. Further storage may take place in individual cases if this is required by law or necessary for the performance of a contract.

Demo booking

You have the option of booking a demo of our platform on our website. For this purpose, we provide you with the “Book a demo” function. To enable this, we use the “HubSpot” service provided by HubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA (hereinafter: “HubSpot”).

The following personal data is processed through the use of HubSpot:

• Your name
• Your email address
• Your company name

HubSpot is used for quick and easy communication so that we can offer you an available appointment for the demo. This allows you to see quickly when we have an available appointment and to select it.

Your personal data is processed in order to carry out a pre-contractual measure, as you request a product presentation by using the “Book a demo” function. The lawfulness of the processing of your data is therefore based on Art. 6(1)(b) GDPR. If no contract is concluded, the data will continue to be stored by us even after negotiations have been terminated. The legal basis for this is Art. 6(1)(f) GDPR. The legitimate interest derives from the fact that we wish to ensure organised and efficient planning of our demos.

Thereafter, we store the data only for as long as strictly necessary. Further storage may take place in individual cases if this is required by law or necessary for the performance of a contract.

The information is generally transferred to a HubSpot server in the USA and stored there. There is an adequacy decision of the EU Commission for data transfers to the USA, the EU-U.S. Data Privacy Framework. “HubSpot” is certified under this framework, which is why such transfers are based on the legal basis of Art. 45 GDPR.

More information on data protection at “HubSpot” can be found at:

https://legal.hubspot.com/de/privacy-policy

Free trial

You have the option of requesting a free 30-day trial version of our platform on our website. For this purpose, we provide you with the “Free trial” function. To enable this, we use the “HubSpot” service provided by HubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA (hereinafter: “HubSpot”).

The following personal data is processed through the use of HubSpot:

• Your name
• Your email address
• Your company name

HubSpot is used to provide the trial version quickly and easily. In addition, we send you information on using the platform as part of an email sequence and may contact you to ask whether you are interested in a further sales demo.

Your personal data is processed in order to carry out a pre-contractual measure, as you request a trial period for our product by using the “Free trial” function. The lawfulness of the processing of your data is therefore based on Art. 6(1)(b) GDPR. If no contract is concluded, the data will continue to be stored by us even after negotiations have been terminated. The legal basis for this is Art. 6(1)(f) GDPR. The legitimate interest derives from the fact that we wish to prevent several persons from the same company from repeatedly booking trial versions.

Thereafter, we store the data only for as long as strictly necessary. Further storage may take place in individual cases if this is required by law or necessary for the performance of a contract.

The information is generally transferred to a HubSpot server in the USA and stored there. There is an adequacy decision of the EU Commission for data transfers to the USA, the EU-U.S. Data Privacy Framework. “HubSpot” is certified under this framework, which is why such transfers are based on the legal basis of Art. 45 GDPR.

More information on data protection at “HubSpot” can be found at:

https://legal.hubspot.com/de/privacy-policy

5. Processing in the context of the business relationship

Scope and purpose of data processing

In the context of initiating contracts and maintaining business relationships, we process customer data arising in this connection – including contact details of contact persons, information from support requests, and contract and transaction data – for the purposes of customer relationship management (“CRM”), for measuring and managing our marketing and sales activities, and for optimising our processes.

To ensure the quality of our business contacts, we may also enrich existing contact or company data with information from publicly accessible or licensed third-party sources, for example to keep company size, industry or contact details up to date. As this data is not collected directly from you, we inform you of this in accordance with Art. 14 GDPR in this privacy policy.

Legal basis

The legal basis for the aforementioned processing is Art. 6(1)(f) GDPR. The legitimate interest of ZEP GmbH lies in the commercial management and continuous improvement of its business activities, process and product development, and the sustained maintenance of customer relationships.

Storage period and data erasure

The processed data will be deleted as soon as it is no longer required for the respective purposes, but at the latest upon expiry of the statutory retention periods.

6. Use of artificial intelligence (“AI”)

We may use artificial intelligence in the context of the processing of personal data described in this privacy policy. This may take place in particular for the purposes of process support, optimisation and automation, data analysis, the evaluation and identification of patterns, trends and correlations, and the preparation of forecasts and decision support.

Artificial intelligence is used in compliance with the legal requirements of the GDPR and Regulation (EU) 2024/1689 – the Regulation laying down harmonised rules on artificial intelligence (“AI Act”) – and serves exclusively supporting, preparatory or monitoring purposes. No automated decision-making or profiling producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR takes place. Personal data is not used to train AI models.

7. Cookies

Scope and purpose of processing

We use cookies on our website. A cookie is a set of information that is stored on your computer when you visit our website and that allows your browser to be recognised again. Cookies store information such as your language settings for the duration of your visit to our website or the entries you make there.

There are different types of cookies. Session cookies are temporary cookies that are stored in the user’s internet browser until the browser window is closed and the session cookies are deleted. Persistent or permanent cookies are used for repeat visits and are stored in the user’s browser for a predefined period. First-party cookies are set by the website the user is visiting. Only this website is authorised to read information from the cookies. Third-party cookies are set by organisations that do not operate the website the user is visiting.

A distinction can also be made between technically necessary, functional and advertising cookies. The former are necessary to ensure basic functions of the website (e.g. storing the language setting). Functional cookies collect information about the user’s behaviour and whether they receive error messages. Advertising cookies, on the other hand, are used to offer the user tailored advertising.

Legal basis

In view of the purposes of use described, the legal basis for the processing of personal data using technically necessary cookies is Art. 6(1)(f) GDPR, as we have an interest in the user-friendly presentation of our website. If you have given us your consent to the use of functional and advertising cookies by means of a notice provided by us on the website (“cookie banner”), the lawfulness of their use is likewise governed by Art. 6(1) sentence 1(a) GDPR.

Storage period and data erasure

As soon as the data transmitted to us via the cookies is no longer required to fulfil the purposes described above, this information is deleted. Further storage takes place in individual cases where required by law.

Configuring your browser settings

Most browsers are set to accept cookies by default. However, you can configure your browser so that it accepts only certain cookies or no cookies at all. Please note, however, that you may no longer be able to use all the functions of our website if you deactivate cookies on our website via your browser settings. You can also use your browser settings to delete cookies already stored in your browser or to display their storage period. It is also possible to set your browser so that it notifies you before cookies are stored. As the various browsers may differ in their respective functions, we ask you to use the relevant help menu of your browser for the configuration options.

Cookie list

8. International data transfer

We process your data primarily within the European Union (EU) and the European Economic Area (EEA). However, some of our service providers may be located outside the EEA in so-called “third countries”. The General Data Protection Regulation imposes strict requirements on the transfer of personal data to third countries. All of our data recipients must meet these requirements. Before we transfer your data to a service provider in a third country, each service provider is first assessed with regard to its level of data protection. A service provider is selected only if it can demonstrate an adequate level of data protection outside the EEA. Irrespective of whether our service providers are located within the EEA or in third countries, each service provider must conclude a data processing agreement with us. Additional requirements must be met for service providers outside the EEA. In accordance with Art. 44 et seq. GDPR, personal data may be transferred to service providers that meet at least one of the following conditions:

• The European Commission has decided that the third country ensures an adequate level of protection (e.g. Israel and Canada).
• Standard contractual clauses have been included in our contract with the data recipient (including any supplementary measures, where necessary).
• Other appropriate safeguards pursuant to Art. 46 GDPR are provided (e.g. binding corporate rules).
• In specific exceptional cases pursuant to Art. 49 GDPR.

9. Analytics

We use tracking and analytics tools to ensure the continuous optimisation and needs-based design of our website. Tracking measures also enable us to record statistically how visitors use our website and to use the insights gained to further develop our online offering for you. If you have given us your consent to the use of cookies by means of a notice provided by us on the website (“cookie banner”), the lawfulness of their use is also governed by Art. 6(1) sentence 1(a) GDPR.

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, and Google, LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter: “Google”). Google Analytics uses “cookies” and similar tracking methods such as device fingerprinting.

The information stored in these cookies, e.g. about the time, place and frequency of your use of this website, is generally transferred to a Google server in the USA and stored there. There is an adequacy decision of the EU Commission for data transfers to the USA, the EU-U.S. Data Privacy Framework. “Google” is certified under this framework, which is why such transfers are based on the legal basis of Art. 45 GDPR.

When Google Analytics is used, it cannot be ruled out that the cookies set by Google Analytics also collect other personal data in addition to the IP address. Please note that Google may transfer this information to third parties where required by law or where third parties process this data on Google’s behalf.

Google will use the information generated by the cookie on behalf of the operator of this website in order to evaluate your use of the website, to compile reports on website activity and to provide the website operator with further services relating to website and internet use.

You can generally prevent cookies from being stored by adjusting your browser software accordingly. You can withdraw your consent to the processing and transfer to third countries at any time in the “Cookiebot” consent tool. This does not affect the lawfulness of the processing carried out before the withdrawal.

Google Tag Manager

This website uses Google Tag Manager, provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, and Google, LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter: “Google”). Google Tag Manager enables website tags to be managed. When you visit the website, an HTTP request is sent to Google. As a result, device information (such as your IP address) is transferred to Google and within a Google server in the USA. There is an adequacy decision of the EU Commission for data transfers to the USA, the EU-U.S. Data Privacy Framework. “Google” is certified under this framework, which is why such transfers are based on the legal basis of Art. 45 GDPR.

Google Ads

We use the “Google Ads” service of Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter: “Google”) to advertise our offerings and to measure the effectiveness of our campaigns.

Conversion tracking

As part of Google Ads, we use Google conversion tracking. If a user clicks on an advertisement placed by Google, a cookie is set on the user’s device. These cookies expire after 30 days and are not used for personal identification. If the user visits certain pages of our website and the cookie has not yet expired, we and Google can recognise that the user clicked on the advertisement and was redirected to this page.

Enhanced conversion measurement (Enhanced Conversions)

In addition, we use the “Enhanced Conversions” function of Google Ads in two forms:

a) Tag-based Enhanced Conversions (for form submissions)

If you enter personal data such as your email address in our forms (e.g. demo booking or free trial) and have given your consent for this, this email address is encrypted locally in your browser using the SHA-256 hashing method before transmission and transmitted to Google in this encrypted format via Google Tag Manager. Google uses this hash value to determine whether you, as a logged-in Google user, have previously clicked on one of our advertisements, and thus to measure the effectiveness of our advertising campaigns more precisely.

b) CRM-based Enhanced Conversions (offline data matching via HubSpot)

In addition, via our CRM system HubSpot, we transmit to Google Ads hashed email addresses of users who are at a certain lifecycle stage in our CRM (e.g. as a qualified lead or customer). Here, too, the email address is hashed using SHA-256 before transmission. Google matches this hash value against its own user data in order to attribute the original advertisement interaction to a subsequent conversion. This matching serves exclusively to measure campaign effectiveness.

In both cases, processing takes place exclusively on the basis of your consent. Where information is stored on or read from your device in the course of using Google Ads, this is done on the basis of Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The subsequent processing of personal data is governed by Art. 6(1)(a) GDPR.

Consent is obtained via our consent management tool and can be withdrawn at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

There is an adequacy decision of the EU Commission for data transfers to the USA, the EU-U.S. Data Privacy Framework. “Google” is certified under this framework, which is why such transfers are based on the legal basis of Art. 45 GDPR.

Further information on data protection at Google can be found at:

https://policies.google.com/privacy

HubSpot

We use the “HubSpot” service provided by HubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA (hereinafter: “HubSpot”).

The following personal data is processed through the use of HubSpot:

• A unique user identifier in the form of a user token
• Domain of the website
• Date and time of the visit to our website
• Number of sessions

Further information on the content of HubSpot cookies is available at:

https://knowledge.hubspot.com/de/privacy-and-consent/what-cookies-does-hubspot-set-in-a-visitor-s-browser

The use of “HubSpot” enables us to monitor the website and helps us to improve its functionality. The data is further used to support and improve our digital marketing.

• Your personal data is processed only with your express consent pursuant to Art. 6(1)(a) GDPR.
• You are entitled to withdraw your consent at any time. However, this does not affect the lawfulness of processing carried out before the withdrawal.

The information is generally transferred to a HubSpot server in the USA and stored there. There is an adequacy decision of the EU Commission for data transfers to the USA, the EU-U.S. Data Privacy Framework. “HubSpot” is certified under this framework, which is why such transfers are based on the legal basis of Art. 45 GDPR.

More information on data protection at “HubSpot” can be found at:

https://legal.hubspot.com/de/privacy-policy

Visual Website Optimizer (VWO)

On our website, we use the “Visual Website Optimizer” (VWO) tool, a service of Wingify Software Pvt. Ltd., KLJ Tower North, Netaji Subhash Place, Pitam Pura, Delhi 110034, India. VWO enables us to carry out A/B tests, multivariate tests and other functions to optimise the user experience and conversion rate of our website.

Data processing and purpose

VWO uses cookies and similar technologies to recognise visitors, evaluate their behaviour and show them different versions of the website. The data processed may include, among other things:

• Information on user behaviour (e.g. clicks, scroll depth, time spent on the page)
• Browser and device information
• Anonymised IP address (truncated)
• URLs visited and referrer data

The data is processed exclusively in pseudonymised form and serves to optimise our content and offerings. Your personal data is processed only with your express consent pursuant to Art. 6(1)(a) GDPR. You are entitled to withdraw your consent at any time.

Data transfer to third countries

VWO is a provider based in India. A transfer of data to servers outside the EU can therefore not be ruled out. In order to nevertheless ensure an adequate level of data protection, we have concluded the standard contractual clauses approved by the EU Commission with VWO.

Further information can be found at:

https://vwo.com/privacy-policy/

Microsoft Clarity

On our website, we use the “Microsoft Clarity” analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, and Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA (hereinafter: “Microsoft”).

Microsoft Clarity enables us to analyse user behaviour on our website by means of heatmaps, session recordings and click and scroll analyses. The data processed may include, among other things:

• Mouse movements, clicks and scrolling behaviour
• Pages visited and time spent
• Browser and device information
• Anonymised IP address

Your personal data is processed only with your express consent pursuant to Art. 6(1)(a) GDPR. Where information is stored on or read from your device in the course of using Microsoft Clarity, this is done on the basis of Section 25(1) TDDDG. You are entitled to withdraw your consent at any time.

The data collected is generally transferred to Microsoft servers in the USA and stored there. There is an adequacy decision of the EU Commission for data transfers to the USA, the EU-U.S. Data Privacy Framework. “Microsoft” is certified under this framework, which is why such transfers are based on the legal basis of Art. 45 GDPR.

Further information on data protection at Microsoft Clarity can be found at:

https://privacy.microsoft.com/de-de/privacystatement

UTM parameters

We use so-called UTM tags in order to trace the origin and interaction of visitors to our website and to analyse the reach of our marketing activities. Parameters such as source, medium, campaign and search terms used are recorded. This information generally does not relate to individual persons and does not in itself enable visitors to be identified. In combination with other data (e.g. a user ID or the use of a form), however, it may be possible to trace individuals in individual cases. The processing is carried out on the basis of our legitimate interest in the efficient and targeted design of our online offering pursuant to Art. 6(1)(f) GDPR.

10. Content delivery network

In order to speed up the loading time of our website and to protect it against distributed denial-of-service attacks, we use the content delivery network “Cloudflare”, provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107 (hereinafter: “Cloudflare”).

The following personal data is processed through the use of Cloudflare:

• the web page accessed
• the browser type used
• the operating system
• the referrer URL
• the IP address
• the requesting provider

Your personal data is processed only with your express consent pursuant to Art. 6(1)(a) GDPR. You are entitled to withdraw your consent at any time.

The information is generally transferred to a Cloudflare server in the USA and stored there. There is an adequacy decision of the EU Commission for data transfers to the USA, the EU-U.S. Data Privacy Framework. “Cloudflare” is certified under this framework, which is why such transfers are based on the legal basis of Art. 45 GDPR.

More information on data protection at “Cloudflare” can be found at:

https://www.cloudflare.com/privacypolicy/

11. Recipients of personal data

Within our company, only those persons who need your personal data for the purposes specified in each case have access to it. Your personal data is passed on to external recipients only if we are legally permitted to do so or if you have given your consent. Below you will find an overview of the respective recipients:

Processors: Group companies or external service providers, e.g. in the areas of technical infrastructure and handling, maintenance and payment processing, which are carefully selected and monitored. The processors may use the data only in accordance with our instructions.

Public bodies: Authorities and government institutions, such as tax authorities, public prosecutors’ offices or courts, to which we transmit (or are required to transmit) personal data, e.g. to fulfil legal obligations or to safeguard legitimate interests.

12. Plug-ins

Our presence on social networks and platforms serves the purpose of active communication with our customers and prospective customers.

LinkedIn

Our website therefore includes a link to our company page on the social network “LinkedIn” of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. On the basis of the data transmitted to the respective service via the social plug-in, the service may be able to assign you to your account with it.

• Before you click on the link, no data is transmitted directly to LinkedIn.
• Data is transmitted only when you click on the button. In doing so, you leave our website and establish a direct connection between your browser and LinkedIn’s servers.

Information on the data subsequently collected by LinkedIn can be found at:

https://de.linkedin.com/legal/privacy-policy

YouTube – Link to our company page

Our website also includes a link to our company page on the video platform “YouTube”, provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, and Google, LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

• Before you click on the link, no data is transmitted directly to Google.
• Data is transmitted only when you click on the button. In doing so, you leave our website and establish a direct connection between your browser and Google’s servers.

Information on the data subsequently collected by Google can be found at:

https://policies.google.com/privacy

YouTube videos

Scope and purpose of data processing

On individual pages of our website – in particular our reference and case study pages – we embed videos from the YouTube platform. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”); the parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

When the page is merely accessed, no YouTube player and no preview image from YouTube is loaded. No connection to Google servers is established at this point. Instead, a preview image provided by us with an explanatory notice is displayed.

Videos are embedded exclusively via the domain youtube-nocookie.com in privacy-enhanced mode. A connection to YouTube and the transfer of your data take place only when you actively play the video, either because you have consented to marketing cookies in the cookie consent banner or because you give your consent for the respective video by clicking on the preview image.

As soon as you start a video, the following personal data is processed:

• your IP address,
• date and time of access,
• information about which page you visited,
• browser and device information.

If you are logged into your Google account at the same time, Google may assign this information to your user account. You can prevent this by logging out of your Google account before playing the video.

Legal basis

The legal basis for the processing is your consent pursuant to Art. 6(1)(a) GDPR and, where cookies are set or information on your device is accessed during playback, Section 25(1) TDDDG. You give this consent either via our cookie consent banner or by actively clicking on the preview image of the respective video. You can withdraw your consent at any time with effect for the future by adjusting the cookie settings in our consent banner or by deleting the relevant cookies in your browser. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Storage period and data erasure

We have no influence on the storage period of the data processed by Google. For further information, please refer to Google’s privacy policy at https://policies.google.com/privacy.

Data transfer to third countries

Playing the videos may result in personal data being transferred to Google LLC in the USA. There is an adequacy decision of the EU Commission for data transfers to the USA, the EU-U.S. Data Privacy Framework. “Google” is certified under this framework, which is why such transfers are based on the legal basis of Art. 45 GDPR.

More information on data protection at “YouTube” and “Google” can be found at:

https://policies.google.com/privacy

‍

Facebook

Our website also includes a link to our company page on the social network “Facebook”, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

• Before you click on the link, no data is transmitted directly to Meta Platforms Ireland Limited.
• Data is transmitted only when you click on the button. In doing so, you leave our website and establish a direct connection between your browser and Facebook’s servers.

Information on the data subsequently collected by Facebook can be found at:

https://de-de.facebook.com/privacy/policy/

Instagram

Our website also includes a link to our company page on the social network “Instagram”, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

• Before you click on the link, no data is transmitted directly to Meta Platforms Ireland Limited.
• Data is transmitted only when you click on the button. In doing so, you leave our website and establish a direct connection between your browser and Instagram’s servers.

Information on the data subsequently collected by Instagram can be found at:

https://privacycenter.instagram.com/policy

13. Data security and security measures

We undertake to treat your personal data confidentially. In order to prevent manipulation, loss or misuse of your data stored with us, we take extensive technical and organisational security precautions, which are regularly reviewed and adapted to technological progress.

However, we would point out that, owing to the structure of the internet, it is possible that the rules of data protection and the security measures mentioned above may not be observed by other persons or institutions outside our area of responsibility. In particular, unencrypted data – e.g. when transmitted by email – can be viewed by third parties. We have no technical influence over this. It is your responsibility as a user to protect the data you provide against misuse by means of encryption or in any other way.

14. Data storage

The personal data of the data subject will be erased or blocked as soon as the purpose of storage ceases to apply. Storage may also take place if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or erased when a storage period prescribed by the aforementioned provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

15. Rights of the data subject

With regard to your personal data, you have the following statutory rights vis-à-vis us:

Right of access

You have the right to obtain confirmation as to whether we process personal data concerning you. Where this is the case, you have the right of access to this personal data and to further information, e.g. about the purposes of the processing, the recipients and the envisaged storage period or the criteria used to determine that period.

Right to rectification

You have the right to request the rectification of inaccurate data without undue delay. Taking into account the purposes of the processing, you have the right to request the completion of incomplete data.

Right to erasure (“right to be forgotten”)

You have the right to request erasure if the processing is not necessary. This is the case, for example, if your data is no longer required for the original purposes, if you have withdrawn your declaration of consent under data protection law or if the data has been processed unlawfully.

Right to restriction of processing

You have the right to restrict processing, e.g. if you believe that the personal data is inaccurate.

Right to data portability

You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format.

Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of certain personal data concerning you.

Where personal data is processed for direct marketing purposes, you as the data subject have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling to the extent that it is related to such direct marketing.

Right to withdraw your consent under data protection law

You can withdraw your consent to the processing of your personal data at any time with effect for the future. However, this does not affect the lawfulness of the processing carried out until the withdrawal.

Without prejudice to these rights, you have the right to lodge a complaint with a supervisory authority at any time if you consider that the processing of your personal data infringes data protection provisions.

16. Change history

With regard to your personal data, you have the following statutory rights vis-à-vis us: