Privacy policy
Introduction and overview
We have drawn up this privacy policy (version 11.07.2025-113024821) to explain to you, in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws. In short, we provide you with comprehensive information about the data we process about you.
In short: we provide you with comprehensive information about the data we process about you.
Privacy policies usually sound very technical and use legal jargon. This privacy policy, on the other hand, aims to describe the most important aspects as simply and transparently as possible. Where it promotes transparency, technical terms are explained in a reader-friendly manner, links to further information are provided and graphics are used. We therefore use clear and simple language to inform you that we only process personal data in the course of our business activities if there is a corresponding legal basis for doing so. This is certainly not possible if you provide explanations that are as concise, unclear and legally technical as possible, as is often the standard on the internet when it comes to data protection. I hope you find the following explanations interesting and informative, and perhaps there is some information here that you did not know before.
If you still have questions, please contact the responsible body listed below or in the imprint, follow the links provided and view further information on third-party websites. You will also find our contact details in the imprint.
Scope of application
This privacy policy applies to all personal data processed by us within the company and to all personal data processed by companies commissioned by us (processors). By personal data, we mean information within the meaning of Art. 4 No. 1 GDPR, such as a person’s name, email address and postal address. The processing of personal data ensures that we can offer and bill our services and products, whether online or offline. The scope of this privacy policy covers:
all online presences (websites, online shops) that we operate
social media sites and email communication
mobile apps for smartphones and other devices
In short, the privacy policy applies to all areas in which personal data is processed in a structured manner within the company via the channels mentioned. If we enter into legal relationships with you outside of these channels, we will inform you separately if necessary.
Legal basis
In the following privacy policy, we provide you with transparent information about the legal principles and regulations, i.e. the legal basis of the General Data Protection Regulation, which enable us to process personal data.
With regard to EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can, of course, read this EU General Data Protection Regulation online at EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679.
We only process your data if at least one of the following conditions applies:
Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of your data entered in a contact form.
Contract (Article 6(1)(b) GDPR): We process your data in order to fulfil a contract or pre-contractual obligations with you. For example, if we conclude a purchase contract with you, we need personal information in advance.
Legal obligation (Article 6(1)(c) GDPR): We process your data if we are subject to a legal obligation. For example, we are legally obliged to retain invoices for accounting purposes. These usually contain personal data.
Legitimate interests (Article 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data in order to operate our website securely and economically. This processing is therefore a legitimate interest.
Other conditions, such as recording in the public interest, exercising public authority, and protecting vital interests, do not generally apply in our case. If such a legal basis should nevertheless be relevant, it will be indicated at the appropriate place.
In addition to the EU regulation, national laws also apply:
In Austria, this is the Federal Act on the Protection of Individuals with regard to the Processing of Personal Data (Data Protection Act), or DSG for short.
In Germany, the Federal Data Protection Act, or BDSG for short, applies.
If other regional or national laws apply, we will inform you about them in the following sections.
Contact details of the controller
If you have any questions about data protection or the processing of personal data, you will find the contact details of the controller in accordance with Article 4(7) of the EU General Data Protection Regulation (GDPR) below:
DTR Josefstadt Betriebs GmbH
Markus Heinrich
Email: direktion@residenz-josefstadt.at
Telephone: +43 890 2464602
Legal notice: https://www.residenz-josefstadt.at/imprint
Storage period
It is our general policy to store personal data only for as long as is absolutely necessary for the provision of our services and products. This means that we delete personal data as soon as the reason for data processing no longer exists. In some cases, we are legally obliged to store certain data even after the original purpose has ceased to exist, for example for accounting purposes.
If you wish to have your data deleted or revoke your consent to data processing, the data will be deleted as quickly as possible and insofar as there is no obligation to store it.
We will inform you about the specific duration of the respective data processing below, provided we have further information on this.
Rights under the General Data Protection Regulation
In accordance with Articles 13 and 14 of the GDPR, we inform you of the following rights to which you are entitled in order to ensure fair and transparent data processing:
According to Article 15 of the GDPR, you have the right to know whether we process your data. If this is the case, you have the right to receive a copy of the data and to obtain the following information:
the purpose for which we are processing the data;
the categories, i.e. the types of data being processed;
who receives this data and, if the data is transferred to third countries, how security can be guaranteed;
how long the data will be stored;
the existence of the right to rectification, erasure or restriction of processing and the right to object to processing;
that you can lodge a complaint with a supervisory authority (links to these authorities can be found below);
the origin of the data if we have not collected it from you;
whether profiling is carried out, i.e. whether data is automatically evaluated to create a personal profile of you.
According to Article 16 of the GDPR, you have the right to rectification of the data, which means that we must correct the data if you find any errors.
According to Article 17 of the GDPR, you have the right to erasure (‘right to be forgotten’), which specifically means that you may request the erasure of your data.
According to Article 18 of the GDPR, you have the right to restrict processing, which means that we may only store the data but may not use it further.
According to Article 20 of the GDPR, you have the right to data portability, which means that we will provide you with your data in a commonly used format upon request.
According to Article 21 GDPR, you have a right to object, which, once enforced, will result in a change in processing.
If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you may object to the processing. We will then check as soon as possible whether we can legally comply with this objection.
If data is used for direct marketing, you can object to this type of data processing at any time. We will then no longer be allowed to use your data for direct marketing.
If data is used for profiling, you can object to this type of data processing at any time. We will then no longer be allowed to use your data for profiling.
According to Article 22 of the GDPR, you may have the right not to be subject to a decision based solely on automated processing (e.g. profiling).
According to Article 77 of the GDPR, you have the right to lodge a complaint. This means that you can lodge a complaint with the data protection authority at any time if you believe that the processing of personal data violates the GDPR.
In short: you have rights – do not hesitate to contact the responsible body listed above!
If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can lodge a complaint with the supervisory authority. In Austria, this is the data protection authority, whose website can be found at https://www.dsb.gv.at/. In Germany, there is a data protection officer for each federal state. For more information, please contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:
Austrian Data Protection Authority
Head: Dr Matthias Schmidl
Address: Barichgasse 40-42, 1030 Vienna
Telephone number: +43 1 52 152-0
Email address: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/
Data transfer to third countries
We only transfer or process data to countries outside the scope of the GDPR (third countries) if you consent to this processing or if there is other legal permission to do so. This applies in particular if the processing is required by law or necessary for the fulfilment of a contractual relationship and, in any case, only to the extent that this is generally permitted. In most cases, your consent is the most important reason for us to have data processed in third countries. The processing of personal data in third countries such as the USA, where many software manufacturers offer services and have their server locations, may mean that personal data is processed and stored in unexpected ways.
We expressly point out that, in the opinion of the European Court of Justice, an adequate level of protection for data transfers to the USA currently only exists if a US company that processes personal data of EU citizens in the USA is an active participant in the EU-US Data Privacy Framework. For more information, please visit: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en
Data processing by US services that are not active participants in the EU-US Data Privacy Framework may result in data not being processed and stored anonymously. Furthermore, US government authorities may have access to individual data. In addition, collected data may be linked to data from other services of the same provider, provided you have a corresponding user account. Where possible, we try to use server locations within the EU, if this is offered.
We will provide you with more detailed information on data transfers to third countries, where applicable, in the relevant sections of this privacy policy.
Security of data processing
We have implemented both technical and organisational measures to protect personal data. Where possible, we encrypt or pseudonymise personal data. In this way, we make it as difficult as possible for third parties to derive personal information from our data.
Article 25 of the GDPR refers to this as ‘data protection through technology design and data protection-friendly default settings’ and means that security must always be considered and appropriate measures taken for both software (e.g. forms) and hardware (e.g. access to the server room). In the following, we will discuss specific measures where necessary.
TLS encryption with https
TLS, encryption and https sound very technical, and they are. We use HTTPS (Hypertext Transfer Protocol Secure) to transmit data securely over the Internet.
This means that the entire transfer of all data from your browser to our web server is secure – no one can ‘eavesdrop’.
This means we have introduced an additional layer of security and comply with data protection through technology design (Article 25(1) GDPR). By using TLS (Transport Layer Security), an encryption protocol for secure data transmission on the internet, we can ensure the protection of confidential data.
You can recognise the use of this data transmission security by the small lock symbol in the top left corner of your browser, to the left of the Internet address (e.g. examplepage.co.uk) and the use of the https scheme (instead of http) as part of our Internet address.
If you would like to know more about encryption, we recommend searching Google for ‘Hypertext Transfer Protocol Secure wiki’ to find useful links to further information.
Communication
Communication Summary
Affected persons: Anyone who communicates with us by telephone, email or online form
Processed data: e.g. telephone number, name, email address, form data entered. You can find more details on this under the respective contact type used
Purpose: Handling communication with customers, business partners, etc.
Storage period: Duration of the business transaction and legal requirements
Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (legitimate interests)
When you contact us and communicate by telephone, email or online form, personal data may be processed.
The data will be processed for the purpose of handling and processing your enquiry and the associated business transaction. The data will be stored for as long as necessary or as required by law.
Data subjects
The above processes affect all persons who contact us via the communication channels provided by us.
Telephone
When you call us, the call data is stored pseudonymously on the respective end device and by the telecommunications provider used. In addition, data such as your name and telephone number may be sent by email and stored for the purpose of responding to your enquiry. The data will be deleted as soon as the business transaction has been completed and legal requirements permit.
When you communicate with us by email, data may be stored on the respective device (computer, laptop, smartphone, etc.) and data may be stored on the email server. The data will be deleted as soon as the business transaction has been completed and legal requirements permit.
Online forms
When you communicate with us using an online form, data is stored on our web server and, if necessary, forwarded to one of our email addresses. The data will be deleted as soon as the business transaction has been completed and legal requirements permit.
Legal basis
The processing of data is based on the following legal grounds:
6(1)(a) GDPR (consent): You give us your consent to store your data and use it for purposes related to the business transaction;
Art. 6(1)(b) GDPR (contract): It is necessary for the performance of a contract with you or a processor, such as a telephone provider, or we need to process the data for pre-contractual activities, such as preparing an offer;
Art. 6 (1) (f) GDPR (legitimate interests): We want to handle customer enquiries and business communications in a professional manner. This requires certain technical facilities, such as email programmes, Exchange servers and mobile phone operators, in order to communicate efficiently.
Data processing agreement (DPA)
In this section, we would like to explain what a data processing agreement is and why it is necessary. Because the term ‘data processing agreement’ is quite a tongue twister, we will often use the acronym DPA in this text. Like most companies, we do not work alone, but also use the services of other companies or individuals. By involving various companies or service providers, we may pass on personal data for processing. These partners then act as processors with whom we conclude a contract, known as a data processing agreement (DPA). The most important thing for you to know is that the processing of your personal data is carried out exclusively in accordance with our instructions and must be regulated by the DPA.
Who are processors?
As a company and website owner, we are responsible for all data that we process from you. In addition to the responsible parties, there may also be so-called processors. This includes any company or person who processes personal data on our behalf. More precisely, and according to the GDPR definition, any natural or legal person, authority, institution or other body that processes personal data on our behalf is considered a processor. Processors can therefore be service providers such as hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.
For a better understanding of the terminology, here is an overview of the three roles in the GDPR:
Data subject (you as a customer or prospective customer) → Controller (us as a company and client) → Processor (service providers such as web hosts or cloud providers)
Contents of a data processing agreement
As mentioned above, we have concluded a DPA with our partners who act as processors. First and foremost, this stipulates that the processor shall process the data to be processed exclusively in accordance with the GDPR. The contract must be concluded in writing, but in this context, electronic conclusion of the contract is also considered ‘in writing’. Personal data shall only be processed on the basis of the contract. The contract must contain the following:
Commitment to us as the controller
Obligations and rights of the controller
Categories of data subjects
Type of personal data
Type and purpose of data processing
Subject matter and duration of data processing
Place of data processing
Furthermore, the contract contains all the obligations of the processor. The most important obligations are:
Measures to ensure data security
Take possible technical and organisational measures to protect the rights of the data subject
Maintain a data processing directory
Cooperate with the data protection supervisory authority upon request
Perform a risk analysis with regard to the personal data received
Sub-processors may only be commissioned with the written consent of the controller
You can see what such a DPA looks like in concrete terms at https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-mustervertrag-auftragsverarbeitung.html, for example. A sample contract is presented here.
Cookies
Cookies Summary
Data subjects: Visitors to the website
Purpose: Depends on the respective cookie. More details can be found below or from the manufacturer of the software that sets the cookie.
Processed data: Depends on the respective cookie used. More details can be found below or from the manufacturer of the software that sets the cookie.
Storage period: Depends on the respective cookie, can vary from hours to years
Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)
What are cookies?
Our website uses HTTP cookies to store user-specific data.
Below, we explain what cookies are and why they are used so that you can better understand the following privacy policy.
Whenever you surf the Internet, you use a browser. Well-known browsers include Chrome, Safari, Firefox, Internet Explorer and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.
One thing cannot be denied: cookies are really useful little helpers. Almost all websites use cookies. More specifically, they are HTTP cookies, as there are also other cookies for other areas of application. HTTP cookies are small files that are stored on your computer by our website. These cookie files are automatically stored in the cookie folder, which is essentially the ‘brain’ of your browser. A cookie consists of a name and a value. When defining a cookie, one or more attributes must also be specified.
Cookies store certain user data about you, such as language or personal page settings. When you visit our site again, your browser transmits the ‘user-related’ information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are used to. In some browsers, each cookie has its own file, while in others, such as Firefox, all cookies are stored in a single file.
The following graphic shows a possible interaction between a web browser such as Chrome and the web server. The web browser requests a website and receives a cookie from the server, which the browser reuses when another page is requested.
There are both first-party cookies and third-party cookies. First-party cookies are created directly by our site, while third-party cookies are created by partner websites (e.g. Google Analytics). Each cookie must be evaluated individually, as each cookie stores different data. The expiry time of a cookie also varies from a few minutes to a few years. Cookies are not software programmes and do not contain viruses, Trojans or other ‘malware’. Cookies cannot access information on your PC.
Cookie data may look like this, for example:
Name: _ga
Value: GA1.2.1326744211.152113024821-9
Purpose: Distinguishing website visitors
Expiry date: After 2 years
A browser should be able to support these minimum sizes:
At least 4096 bytes per cookie
At least 50 cookies per domain
At least 3000 cookies in total
What types of cookies are there?
The question of which cookies we use in particular depends on the services used and is clarified in the following sections of the privacy policy. At this point, we would like to briefly discuss the different types of HTTP cookies.
There are 4 types of cookies:
Essential cookies
These cookies are necessary to ensure the basic functionality of the website. For example, these cookies are needed when a user adds a product to their shopping basket, then continues browsing other pages and only proceeds to checkout later. These cookies ensure that the shopping basket is not deleted, even if the user closes their browser window.
Functional cookies
These cookies collect information about user behaviour and whether the user receives any error messages. These cookies are also used to measure the loading time and behaviour of the website on different browsers.
Targeted cookies
These cookies ensure better user-friendliness. For example, they store locations, font sizes or form data that have been entered.
Advertising cookies
These cookies are also known as targeting cookies. They are used to deliver personalised advertising to the user. This can be very practical, but also very annoying.
When you visit a website for the first time, you are usually asked which of these cookie types you would like to allow. And, of course, this decision is also stored in a cookie.
If you would like to learn more about cookies and are not afraid of technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Request for Comments from the Internet Engineering Task Force (IETF) entitled ‘HTTP State Management Mechanism’.
Purpose of processing via cookies
The purpose ultimately depends on the respective cookie. You can find more details below or from the manufacturer of the software that sets the cookie.
What data is processed?
Cookies are small helpers for many different tasks. Unfortunately, it is not possible to generalise about what data is stored in cookies, but we will inform you about the processed or stored data in the following privacy policy.
Storage period of cookies
The storage period depends on the respective cookie and is specified below. Some cookies are deleted after less than an hour, while others can remain stored on a computer for several years.
You also have control over how long cookies are stored. You can manually delete all cookies at any time via your browser (see also ‘Right to object’ below). Furthermore, cookies that are based on consent will be deleted at the latest after you revoke your consent, whereby the legality of the storage remains unaffected until then.
Right to object – how can I delete cookies?
You decide for yourself how and whether you want to use cookies. Regardless of which service or website the cookies come from, you always have the option to delete, deactivate or only partially allow cookies. For example, you can block third-party cookies but allow all other cookies.
If you want to find out which cookies have been stored in your browser, or if you want to change or delete cookie settings, you can find this in your browser settings:
Chrome: Delete, enable and manage cookies in Chrome
Safari: Manage cookies and website data with Safari
Firefox: Delete cookies to remove data that websites have stored on your computer
Internet Explorer: Deleting and managing cookies
Microsoft Edge: Deleting and managing cookies
If you do not want cookies at all, you can set your browser to always inform you when a cookie is about to be set. This allows you to decide whether to accept or reject each individual cookie. The procedure varies depending on the browser. The best way to find the instructions is to search Google using the search term ‘delete cookies Chrome’ or ‘disable cookies Chrome’ in the case of a Chrome browser.
Legal basis
The so-called ‘cookie guidelines’ have been in place since 2009. These stipulate that the storage of cookies requires your consent (Article 6(1)(a) GDPR). However, there are still very different responses to these guidelines within EU countries. In Austria, however, this guideline was implemented in Section 165(3) of the Telecommunications Act (2021). In Germany, the cookie guidelines have not been implemented as national law. Instead, this directive has largely been implemented in Section 15 (3) of the Telemedia Act (TMG), which was replaced by the Digital Services Act (DDG) in May 2024.
There are legitimate interests (Article 6(1)(f) GDPR) for strictly necessary cookies, even if no consent has been given, which are mostly of an economic nature. We want to provide visitors to the website with a pleasant user experience, and certain cookies are often absolutely necessary for this.
If cookies that are not absolutely necessary are used, this only happens with your consent. The legal basis for this is Article 6(1)(a) GDPR.
The following sections provide more detailed information about the use of cookies, if the software used employs cookies.
Web hosting Introduction
Web hosting Summary
Data subjects: Visitors to the website
Purpose: professional hosting of the website and securing its operation
Processed data: IP address, time of website visit, browser used and other data. More details can be found below or from the respective web hosting provider.
Storage period: depending on the respective provider, but usually 2 weeks
Legal basis: Art. 6 (1) (f) GDPR (legitimate interests)
What is web hosting?
When you visit websites today, certain information – including personal data – is automatically generated and stored, and this website is no exception. This data should be processed as sparingly as possible and only when justified. By website, we mean all web pages on a domain, i.e. everything from the home page to the very last subpage (like this one). By domain, we mean, for example, example.co.uk or sampleexample.com.
If you want to view a website on a computer, tablet or smartphone, you use a programme called a web browser. You are probably familiar with some web browsers by name: Google Chrome, Microsoft Edge, Mozilla Firefox and Apple Safari. We refer to these as browsers or web browsers for short.
To display the website, the browser must connect to another computer where the website’s code is stored: the web server. Operating a web server is a complicated and time-consuming task, which is why it is usually handled by professional providers. These providers offer web hosting and thus ensure reliable and error-free storage of website data. That’s a lot of technical terms, but please hang in there, it gets even better!
When your browser connects to your computer (desktop, laptop, tablet or smartphone) and during data transfer to and from the web server, personal data may be processed. On the one hand, your computer stores data, and on the other hand, the web server must also store data for a period of time to ensure proper operation.
A picture is worth a thousand words, so the following graphic illustrates the interaction between the browser, the internet and the hosting provider.
Why do we process personal data?
The purposes of data processing are:
Professional hosting of the website and securing its operation
Maintaining operational and IT security
Anonymous evaluation of access behaviour to improve our offering and, if necessary, for criminal prosecution or the pursuit of claims
What data is processed?
Even while you are visiting our website right now, our web server, which is the computer on which this website is stored, automatically stores data such as
the complete Internet address (URL) of the website accessed
browser and browser version (e.g. Chrome 87)
the operating system used (e.g. Windows 10)
the address (URL) of the previously visited page (referrer URL) (e.g. https://www.beispielquellsite.de/vondabinichgekommen/)
the host name and IP address of the device from which access is made (e.g. COMPUTERNAME and 194.23.43.121)
Date and time
in files known as web server log files
How long is data stored?
As a rule, the above data is stored for two weeks and then automatically deleted. We do not pass on this data, but cannot rule out the possibility that it may be accessed by authorities in the event of illegal behaviour.
In short: your visit is logged by our provider (the company that runs our website on special computers (servers)), but we do not pass on your data without your consent!
Legal basis
The lawfulness of the processing of personal data in the context of web hosting is based on Art. 6(1)(f) GDPR (protection of legitimate interests), as the use of professional hosting by a provider is necessary in order to present the company on the internet in a secure and user-friendly manner and to be able to pursue any attacks and claims arising from this.
As a rule, there is a contract between us and the hosting provider for order processing in accordance with Art. 28 f. GDPR, which ensures compliance with data protection and guarantees data security.
1&1 IONOS Web Hosting Privacy Policy
1&1 IONOS Web Hosting Privacy Policy Summary
Data subjects: Visitors to the website
Purpose: Website storage and accessibility on the internet
Processed data: IP address, but above all technical data
Storage period: Visitor data is deleted after 8 weeks
Legal basis: Art. 6 para. 1 lit. f GDPR (Legitimate interests)
What is 1&1 IONOS Web Hosting?
We use the web hosting services of IONOS by 1&1 to host our website. In Germany, 1&1 IONOS SE is based at Elgendorfer Str. 57 in 56410 Montabaur. In Austria, you can find 1&1 IONOS SE at Gumpendorfer Straße 142/PF 266 in 1060 Vienna.
IONOS offers the following web hosting services: domain, website & shop, hosting & WordPress, marketing, email & office, IONOS Cloud and servers. With over 22 million domains, almost 9 million customer contracts and 100,000 servers, IONOS is one of Germany’s biggest players in the web hosting sector.
We already mentioned this in our introduction to web hosting: hosting means that data from you or your device is also stored on the IONOS servers. First and foremost, your IP address, which is known to be personal data, is stored. In addition, technical data such as the URL of our website, the name of your internet browser or which operating system you use is also stored.
Why do we use 1&1 IONOS web hosting?
IONOS was founded in Germany back in 1988 and therefore has over 30 years of experience under its belt. However, this does not mean that the company has not continued to develop in terms of technology. In our view, it is precisely this combination of experience and innovative spirit that provides a good basis for our website. After all, we want our website to run smoothly 24 hours a day and guarantee a high level of security. Since IONOS does not limit monthly data traffic and provides plenty of storage space, our website remains powerful even with many visitors. We are very satisfied with the speed of the website and the price-performance ratio currently meets our requirements.
What data is processed by 1&1 IONOS Webhosting?
1&1 IONOS Webhosting may also process your personal data. When you visit our website, the following data about you or your computer is stored by IONOS:
the previously visited website (also known as the referrer)
the requested website (in this case, our website)
browser type and browser version
your operating system and device type
time of page access
your IP address in anonymised form
The data collected is used to increase the security of the website, identify potential errors and also to perform anonymous statistical analyses. According to IONOS, the anonymised IP address is only used to determine the location of access.
How long and where is the data stored?
The data is stored on IONOS’s own servers. In principle, IONOS stores the data for as long as necessary to fulfil its obligations. Visitor data is stored for 8 weeks. However, data may also be stored for longer, for example to provide evidence for possible legal disputes. Visitor data is not passed on to third parties and is not transferred to countries outside the EU.
How can I delete my data or prevent it from being stored?
You have the right to access, correct, delete and restrict the processing of your personal data at any time. You can also revoke your consent to the processing of your data at any time.
If you wish to deactivate, delete or manage cookies, you will find the relevant links to the respective instructions for the most popular browsers in the ‘Cookies’ section.
Legal basis
We have a legitimate interest in using IONOS to offer our online services. Professional hosting with a provider is necessary to present our company securely and user-friendly on the internet and to be able to track possible cyber attacks. The legal basis for this is Art. 6 (1) lit. f GDPR (legitimate interests).
You can find more information about data protection at IONOS in the privacy policy at https://www.ionos.de/terms-gtc/datenschutzerklaerung/. If you have any further questions about data protection, you can also contact the IONOS data protection team by email at datenschutz@ionos.de.
Web analytics Introduction
Web analytics privacy policy Summary
Data subjects: Website visitors
Purpose: Evaluation of visitor information to optimise the website.
Processed data: Access statistics containing data such as access locations, device data, access duration and time, navigation behaviour, click behaviour and IP addresses. More details can be found in the respective web analytics tool used.
Storage period: Depends on the web analytics tool used
Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)
What is web analytics?
We use software on our website to evaluate the behaviour of website visitors, known as web analytics or web analysis for short. This involves collecting data that is stored, managed and processed by the respective analytics tool provider (also known as a tracking tool). The data is used to create analyses of user behaviour on our website and made available to us as the website operator. In addition, most tools offer various testing options. This allows us to test which offers or content are most popular with our visitors. To do this, we show you two different offers for a limited period of time. After the test (known as an A/B test), we know which product or content our website visitors find more interesting. For such testing procedures, as well as for other analytics procedures, user profiles can also be created and the data stored in cookies.
Why do we use web analytics?
With our website, we have a clear goal in mind: we want to provide the best web offering on the market for our industry. To achieve this goal, we want to offer the best and most interesting content while also ensuring that you feel completely at home on our website. With the help of web analysis tools, we can take a closer look at the behaviour of our website visitors and then improve our website for you and us accordingly. For example, we can see the average age of our visitors, where they come from, when our website is most visited, and which content or products are particularly popular. All this information helps us to optimise the website and thus tailor it to your needs, interests and wishes.
What data is processed?
The exact data that is stored depends, of course, on the analysis tools used. However, as a rule, the following information is stored: what content you view on our website, which buttons or links you click on, when you visit a page, which browser you use, which device (PC, tablet, smartphone, etc.) you use to visit the website, and which computer system you use. If you have agreed that location data may also be collected, this can also be processed by the web analysis tool provider.
Your IP address is also stored. According to the General Data Protection Regulation (GDPR), IP addresses are personal data. However, your IP address is usually stored in pseudonymised form (i.e. in an unrecognisable and abbreviated form). For the purposes of testing, web analysis and web optimisation, no direct data such as your name, age, address or email address is stored. All such data, if collected, is stored in pseudonymised form. This means that you cannot be identified as an individual.
The following example shows schematically how Google Analytics works as an example of client-based web tracking with JavaScript code.
How long the respective data is stored always depends on the provider. Some cookies only store data for a few minutes or until you leave the website, while others can store data for several years.
Duration of data processing
We will inform you about the duration of data processing below, provided we have further information on this. In general, we only process personal data for as long as is absolutely necessary to provide our services and products. If required by law, as in the case of accounting, this storage period may be exceeded.
Right to object
You also have the right and option to revoke your consent to the use of cookies or third-party providers at any time. You can do this either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating or deleting cookies in your browser.
Legal basis
The use of web analytics requires your consent, which we have obtained with our cookie pop-up. According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when collected by web analytics tools.
In addition to consent, we have a legitimate interest in analysing the behaviour of website visitors in order to improve our offering both technically and economically. With the help of web analytics, we can detect errors on the website, identify attacks and improve economic efficiency. The legal basis for this is Art. 6 (1) lit. f GDPR (legitimate interests). However, we only use the tools if you have given your consent.
Since web analytics tools use cookies, we also recommend that you read our general privacy policy on cookies. To find out exactly what data is stored and processed, you should read the privacy policies of the respective tools.
Information on specific web analytics tools can be found in the following sections, where available.
Google Analytics privacy policy
Google Analytics privacy policy summary
Data subjects: Visitors to the website
Purpose: Evaluation of visitor information to optimise the website.
Processed data: Access statistics containing data such as access locations, device data, access duration and time, navigation behaviour and click behaviour. More details can be found further down in this privacy policy.
Storage period: individually adjustable; by default, Google Analytics 4 stores data for 14 months.
Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)
What is Google Analytics?
We use the Google Analytics 4 (GA4) analysis tracking tool from the American company Google Inc. on our website. For the European region, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. Google Analytics collects data about your actions on our website. By combining various technologies such as cookies, device IDs and login information, you as a user can be identified across different devices. This allows your actions to be analysed across platforms.
For example, when you click on a link, this event is stored in a cookie and sent to Google Analytics. The reports we receive from Google Analytics help us to better tailor our website and services to your needs. Below, we provide more detailed information about the tracking tool, in particular what data is processed and how you can prevent this.
Google Analytics is a tracking tool used to analyse traffic on our website. These measurements and analyses are based on a pseudonymous user identification number. This number does not contain any personal data such as name or address, but is used to assign events to a device. GA4 uses an event-based model that collects detailed information about user interactions such as page views, clicks, scrolling and conversion events. In addition, various machine learning functions have been built into GA4 to better understand user behaviour and certain trends. GA4 relies on modelling with the help of machine learning functions. This means that, based on the data collected, missing data can also be extrapolated in order to optimise analysis and make forecasts.
In order for Google Analytics to function, a tracking code is embedded in the code of our website. When you visit our website, this code records various events that you perform on our website. With GA4’s event-based data model, we as website operators can define and track specific events to obtain analyses of user interactions. This means that, in addition to general information such as clicks or page views, specific events that are important to our business can also be tracked. Such specific events can include, for example, submitting a contact form or purchasing a product.
As soon as you leave our website, this data is sent to the Google Analytics servers and stored there.
Google processes the data and we receive reports on your user behaviour. These reports may include the following:
Audience reports: Audience reports help us get to know our users better and understand who is interested in our service.
Advertising reports: Advertising reports make it easier for us to analyse and improve our online advertising.
Acquisition reports: Acquisition reports provide us with helpful information on how we can get more people excited about our service.
Behaviour reports: Here we learn how you interact with our website. We can track your path through our site and which links you click on.
Conversion reports: Conversion is the process by which you perform a desired action based on a marketing message. For example, when you go from being a mere website visitor to a buyer or newsletter subscriber. These reports help us learn more about how our marketing measures are received by you. This is how we aim to increase our conversion rate.
Real-time reports: Here, we always find out immediately what is happening on our website. For example, we can see how many users are currently reading this text.
In addition to the analysis reports mentioned above, Google Analytics 4 also offers the following functions, among others:
Event-based data model: This model records very specific events that may occur on our website. For example, playing a video, purchasing a product or subscribing to our newsletter.
Advanced analytics: These features allow us to better understand your behaviour on our website or certain general trends. For example, we can segment user groups, perform comparative analyses of target groups, or track your path on our website.
Predictive modelling: Based on the data collected, machine learning can be used to extrapolate missing data that predicts future events and trends. This can help us develop better marketing strategies.
Cross-platform analysis: Data can be collected and analysed from both websites and apps. This allows us to analyse user behaviour across platforms, provided you have consented to data processing, of course.
Why do we use Google Analytics on our website?
Our goal with this website is clear: we want to offer you the best possible service. The statistics and data from Google Analytics help us achieve this goal.
The statistically evaluated data gives us a clear picture of the strengths and weaknesses of our website. On the one hand, we can optimise our site so that it is easier for interested people to find on Google. On the other hand, the data helps us to better understand you as a visitor. This means we know exactly what we need to improve on our website in order to offer you the best possible service. The data also helps us to tailor our advertising and marketing activities more effectively and cost-efficiently. After all, it only makes sense to show our products and services to people who are interested in them.
What data is stored by Google Analytics?
Google Analytics uses a tracking code to create a random, unique ID that is linked to your browser cookie. This allows Google Analytics to recognise you as a new user and assign you a user ID. The next time you visit our site, you will be recognised as a ‘returning’ user. All collected data is stored together with this user ID. This is the only way to evaluate pseudonymous user profiles.
In order to analyse our website with Google Analytics, a property ID must be inserted into the tracking code. The data is then stored in the corresponding property. For each newly created property, the Google Analytics 4 property is the default. Depending on the property used, data is stored for different lengths of time.
Through identifiers such as cookies, app instance IDs, user IDs or custom event parameters, your interactions are measured across platforms, provided you have given your consent. Interactions are all types of actions you perform on our website. If you also use other Google systems (such as a Google account), data generated by Google Analytics may be linked to third-party cookies. Google does not share Google Analytics data unless we, as the website operator, approve it. Exceptions may occur if required by law.
According to Google, no IP addresses are logged or stored in Google Analytics 4. However, Google uses the IP address data to derive location data and deletes it immediately afterwards. All IP addresses collected from users in the EU are therefore deleted before the data is stored in a data centre or on a server.
Since Google Analytics 4 focuses on event-based data, the tool uses significantly fewer cookies compared to previous versions (such as Google Universal Analytics). Nevertheless, there are some specific cookies that are used by GA4. These include, for example:
Name: _ga
Value: 2.1326744211.152113024821-5
Purpose: By default, analytics.js uses the _ga cookie to store the user ID. It is primarily used to distinguish between website visitors.
Expiration date: after 2 years
Name: _gid
Value: 2.1687193234.152113024821-1
Purpose: This cookie is also used to distinguish between website visitors.
Expiry date: after 24 hours
Name: _gat_gtag_UA_<property-id>
Value: 1
Purpose: Used to reduce the request rate. If Google Analytics is provided via Google Tag Manager, this cookie is named _dc_gtm_ <property-id>.
Expiry date: after 1 minute
Note: This list cannot claim to be exhaustive, as Google constantly changes its choice of cookies. GA4 also aims to improve data protection. The tool therefore offers a number of options for controlling data collection. For example, we can specify the storage period ourselves and also control data collection.
Here is an overview of the most important types of data collected by Google Analytics:
Heat maps: Google creates so-called heat maps. Heat maps show exactly which areas you click on. This gives us information about where you are ‘travelling’ on our site.
Session duration: Google defines session duration as the time you spend on our site without leaving the site. If you have been inactive for 20 minutes, the session ends automatically.
Bounce rate: A bounce occurs when you view only one page on our website and then leave our website.
Account creation: When you create an account or place an order on our website, Google Analytics collects this data.
Location: IP addresses are not logged or stored in Google Analytics. However, shortly before the IP address is deleted, derivations are used for location data.
Technical information: Technical information includes your browser type, your internet service provider and your screen resolution.
Source of origin: Google Analytics and we are of course also interested in which website or advertisement brought you to our site.
Other data includes contact details, any ratings, media playback (e.g. when you play a video via our site), sharing content via social media or adding it to your favourites. This list is not exhaustive and is only intended to provide a general overview of data storage by Google Analytics.
How long and where is the data stored?
Google has servers located around the world. You can find out exactly where Google’s data centres are located here: https://datacenters.google/
Your data is distributed across various physical data carriers. This has the advantage that the data can be accessed more quickly and is better protected against manipulation. Every Google data centre has appropriate emergency programmes for your data. For example, if Google’s hardware fails or natural disasters cripple servers, the risk of service interruption at Google remains low.
The retention period for data depends on the properties used. The storage period is always determined separately for each individual property. Google Analytics offers us four options for controlling the storage period:
2 months: this is the shortest storage period.
14 months: by default, data is stored for 14 months in GA4.
26 months: data can also be stored for 26 months.
Data is only deleted when we delete it manually
In addition, there is also the option of deleting data only if you do not visit our website again within the period we have selected. In this case, the retention period is reset each time you visit our website again within the specified period.
Once the specified period has expired, the data is deleted once a month. This retention period applies to your data linked to cookies, user recognition and advertising IDs (e.g. cookies from the DoubleClick domain). Reporting results are based on aggregated data and are stored independently of user data. Aggregated data is a combination of individual data into a larger unit.
How can I delete my data or prevent data storage?
Under European Union data protection law, you have the right to obtain information about your data, to update it, to delete it or to restrict its use. You can prevent Google Analytics 4 from using your data by using the browser add-on to deactivate Google Analytics JavaScript (analytics.js, gtag.js). You can download and install the browser add-on at https://tools.google.com/dlpage/gaoptout?hl=de. Please note that this add-on only deactivates data collection by Google Analytics.
If you wish to disable, delete or manage cookies, you will find the relevant links to the respective instructions for the most popular browsers in the ‘Cookies’ section.
Legal basis
The use of Google Analytics requires your consent, which we have obtained with our cookie pop-up. According to Art. 6 (1) (a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when collected by web analytics tools.
In addition to consent, we have a legitimate interest in analysing the behaviour of website visitors in order to improve our offering both technically and economically. With the help of Google Analytics, we can detect website errors, identify attacks and improve economic efficiency. The legal basis for this is Art. 6 (1) lit. f GDPR (legitimate interests). However, we only use Google Analytics if you have given your consent.
Google also processes your data in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.
In addition, Google uses standard contractual clauses (Art. 46(2) and (3) GDPR). Standard contractual clauses (SCC) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to third countries (such as the USA) and stored there. Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google undertakes to comply with European data protection standards when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de
The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.
We hope we have been able to provide you with the most important information about data processing by Google Analytics. If you would like to learn more about the tracking service, we recommend these two links: https://marketingplatform.google.com/about/analytics/terms/de/ and https://support.google.com/analytics/answer/6004245?hl=de.
If you would like to learn more about data processing, please refer to Google’s privacy policy at https://policies.google.com/privacy?hl=de.
Data Processing Agreement (DPA) Google Analytics
We have entered into a Data Processing Agreement (DPA) with Google in accordance with Article 28 of the General Data Protection Regulation (GDPR). You can read about what an DPA is exactly and, above all, what must be included in a DPA in our general section ‘Data Processing Agreement (DPA)’.
This agreement is required by law because Google processes personal data on our behalf. It clarifies that Google may only process data it receives from us in accordance with our instructions and must comply with the GDPR. The link to the data processing terms and conditions can be found at https://business.safety.google/intl/de/adsprocessorterms/.
Google Analytics reports on demographic characteristics and interests
We have enabled the advertising reporting features in Google Analytics. The reports on demographic characteristics and interests contain information on age, gender and interests. This allows us to get a better picture of our users without being able to assign this data to individual persons. You can find out more about the advertising functions at https://support.google.com/analytics/answer/3450482?hl=de_AT&utm_id=ad.
You can opt out of the use of your Google Account activity and information by selecting the checkbox under ‘Advertising settings’ at https://adssettings.google.com/authenticated.
Google Analytics IP anonymisation
We have implemented IP address anonymisation from Google Analytics on this website. This feature was developed by Google so that this website can comply with applicable data protection regulations and recommendations from local data protection authorities if they prohibit the storage of the full IP address. The anonymisation or masking of the IP address takes place as soon as the IP addresses arrive in the Google Analytics data collection network and before the data is stored or processed.
For more information on IP anonymisation, please visit https://support.google.com/analytics/answer/2763052?hl=de.
Meta Conversions API Privacy Policy
Meta Conversions API Privacy Policy Summary
Data subjects: Visitors to the website
Purpose: Optimisation of our services
Processed data: Data such as customer data, user behaviour data, information about your device and your IP address.
More details can be found below in the privacy policy.
Storage period: until the data is no longer useful for Meta purposes
Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)
What is a Meta Conversions API?
We use Meta Conversions API, a server-side event tracking tool, on our website. The service provider is the American company Meta Platforms Inc. Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) is responsible for the European region.
The Meta Conversions API is a tool or function that can measure the performance of our advertising campaigns in real time. The API is an interface that connects our website to Meta and thereby measures certain actions on our website. A conversion occurs when you, as a visitor to a website, perform a desired action. This could be clicking on a button or filling out a registration form, for example. This conversion tracking method is an alternative to Meta Pixel and aims to optimise conversion tracking through precision and reliability. The API sends data directly from our server to Meta on the server side. Personal data may also be processed in the process. In this privacy policy, we go into more detail about data processing by us and Meta.
Why do we use the Meta Conversions API on our website?
We use the Meta Conversions API to improve the quality of our website, our offerings and our advertising campaigns. Our goal is to provide you with the best possible service. We want you to feel comfortable on our website and get exactly what you expect. To do this, we naturally need to tailor our offerings as closely as possible to your wishes and requirements. The Meta Conversions API allows us to do this very effectively and to customise content and offers. This flexibility helps us to take different needs into account and, at the same time, improve our website. The data also helps us to make our advertising measures more cost-effective and more personalised. After all, we only want to show our offers to people who are actually interested in them.
What data is stored by the Meta Conversions API?
With the help of the Meta Conversions API, we can collect various data about events on our website and deliver it to Meta. Exactly which data is stored and processed depends on our individual settings and the specific events and parameters. As a rule, event data, user data, device data and the time at which an event (e.g. button click) took place are stored and sent to Meta. Event data includes actions such as logins, product purchases, page views or button clicks that can be performed on our website. User data may also include personal data such as IP address, name, address or email address. Device data refers to your device type, operating system, browser and screen resolution.
How long and where is the data stored?
Meta generally stores data until it is no longer needed for its own services and Meta products. Meta has servers located around the world where data is stored. However, customer data is deleted within 48 hours after it has been matched with its own user data.
How can I delete my data or prevent it from being stored?
You have the right and the option to access your personal data at any time and to object to its use and processing. You can also lodge a complaint with a government supervisory authority at any time. You can prevent data storage by not consenting to data processing via the Consent Management Tool. Meta Conversions API works on the server side, which means that data deletion is different from client-side methods. Nevertheless, you can check the privacy and security settings in your browser and, if possible, block tracking resources (pixels, cookies, scripts).
Legal basis
If you have consented to your data being processed and stored by Meta Conversions API, this consent serves as the legal basis for data processing (Art. 6(1)(a) GDPR). In principle, your data is also stored and processed on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) in fast and effective communication with you or other customers and business partners. However, we only use the Meta Conversions API if you have given your consent.
Meta also processes your data in the United States, among other places. Meta Platforms is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the United States. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.
Meta also uses standard contractual clauses (= Art. 46(2) and (3) GDPR). Standard contractual clauses (SCCs) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the US). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Meta undertakes to comply with European data protection standards when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de
The Meta data processing terms, which refer to the standard contractual clauses, can be found at https://www.facebook.com/legal/terms/dataprocessing.
For more information about the data processed through the use of Meta Conversions API, please refer to the Privacy Policy at https://www.facebook.com/about/privacy.
Email marketing Introduction
Email marketing Summary
Data subjects: Newsletter subscribers
Purpose: Direct marketing via email, notification of system-related events
Processed data: Data entered during registration, but at least the email address. More details can be found in the respective email marketing tool used.
Storage period: Duration of the subscription
Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)
What is email marketing?
We also use email marketing to keep you up to date. If you have agreed to receive our emails or newsletters, your data will also be processed and stored. Email marketing is a sub-area of online marketing. It involves sending news or general information about a company, products or services by email to a specific group of people who are interested in it.
If you would like to participate in our email marketing (usually via newsletter), you normally only need to register with your email address. To do so, fill out an online form and submit it. However, we may also ask you for your title and name so that we can address you personally.
Registration for newsletters generally works using the ‘double opt-in’ procedure. After you have registered for our newsletter on our website, you will receive an email asking you to confirm your newsletter registration. This ensures that the email address belongs to you and that no one else has registered with someone else’s email address. We or a notification tool we use logs every single registration. This is necessary so that we can also verify that the registration process is legally correct. As a rule, the time of registration, the time of registration confirmation and your IP address are stored. In addition, any changes you make to your stored data are also logged.
Why do we use email marketing?
We naturally want to stay in touch with you and keep you up to date with the most important news about our company. To this end, we use email marketing – often referred to simply as a ‘newsletter’ – as an essential part of our online marketing strategy. Provided you agree to this or it is permitted by law, we will send you newsletters, system emails or other notifications by email. When we use the term ‘newsletter’ in the following text, we mainly mean regularly sent emails. Of course, we do not want to bother you with our newsletters in any way. That is why we always strive to provide only relevant and interesting content. This allows you to learn more about our company, our services or products. As we are constantly improving our offerings, our newsletter will also keep you informed about any news or special, lucrative promotions we may be offering. If we commission a service provider that offers a professional mailing tool for our email marketing, we do so in order to be able to offer you fast and secure newsletters. The purpose of our email marketing is to inform you about new offers and to help us achieve our business goals.
What data is processed?
If you subscribe to our newsletter via our website, you confirm your membership in an email list by email. In addition to your IP address and email address, your title, name, address and telephone number may also be stored. However, this will only happen if you consent to this data storage. The data marked as such is necessary for you to participate in the service offered. Providing this information is voluntary, but failure to do so will result in you being unable to use the service. In addition, information about your device or your preferred content on our website may also be stored. For more information on data storage when you visit a website, please refer to the section ‘Automatic data storage’. We record your declaration of consent so that we can always prove that it complies with our laws.
Duration of data processing
If you unsubscribe your email address from our email/newsletter distribution list, we may store your address for up to three years on the basis of our legitimate interests so that we can still prove your consent at that time. We may only process this data if we need to defend ourselves against any claims.
However, if you confirm that you have given us your consent to subscribe to the newsletter, you can submit an individual deletion request at any time. If you permanently withdraw your consent, we reserve the right to store your email address in a block list. As long as you have voluntarily subscribed to our newsletter, we will of course retain your email address.
Right of objection
You can cancel your newsletter subscription at any time. To do so, you simply need to revoke your consent to subscribe to the newsletter. This usually takes only a few seconds or one or two clicks. In most cases, you will find a link at the end of each email to cancel your newsletter subscription. If you really cannot find the link in the newsletter, please contact us by email and we will cancel your newsletter subscription immediately.
Legal basis
Our newsletter is sent on the basis of your consent (Article 6(1)(a) GDPR). This means that we may only send you a newsletter if you have actively subscribed to it beforehand. We may also send you advertising messages if you have become our customer and have not objected to the use of your email address for direct marketing.
Information on specific email marketing services and how they process personal data can be found in the following sections, where available.
Cookie Consent Management Platform Introduction
Cookie Consent Management Platform Summary
Data subjects: Website visitors
Purpose: Obtaining and managing consent to certain cookies and thus the use of certain tools
Processed data: Data for managing cookie settings, such as IP address, time of consent, type of consent, individual consents. More details can be found in the tool used.
Storage period: Depends on the tool used, but can be expected to be several years
Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)
What is a cookie consent management platform?
We use consent management platform (CMP) software on our website, which makes it easier for us and you to handle scripts and cookies correctly and securely. The software automatically creates a cookie pop-up, scans and checks all scripts and cookies, provides you with the cookie consent required under data protection law, and helps us and you keep track of all cookies. Most cookie consent management tools identify and categorise all existing cookies. As a website visitor, you then decide for yourself whether and which scripts and cookies you allow or do not allow. The following graphic illustrates the relationship between the browser, web server and CMP.
Why do we use a cookie management tool?
Our goal is to offer you the best possible transparency in the area of data protection. We are also legally obliged to do so. We want to inform you as clearly as possible about all tools and cookies that can store and process your data. It is also your right to decide for yourself which cookies you accept and which you do not. In order to grant you this right, we first need to know exactly which cookies have ended up on our website. Thanks to a cookie management tool that regularly scans the website for all existing cookies, we know about all cookies and can provide you with GDPR-compliant information about them. You can then accept or reject cookies via the consent system.
What data is processed?
Our cookie management tool allows you to manage each individual cookie yourself and gives you complete control over the storage and processing of your data. Your consent is stored so that we do not have to ask you for it every time you visit our website and so that we can prove your consent if required by law. This is stored either in an opt-in cookie or on a server. The storage period for your cookie consent varies depending on the provider of the cookie management tool. In most cases, this data (such as pseudonymous user ID, time of consent, details of cookie categories or tools, browser, device information) is stored for up to two years.
Duration of data processing
We will inform you about the duration of data processing below, provided we have further information on this. In general, we only process personal data for as long as is absolutely necessary to provide our services and products. Data stored in cookies is stored for varying lengths of time. Some cookies are deleted as soon as you leave the website, while others may remain stored in your browser for several years. The exact duration of data processing depends on the tool used, but in most cases you should expect a storage period of several years. The respective privacy policies of the individual providers usually provide detailed information about the duration of data processing.
Right to object
You also have the right and the option to revoke your consent to the use of cookies at any time. You can do this either via our cookie management tool or via other opt-out functions. For example, you can also prevent data collection by cookies by managing, deactivating, or deleting cookies in your browser.
Information on specific cookie management tools, if available, can be found in the following sections.
Legal basis
If you agree to cookies, your personal data will be processed and stored via these cookies. If we are permitted to use cookies with your consent (Article 6(1)(a) GDPR), this consent also constitutes the legal basis for the use of cookies and the processing of your data. Cookie consent management platform software is used to manage consent to cookies and to enable you to give your consent. The use of this software enables us to operate the website in an efficient and legally compliant manner, which constitutes a legitimate interest (Article 6(1)(f) GDPR).
Cookiebot Privacy Policy
Cookiebot Privacy Policy Summary
Data subjects: Website visitors
Purpose: Obtaining consent for certain cookies and thus the use of certain tools
Processed data: Data for managing the cookie settings, such as IP address, time of consent, type of consent, individual consents. More details can be found in the respective tool used.
Storage period: the data is deleted after one year.
Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests).
What is Cookiebot?
We use features from the provider Cookiebot on our website. Cookiebot is operated by Cybot A/S, Havnegade 39, 1058 Copenhagen, DK. Among other things, Cookiebot enables us to provide you with a comprehensive cookie notice (also known as a cookie banner or cookie notice). By using this feature, your data may be sent to Cookiebot or Cybot, where it will be stored and processed. In this privacy policy, we explain why we use Cookiebot, what data is transferred, and how you can prevent this data transfer.
Cookiebot is a software product from Cybot. The software automatically creates a GDPR-compliant cookie notice for visitors to our website. In addition, the technology behind Cookiebot scans, checks, and evaluates all cookies and tracking measures on our website.
Why do we use Cookiebot on our website?
We take data protection very seriously. We want to show you exactly what is happening on our website and which of your data is being stored. Cookiebot helps us to get a good overview of all our cookies (first-party and third-party cookies). This allows us to provide you with accurate and transparent information about the use of cookies on our website. You will always receive an up-to-date and privacy-compliant cookie notice and can decide for yourself which cookies you allow and which you do not.
This allows us to provide you with accurate and transparent information about the use of cookies on our website. You will always receive an up-to-date cookie notice that complies with data protection regulations, and you can decide for yourself which cookies you want to allow and which you don’t.
What data is stored by Cookiebot?
If you allow cookies, the following data will be transmitted to Cybot, stored, and processed.
IP address (in anonymized form, the last 3 digits are set to 0)
Date and time of your consent
Our website URL
Technical browser data
Encrypted, anonymous key
The cookies you have allowed (as proof of consent)
The following cookies are set by Cookiebot if you have consented to the use of cookies:
Name: CookieConsent
Value: {stamp:’P7to4eNgIHvJvDerjKneBsmJQd9113024821-2
Purpose: This cookie stores your consent status. This allows our website to read and follow the current status on future visits.
Expiration date: after one year
Name: CookieConsentBulkTicket
Value: kDSPWpA%2fjhljZKClPqsncfR8SveTnNWhys5NojaxdFYBPjZ2PaDnUw%3d%3113024821-6
Purpose: This cookie is set when you allow all cookies and thus activate a “collective consent.” The cookie then stores its own random and unique ID.
Expiration date: after one year
Note: Please note that this is an exemplary list and we cannot claim to be exhaustive. You can see which other cookies may be used in the cookie statement at https://www.cookiebot.com/de/cookie-declaration/.
According to Cybot’s privacy policy, the company does not sell personal data. However, Cybot does share data with trusted third parties or subcontractors who help the company achieve its own business objectives. Data is also shared when required by law.
How long and where is the data stored?
All collected data is transferred, stored, and forwarded exclusively within the European Union. The data is stored in an Azure data center (cloud provider is Microsoft). You can find out more about all “Azure regions” at https://azure.microsoft.com/de-de/explore/global-infrastructure/geographies/. All user data is deleted by Cookiebot 12 months after registration (cookie consent) or immediately after termination of the Cookiebot service.
How can I delete my data or prevent data storage?
You have the right to access and delete your personal data at any time. You can prevent data collection and storage, for example, by rejecting the use of cookies via the cookie notice. Your browser offers another option for preventing data processing or managing it according to your preferences. Cookie management works slightly differently depending on the browser. Under the “Cookies” section, you will find the corresponding links to the respective instructions for the most popular browsers.
Legal basis
If you agree to cookies, your personal data will be processed and stored via these cookies. If we are permitted to use cookies with your consent (Article 6(1)(a) GDPR), this consent also constitutes the legal basis for the use of cookies and the processing of your data. We use Cookiebot to manage consent to cookies and to enable you to give your consent. The use of this software enables us to operate the website in an efficient and legally compliant manner, which constitutes a legitimate interest (Article 6(1)(f) GDPR).
If you would like to learn more about the privacy policy of “Cookiebot” or the company behind it, Cybot, we recommend that you read the privacy policy at https://www.cookiebot.com/de/privacy-policy/.
Heat mapping
We use Hotjar to better understand the needs of our users and to optimize the offering and experience on this website. With the help of Hotjar’s technology, we gain a better understanding of our users’ experiences (e.g., how much time users spend on which pages, which links they click on, what they like and dislike, etc.), which helps us tailor our offering to our users’ feedback. Hotjar uses cookies and other technologies to collect data about our users’ behavior and their devices, in particular the IP address of the device (which is only collected and stored in anonymized form during your use of the website), screen size, device type (unique device identifiers), information about the browser used, location (country only), and preferred language for displaying our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually prohibited from selling the data collected on our behalf.
Online map services Introduction
Online map services Privacy policy Summary
Data subjects: Website visitors
Purpose: Improving the user experience
Processed data: The data processed depends heavily on the services used. In most cases, this includes IP address, location data, search items, and/or technical data. More details can be found in the respective tools used.
Storage period: Depends on the tools used
Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)
What are online map services?
We also use online map services as an extended service for our website. Google Maps is probably the service you are most familiar with, but there are also other providers that specialize in creating digital maps. Such services enable locations, route plans, or other geographical information to be displayed directly on our website. With an integrated map service, you no longer have to leave our website to view the route to a location, for example. To ensure that the online map on our website works, map sections are integrated using HTML code. The services can then display road maps, the earth’s surface, or aerial or satellite images. When you use the built-in map service, data is also transferred to the tool used and stored there. This data may also include personal data.
Why do we use online map services on our website?
Generally speaking, our aim is to ensure that you have an enjoyable experience on our website. And of course, your experience will only be enjoyable if you can easily navigate our website and find all the information you need quickly and easily. That’s why we thought that an online map system could significantly optimize our website service. Without leaving our website, you can easily view route descriptions, locations, and even points of interest with the help of the map system. It is also very convenient that you can see at a glance where our company is located, so you can find us quickly and easily. As you can see, there are many advantages, and we clearly consider online map services on our website to be part of our customer service.
What data is stored by online map services?
When you open a page on our website that has an online map function, personal data may be transmitted to the respective service and stored there. In most cases, this is your IP address, which can also be used to determine your approximate location. In addition to your IP address, data such as search terms entered and longitude and latitude coordinates are also stored. If you enter an address for route planning, for example, this data is also stored. The data is not stored by us, but on the servers of the integrated tools. You can think of it like this: you are on our website, but when you interact with a map service, this interaction actually takes place on their website. To ensure that the service works properly, at least one cookie is usually set in your browser. Google Maps, for example, also uses cookies to record user behavior in order to optimize its own service and display personalized advertising. You can find out more about cookies in our “Cookies” section.
How long and where is the data stored?
Each online map service processes different user data. If we have further information, we will inform you about the duration of data processing below in the relevant sections on the individual tools. As a rule, personal data is only stored for as long as is necessary to provide the service. Google Maps, for example, stores certain data for a specified period of time, while other data must be deleted by you. Mapbox, for example, stores your IP address for 30 days and then deletes it. As you can see, each tool stores data for different lengths of time. We therefore recommend that you carefully review the privacy policies of the tools used.
The providers also use cookies to store data about your user behavior with the map service. You can find more general information about cookies in our “Cookies” section, but you can also find out which cookies may be used in the privacy policies of the individual providers. In most cases, however, this is only an illustrative list and is not exhaustive.
Right to object
You always have the option and the right to access your personal data and to object to its use and processing. You can also revoke your consent at any time. The easiest way to do this is usually via the cookie consent tool. However, there are also other opt-out tools that you can use. You can also manage, delete, or deactivate cookies set by the providers used with just a few clicks of the mouse. However, this may mean that some functions of the service no longer work as usual. How you manage cookies in your browser depends on the browser you use. In the “Cookies” section, you will also find links to instructions for the most important browsers.
Legal basis
If you have consented to the use of an online map service, the legal basis for the corresponding data processing is this consent. According to Art. 6 (1) lit. a GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur when collected by an online map service.
We also have a legitimate interest in using an online map service to optimize our service on our website. The legal basis for this is Art. 6 (1) lit. f GDPR (legitimate interests). However, we only use an online map service if you have given your consent. We would like to emphasize this point once again.
Information on specific online map services can be found in the following sections, where available.
Google Maps Privacy Policy
Google Maps Privacy Policy Summary
Data subjects: Visitors to the website
Purpose: Optimization of our services
Processed data: Data such as search terms entered, your IP address, and latitude and longitude coordinates.
You can find more details below in this privacy policy.
Storage period: Depends on the stored data
Legal basis: Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (f) GDPR (legitimate interests)
What is Google Maps?
We use Google Maps from Google Inc. on our website. For Europe, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services. Google Maps allows us to show you locations more effectively and thus tailor our service to your needs. When you use Google Maps, data is transferred to Google and stored on Google’s servers. Here we would like to explain in more detail what Google Maps is, why we use this Google service, what data is stored, and how you can prevent this.
Google Maps is an internet map service provided by Google. With Google Maps, you can search for the exact locations of cities, landmarks, accommodations, or businesses online via a PC, tablet, or app. If businesses are listed on Google My Business, additional information about the company is displayed alongside the location. To show how to get there, map sections of a location can be embedded in a website using HTML code. Google Maps displays the earth’s surface as a road map or as an aerial or satellite image. Thanks to Street View images and high-quality satellite images, very accurate representations are possible.
Why do we use Google Maps on our website?
All our efforts on this page are aimed at providing you with a useful and meaningful experience on our website. By integrating Google Maps, we can provide you with the most important information about various locations. You can see at a glance where our company headquarters are located. The directions always show you the best or fastest way to get to us. You can call up directions for routes by car, public transport, on foot, or by bicycle. For us, providing Google Maps is part of our customer service.
What data is stored by Google Maps?
In order for Google Maps to offer its full range of services, the company must collect and store data from you. This includes the search terms you enter, your IP address, and your latitude and longitude coordinates. If you use the route planner function, the starting address you enter is also stored. However, this data is stored on the Google Maps website. We can only inform you about this, but we cannot influence it. Since we have integrated Google Maps into our website, Google sets at least one cookie (name: NID) in your browser. This cookie stores data about your user behavior. Google primarily uses this data to optimize its own services and to provide you with individual, personalized advertising.
The following cookie is set in your browser due to the integration of Google Maps:
Name: NID
Value: 188=h26c1Ktha7fCQTx8rXgLyATyITJ113024821-5
Purpose: NID is used by Google to tailor advertisements to your Google search. With the help of the cookie, Google “remembers” your most frequently entered search queries or your previous interaction with ads. This ensures that you always receive customized advertisements. The cookie contains a unique ID that Google uses to collect your personal settings for advertising purposes.
Expiration date: after 6 months
Note: We cannot guarantee that the information provided about the stored data is complete. Changes can never be ruled out, especially when cookies are used. To identify the NID cookie, a separate test page was created that only included Google Maps.
How long and where is the data stored?
Google’s servers are located in data centers around the world. However, most servers are located in America. For this reason, your data is increasingly stored in the USA. You can find out exactly where the Google data centers are located here: https://datacenters.google/
Google distributes the data across various data carriers. This makes the data faster to access and better protected against any attempts at manipulation. Each data center also has special emergency programs. If, for example, there are problems with Google’s hardware or a natural disaster cripples the servers, the data remains fairly secure.
Google stores some data for a specified period of time. For other data, Google only offers the option of manually deleting it. The company also anonymizes information (such as advertising data) in server logs by deleting part of the IP address and cookie information after 9 or 18 months.
How can I delete my data or prevent data storage?
With the automatic deletion feature for location and activity data introduced in 2019, information about your location and web/app activity is stored for either 3 or 18 months, depending on your decision, and then deleted. You can also manually delete this data from your history at any time via your Google account. If you want to prevent your location from being tracked completely, you must pause the “Web & App Activity” section in your Google account. Click on “Data & personalization” and then on the “Activity settings” option. Here you can turn activities on or off.
You can also disable, delete, or manage individual cookies in your browser. Depending on which browser you use, this works slightly differently. Under the “Cookies” section, you will find the corresponding links to the respective instructions for the most popular browsers.
If you do not want cookies at all, you can set your browser to always inform you when a cookie is about to be set. This allows you to decide whether to allow each individual cookie or not.
Legal basis
If you have consented to the use of Google Maps, the legal basis for the corresponding data processing is this consent. According to Art. 6 (1) lit. a GDPR (consent), this consent constitutes the legal basis for the processing of personal data, as may occur during collection by Google Maps.
We also have a legitimate interest in using Google Maps to optimize our online service. The corresponding legal basis for this is Art. 6 (1) lit. f GDPR (legitimate interests). However, we only use Google Maps if you have given your consent.
Google also processes your data in the USA, among other places. Google is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.
Google also uses standard contractual clauses (= Art. 46 (2) and (3) GDPR). Standard contractual clauses (SCC) are model templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even when it is transferred to and stored in third countries (such as the US). Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Google undertakes to comply with European data protection standards when processing your relevant data, even if the data is stored, processed, and managed in the US. These clauses are based on an implementing decision by the EU Commission. You can find the decision and the corresponding Standard Contractual Clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de
The Google Ads Data Processing Terms, which refer to the standard contractual clauses, can be found at https://business.safety.google/intl/de/adsprocessorterms/.
If you would like to learn more about Google’s data processing, we recommend that you read the company’s own privacy policy at https://policies.google.com/privacy?hl=de.
Explanation of terms used
We always strive to make our privacy policy as clear and understandable as possible. However, this is not always easy, especially when it comes to technical and legal issues. It often makes sense to use legal terms (such as personal data) or certain technical terms (such as cookies, IP address). However, we do not want to use these without explanation. Below you will find an alphabetical list of important terms used that we may not have covered sufficiently in the previous privacy policy. If these terms are taken from the GDPR and are definitions, we will also cite the GDPR texts here and add our own explanations where necessary.
Supervisory authority
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the following definitions apply:
“Supervisory authority” means an independent public authority established by a Member State pursuant to Article 51;
Explanation: “Supervisory authorities” are always independent government agencies that also have the authority to issue instructions in certain cases. They are responsible for carrying out what is known as state supervision and are located in ministries, special departments, or other authorities. In Austria, data protection is overseen by the Austrian Data Protection Authority, while in Germany, each federal state has its own data protection authority.
Processor
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Processor” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller;
Explanation: As a company and website owner, we are responsible for all data that we process from you. In addition to the controllers, there may also be so-called processors. This includes any company or person who processes personal data on our behalf. Processors can therefore be service providers such as tax advisors, but also hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.
Relevant supervisory authority
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“supervisory authority concerned” means a supervisory authority which is concerned by the processing of personal data because
a)
the controller or processor is established in the territory of the Member State of that supervisory authority,
b)
that processing has or is likely to have a significant impact on data subjects residing in the Member State of that supervisory authority, or
c)
a complaint has been lodged with that supervisory authority;
Explanation: In Germany, each federal state has its own supervisory authority for data protection. If your company headquarters (main office) is located in Germany, the respective supervisory authority of the federal state is generally your point of contact. In Austria, there is only one supervisory authority for data protection for the entire country.
Consent
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
Explanation: On websites, such consent is usually given via a cookie consent tool. You are probably familiar with this. Whenever you visit a website for the first time, you are usually asked via a banner whether you agree to or consent to data processing. In most cases, you can also configure individual settings and thus decide for yourself which data processing you allow and which you do not. If you do not give your consent, no personal data relating to you may be processed. In principle, consent can of course also be given in writing, i.e., not via a tool.
Personal data
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term:
“personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Explanation: Personal data is therefore all data that can identify you as a person. This usually includes data such as:
Name
Address
Email address
Postal address
Phone number
Date of birth
Identification numbers such as social security number, tax identification number, ID card number, or student ID number
Bank details such as account number, credit information, account balances, and more
According to the European Court of Justice (ECJ), your IP address is also considered personal data. IT experts can use your IP address to determine at least the approximate location of your device and, subsequently, you as the connection owner. Therefore, storing an IP address also requires a legal basis within the meaning of the GDPR. There are also so-called “special categories” of personal data that are particularly sensitive. These include:
racial and ethnic origin
political opinions
religious or philosophical beliefs
trade union membership
genetic data, such as data taken from blood or saliva samples
biometric data (i.e., information about psychological, physical, or behavioral characteristics that can identify a person).
Health data
Data on sexual orientation or sex life
Profiling
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the following definitions apply:
“Profiling” means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements;
Explanation: Profiling involves gathering various pieces of information about a person in order to learn more about that person. In the web environment, profiling is often used for advertising purposes or for credit checks. Web or advertising analysis programs, for example, collect data about your behavior and interests on a website. This results in a specific user profile that can be used to target advertising to a specific audience.
Controller
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term “controller” means:
“Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
Explanation: In our case, we are responsible for the processing of your personal data and are therefore the “controller.” If we pass on collected data to other service providers for processing, they are “processors.” For this purpose, a “processing agreement (PA)” must be signed.
Processing
Definition according to Article 4 of the GDPR
For the purposes of this Regulation, the term “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or otherwise making available, alignment or combination, restriction, erasure, or destruction;
Note: When we refer to processing in our privacy policy, we mean any type of data processing. As mentioned above in the original GDPR statement, this includes not only the collection but also the storage and processing of data.
Concluding remarks
Congratulations! If you are reading these lines, you have really “fought your way through” our entire privacy policy, or at least scrolled down to this point. As you can see from the scope of our privacy policy, we take the protection of your personal data very seriously.
It is important to us to inform you to the best of our knowledge and belief about the processing of personal data. However, we don’t just want to tell you what data is processed, we also want to explain the reasons for using various software programs. Privacy policies usually sound very technical and legal. However, since most of you are not web developers or lawyers, we wanted to take a different approach linguistically and explain the facts in simple and clear language. Of course, this is not always possible due to the nature of the subject matter. Therefore, the most important terms are explained in more detail at the end of the privacy policy.
If you have any questions about data protection on our website, please do not hesitate to contact us or the responsible authority. We wish you a pleasant time and hope to welcome you back to our website soon.
All texts are protected by copyright.
Source: Privacy policy created with the privacy policy generator for Austria by AdSimple