Privacy policy

––––––––––––––––––––
Privacy Policy
––––––––––––––––––––



  1. Introduction and contact details of the controller
    1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data means any information that can be used to identify you personally.
    1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Uwe van Afferden GmbH, Dominikanerstr. 11a, 40545 Düsseldorf, Germany, Tel.: +49211552132, Email: s.kobayashi@theheritagepost.com. The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.


  2. Data collection when you visit our website
    2.1 When you use our website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to the website server (known as “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

  • The page of our website visited

  • Date and time of access

  • Amount of data transmitted in bytes

  • Source/referrer from which you accessed the page

  • Browser used

  • Operating system used

  • IP address used (where applicable, in anonymised form)

Processing is carried out pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.
2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries sent to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the character sequence “https://” and the padlock symbol in your browser’s address bar.

3) Hosting & Content Delivery Network
3.1 Amazon Web Services
We use the system of the following provider to host our website and display its content: AWS EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg
Data may also be transferred to: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA
All data collected on our website is processed on the provider’s servers. We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision adopted by the European Commission.
3.2 Shopify
We use the system of the following provider to host our website and display its content: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)
Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
All data collected on our website is processed on the provider’s servers. We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision adopted by the European Commission.
3.3 Cloudflare
We use a content delivery network provided by: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA
This service enables us to deliver large media files, such as graphics, page content or scripts, more quickly through a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Article 6(1)(f) GDPR. We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision adopted by the European Commission.
3.4 Shopify
We use a content delivery network provided by: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)
Data may also be transferred to:

  • Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

  • Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files, such as graphics, page content or scripts, more quickly through a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Article 6(1)(f) GDPR. We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision adopted by the European Commission.
For data transfers to the USA, the data recipient participates in the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision adopted by the European Commission.

4) Cookies
To make visiting our website appealing and enable the use of certain functions, we use cookies, which are small text files stored on your device. Some of these cookies are automatically deleted when you close your browser (known as “session cookies”), while others remain on your device for longer and allow website settings to be saved (known as “persistent cookies”). In the latter case, you can find the storage period in the cookie settings overview of your web browser.
Where individual cookies used by us also involve the processing of personal data, such processing is carried out either pursuant to Article 6(1)(b) GDPR for the performance of the contract, pursuant to Article 6(1)(a) GDPR where consent has been given, or pursuant to Article 6(1)(f) GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and a user-friendly and effective browsing experience.
You can configure your browser so that you are notified when cookies are set and can decide individually whether to accept them, or so that cookies are rejected in specific cases or generally.
Please note that the functionality of our website may be restricted if you do not accept cookies.

5) Contacting us
When you contact us (e.g. via a contact form or by email), personal data is processed exclusively for the purpose of dealing with and responding to your enquiry and only to the extent necessary for that purpose.
The legal basis for processing this data is our legitimate interest in responding to your enquiry pursuant to Article 6(1)(f) GDPR. If your enquiry relates to a contract, Article 6(1)(b) GDPR provides an additional legal basis for the processing. Your data will be deleted when it is apparent from the circumstances that the matter concerned has been conclusively resolved, provided that no statutory retention obligations prevent its deletion.

6) Data processing when opening a customer account
Pursuant to Article 6(1)(b) GDPR, personal data is also collected and processed to the extent necessary when you provide it to us when opening a customer account. The data required to open an account is shown in the input fields of the relevant form on our website.
You may have your customer account deleted at any time by sending a message to the controller at the address stated above. Once your customer account has been deleted, your data will be deleted, provided that all contracts concluded through the account have been fully performed, no statutory retention periods prevent deletion and we no longer have a legitimate interest in retaining the data.

7) Use of customer data for direct marketing
7.1 Subscribing to our email newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers. The only information required to receive the newsletter is your email address. Providing any additional data is voluntary, and such data is used to address you personally. We use the double opt-in procedure for sending newsletters. This ensures that you only receive newsletters once you have expressly confirmed your consent to receiving them by clicking a verification link sent to the email address provided.
By activating the confirmation link, you give us your consent to use your personal data pursuant to Article 6(1)(a) GDPR. In this context, we store the IP address assigned by your Internet Service Provider (ISP), together with the date and time of registration, so that any possible misuse of your email address can be traced at a later date. The data we collect when you subscribe to the newsletter is used strictly for the specified purposes.
You may unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending an appropriate message to the controller identified at the beginning of this policy. Once you have unsubscribed, your email address will be deleted from our newsletter mailing list without undue delay, unless you have expressly consented to further use of your data or we reserve the right to use your data further in a manner permitted by law and of which we inform you in this policy.
7.2 Sending email newsletters to existing customers
If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly email you offers for goods or services from our range that are similar to those you have already purchased. Under section 7(3) of the German Act Against Unfair Competition (UWG), we are not required to obtain your separate consent for this purpose. In this case, data processing is carried out solely on the basis of our legitimate interest in personalised direct marketing pursuant to Article 6(1)(f) GDPR. If you objected to the use of your email address for this purpose at the outset, we will not send you such emails.
You are entitled to object to the use of your email address for the aforementioned marketing purpose at any time with effect for the future by notifying the controller identified at the beginning of this policy. You will only incur transmission costs at the basic rates. Once we have received your objection, we will cease using your email address for marketing purposes without undue delay.
7.3 MailChimp
Our email newsletters are sent through the following provider: The Rocket Science Group, LLC d/b/a MailChimp, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA
On the basis of our legitimate interest in effective and user-friendly newsletter marketing, we disclose the data you provided when subscribing to the newsletter to this provider pursuant to Article 6(1)(f) GDPR so that it can send the newsletters on our behalf.
Subject to your express consent pursuant to Article 6(1)(a) GDPR, the provider also carries out statistical performance evaluations of newsletter campaigns using web beacons or tracking pixels in the emails sent, which can measure opening rates and specific interactions with the newsletter content. Device information (e.g. time of access, IP address, browser type and operating system) is also collected and analysed, but is not combined with other datasets.
You may withdraw your consent to newsletter tracking at any time with effect for the future.
We have entered into a data processing agreement with the provider that protects our website visitors’ data and prohibits disclosure to third parties.
For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision adopted by the European Commission.
7.4 Advertising by post
On the basis of our legitimate interest in personalised direct marketing, we reserve the right to store your first and last names, your postal address and, where we have received this additional information from you in the course of our contractual relationship, your title, academic degree, year of birth and professional, industry or business designation pursuant to Article 6(1)(f) GDPR, and to use this information to send you relevant offers and information about our products by post.
You may object to our storage and use of your data for this purpose at any time.

8) Data processing for order fulfilment
8.1 To the extent necessary for the performance of the contract for delivery and payment purposes, the personal data collected by us will be disclosed to the transport company and financial institution commissioned by us pursuant to Article 6(1)(b) GDPR.
Where we are obliged under a corresponding contract to provide you with updates for goods with digital elements or for digital products, we process the contact details you provided when placing your order in order to inform you personally in fulfilment of our statutory information obligations pursuant to Article 6(1)(c) GDPR. Your contact details are used strictly for notifications about updates that we are obliged to provide, and we process them for this purpose only to the extent necessary for the relevant notification.
8.2 Use of payment service providers (payment services)
- Apple Pay
If you select the “Apple Pay” payment method offered by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed through the “Apple Pay” function on your device running iOS, watchOS or macOS by charging a payment card stored in “Apple Pay”. Apple Pay uses security features integrated into your device’s hardware and software to protect your transactions. Authorising a payment therefore requires you to enter a code that you have previously set and to verify your identity using your device’s “Face ID” or “Touch ID” function.
For the purpose of processing the payment, the information you provide during the ordering process, together with information about your order, is transmitted to Apple in encrypted form. Apple then encrypts this data again using a developer-specific key before transmitting it to the payment service provider for the payment card stored in Apple Pay to execute the payment. Encryption ensures that only the website through which the purchase was made can access the payment data. Once payment has been made, Apple sends your device account number and a transaction-specific dynamic security code to the originating website to confirm that the payment was successful.
Where personal data is processed in the course of the transfers described above, it is processed exclusively for the purpose of payment processing pursuant to Article 6(1)(b) GDPR.
Apple retains anonymised transaction data, including the approximate purchase amount, the approximate date and time, and an indication of whether the transaction was successfully completed. Anonymisation completely prevents the data from being linked to an individual. Apple uses the anonymised data to improve “Apple Pay” and other Apple products and services.
If you use Apple Pay on your iPhone or Apple Watch to complete a purchase made through Safari on your Mac, the Mac and the authorising device communicate through an encrypted channel on Apple’s servers. Apple does not process or store any of this information in a format that can identify you personally. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to “Wallet & Apple Pay” and disable “Allow Payments on Mac”.
Further information about data protection when using Apple Pay is available at: https://support.apple.com/de-de/HT203027
- Google Pay
If you select the “Google Pay” payment method offered by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), payment is processed through the “Google Pay” application on your NFC-enabled mobile device running at least Android 4.4 (“KitKat”) by charging a payment card stored in Google Pay or a payment system verified there (e.g. PayPal). To authorise a payment of more than €25 through Google Pay, you must first unlock your mobile device using the verification method you have configured (such as facial recognition, a password, a fingerprint or a pattern).
For the purpose of processing the payment, the information you provide during the ordering process, together with information about your order, is disclosed to Google. Google then transmits the payment information stored in Google Pay to the originating website in the form of a uniquely assigned transaction number, which is used to verify that payment has been made. This transaction number does not contain any information about the actual payment details of the payment methods stored in Google Pay; instead, it is generated and transmitted as a numerical token valid for a single use. For all transactions through Google Pay, Google acts solely as an intermediary for processing the payment. The transaction itself takes place exclusively between the user and the originating website by charging the payment method stored in Google Pay.
Where personal data is processed in the course of the transfers described above, it is processed exclusively for the purpose of payment processing pursuant to Article 6(1)(b) GDPR.
Google reserves the right to collect, store and analyse certain transaction-specific information for every transaction carried out through Google Pay. This includes the date, time and amount of the transaction, the merchant’s location and description, a description of the purchased goods or services provided by the merchant, photographs you have attached to the transaction, the name and email address of the seller and buyer or of the sender and recipient, the payment method used, your description of the reason for the transaction and, where applicable, the offer associated with the transaction.
According to Google, this processing is carried out exclusively pursuant to Article 6(1)(f) GDPR on the basis of its legitimate interest in proper accounting, verifying transaction data, and optimising and maintaining the functionality of the Google Pay service.
Google also reserves the right to combine the transaction data processed with other information collected and stored by Google when other Google services are used.
The Google Pay terms of service are available here:
https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de
Further information about data protection when using Google Pay is available at:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de
- Paypal
One or more online payment methods offered by the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
If you select a payment method offered by the provider under which you pay in advance, the payment data you provide during the ordering process (including your name, address, bank and payment card information, currency and transaction number), together with information about the contents of your order, will be disclosed to the provider pursuant to Article 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of processing the payment with the provider and only to the extent necessary for that purpose.
If you select a payment method under which we provide our goods or services before receiving payment, you will also be asked during the ordering process to provide certain personal data (first and last names, street, house number, postcode, town or city, date of birth, email address, telephone number and, where applicable, details of an alternative payment method).
To safeguard our legitimate interest in establishing your ability to pay in such cases, we forward this data to the provider for the purpose of a creditworthiness check pursuant to Article 6(1)(f) GDPR. On the basis of the personal data you provide and other data (such as your shopping basket, invoice amount, order history and payment history), the provider checks whether the payment option you have selected can be granted in view of the risks of payment default and/or bad debt.
The credit report may contain probability values (known as credit scores). Where credit scores are included in the credit report, they are based on a scientifically recognised mathematical and statistical procedure. The calculation of credit scores takes account of address data, among other factors.
You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data where this is necessary to process the payment in accordance with the contract.
- Shopify Payments
One or more online payment methods offered by the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland
If you select a payment method offered by the provider under which you pay in advance (such as payment by credit card), the payment data you provide during the ordering process (including your name, address, bank and payment card information, currency and transaction number), together with information about the contents of your order, will be disclosed to the provider pursuant to Article 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of processing the payment with the provider and only to the extent necessary for that purpose.
8.3 Electronic termination option for continuing contractual relationships with consumers
Consumers who have entered into contracts on this website involving continuing obligations in return for payment (such as subscription contracts) may terminate those contracts using an electronic button in accordance with the applicable notice periods.
Clicking the button takes the consumer to a confirmation page, where they can provide further details about the termination, clearly identify themselves and then submit their notice of termination electronically.
Personal data is collected and transmitted to us in this context pursuant to Article 6(1)(b) GDPR and only to the extent necessary to process the termination properly. Also on the basis of Article 6(1)(b) GDPR, the personal data provided is used to confirm electronically in text form the receipt of the notice of termination and the date on which the contract is to end. Article 6(1)(c) GDPR provides a further legal basis for the processing. We are legally obliged to provide an electronic termination option for consumer contracts concluded by electronic means that involve continuing obligations in return for payment.
8.4 Electronic withdrawal function for distance contracts
Consumers who conclude contracts on this website for which a statutory right of withdrawal exists may exercise that right using an electronic withdrawal function in accordance with the applicable withdrawal provisions.
To provide the electronic withdrawal function, we use a solution supplied by the following provider: Martini & Radl OG Garnisongasse 4/11 1090 Vienna Austria.
When using the withdrawal function, consumers must provide or confirm not only details identifying the contract from which they wish to withdraw, but also additional personal information such as their first and last names and email address.
This information is initially collected by the provider on the basis of our legitimate interest in a user-friendly, stable solution that optimises processing pursuant to Article 6(1)(f) GDPR. It is then used to confirm receipt of the statement of withdrawal by email on our behalf and is finally transmitted to us. We subsequently process the information transmitted to us to handle the withdrawal properly pursuant to Article 6(1)(b) GDPR and Article 6(1)(c) GDPR, on the basis of our statutory obligation to provide an electronic withdrawal function for consumer distance contracts involving payment.
The information collected by the provider is routinely deleted once the withdrawal has been fully processed, provided that no statutory retention obligations prevent deletion.
We have entered into a data processing agreement with the provider that protects the data processed as part of the withdrawal function and prohibits unauthorised disclosure to third parties.

9) Web analytics services
9.1 Google Analytics 4
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables an analysis of your use of our website.
By default, Google Analytics 4 sets cookies when you visit the website. These are stored on your device as small text files and collect certain information. This information also includes your IP address, although Google truncates its final digits to prevent it from being directly linked to an individual.
The information is transmitted to Google’s servers and further processed there. Transfers to Google LLC, based in the USA, are also possible.
Google uses the information collected on our behalf to evaluate your use of the website, compile reports on website activity for us and provide other services relating to website and internet usage. The truncated IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. The data collected through the use of Google Analytics 4 is stored for two months and then deleted.
All processing described above, in particular the setting of cookies on the device used, takes place only if you have given us your express consent pursuant to Article 6(1)(a) GDPR.
Without your consent, Google Analytics 4 will not be used during your visit to the website. You may withdraw your consent at any time with effect for the future. To exercise your right to withdraw consent, please deactivate this service using the “Cookie Consent Tool” provided on the website.
We have entered into a data processing agreement with Google that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
Further legal information about Google Analytics 4 is available at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de and https://policies.google.com/technologies/partner-sites

Demographics
Google Analytics 4 uses the special “Demographics” feature, which enables it to generate statistics about the age, gender and interests of website visitors. This is done by analysing advertising and information from third-party providers. This makes it possible to identify target groups for marketing activities. However, the data collected cannot be attributed to a specific person and is deleted after being stored for two months.
Google Signals
As an extension to Google Analytics 4, Google Signals may be used on this website to generate cross-device reports. If you have enabled personalised advertising and linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics pursuant to Article 6(1)(a) GDPR, analyse your usage behaviour across devices and create database models, including models relating to cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop cross-device analysis, you can disable the “Personalised advertising” function in your Google account settings. To do so, follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=de
Further information about Google Signals is available at: https://support.google.com/analytics/answer/7532985?hl=de
UserIDs
As an extension to Google Analytics 4, the “UserIDs” function may be used on this website. If you have consented to the use of Google Analytics 4 pursuant to Article 6(1)(a) GDPR, created an account on this website and sign in to that account on different devices, your activities, including conversions, may be analysed across devices.
For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision adopted by the European Commission.
9.2 Shopify Analytics
This website uses the web analytics service of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland
Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
Using cookies and/or comparable technologies (tracking pixels, web beacons and algorithms for reading device and browser information), the service collects and stores pseudonymised visitor data, including information about the device used, such as the IP address and browser information, in order to carry out statistical analyses of usage behaviour on our website and create pseudonymised usage profiles. Pseudonymisation generally prevents the data from being directly linked to an individual. The data is not combined with directly identifying information about you collected by other means.
All processing described above, in particular the reading or storage of information on the device used, is carried out only if you have given us your express consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by deactivating this service in the “Cookie Consent Tool” provided on the website.
We have entered into a data processing agreement with the provider that protects our website visitors’ data and prohibits disclosure to third parties.
For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision adopted by the European Commission.

10) Retargeting/Remarketing and conversion tracking
10.1 Meta Pixel
We use the “Meta Pixel” service provided by the following provider as part of our online services: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”)
When a user clicks on an advertisement placed by us on Facebook and/or Instagram, “Meta Pixel” adds a parameter to the URL of our linked page. After the user is redirected, this URL parameter is stored in the user’s browser by a cookie set by our linked page itself.
On the one hand, this enables Meta to identify visitors to our online services as a target audience for displaying advertisements (“ads”). Accordingly, we use the service to display the Facebook and/or Instagram ads placed by us only to users who have shown an interest in our online services or who have certain characteristics (e.g. interests in particular topics or products determined on the basis of the websites visited) that we communicate to Meta (known as “Custom Audiences”).
On the other hand, “Meta Pixel” makes it possible to track whether users were redirected to our website after clicking on an advertisement and what actions they carry out there (known as “conversion tracking”).
The data collected is anonymous to us and therefore does not allow us to draw conclusions about users’ identities. However, the data is stored and processed by Meta, making it possible to link it to the respective user profile and enabling Meta to use the data for its own advertising purposes.
All processing described above, in particular the setting of cookies to read information on the device used, is carried out only if you have given us your express consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by deactivating this service in the “Cookie Consent Tool” provided on the website.
We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
The information generated by Meta is generally transmitted to and stored on a Meta server; this may also involve transfers to servers of Meta Platforms Inc. in the USA.
For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision adopted by the European Commission.
10.2 Google Ads conversion tracking
This website uses the online advertising programme “Google Ads” and, as part of Google Ads, the conversion tracking service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). We use Google Ads to draw attention to our offers on external websites through advertising materials (known as Google AdWords). By reference to the advertising campaign data, we can determine how successful individual advertising measures are. Our aim is to show you advertising that is relevant to you, make our website more interesting for you and ensure a fair calculation of the advertising costs incurred.
The conversion tracking cookie is set when a user clicks on an Ads advertisement served by Google. Cookies are small text files stored on your device. These cookies generally expire after 30 days and are not used to identify individuals personally. If a user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the advertisement and was redirected to that page. Each Google Ads customer receives a different cookie. Cookies therefore cannot be tracked across the websites of Google Ads customers. The information obtained using the conversion cookie, which also includes your IP address, is used to compile conversion statistics for Google Ads customers who have opted to use conversion tracking. These customers learn the total number of users who clicked on their advertisement and were redirected to a page containing a conversion tracking tag. However, they do not receive any information that would allow users to be identified personally. The use of Google Ads may also involve the transfer of personal data to the servers of Google LLC in the USA.
Details about the processing initiated by Google Ads conversion tracking and how Google handles data from websites are available here: https://policies.google.com/technologies/partner-sites
All processing described above, in particular the setting of cookies to read information on the device used, is carried out only if you have given us your express consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by deactivating this service in the “Cookie Consent Tool” provided on the website.
You may also permanently object to the setting of cookies by Google Ads conversion tracking by downloading and installing the Google browser plug-in available at the following link:
https://support.google.com/My-Ad-Center-Help/answer/12155656?hl=de
Please note that certain functions of this website may be unavailable or only partially available if you have disabled the use of cookies.
Google’s privacy policies are available here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/
For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision adopted by the European Commission.

11) Website functionalities
Youtube
This website uses plug-ins to display and play videos from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland
Data may also be transferred to: Google LLC., USA
When you access a page on our website that contains such a plug-in, your browser establishes a direct connection to the provider’s servers to load the content, at the latest when the video is played. Certain information, including your IP address, is transmitted to the provider in the process.
If playback of embedded videos is started through the plug-in, the provider also uses cookies to collect information about user behaviour, compile playback statistics and prevent abusive behaviour.
If you are signed in to a user account with the provider while visiting our website, your data will be linked directly to your account when you click on a video. If you do not want the data to be linked to your account, you must sign out before pressing the play button.
All processing described above, in particular the setting of cookies to read information on the device used, takes place only if you have given us your express consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by deactivating this service using the “Cookie Consent Tool” provided on the website.
For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision adopted by the European Commission.

12) Tools and miscellaneous
12.1 DATEV
We use the cloud-based accounting software service of the following provider to carry out our accounting: DATEV eG, Paumgartnerstr. 6-14, 90429 Nürnberg, Germany
The provider processes incoming and outgoing invoices and, where applicable, our company’s bank transactions in order to record invoices automatically, match them to transactions and use them to prepare the financial accounts through a partially automated process.
Where personal data is also processed in this context, processing is carried out on the basis of our legitimate interest in efficiently organising and documenting our business transactions pursuant to Article 6(1)(f) GDPR.
12.2 easybill
We use the cloud-based accounting software service of the following provider to carry out our accounting: easybill GmbH, Düsselstr. 21, 41564 Kaarst
The provider processes incoming and outgoing invoices and, where applicable, our company’s bank transactions in order to record invoices automatically, match them to transactions and use them to prepare the financial accounts through a partially automated process.
Where personal data is also processed in this context, processing is carried out on the basis of our legitimate interest in efficiently organising and documenting our business transactions pursuant to Article 6(1)(f) GDPR.
12.3 PayJoe
We use the “PayJoe” service provided by NetConnections GmbH, Jesinger Str. 52, 73230 Kirchheim unter Teck (“PayJoe”), to carry out our accounting.
PayJoe acts as an interface between the payment service providers we use and our accounting software by processing individual transactions from the payment service providers and supplementing them with supporting document data. This allows incoming payments, refunds, fees and payout amounts from payment service providers to be automatically recorded and processed in the accounting software we use. PayJoe also enables physical or digital incoming invoices to be transmitted automatically and in the correct format to the accounting software for recording there.
Where personal data is also processed in the course of these operations, processing is carried out on the basis of our legitimate interests in efficiently organising and documenting our business transactions and in ensuring appropriate and complete accounting procedures pursuant to Article 6(1)(f) GDPR.
We have entered into a data processing agreement with NetConnections GmbH as the operator of PayJoe, under which we require the company to protect our customers’ data and not to disclose it to third parties.
12.4 Cookie Consent Tool
This website uses a “Cookie Consent Tool” to obtain valid user consent for cookies and cookie-based applications that require consent. The “Cookie Consent Tool” is displayed to users when they access the website in the form of an interactive user interface, on which consent to certain cookies and/or cookie-based applications can be given by ticking the relevant boxes. The tool ensures that all cookies/services requiring consent are loaded only if the respective user has given the corresponding consent by ticking the relevant boxes. This ensures that such cookies are placed on the user’s device only where consent has been given.
The tool sets technically necessary cookies to store your cookie preferences. As a rule, no personal user data is processed in this context.
If, in an individual case, personal data (such as an IP address) is nevertheless processed for the purpose of storing, assigning or recording cookie settings, such processing is carried out pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly cookie consent management and, consequently, in ensuring that our website complies with the law.
Article 6(1)(c) GDPR provides a further legal basis for the processing. As the controller, we are legally obliged to make the use of cookies that are not technically necessary conditional upon the respective user’s consent.
Where necessary, we have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.
Further information about the operator and the settings available in the Cookie Consent Tool can be found directly in the relevant user interface on our website.

13) Rights of the data subject
13.1 Applicable data protection law grants you the following rights as a data subject against the controller in relation to the processing of your personal data (rights of access and intervention). The conditions for exercising each right are set out in the legal provision cited:

  • Right of access pursuant to Article 15 GDPR;

  • Right to rectification pursuant to Article 16 GDPR;

  • Right to erasure pursuant to Article 17 GDPR;

  • Right to restriction of processing pursuant to Article 18 GDPR;

  • Right to be informed pursuant to Article 19 GDPR;

  • Right to data portability pursuant to Article 20 GDPR;

  • Right to withdraw consent pursuant to Article 7(3) GDPR;

  • Right to lodge a complaint pursuant to Article 77 GDPR.

13.2 RIGHT TO OBJECT
IF, FOLLOWING A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

14) Duration of storage of personal data
The duration for which personal data is stored is determined by the relevant legal basis, the purpose of the processing and, where applicable, the relevant statutory retention period (e.g. retention periods under commercial and tax law).
Where personal data is processed on the basis of express consent pursuant to Article 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.
Where statutory retention periods apply to data processed in connection with contractual or similar obligations on the basis of Article 6(1)(b) GDPR, this data is routinely deleted upon expiry of those retention periods, provided that it is no longer necessary for the performance or initiation of a contract and/or we no longer have a legitimate interest in retaining it.
Where personal data is processed on the basis of Article 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes on the basis of Article 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Article 21(2) GDPR.
Unless otherwise stated in the other information in this policy concerning specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.