Contact

Privacy Policy

This is a convenience translation. The German version is legally binding.

1 Contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

VRtual X GmbH,
Hegestraße 40,
20251 Hamburg
x@vrtual-x.com
+49-15679 111200

2 Your rights in general

At this point, we summarize the general rights you have under the GDPR with regard to your personal data processed by us. For an explanation of the legal terms, we refer to the applicable definitions in the GDPR (see Article 4 GDPR). If anything remains unclear, please feel free to ask us.

  • You may withdraw any consent you have given us to the processing or disclosure of your data at any time with effect for the future (Article 7(3) GDPR).
  • If the legal basis for processing your data is a legitimate interest under Article 6(1)(f) GDPR, you may object to the data processing under Article 21 GDPR. Where the data processing in question is direct marketing, you do not have to give any reasons for your objection; in all other cases, you would have to state reasons for your objection arising from your particular situation.
  • If we have stored incorrect information about you, you may request that we rectify your data (Article 16 GDPR).
  • You may request information from us about which of your data we process (Article 15 GDPR, Section 34 BDSG (German Federal Data Protection Act)).
  • You may request that we erase your data or restrict its processing, provided that no overriding retention obligations prevent us from doing so (Article 17 or 18 GDPR, Section 35 BDSG).
  • You may request that we provide the data you have made available to us yourself in a machine-readable format for transfer to third parties (Article 20 GDPR).
  • You may lodge a complaint about data protection matters concerning us with a data protection supervisory authority, e.g. the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Datenschutzbeauftragter).

3 Our data processing in general

Every form of processing of personal data requires a legal basis that permits us to carry out this processing. The legal basis results primarily from the purpose for which the data are processed. Lawfulness within a legal basis is generally measured by the specific scope of the data processing and by the measures we have taken to protect your data. Legal bases for data processing result from Article 6(1) GDPR and, for particularly sensitive data such as health data, from Article 9(2) GDPR. These two provisions name the preparation or performance of contractual, legal or social obligations as the most important legal bases for data processing. In addition, much data processing takes place in our legitimate interest, unless the interests of the data subjects override it in view of the specific circumstances. If one of the aforementioned types of legal basis applies, the processing does not require any further consent from you. Data processing may also be based on your consent (Article 7 GDPR) or, for persons under the age of 16 using information society services (e.g. websites, online games, social media platforms), on the consent of the children or adolescents together with the consent of a parent or guardian (Article 8 GDPR). We expressly point out at this point that none of our offerings is directed at persons under the age of 16. In some cases, our obligation to ask for your consent results not, or not solely, from the GDPR but from the TDDDG (German Telecommunications and Digital Services Data Protection Act) or the UWG (German Act Against Unfair Competition). We have taken the obligations under these laws into account without expressly referring to them below. If data are transferred to a country outside the European Economic Area (EEA), we ensure that data protection is safeguarded within the meaning of Articles 44 to 49 GDPR.

4 General information on cookies

Cookies are text files that your browser stores on your device when you visit a website. Different types of information can be stored in a cookie. Sometimes a cookie only stores a yes or no (“true” or “false”); sometimes it stores a string of characters that allows the browser to be uniquely identified when the website is visited again (a so-called cookie ID). The right to set cookies is governed not only by the GDPR but also by the EU ePrivacy Directive and Section 25 TDDDG. The ePrivacy Directive distinguishes between cookies that are strictly necessary for the operation of the online service (essential cookies) and those that are not. Essential cookies may be set without consent, but non-essential cookies always require consent, even if this is not required under the GDPR (and, for example, a legitimate interest exists as the legal basis). Before we store non-essential cookies on your device, we ask for your consent in accordance with the requirements of the ePrivacy Directive. The purpose of each cookie and the legal basis for its use under the GDPR are set out in the following description of the individual data processing operations. You have various ways of preventing cookies from being accepted on your device:

  1. The standard case will probably be that, when you visit one of our websites, you decide via our consent manager which cookies you allow and which you do not. In some cases, we can only offer you a blanket acceptance or rejection of all cookies or of groups of cookies.
  2. In principle, you can set your browser so that it never accepts cookies. Such a complete exclusion will very likely cause you to lose functions that are based on cookies and that you would actually like to allow or that do not require consent at all.
  3. You can visit websites in your browser’s private mode. Private mode also blocks cookies from being set in your browser storage or automatically deletes all cookies at the end of the session.
  4. Some browsers or browser plug-ins give you the option of making more differentiated default settings as to which cookies you generally want to accept by default and which you do not.
  5. A special case: Google offers a browser plug-in that prevents the various Google cookies from being set. You can find the plug-in here: https://tools.google.com/dlpage/gaoptout?hl=de

5 Specific data processing operations

5.1 Direct communication with us

5.1.1 Email communication

Description: If you send us an email, it reaches at least one of our email mailboxes. The content of your email and the accompanying metadata (sender, time of sending, etc.) are stored on the email servers of our hosting provider. In addition, after being retrieved from the server, they may be stored in the email programs on the devices that have access to the mailbox (computers, smartphones, tablets). The same applies to emails that we send to you. The specific processing of the personal data in an email depends on the subject matter of the email. It is likely that we will add your data to our contact directory for customers, business partners and other contacts. Categories of data: Name, email address; time of delivery or sending; other metadata that typically arise in email communication; further personal information in the content of the email, such as further contact details in email signatures, inquiries, orders, offers or complaints by email Recipients (and transfers to third countries, if any): Our service provider for email hosting, which is bound to data protection by a data processing agreement, is based in the EEA. The service provider is part of an international group of companies headquartered in the USA with further subcontractors in various third countries. The resulting transfer of data outside the EEA is safeguarded by the conclusion of EU standard contractual clauses. If you use a hosting service provider outside the EEA for your mailbox or retrieve our emails from outside the EEA, this is not our responsibility. Purpose and legal basis: Communication by email. Depending on the content of the correspondence, the legal basis is the preparation or performance of a contract or a legitimate interest in replying to your email. Retention period: Depends on the content of the correspondence; commercial law, for example, requires business letters to be retained for six years, but other documentation obligations may also result in longer retention periods.

5.1.2 Phone calls

Description: If we speak to each other by phone via our main number or a mobile number, our devices record your number and the time of the call. If we speak to each other via the direct extension of one of our employees, our cloud-based phone system, in conjunction with our softphones (apps for making phone calls), records your number and the time of the call. If the content of the call suggests it, we write a note of the call and document it in the appropriate place (e.g. in the HR department for applicants and employees). It is conceivable that we will add your data to our contact directory for further communication. Audio recordings of calls are made only in exceptional cases and after we have obtained your express consent. Categories of data: Phone number; time of the call; content of the call, if applicable Recipients (and transfers to third countries, if any): Telecommunications providers that are subject to the secrecy of telecommunications. In this respect, a transfer to third countries takes place only in the case of corresponding international calls. Our service provider for the cloud-based phone system for the direct extensions, which is bound to data protection by a data processing agreement, is based in the EEA. The service provider is part of an international group of companies headquartered in the USA with further subcontractors in various third countries. The resulting transfer of data outside the EEA is safeguarded by the conclusion of EU standard contractual clauses. Purpose and legal basis: Communication by phone. Depending on the content of the call, the legal basis is the preparation or performance of a contract or a legitimate interest in communicating with you. Retention period: Depends on the content of the call. Individual call notes may be subject to the six-year retention obligation for business letters under commercial law.

5.1.3 Letters

Description: If you send us a letter, we generally reply with a letter that we write on the computer and save as a file. We often scan your letter in order to archive it as part of digital office management. The specific processing of the personal data in our correspondence depends on the subject matter of the letters and the resulting retention obligations. It is conceivable that we will add your data to our contact directory for further communication. Categories of data: Name and address; personal information in the content of the letters, such as further contact details in your letterhead, inquiries, orders, offers, complaints or other topics Recipients (and transfers to third countries, if any): Postal service providers. A transfer to third countries takes place only if the item is sent to an address outside the European Economic Area. In these cases, data protection is ensured by international agreements on postal secrecy. Purpose and legal basis: Communication by letter. Depending on the content of the correspondence, the legal basis is the preparation or performance of a contract or a legitimate interest in communicating with you. Retention period: Depends on the content of the correspondence; in principle, commercial law requires business letters to be retained for six years.

5.1.4 Video conferences

Description: If you take part in a video conference with us to which we have (technically) invited you, we are responsible for the data processing through this communication. When we invite you to a conference, we send a URL specific to that conference together with the appointment. The specific URL shows you whether we have invited you to a conference in a video conferencing system operated by ourselves (using Jitsi as the application) or via an external cloud provider such as Microsoft Teams or Zoom. You can take part in a video conference via an app of the chosen provider or via your web browser. It is possible to take part as a guest, so you do not need your own user account with the chosen provider. When you dial into the conference, you will be asked to give yourself a participant name, e.g. so that contributions in the chat can be attributed to you. You may also use a fictitious name here. The conference application asks for your consent to access your microphone and your camera. You may grant each of these permissions, but you do not have to, e.g. if you want to follow a conference without actively participating. In addition to audio and video, conference applications offer you supplementary functions: an accompanying chat for exchanges in text form, requests to speak via icons, an artificial background image. Conferences can be recorded. If a conference is to be recorded, we inform all participants in advance and start the recording only once all participants have declared their consent to the recording. Audio recordings may be transcribed into a text file. Unless an expressly agreed recording takes place, we do not store the conference in any way. After the conference has ended, the contents of a conference that has not been recorded can no longer be accessed. In this respect, this corresponds to phone calls that have not been recorded. It is technically possible for any participant to make screenshots or a recording of the conference in whole or in part using means outside the conference application. Such conduct without corresponding agreement with all participants constitutes a data protection violation by the person acting and, unless that person is one of our employees, lies outside our responsibility. Secret recordings of the spoken word may constitute a criminal offense under Section 201 StGB (German Criminal Code). We reserve the right to take legal action of any kind against persons who use their participation in a video conference for conduct hostile to data protection. As host (moderator) of the conference, we have the technical means to mute you or switch off your video (black screen) without your involvement, to change your user name and to exercise other moderator functions. We use such options only when there is a need to do so. Insofar as data processing is concerned that is not directly related to the specific conference, the responsibility lies not with us but directly with the cloud providers. This applies, for example, to downloading the video conferencing app. By downloading an app to your device, you establish in this respect an independent legal relationship between yourself and the cloud provider. In some cases, responsibility also lies with the organization (e.g. your employer) that provides you with your personal user account. The transfer of data between your device and the conference server requires the provider to take note of the IP address through which you are online during the video conference. The servers also record all types of data that regularly arise when using telemedia services. Categories of data: User name, participation times, video or audio signal, video or audio recording (only with consent), audio transcript (only after recording), actions in the chat, request-to-speak status, profile data (profile picture, contact details, background image), phone number (when participating by phone); further categories of data, such as IP address or email address, may be processed by the provider under its own responsibility. Recipients (and transfers to third countries, if any): If we use our own video conferencing application, our hosting service provider is based in the EEA; no transfer to third countries takes place. If we use cloud service providers that are bound to data protection by a data processing agreement, they are based in the EEA but are part of an international group of companies headquartered in the USA with further subcontractors in various third countries, or they are based directly in the USA. The resulting transfer of data outside the EEA is safeguarded by the conclusion of EU standard contractual clauses. Purpose and legal basis: Use of a video conference. Depending on the content of the conversation, the legal basis is the preparation or performance of a contract or a legitimate interest in communicating with you. For recordings, consent is the legal basis. Retention period: Unless a recording takes place, all data are deleted when the conference ends. If the conference was recorded, the recording is deleted as soon as the last purpose for which the recording was made has been achieved.

5.1.5 Contact directory and business cards

Description: If we are likely to be in contact with you again in the future, we store your contact details in our contact directory in order to recognize you as a known contact when you call or email us and to be able to continue our contact with you. If you give us your business card, we add your data to our contact directory. Categories of data: Name, contact details (address, phone, fax, email), your company, your company’s line of business, your job title, your area of responsibility, place, time and circumstances of the contact and, if applicable, special notes on your availability or the business topics discussed Recipients (and transfers to third countries, if any): Our service provider for hosting our contact directory, which is bound to data protection by a data processing agreement, is based in the EEA. The service provider is part of an international group of companies headquartered in the USA with further subcontractors in various third countries. The resulting transfer of data outside the EEA is safeguarded by the conclusion of EU standard contractual clauses. Purpose and legal basis: Maintaining contacts. The legal basis is a legitimate interest, since you voluntarily gave us your business card. Retention period: We store your data until you ask us to delete them, unless a business relationship has arisen between us in the meantime that gives rise to independent retention obligations on our part with regard to your contact details.

5.2 Visiting our websites

5.2.1 Providing our websites

Description: In order for a web server to make our website available to your browser, the server must collect technical data about the device you use for this, your browser and your internet connection. This is referred to as a log file or web log. These are the same data that you necessarily leave behind on every website you visit. The focus is on the IP address from which you access our pages. The web server sends you the data you want to see to this internet address. Our websites are hosted on a server that we operate ourselves. Fonts, images and scripts are delivered from this server. When you access our pages, no connection to servers of other providers is established without your consent.

Categories of data: IP address from which our site was accessed; date and time of access; objects on our website accessed in the browser; type and version of the web browser; type and version of the operating system; previously visited page, if your browser transmits it

Recipients (and transfers to third countries, if any): Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, as operator of the data center. Hetzner is bound to data protection by a data processing agreement. The server is located in Germany. No transfer of data outside the EEA takes place. In the event of attacks on our pages, disclosure to forensic experts engaged by us and to law enforcement authorities.

Purpose and legal basis: Providing our website and investigating any unlawful access to our web pages (e.g. a hacker attack). The legal basis is a legitimate interest under Article 6(1)(f) GDPR, since it is not possible to operate a website without recording the web log.

Retention period: 7 days

5.2.2 Managing your consents

Description: We load services that require consent only after you have agreed. On your first visit, we ask for your decision in a notice window. You can accept all services, allow only the necessary functions, or decide individually for the categories “Statistics”, “Marketing” and “External media”. Your decision is stored in your browser’s local storage on your device so that we do not have to ask you again on your next visit. No cookie is set for this purpose. The decision is not transmitted to us or to third parties. You can change or withdraw your decision at any time via the “Cookie settings” link in the footer of every page.

Categories of data: Consent status per category (yes/no); time of the decision; version number of the consent request

Recipients (and transfers to third countries, if any): None

Purpose and legal basis: Legally compliant consent management. The legal basis is compliance with a legal obligation under Article 6(1)(c) GDPR and a legitimate interest under Article 6(1)(f) GDPR. Storing the decision on your device is strictly necessary within the meaning of Section 25(2) no. 2 TDDDG.

Retention period: Twelve months. After that, we ask again. You can delete the entry beforehand via your browser settings.

5.2.3 Analysis of usage behavior (Google Analytics)

Description: If you consent to the “Statistics” category, we use the web analytics service Google Analytics 4. On our behalf, Google Analytics prepares statistical evaluations of the use of our websites: which pages are accessed, how visitors reach our pages, which region they come from and which devices they use to visit our pages. For this purpose, Google Analytics stores cookies in your browser (e.g. _ga and _ga_G3MTCT2G1C) that recognize your browser on a repeat visit. The cookie does not reveal to us who you are. Your IP address is not stored by Google Analytics 4. Without your consent, Google Analytics is not loaded and no data are transferred to Google. You can find more information in Google’s privacy policy at https://policies.google.com/privacy.

Categories of data: Identifier stored in cookies (client ID); pages accessed and elements clicked; date, time and duration of the visit; previously visited page; approximate location (country, region); type and version of browser, operating system and device

Recipients (and transfers to third countries, if any): Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, as processor. A transfer of data to Google LLC in the USA cannot be ruled out. It is safeguarded by the adequacy decision of the EU Commission on the EU-U.S. Data Privacy Framework, under which Google is certified, and additionally by EU standard contractual clauses.

Purpose and legal basis: Improving our online offering on the basis of the evaluations. The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Retention period: Google Analytics deletes user-level data after 14 months at the latest. The cookies expire after two years at the latest.

5.2.4 Measuring advertisements (Google Tag Manager and Google Ads)

Description: We place advertisements via Google Ads. If you consent to the “Marketing” category, we load Google Tag Manager. It serves to carry out the measurement for Google Ads. We measure whether a visit after a click on one of our advertisements leads to you contacting us: submitting our contact form, a click on our email address or phone number, an appointment booking or a longer time spent on our pages. For this purpose, Google stores cookies in your browser (e.g. _gcl_au). Google tells us how many contacts can be traced back to which advertisement. We do not learn who you are. If you are logged into a Google account, Google can associate the visit with your account. Without your consent, Google Tag Manager and Google Ads are not loaded and no data are transferred to Google.

Categories of data: Identifier stored in cookies; ad click identifier; IP address; date and time; page accessed; type of contact; type and version of browser, operating system and device

Recipients (and transfers to third countries, if any): Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer of data to Google LLC in the USA cannot be ruled out. Safeguards as described under “Analysis of usage behavior (Google Analytics)”.

Purpose and legal basis: Measuring the success of our advertisements. The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Retention period: The _gcl_au cookie expires after 90 days. Any further retention period is the responsibility of Google.

5.2.5 Video streaming (YouTube)

Description: Our websites show films via a video player from YouTube, a service of Google. When you access a page, you initially see only a still image stored on our own server. No connection to YouTube exists at that point. The YouTube player is loaded only when you start the film and confirm the data transfer, or if you have consented to the “External media” category. For this, we use YouTube’s privacy-enhanced mode (youtube-nocookie.com). When the player loads, Google learns which of our pages you visited and which film you are watching. If you are logged into your YouTube or Google account, Google can associate your usage behavior with your personal profile. We do not receive any data about your usage behavior from Google. You can find more information in Google’s privacy policy at https://policies.google.com/privacy.

Categories of data: IP address from which our site was accessed; date and time of access; films viewed; type and version of the web browser; type and version of the operating system; Google identifiers stored in the browser

Recipients (and transfers to third countries, if any): Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. The data may be transferred to servers of Google LLC in the USA. Safeguards as described under “Analysis of usage behavior (Google Analytics)”.

Purpose and legal basis: We use the YouTube player in order to offer you high-performance video streaming. The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Retention period: The retention period is the responsibility of Google. Deletion of data by us is not possible, since we do not collect any of your data through the use of YouTube.

5.2.6 Video streaming (Vimeo)

Description: We show individual films via a video player from Vimeo. Here, too, you initially see only a still image from our own server. The Vimeo player is loaded only when you start the film and confirm the data transfer, or if you have consented to the “External media” category. We embed the player with the setting that Vimeo does not track your usage behavior (“Do Not Track”). When the player loads, Vimeo learns which of our pages you visited and which film you are watching. We do not receive any data about your usage behavior from Vimeo. You can find more information in Vimeo’s privacy policy: https://vimeo.com/privacy.

Categories of data: IP address from which our site was accessed; date and time of access; films viewed; type and version of the web browser; type and version of the operating system

Recipients (and transfers to third countries, if any): Vimeo.com, Inc., 330 West 34th Street, New York, New York 10001, USA. The data are transferred to servers in the USA and processed there. The transfer is safeguarded by the adequacy decision of the EU Commission on the EU-U.S. Data Privacy Framework and additionally by EU standard contractual clauses.

Purpose and legal basis: We use the Vimeo player in order to offer you high-performance video streaming. The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Retention period: The retention period is the responsibility of Vimeo. Deletion of data by us is not possible, since we do not collect any of your data through the use of Vimeo.

5.2.7 Appointment booking (Calendly)

Description: On our websites, you can book an appointment for a call. First, you see a monthly calendar that comes from our own server. No connection to any other provider exists at that point. When you select a day, the booking calendar of the Calendly service is loaded. We point this out at the calendar. In the booking calendar, you select a time and enter your name and email address. Any further information is voluntary. Calendly sends you and us a confirmation and enters the appointment in our calendar. If you have consented to the “Marketing” category, we also measure that a booking has taken place (see “Measuring advertisements”). You can find more information in Calendly’s privacy policy: https://calendly.com/privacy.

Categories of data: IP address; date and time of access; type and version of browser and operating system; name; email address; selected appointment; voluntary information about your request

Recipients (and transfers to third countries, if any): Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. Calendly is bound to data protection by a data processing agreement. The data are transferred to servers in the USA and processed there. The transfer is safeguarded by the adequacy decision of the EU Commission on the EU-U.S. Data Privacy Framework and additionally by EU standard contractual clauses.

Purpose and legal basis: Easy scheduling of appointments for calls. The legal basis for loading the booking calendar is your consent under Article 6(1)(a) GDPR, which you give by selecting a day. Depending on your request, the legal basis for processing the information you provide for the booking is the preparation of the performance of a contract under Article 6(1)(b) GDPR or a legitimate interest.

Retention period: We delete appointment data at Calendly no later than twelve months after the appointment. Otherwise, the processing “Email communication” applies.

5.2.8 Fonts

Description: The fonts of our websites are stored on our own server. No connection to other providers is established when the fonts are loaded. This is not a separate processing operation that goes beyond the processing “Providing our websites”.

5.2.9 Language selection

Description: Our websites are available in German and English. On your first visit, we show the English version if German is not set as a language in your browser. To do this, the page reads your browser’s language setting. This information is not stored and not transmitted. If you switch the language yourself using the navigation, that choice is stored in your browser’s local storage so that we do not redirect you again on your next visit. No cookie is set for this purpose.

Categories of data: Selected language (German/English)

Recipients (and transfers to third countries, if any): None

Purpose and legal basis: Displaying the page in the language you want. Storing the choice on your device is strictly necessary within the meaning of Section 25(2) no. 2 TDDDG because you are expressly using the function. The legal basis is a legitimate interest under Article 6(1)(f) GDPR.

Retention period: Until you delete the entry via your browser settings.

5.2.10 Contact form

Description: Our websites have a contact form. Your entries are transmitted to a service on our own server, which turns them into an email to our central contact address. The entries are not stored on the server itself. Once the email has reached us, the data processing corresponds to the processing “Email communication”. To protect against misuse, the service briefly counts how many requests arrive from one IP address. If you have consented to the “Marketing” category, we also measure that a request was sent (see “Measuring advertisements”). The content of your request is not transmitted in the process.

Categories of data: Name; email address; message; optional: company and phone number; page from which the form was sent; IP address (only to limit requests, held in memory for no more than one hour)

Recipients (and transfers to third countries, if any): See the processing “Providing our websites” and “Email communication”.

Purpose and legal basis: Providing a contact form as an additional way of contacting us. Depending on the content of your inquiry, the legal basis is the preparation of the performance of a contract under Article 6(1)(b) GDPR or a legitimate interest under Article 6(1)(f) GDPR.

Retention period: See the processing “Email communication”.

5.3 Marketing communication

5.3.1 Google Business Profile

Description: We maintain a business profile on Google Business Profile (“GMB”). Via GMB, we publish information about ourselves that feeds the presentation of our company in various Google services. This applies in particular to the presentation of our company in the Google Search results and in Google Maps. Google provides us with statistical data on the use of the information we have published on GMB. In addition, you can contact us directly via GMB (e.g. call our phone number directly) or publish comments on our business profile. If you contact us or comment on our profile, we receive data about you from Google, e.g. the Google user name with which you were logged in during your interaction with GMB. We have no way of influencing the data processing at Google. The provision of GMB as well as Google Search and Google Maps is the responsibility of Google. Legally, as the operator of the GMB profile, we are considered jointly responsible for these data processing operations, which is why we have concluded a joint controller agreement with Google on this matter (see: https://privacy.google.com/businesses/controllerterms/). The agreement divides responsibility between Google and us in such a way that we are responsible for establishing a relationship between your data and our GMB profile and Google is responsible for the further processing of the data. You should assert all your rights with regard to the processing of your data by Google directly with Google. You should contact us if the matter concerns the processing of your data in direct communication with us. Legally, you are free to contact both Google and us with all your concerns at any time, and the recipient will forward your request to the appropriate party if necessary. For details of the data processing at Google, we refer to Google’s privacy information (https://policies.google.com/privacy). We use the personal data we receive from you via GMB in order to answer your inquiries or respond to your comments. Categories of data: For the categories of data processed by Google, see Google’s privacy information. We process your name or the user name you provided to Google, your contact requests and the comments you publish on GMB. Recipients (and transfers to third countries, if any): Google LLC, which can be contacted by us as a European organization via Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. Google is bound to data protection by a joint controller agreement. Transfers of data outside the EEA are safeguarded by the conclusion of EU standard contractual clauses. Purpose and legal basis: Answering your inquiries and responding to your comments on Google Business Profile. The legal basis for the processing by us is a legitimate interest, since you yourself visited our GMB profile in a Google service and communicated with us there. Retention period: The retention period is the responsibility of Google. Deletion of data by us is not necessary, since we do not independently store any of your data through the use of GMB.

5.4 Our social media profiles

5.4.1 Facebook and Instagram

Description: We maintain business profiles (also called fan pages) on Facebook and Instagram. Such a fan page enables us to present our organization on Facebook or Instagram, to get in touch with you on this social media platform and to draw attention to our services and offerings via advertisements on these platforms. Facebook provides us with analytics data on the use of our fan page (called Page Insights). This gives us an impression of how successful our individual communication measures are. For details of the data processing at Facebook, Facebook’s privacy information applies: https://www.facebook.com/about/privacy In accordance with a ruling of the European Court of Justice, these analytics data are used under joint controllership with Facebook pursuant to Article 26 GDPR. Facebook has accordingly provided a joint controller agreement (https://www.facebook.com/legal/terms/page_controller_addendum). In the agreement, Facebook has assumed sole responsibility for all questions of data processing. If you wish to exercise your rights under the GDPR with regard to the data processed in Page Insights, you should contact Facebook directly via your Facebook account. However, in accordance with the statutory rules on joint controllership, you are also free to contact us with your request. We would then forward your request to Facebook. Categories of data: Facebook user name; comments, likes and page views within Facebook or Instagram and the time of the action Recipients (and transfers to third countries, if any): Meta Platforms Ireland Limited, which can be contacted by us as a European organization via Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Transfers of data outside the EEA are safeguarded by the conclusion of EU standard contractual clauses. Purpose and legal basis: Analysis of usage behavior on our fan page or our Instagram profile. The legal basis is the consent you gave when registering with Facebook. Retention period: The retention period is the responsibility of Facebook.

5.4.2 LinkedIn

Description: We maintain a business profile on LinkedIn. Such a LinkedIn profile enables us to present our organization on LinkedIn, to get in touch with you on this social media platform and to draw attention to our services and offerings via advertisements on this platform. LinkedIn provides us with analytics data on the use of our profile page. This gives us an impression of how successful our individual communication measures are. For details of the data processing at LinkedIn, LinkedIn’s privacy information applies: https://www.linkedin.com/legal/privacy-policy Categories of data: LinkedIn user name; comments, likes and page views within LinkedIn and the time of the action Recipients (and transfers to third countries, if any): LinkedIn Corp., which can be contacted by us as a European organization via LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Transfers of data outside the EEA are safeguarded by the conclusion of EU standard contractual clauses. Purpose and legal basis: Analysis of usage behavior on our LinkedIn profile. The legal basis is the consent you gave when registering with LinkedIn. Retention period: The retention period is the responsibility of LinkedIn.

5.5 Clients, suppliers and service providers

5.5.1 Business relationship

Description: As a customer, we process personal data of our suppliers and service providers who are self-employed or partnerships, or of our contacts at such organizations, in order to be able to communicate with you about the handling of the order. In addition to communication on the substance, your data are typically processed in the separately described processing operations for “Communication with us” (see there). Categories of data: Contact, contract and invoice data Recipients (and transfers to third countries, if any): Tax advisors, auditors and lawyers in their capacity as persons bound by professional secrecy. Purpose and legal basis: Proper business management. The legal bases are the performance of contracts as well as legal obligations and legitimate interests. Retention period: Under tax law, invoice data must be retained for 10 years; contract data must be retained for different periods depending on the type of contract. In the case of copyrights, such periods extend up to 70 years after the death of the author.

5.5.2 Project management

Description: For our collaboration with our clients and service providers, we use project management applications, mostly as cloud applications. In some cases, we also give our business partners access to the project management system in order to manage project communication together. Pictures can be uploaded to the user profiles. This is voluntary, and the upload is to be understood as consent to the processing of the photo. Categories of data: Login data (email address, password), profile data (name, form of address, title, organization/company, job title, profile photo), content data (comments, messages, project descriptions), activity history (timestamps, browser actions) Recipients (and transfers to third countries, if any): Our service providers for the project management applications, which are bound to data protection by a data processing agreement, are based in the USA. The resulting transfer of data outside the EEA is safeguarded by the conclusion of EU standard contractual clauses. Purpose and legal basis: Project management based on modern applications. The legal basis is a legitimate interest, since only project-related data of business partners are included here. For the processing of profile pictures, the legal basis is the consent expressed by the upload. This consent can be withdrawn at any time by removing one’s own picture. Retention period: After a project has been completed, it is stored for 6 years in accordance with the retention obligations for business letters under commercial law.

5.6 Recruitment

5.6.1 Applications

Description: If you apply to us for a position, we process your application documents until the application process has been completed, exclusively for the purpose of deciding whether to hire you. We restrict access to your documents to the persons whom it makes sense to involve in the decision on your hiring. If you are hired, your application documents become part of your personnel file. If you are not hired, we will either ask for your consent to be included in our candidate pool or return or destroy your documents as soon as an objection to our decision is no longer to be expected under anti-discrimination law. Categories of data: Name and contact details (email, phone, address), photo, profile URL in professional networks (e.g. Xing); information in the cover letter, résumé, certificates and references, proof of education and professional qualifications, notes on job interviews (by phone and in person), results of recruitment tests, if applicable Recipients (and transfers to third countries, if any): Our service provider for email hosting, which is bound to data protection by a data processing agreement, is based in the EEA. The service provider is part of an international group of companies headquartered in the USA with further subcontractors in various third countries. The resulting transfer of data outside the EEA is safeguarded by the conclusion of EU standard contractual clauses. Purpose and legal basis: Basis for decisions on filling positions. The legal basis is the preparation of the performance of a contract (employment contract) and subsequently a legitimate interest in defending against objections to rejection decisions. Retention period: 6 months after the original application process has been completed

5.6.2 Candidate pool

Description: If we are currently unable to offer you a suitable position but would like to consider you again in the selection process for positions to be filled in the future, we will ask for your consent to retain your application documents beyond the completion of the current application process. If we are unable to get back to you for more than two years, we will either obtain your consent to further retention again or return or delete your documents. Categories of data: Name and contact details (email, phone, address), photo, profile URL in professional networks (e.g. Xing); information in the cover letter, résumé, certificates and references, proof of education and professional qualifications, notes on job interviews (by phone and in person), results of recruitment tests, if applicable Recipients (and transfers to third countries, if any): Our service provider for email hosting, which is bound to data protection by a data processing agreement, is based in the EEA. The service provider is part of an international group of companies headquartered in the USA with further subcontractors in various third countries. The resulting transfer of data outside the EEA is safeguarded by the conclusion of EU standard contractual clauses. Purpose and legal basis: Basis for decisions on filling positions in the future. The legal basis is consent. Retention period: 2 years from the last contact or the last consent

5.7 General infrastructure

5.7.1 Invoicing and financial accounting

Description: Where our customers are self-employed or part of a partnership, we process your personal data when we send you our invoices. We create our invoices in a cloud application for bookkeeping and accounting. All payments are recorded in our financial accounting. In the process, the identity of the payer or payee is documented. In the case of legal entities, this sometimes also includes the names and contact details of the contacts for the transaction. In some cases, the reason for payment also reveals information about persons or the activity of a person (e.g. in the case of salary/fee payments, travel bookings, reimbursements of expenses). Categories of data: Name, address, date, customer/supplier number and invoice number, invoice amount and invoice content, bank details or credit card data, reason for payment, travel data (time, destination, accommodation, means of transport, costs), hospitality (date, place/restaurant, persons entertained, reason for the hospitality, costs), information on other expenses (purchases, gifts) Recipients (and transfers to third countries, if any): Our service provider for the cloud application for bookkeeping and accounting, which is bound to data protection by a data processing agreement, is based in the EEA. Tax advisors, auditors and lawyers in their capacity as persons bound by professional secrecy. No transfer of data outside the EEA takes place. Purpose and legal basis: Management of all payment transactions. The legal basis is the performance of a contract or a legal obligation (tax and commercial law). Retention period: We retain the data in our financial accounting for 10 years.

5.7.2 Payment transfers

Description: Payments made via one of our bank or credit card accounts are documented accordingly in the account statements. Categories of data: Name, bank details, payment date, payment amount, reason for payment (booking text) Recipients (and transfers to third countries, if any): Our account-holding financial institutions, which are bound by law to data protection through banking secrecy and banking supervision. No transfer to third countries takes place. Purpose and legal basis: Cashless payment transactions; the legal basis is the performance of a contract. Retention period: We retain account statements for 10 years.

5.7.3 File storage

Description: In addition to recording data in individual (previously described) databases, we store documents on our storage media. This typically includes Office documents (Word, Excel, PowerPoint), PDF files, images, films, layouts, other formats of text, spreadsheet and presentation files and, ultimately, any type of file whose use is appropriate in the context of our business processes. The data protection questions regarding the content of the files depend on the relevant processing purposes in each case. In parallel, the storage of the files and the metadata regularly attached to them (primarily the author signature) constitute a separate processing operation. Office documents contain personal metadata in particular when they are worked on jointly (collaboration) and the comment and note functions and the track changes mode are used for this. We use both local servers and cloud solutions for file storage. Categories of data: Any type of data, but here with a focus on metadata: signature of the file creator, signatures of file editors (including in comments and notes); time of creation, editing or saving Recipients (and transfers to third countries, if any): Our primary service provider for cloud storage, which is bound to data protection by a data processing agreement, is based in the EEA. The service provider is part of an international group of companies headquartered in the USA with further subcontractors in various third countries. Other occasionally used service providers, which are bound to data protection by a data processing agreement, are based in the USA. The resulting transfer of data outside the EEA is safeguarded by the conclusion of EU standard contractual clauses. Purpose and legal basis: File storage in a high-performance data center and use of modern search functions. The legal basis is a legitimate interest, since the processing takes place within the framework of processing on our behalf by a processor. Retention period: Depends on the retention period for the individual file

5.7.4 Disposal of data carriers and documents

Description: The erasure or destruction of data also constitutes data processing. Paper documents containing personal data requiring corresponding protection are shredded by us or occasionally disposed of via the locked bins of a professional document destruction company. The quality level of the shredder used or the level of document destruction agreed with the service provider corresponds to the risk or confidentiality classification of the documents to be destroyed. Storage media (hard drives, e.g. from servers, computers, smartphones, tablets, USB sticks, memory cards) on which personal data requiring protection were previously stored are securely erased by our IT administration by overwriting them completely several times, at least three times, when they are no longer to be used for storing such data. The level of the erasure or destruction process corresponds to the risk or confidentiality classification of the data previously stored on the medium. Categories of data: Any type of data Recipients (and transfers to third countries, if any): Service providers for the professional destruction of paper documents and storage media, which are bound to comply with data protection by data processing agreements. No transfer to third countries takes place. Purpose and legal basis: Destruction or erasure of personal data in line with the risk involved. The legal basis is the legal obligation of data minimization and erasure under the GDPR. Retention period: No storage takes place beyond the erasure/destruction.

Description: In the event that we become involved in a legal dispute with you, we pass on data about you and the circumstances of the dispute to lawyers and, if necessary, to courts. Categories of data: Name, contact details, information on the subject matter of the dispute Recipients (and transfers to third countries, if any): Lawyers, courts, bailiffs. All recipients are bound to confidentiality as public bodies or as persons bound by professional secrecy. No transfer to third countries takes place. Purpose and legal basis: Legal enforcement. The legal basis is the legitimate interest in seeking legal assistance from lawyers and, if necessary, courts when required. Retention period: The recipients of your data named above process them according to their own rules to the extent necessary to fulfill their respective tasks. We store the data relating to a legal dispute until the dispute has been finally concluded, including all applicable limitation and objection periods. If a repetition of a comparable dispute with you or other employees is conceivable, we store at least the documents decisive for the proceedings (in anonymized form, if appropriate) for a correspondingly longer period.

5.7.6 Data protection management

Description: If you assert your data protection rights against us, we document the associated communication and processes in our data protection management application. Categories of data: Name, contact details, information on the data protection request Recipients (and transfers to third countries, if any): Our data protection officer, who is bound to confidentiality by law, is based in the EEA. Our service provider for the cloud application for data protection management, which is bound to data protection by a data processing agreement, is based in the EEA. No transfer to third countries takes place. Purpose and legal basis: Data protection management. The legal basis is the statutory accountability obligation under the GDPR. Retention period: We store the data relating to a legal dispute until the dispute has been finally concluded, including all applicable limitation and objection periods. If a repetition of a comparable dispute with you or other employees is conceivable, we store at least the documents decisive for the proceedings (in anonymized form, if appropriate) for a correspondingly longer period. Last updated: October 2026