Privacy policy
Thank you for your interest in our website. The protection of your personal data is very important to us. Below you will find information on how we handle the data collected through your use of our website. Your data is processed in accordance with the legal regulations on data protection.
1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) is
TRIGA-S GmbH
Mühltal 5
82392 Habach
Phone: +49 (0) 88 47 – 695 78 0
Email: info@triga-s.de
2. Contact information for the Data Protection Officer
You can reach the Data Protection Officer at
Proliance GmbH
www.proliance.ai
Data Protection Officer
Leopoldstr. 21
80802 Munich
Email: datenschutzbeauftragter@proliance.ai
When contacting the Data Protection Officer, please specify the company to which your inquiry relates. Please also refrain from attaching sensitive information, such as a copy of your ID, to your inquiry.
3. General Information on Data Transfer to Third Countries
The processing of your data may, where applicable, also take place in countries outside the European Union (EU) and the European Economic Area (EEA).
For data transfers to certain third countries, an adequacy decision by the EU Commission pursuant to Art. 45(1) GDPR may exist. Such a decision establishes that an adequate level of data protection exists in the third country. A list of previous adequacy decisions can be viewed at the following link: Data protection adequacy for non-EU countries.
The scope of an adequacy decision may also be limited to a specific group of recipients or subject to the fulfillment of additional conditions.
For example, the adequacy decision for data transfers to the U.S. applies only to companies certified under the EU- U.S. Data Privacy Framework. The certification status of a participating company can be viewed at the following link: Participant Search (dataprivacyframework.gov).
When your data is transferred to recipients in third countries for which no adequacy decision exists, there is a risk that authorities in those countries may access your data for security and surveillance purposes without you being informed or having the opportunity to seek legal remedy.
To ensure an adequate level of data protection when transferring your data to recipients in such third countries, we therefore ensure that appropriate safeguards exist in accordance with Article 46 of the GDPR.
Consequently, either we or the service providers we engage regularly enter into the European Commission’s Standard Data Protection Clauses pursuant to Article 46(2)(c) of the GDPR. These clauses oblige the recipient of the data in the third country to process it in accordance with the European level of protection. The clauses can be viewed at the following link: Publications on the Standard Contractual Clauses (SCCs) – European Commission. Should you require further information regarding the modules of the Standard Data Protection Clauses we have concluded in specific cases or supplementary measures, we will be happy to provide you with a copy. In this case, simply contact us using the contact details listed above under “Data Controller.”
For certain recipients, data transfers may also be based on binding corporate rules (BCRs) approved by the supervisory authorities in accordance with Article 46(2)(b) of the GDPR. These can be viewed at the following link: Approved Binding Corporate Rules | European Data Protection Board.
To the extent that the Standard Data Protection Clauses or Binding Corporate Rules are insufficient to ensure the required level of protection, additional technical, contractual, or organizational measures are implemented to safeguard the data transfer. Furthermore, we regularly review and assess whether these additional measures continue to ensure an adequate level of data protection or whether further supplementary measures may need to be implemented.
Further information on data transfers to third countries can be found in the relevant cases below in the sections on data processing or services used under “Data Processing in Third Countries.”
4. Privacy Information for Website Visitors
4.1. Data processing in connection with web hosting
4.1.1. Usage Data and Server Log Files
Description of data processing and purpose
When you visit our website, it is technically necessary for data to be transmitted between your web browser and ours for communication purposes. During an active connection for communication between the web browser and the web server, the following data is regularly collected:
- IP address of the requesting device (router or mobile device),
- Date and time of the request,
- Name of the requested file,
- Website from which the file was requested (referrer URL),
- Access status,
- Amount of data transferred,
- Web browser and operating system used,
- Language used.
The listed data is stored in log files and analyzed as needed.
The purpose of data processing and our legitimate interest lie in ensuring a smooth connection between your web browser and our website, guaranteeing the technically error-free provision of our services, and being able to detect, prevent, and track attacks on our website. The log files are used to evaluate system stability, functionality, and security. The processing of this data is strictly necessary to make the website available to you.
Legal basis for data processing
The legal basis for the processing of the data is Art. 6(1)(f) of the GDPR.
Recipients
In the course of data processing, your data is transferred to the following categories of recipients or recipients whom we engage in the course of data processing to achieve the stated purposes
- Hosting service providers
- IT support and administration service providers,
- Software service providers who provide us with solutions for the analysis of log data.
These recipients include, in particular:
Hosting service providers
Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany
In the event of suspicious activity or attacks, data may also be shared in individual cases with:
- Information security consultants and IT forensic experts
- Attorneys,
- Investigative authorities,
- courts.
Data Processing in Third Countries
No data is transferred to third countries. Additional information on this topic and further links can be found above in the section “General Information on Data Transfer to Third Countries.”
Retention period
For technical security reasons, in particular to defend against attempted attacks on our web server, we store this data temporarily. After no later than 7 days, the data is anonymized by truncating the IP address to the domain level, so that it is no longer possible to establish a connection to the individual user.
In individual cases, such as attacks or attempted attacks, the data may be retained for a longer period if necessary, to the extent required until the conclusion of investigative or legal proceedings or for the exercise of legal claims.
In anonymized form, the data from the log files may be further stored and processed for statistical purposes.
4.2. Data Processing in Connection with Cookies and Similar Technologies
4.2.1. Access to and storage of information on end devices
By using our website, information (e.g., IP address) may be accessed or stored (e.g., cookies) on your end devices. This access or storage may involve further processing of personal data within the meaning of the GDPR.
In cases where such access to or storage of information is absolutely necessary for the technically error-free provision of our services, this is carried out on the basis of Section 25(2)(1) or (2) of the Telecommunications and Digital Services Data Protection Act (TDDDG).
In cases where such a process serves other purposes (e.g., the needs-based design of our website), it is carried out solely on the basis of Section 25(1) of the TDDDG. Consent may be revoked at any time with future effect.
To the extent that personal data is subsequently processed, this is done on the basis of the GDPR and the Federal Data Protection Act (BDSG). We explain these data processing activities separately in our Privacy Policy.
Further information regarding the processing of your personal data and the relevant legal bases in this context can be found in the following sections on specific processing activities on our website.
4.2.2. Cookies and Similar Technologies
4.2.2.1. General Information
We use services on this website that employ cookies and similar technologies to store data in your device’s browser and to read data that has already been stored. Cookies, your browser’s local storage, pixels, and so-called tags may be used for this purpose.
Cookies are small text files that are stored on your device and can be read.
A distinction is made between session cookies, which are deleted as soon as you close your browser, and persistent cookies, which are stored for a specific period of time beyond the individual session.
In addition to cookies, we may use your browser’s session storage or local storage to store and read data there.
We may also embed pixels in our websites. Pixels are small, customized, invisible image files that are loaded when a page is loaded and can be used to track user activity.
Finally, we may use tags on our websites. Tags are small HTML or JavaScript code fragments or markers that enable website analytics or user tracking services to distinguish or identify users and track certain user activities.
Further information about the cookies and similar technologies we use can be found below in the descriptions of the categories of cookies, as well as in our consent management platform, which is displayed when you visit our website. Through the platform, you can give your consent and easily revoke it.
You can access the platform at any time via the cookie icon at the bottom left of the webpage to change your settings.
Please note that without the use of certain cookies and similar technologies, our websites may not display correctly, and some features may no longer be technically available.
4.2.2.2. Category: Necessary
Services in this category may use cookies and similar technologies to store and read information on your device. We use these for the purpose and in the interest of
- enable the display of the website and provide its basic functions, in particular page navigation and access to login areas,
- to enable the granting and revocation of consent,
- to protect our forms from fraudulent entries, and
- to protect our website from cyberattacks and fraud attempts.
The use of the services as well as corresponding cookies and similar technologies in this category is based on Section 25(2)(1) and (2) of the TDDDG. Subsequent data processing is based on Article 6(1)(f) of the GDPR.
4.2.2.3. Category: Preferences
Services or external content and media from third-party providers in this category may use cookies and similar technologies to store and read information on your device. We use these
- to enable the loading of third-party content and media,
- to design our websites to be appealing to you and to operate them efficiently, and
- to provide you with certain settings and additional website features.
The use of the services as well as corresponding cookies and similar technologies in this category is based on your consent pursuant to Section 25(1) TDDDG. Subsequent data processing is based on your consent pursuant to Article 6(1)(a) GDPR.
4.2.2.4. Category: Statistics
Services in this category may use cookies and similar technologies to store and read information on your device. We use these,
- to identify and distinguish you as an individual website visitor and to generate statistical analyses of your interactions and use of our websites,
- to design our websites to meet your needs and adapt them to user interactions,
- to test changes to the website and measure user response to them (A/B testing), and
- to monitor the technical functionality of our website and enable troubleshooting.
To this end, we and the services regularly store individual pseudonymous identifiers (recognition features) consisting of numbers and letters in cookies on your device when you visit our website, and read them out again when you visit again.
The use of pseudonyms enables the individual differentiation and recognition of users. However, the natural person behind a pseudonym cannot generally be identified directly – and certainly not by name – without further, additional data.
Other technologies may also be used to read identification features from your device, such as in the case of so-called browser or device fingerprinting, where data regarding the characteristics of the browser you use (e.g., type and version of the browser) and its configuration (e.g., preferred language), the characteristics of your device (e.g., manufacturer and model of your mobile phone, operating system), or the hardware you use (e.g., screen resolution) to pseudonymously recognize you as a distinct user.
The use of the services as well as corresponding cookies and similar technologies in this category is based on your consent pursuant to Section 25(1) TDDDG. Subsequent data processing is based on your consent pursuant to Article 6(1)(a) GDPR.
4.2.2.5. Category: Marketing
Services in this category may use cookies and similar technologies to store and read information on your device. We use these
- to count and distinguish you as an individual website visitor and to create statistical analyses of your interactions and your use of our websites,
- to track your interactions with advertisements placed by us via third-party providers on other websites across various devices and websites (so-called conversion tracking),
- to track and evaluate your interactions with our website and subsequently use this information as the basis for targeted advertising campaigns in ad networks aimed at you or a specific target group to which you belong (so-called retargeting and remarketing),
- to improve the effectiveness of our advertising measures and manage our advertising campaigns.
To this end, individual pseudonymous identifiers (recognition features) consisting of numbers and letters are regularly stored in cookies on your device when you visit another website or our website, and are read again when you revisit that website or visit a new one.
Other technologies may also be used regularly to read recognition features from your device, such as in the case of so-called browser or device fingerprinting, in which data regarding the characteristics of the browser you use (e.g., type and version of the browser) and its configuration (e.g., preferred language) or the characteristics of your device (e.g., manufacturer and model of your mobile phone, operating system) or the hardware you use (e.g., screen resolution) to pseudonymously identify you as a distinct user.
If necessary, the processed pseudonymous identification features may also be combined with other data by us or the providers of the services used.
This allows the services we use and their providers to exchange and compare recognition features (IDs) with one another so that, in the event of a match, the features can be merged and assigned to the same pseudonymous user (so-called ID matching/ID syncing). This enables cross-device, cross-platform, and cross-ad network recognition and targeted advertising of website visitors.
If you identify yourself with your personal data such as your name or email address, or enter your own user data on our websites, or log in to social networks or third-party online services that also provide us with corresponding tracking and advertising services, pseudonymous identifiers may additionally be linked to your personal data or user data.
In this way, we or the service providers can create and analyze comprehensive pseudonymous or non-pseudonymous user profiles to subsequently use them for targeted advertising based on your interests.
The use of these services, as well as corresponding cookies and similar technologies in this category, is based on your consent pursuant to Section 25(1) of the German Telemedia Act (TDDDG). Subsequent data processing is based on your consent pursuant to Article 6(1)(a) of the General Data Protection Regulation (GDPR).
4.3. Consent Management via the “Cookiebot by Usercentrics” Consent Management Platform
On our websites, we use the consent management platform “Cookiebot by Usercentrics” provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark.
Description of data processing and purpose
We use this service to manage your consent to the use of cookies and similar technologies, as well as to the subsequent data processing.
If you grant or deny consent via the banner on our consent management platform, the service processes the following data:
- Your device information
- the description of the web browser and operating system used
- The language used by your browser and operating system
- Device ID
- Website and banner data
- The website operator’s ID and the address of the website where you provide your consent
- The language of the consent banner
- The version of the banner template
- IP address
- Geographic location
- Consent data
- Your consent ID for assigning and requesting your consent
- Date and time of consent
- Your consent status regarding the cookies and similar technologies we use, or regarding the services we provide, which serves as proof of your consent.
Purposes of processing:
- Obtaining, managing, and documenting cookie consents
- Provision of legally compliant consent management
- Automatic detection of cookies used (cookie scan)
- Storage of user preferences
This data is logged on the provider’s servers. As part of data processing, data is stored in the browser’s session storage and local storage, and a pixel is used to save your consent status on your device, read it again when you revisit the page, and verify it.
This allows us to verify your consent status during all subsequent and future visits to our websites and, in accordance with your decision regarding the use of cookies and other technologies, to activate or deactivate them when you revisit the page.
The purpose of the data processing and our legitimate interest lie in centrally managing cookies and similar technologies integrated into our website, as well as integrated services, and in offering you a simple way to provide and revoke your consent, thereby enabling us to fulfill our legal obligations to obtain consent and our accountability obligations pursuant to Art. 5(2) 2 of the GDPR.
Legal basis for data processing
To the extent that we use cookies and similar technologies in connection with the integration of the service, or to the extent that data is stored on or read from your device by the service, this is done in accordance with § 25(2)(2) TDDDG. Subsequent data processing is based on Art. 6(1)(f) GDPR.
Recipients
In connection with the use of the service, the data collected via our websites is transmitted to the following recipients:
- Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark
Further information can be found in the official privacy policy:
https://www.cookiebot.com/de/privacy-policy/
Retention Period
By integrating the service into our websites, data is transmitted to the recipients listed above and stored there for a period of 1 month. Data processed by the service and made available to us is not typically stored in our own systems beyond this period. In individual cases, data regarding the time, status, and scope of consent may also be stored in our own systems for a longer period, provided this is permissible for other purposes specified in this statement.
4.4. Google Tag Manager
We integrate the “Google Tag Manager” service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, into our websites.
In the European Union (EU) and the European Economic Area (EEA), the service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Description of data processing and purpose
“Google Tag Manager” is a tag management system (TMS) that enables us to integrate and manage additional website content in JavaScript or HTML code.
In particular, it allows so-called tags to be integrated into and managed on our website. Tags are small code fragments or markers (web beacons, tracking pixels, or similar markers) that enable website analytics or user tracking services to distinguish or identify users.
The analysis of website visits or user tracking is not performed by “Google Tag Manager” itself, but by the services used for these purposes, such as “Google Analytics” or other third-party solutions. Rather, “Google Tag Manager” serves solely to integrate and manage the markers required for analysis or tracking on our websites.
Since “Google Tag Manager” is provided by Google and is loaded from its servers when a page is accessed, the usage data technically required for page access is also transmitted. In this regard, Google also receives your IP address, which is technically necessary for retrieving the content.
The purpose of data processing and our legitimate interest lie in being able to integrate additional services and content into our websites in a simple and efficient manner through the use of Google Tag Manager.
Legal basis for data processing
The legal basis for the integration and use of the service is your consent, provided you have given it via our consent management platform.
The use of cookies and similar technologies is based on Section 25(1) of the TDDDG. The subsequent data processing is based on Article 6(1)(a) of the GDPR.
Your consent is voluntary and may be freely revoked at any time with future effect. To revoke your consent, please use the cookie icon at the bottom left of the webpage to reopen the consent management platform and change your settings.
Recipients
In connection with the use of the service, the data collected via our websites is transmitted to the following recipients:
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,
- Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.
For more information on how the service provider handles personal data, please visit https://policies.google.com/privacy?hl=de.
Data Processing in Third Countries
Your data is transferred to recipients in third countries. For data transfers to the U.S., there is an adequacy decision by the European Commission regarding companies certified under the EU-U.S. Data Privacy Framework. Google LLC is certified under the EU-U.S. Data Privacy Framework.
Additional information on this topic and further links can be found above in the section “General Information on Data Transfers to Third Countries.”
Retention Period
By integrating the service into our websites, data is transferred to the recipients listed above and processed there for as long as necessary to achieve the stated purposes. No further storage of the data processed by the service and made available to us takes place in our own systems.
4.5. Google Analytics
We integrate the “Google Analytics” service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, into our websites.
In the European Union (EU) and the European Economic Area (EEA), the service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Description of data processing and purpose
“Google Analytics” creates usage profiles based on pseudonyms (identification features derived from cookie and device IDs and other data regarding the end device used or the so-called browser fingerprint) and usage data (e.g., name and address of the web content requested by your browser, referral links, description of the web browser and operating system used, as well as the IP address of the requesting device).
Likewise,
- demographic data (such as continent, country, region, city, age group, gender, language, and user interests)
- data regarding your interactions with search engines or other websites that are collected by Google (such as search engine queries that can be associated with your Google account, the origin of your visit to our site – for example, whether it resulted from clicking on a paid ad in a search engine – search terms used, or, in some cases, the history of websites you have visited)
- Information about which website you came to our website from,
- Information about your device (such as category, manufacturer, and model) and its configuration (e.g., language settings, screen resolution),
- Information about your interests, to the extent that they are collected by Google as part of your internet usage,
- Information about your interactions with our advertisements or campaigns (e.g., that a specific action on our website resulted from clicking on a particular advertisement),
- Data regarding your interactions with our websites, as well as
- Data regarding your interactions with social media networks (such as sharing content).
collected and analyzed.
In this way, Google is able to recognize website visitors and the devices they use pseudonymously, count them as such, and assign them to specific demographic target groups, interest groups, or customer segments.
Visitors who have their own user account on Google platforms can also be identified by Google across devices as visitors to our websites.
Cookies and similar technologies, in particular JavaScript, are used to store and read data on your device. For further details, see “Data Processing in Connection with Cookies and Similar Technologies” above.
Google compiles summary statistics for us from the processed information, which allow us to see what our website users are interested in and how many users have interacted with our websites and in what ways.
We receive only summarized statistics (aggregated data) from Google, from which we, as users of Google advertising services, cannot draw conclusions about individual persons.
We then use these insights to run target-audience-oriented online advertising measures and marketing campaigns in advertising networks, particularly in Google advertising services.
The purpose of data processing is to evaluate and analyze the origin, preferences, and interests of visitors to our websites so that we can subsequently optimize our online advertising measures and display ads tailored to specific target groups based on these insights.
Legal basis for data processing
The legal basis for the integration and use of the service is your consent, provided you have given it via our consent management platform.
The use of cookies and similar technologies is based on Section 25(1) of the TDDDG. The subsequent data processing is based on Article 6(1)(a) of the GDPR.
Your consent is voluntary and may be freely revoked at any time with future effect. To revoke your consent, please use the cookie icon at the bottom left of the webpage to reopen the consent management platform and change your settings.
Recipients
In connection with the use of the services, the data collected via our websites is transmitted to the following recipients:
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,
- Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.
For more information on how the service provider handles personal data, please visit https://policies.google.com/privacy?hl=de.
Data Processing in Third Countries
Your data is transferred to recipients in third countries. For data transfers to the U.S., there is an adequacy decision by the European Commission regarding companies certified under the EU-U.S. Data Privacy Framework. Google LLC is certified under the EU-U.S. Data Privacy Framework.
Additional information on this topic and further links can be found above in the section “General Information on Data Transfers to Third Countries.”
Retention Period
By integrating the service into our websites, data is transferred to the recipients listed above and stored there for a period of 18 months. No further storage of the data processed by the service and made available to us takes place in our own systems.
4.6. Use of SalesViewer® Technology
On this website, data is collected and stored using SalesViewer® technology from SalesViewer® GmbH for marketing, market research, and optimization purposes
For this purpose, a JavaScript-based code is used to collect corporate and personal data and for the corresponding use. The data collected using this technology is encrypted via a one-way function that cannot be reversed (so-called hashing). The data is immediately pseudonymized and is not used to personally identify visitors to this website.
Legal basis for data processing
The legal basis for the use of SalesViewer® is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG.
Consent is given via our consent management tool and can be revoked there at any time with future effect.
Your consent is voluntary and may be freely revoked at any time with future effect. To exercise your right to revoke consent, please use the cookie icon at the bottom left of the webpage to reopen the consent management platform and change your settings. Additionally, you can disable data collection by SalesViewer® using the opt-out mechanism provided by the provider. To do so, you can click the SalesViewer® opt-out link https://www.salesviewer.com/opt-out. This will place an opt-out cookie for this website on your device. If you delete your cookies in this browser, you must click this link again.
Recipients
In connection with the use of SalesViewer®, data is transmitted to the following recipient:
SalesViewer GmbH, Universitätsstraße 60, 44789 Bochum, Germany
Retention Period
By integrating the service into our websites, data is transmitted to the recipients listed above and processed there for as long as necessary to achieve the stated purposes. In addition, the data processed by the service and made available to us is processed in our own systems for as long as necessary to achieve the stated purposes.
4.7. Contact form and general inquiries via email
Description of data processing and purpose
If you send us inquiries via the contact form or email, the information you provide in the inquiry form or your email—including the personal data you provide there—will be stored by us to process the inquiry and in case of follow-up questions.
Providing an email address is required to contact us; providing your first and last name and your phone number is voluntary. We will not disclose this data under any circumstances without your consent.
Legal basis for data processing
The legal basis for processing your data is your and our legitimate interest in responding to your inquiry pursuant to Art. 6(1)(f) GDPR, as well as, where applicable, Art. 6(1)(b) GDPR, provided your inquiry is aimed at entering into a contract.
Recipients
In the course of data processing, your data will not be transferred to any recipients other than those we use in the course of data processing to achieve the stated purposes
Retention period
Your data will be deleted after your inquiry has been fully processed, as soon as no further inquiries are expected and provided that no legal retention obligations preclude this.
4.8. Web forms for collecting advertising data
On our website, we collect personal data through various web forms for the purpose of sending you promotional messages to promote the sale of our products, goods, or services through direct marketing.
These may include forms
- for signing up for newsletters, webinars, or events,
- to schedule consultations or product demo appointments, or
- to download white papers and other documents
.
Further information on the processing of your data for advertising purposes can be found in the following section of this privacy policy .
5. Privacy Information for Visitors to Our Social Media Profiles
Below you will find information on how we handle your data collected through your use of our social media profiles on social networks and platforms.
5.1. Social media profiles
We maintain profiles, accounts, pages, or fan pages on the following social media platforms:
5.2. Different Controllerships and Roles
Depending on how the platform operators and we, as the page operator, are involved in the processing of your personal data, the respective controllership or role differs.
Accordingly, we may either be joint controllers together with the platform operator, or the platform operator may be the sole controller.
5.3. Joint controllership with platform operators
5.3.1. Joint Controllers
There is a joint controllership between us and the following platform operators:
| Platform | Platform operator |
|---|---|
| LinkedIn Ireland Unlimited Company, Wilton Plaza, Gardner House 4,5,6, Dublin 2, Irland | |
| Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland |
For the processing of your personal data in connection with your visit to our presence, profile, page or fan page on the platforms, we, as the page operator, are joint controllers together with the providers of the respective platform where the platform operators provide aggregated information about visitors to our profiles, presences, pages or fan pages (e.g. so-called “Insights” or “Analytics”).
In the case of joint controllership, we have concluded agreements with the platform operators pursuant to Art. 26 GDPR on joint controllership for the processing of your personal data (e.g. Page Controller Addendum or Joint Controller Addendum).
These agreements set out which data processing operations we and the respective platform operator are responsible for. You can view these agreements at the following links:
| Platform | Joint Controllership Agreements |
|---|---|
| https://legal.linkedin.com/pages-joint-controller-addendum | |
| https://www.facebook.com/legal/terms/page_controller_addendum |
For more information on data processing by the platform operators, please refer to their privacy policies:
| Platform | Privacy Policy |
|---|---|
| https://www.linkedin.com/legal/privacy-policy | |
| https://de-de.facebook.com/privacy/policy |
5.3.2. Contacting the Data Protection Officers of the Platform Operators
You can contact the data protection officers of the platform operators here:
| Platform | Contact options |
|---|---|
You can reach LinkedIn’s data protection officers via the contact form at the following link: | |
You can contact Meta’s Data Protection Officer using the contact form at the following link: |
5.3.3. Data Processing under Joint Controllership
5.3.3.1. Access to and storage of information on end devices
When you visit our profiles on the aforementioned platforms, the platform operator uses cookies and similar technologies on your device to store data on your device or read it from there. This access or storage may involve further processing of personal data within the meaning of the GDPR.
In cases where such access to or storage of information is absolutely necessary for the technically error-free provision of the services, this is done on the basis of Section 25(1) sentence 1, (2) no. 2 of the TDDDG. Any subsequent data processing may be carried out on the basis of Article 6(1)(f) of the GDPR.
In cases where such processing serves other purposes (e.g., the needs-based design of our website), it is carried out on the basis of Section 25(1) of the TDDDG only with your consent pursuant to Article 6(1)(a) of the GDPR. Consent may be revoked at any time with future effect. The processing of your personal data is subject to the provisions of the GDPR and the Federal Data Protection Act (BDSG).
Further information on the use of cookies and similar technologies, as well as their legal basis, can be found in the respective privacy policy of the platform operator. Links to the respective privacy policies can be found above. If you have any further questions regarding this, please contact the operator of the respective social media platform directly.
5.3.3.2. Data Processing for Advertising and Market Research Purposes
As a rule, personal data on our social media profile is primarily processed for the platform operator’s market research and advertising purposes. To the extent that data collection also takes place directly on our social media profile, we participate in the platform operator’s data processing and are therefore acting as joint controllers with the platform operator in this regard
Cookies and similar technologies are used in data processing, enabling the platform operator to recognize you when you visit a social media profile. In addition, for members of the social media platform, the platform operator conducts a comprehensive analysis of your interactions on the platform (clicks, comments, and likes) and processes the information you provide to the platform operator, such as your personal details, profile picture, or name. In particular, demographic information (age, gender, country, industry, occupation, etc.) from your own member profile may also be processed.
User profiles can be created using the collected data. These are then used by the platform operator to display advertisements, both within and outside the platform, that are presumed to match your interests.
Although we do not have direct access to the data processed by the platform operator, we also benefit from this data processing by placing relevant advertisements within or outside the platforms based on the target groups identified by the platform operator.
The legal basis for the processing of your personal data in this context is the consent you have provided to the platform operator pursuant to Art. 6(1)(a) GDPR.
Please note that we have no influence over the data collection and further processing carried out under the controllership of the platform operators. Consequently, we cannot provide any information regarding the extent, location, or duration for which the data is stored by the platform operator.
For further information on this, please refer to the privacy policy of the respective provider.
5.3.3.3. Data Processing in Connection with “Insights” or “Analytics”
In addition, your data is processed jointly in connection with so-called “Page Insights” or “Page Analytics.”
“Page Insights” or “Page Analytics” are analytics features provided by the platform operator that allow the platform operator and us to jointly collect the master data you have processed – in particular demographic data – as well as data regarding your interactions with our profile.
The platform operator then analyzes this data and compiles summarized (so-called aggregated) data for us, from which we can determine which demographic target group visited our profile and how our profile was used by that group.
We also have no direct access to the data processed by the platform operator. This data is made available to us by the platform operator only in aggregated form. This means that we cannot identify individual visitors or their interactions from the aggregated data.
We then use this aggregated data to tailor our social media profile to specific target groups and, more generally, to optimize it for the aforementioned advertising purposes (increasing the reach and visibility of our profile and evaluating the success of marketing campaigns).
The legal basis for the processing of your personal data in this context is the consent you have provided to the platform operator pursuant to Art. 6(1)(a) GDPR.
Please note that we have no influence over the data collection and further processing carried out under the controllership of the platform operators. Consequently, we cannot provide any information regarding the extent, location, or duration for which the data is stored by the platform operator.
For further information on this, please refer to the privacy policy of the respective provider.
5.3.3.4. Data Processing Based on Consent
If you are asked by the respective platform operator to consent to processing for a specific, shared purpose, the legal basis for the processing is Article 6(1)(a) and Article 7 of the GDPR. Consent that has been given may be revoked at any time with future effect.
5.3.3.5. Recipients and Data Transfer to Third Countries
If we transfer personal data to the operators of social media platforms, the latter are recipients of the data within the meaning of Article 4(9) of the GDPR.
| Platform | Recipient |
|---|---|
LinkedIn Ireland Unlimited Company, Wilton Plaza, Gardner House 4,5,6, Dublin 2, Ireland LinkedIn Corp., 1000 W. Maude Ave, Sunnyvale, CA 94085, USA | |
Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA |
When you visit our social media profiles, your data may also be processed in countries outside the European Union (EU) and the European Economic Area (EEA), in third countries.
For data transfers to certain third countries, an adequacy decision by the European Commission is in place.
For data transfers to the U.S., there is an adequacy decision by the European Commission pursuant to Art. 45(1) GDPR regarding companies certified under the EU-U.S. Data Privacy Framework.
For data transfers to third countries for which no adequacy decision by the European Commission exists, standard data protection clauses are concluded or binding internal data protection regulations are used to ensure an adequate level of data protection, and further supplementary measures are taken to safeguard the data transfer.
| Platform | Recipients | Third country | Type of safeguards for transfers to third countries |
|---|---|---|---|
| LinkedIn Corp | USA | EU Commission adequacy decision and certification under the EU-U.S. Data Privacy Framework | |
| Meta Platforms, Inc. | USA | EU Commission Adequacy Decision and certification under the EU-U.S. Data Privacy Framework |
Additional information on this topic and further links can be found above in the section “General Information on Data Transfers to Third Countries.”
5.3.4. Exercising Your Rights in Cases of Joint Controllership
If, as a visitor to the site, you wish to exercise your rights (access, rectification, erasure, restriction, data portability, complaint to the supervisory authority, objection, or withdrawal), you may contact both the platform operator and us.
| Platform | Settings in the platform account |
|---|---|
You can use LinkedIn settings to restrict the visibility of your LinkedIn account (including to us). For more information on exercising your rights, please refer to LinkedIn’s Privacy Policy at the following link: https://www.linkedin.com/legal/privacy-policy | |
You can use Facebook settings to limit the visibility of your Facebook account (including to us). You can also adjust your ad settings yourself in your platform account. To do so, click the following link and log in: https://www.facebook.com/settings?tab=ads. For more information on exercising your rights, please refer to LinkedIn’s privacy policy at the following link: https://www.facebook.com/about/privacy. |
5.4. Controllership of Platform Operators
If your personal data is processed by one of the social media platform operators listed below, such processing is carried out under the platform operator’s own controllership within the meaning of Article 7(4) of the GDPR.
| Platform | Platform operator |
|---|---|
| kununu | New Work SE, Am Strandkai 1, 20457 Hamburg, Germany |
| Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland | |
| YouTube | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland |
We have no influence over the data processing carried out by the platform operators. For further information, please review the privacy policy of the respective platform operator:
| Platform | Privacy Policy |
|---|---|
| Kununu | https://privacy.xing.com/de/datenschutzerklaerung |
| http://instagram.com/about/legal/privacy | |
| YouTube | https://policies.google.com/privacy |
To exercise your data subject rights, please note that these can be most effectively exercised with the respective providers. Only they have access to the data collected from you. If you still need assistance, please feel free to contact us at any time.
5.5. Our Sole Controllership
We are the sole controller for the following data processing activities via our social media profiles.
5.5.1. Data processing through the operation of the social media profile
When you visit or interact with our social media profile, we process your personal data.
This may include information that you actively provide (comments, likes, and information you have made publicly available, such as your profile picture or name). Depending on the provider and your settings on the provider’s platform, we may also be informed about who has viewed our profile within the platform.
The legal basis for processing personal data in connection with the operation of our social media profile is Article 6(1)(f) of the GDPR.
The legitimate interest lies in addressing visitors for promotional purposes and in providing an effective means of communication and interaction with our company on the social media platform.
5.5.2. Data Processing When Contacting Us
We collect personal data ourselves when you contact us, for example, via a contact form or through a messaging feature on the respective platform.
The data collected depends on the information you provide as well as the contact details you have provided or shared. This data is stored by us for the purpose of processing your inquiry and in case of follow-up questions.
The legal basis for processing the data is our legitimate interest in responding to your inquiry pursuant to Art. 6(1)(f) GDPR.
Your data will be deleted after your inquiry has been fully processed, provided that no legal retention obligations prevent this. We consider processing to be complete when the circumstances indicate that the matter in question has been conclusively resolved.
5.5.3. Data Processing for Contract Fulfilment
If your contact via a social network or other platform is aimed at concluding a contract with us for the delivery of goods or the provision of services, we process your data to fulfill the contract, to carry out pre-contractual measures, or to provide the requested services.
The legal basis for the processing of your data in this case is Article 6(1)(b) of the GDPR.
Your data will be deleted when it is no longer necessary for the performance of the contract or when it is determined that the pre-contractual measures will not lead to the conclusion of a contract corresponding to the purpose of the contact.
Please note, however, that even after the contract has been concluded, it may be necessary to store personal data of our contractual partners in order to comply with contractual or legal obligations.
5.5.4. Data Processing Based on Consent
If we ask for your consent to process your data for a specific purpose, the legal basis for the processing is Article 6(1)(a) and Article 7 of the GDPR. You may withdraw your consent at any time with future effect.
5.5.5. Retention Period
The personal data we collect is deleted from our system when it is no longer necessary for the purposes specified at the time of collection or when you have exercised your right to withdraw consent or object. This is ensured annually through automated processes in accordance with our data deletion policy. Statutory retention periods remain unaffected. We have no influence over the retention period of your data stored by social media providers for their own purposes. For details, please contact them directly.
6. Data Protection Information for Data Processing to Ensure Compliance with Data Protection
6.1. Documentation of Consent and Implementation of Data Subject Rights
Description of data processing and purpose
To the extent that you provide us with a declaration of consent, we process your personal data regarding the circumstances and time of submission (including, where applicable, signature, email address, phone or fax number, or IP address) in order to be able to demonstrate, within the scope of our accountability obligation under Art. 5(2) GDPR, that you have consented to the relevant data processing. The same applies to the revocation of your consent.
To the extent that you exercise your data subject rights under the GDPR with us, we also process your personal data in order to be able to demonstrate, within the scope of the accountability obligation pursuant to Article 5(2) of the GDPR, that we have complied with the GDPR when processing your request.
Legal basis for data processing
Processing is carried out in each case on the basis of Article 6(1)(c) of the GDPR in conjunction with Article 5(2) of the GDPR or Article 6(1)(f) of the GDPR. Our legitimate interest lies in being able to document compliance with the requirements of the GDPR as part of our accountability obligations.
Recipients
In the context of data processing, your data is transferred to the following categories of recipients or recipients whom we engage in the context of data processing to achieve the stated purposes:
- External data protection officers,
- software service providers who provide us with solutions for internal and external communication, for creating and editing documents, and for managing databases.
These recipients include, in particular:
- Proliance GmbH, Leopoldstr. 21, 80802 Munich, Germany
Retention Period
We store your data for as long as necessary to achieve the aforementioned purpose. We typically store data related to consent you have provided for up to 3 years from the end of the year in which we last used it. Data we process in connection with the exercise of data subject rights is typically stored for a period of 3 years from the end of the year in which you exercised your data subject rights.
We will then delete your data unless data processing – including, where applicable, in other systems – remains permissible under a different legal basis or is mandatory for us (e.g., in the case of statutory retention obligations).
6.2. Maintenance of an advertising opt-out list
Description of data processing and purpose
If you object to data processing for advertising purposes based on legitimate interests, we regularly add your contact information (e.g., first and last name, email address, phone number, address) to our advertising opt-out list.
We maintain this list to ensure permanently that you will no longer be contacted for advertising purposes in the future, even if we collect and process your data again in accordance with the GDPR.
Thus, only by cross-referencing this list can we ensure that your data is not reused for advertising purposes after it has been otherwise deleted from the active database of our operational systems – for example, because you are re-registered as a customer in our systems, or because we collect your data again from other sources, or because we receive it again from third parties, including processors.
You will be added to the advertising opt-out list even if, in addition to objecting, you exercise your right to erasure, unless it is explicitly important to you – or it is clear to us that it is important to you – that your data be erased, and the permanent enforcement of your right to object is not the primary concern.
Legal basis for data processing
Processing is carried out in each case on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in being able to permanently and effectively implement compliance with the right to object under the GDPR as well as the right to object within the meaning of Section 7(3) of the German Unfair Competition Act (UWG) in cases of direct marketing or marketing to existing customers, beyond the mere deletion of the data.
7. Data protection information for other data processing
7.1. Compliance with other legal obligations
Description of data processing and purpose
We process personal data to the extent necessary to fulfill a legal obligation. The scope of the data to be processed is determined by the legal obligation we are required to comply with.
Legal basis for data processing
In these cases, the legal basis for the processing of your data is Article 6(1)(c) of the GDPR in conjunction with the respective legal provision that imposes such an obligation on us.
These may include, for example, provisions from the German Fiscal Code (AO), e.g., § 147 AO, the German Commercial Code (HGB), e.g., § 257 HGB, or the German Code of Criminal Procedure (StPO).
Recipients
In the course of data processing, your data is transferred to the following categories of recipients whom we engage in the course of data processing to achieve the stated purposes:
- Tax advisors,
- Auditors,
- Financial or investigative authorities,
- Attorneys,
- expert witnesses,
- courts.
Retention Period
We store your data to the extent necessary and for as long as required to achieve the aforementioned purpose. The retention period is determined by specific statutory provisions that require us to retain or process data for up to 10 years, with the specific start date of the retention periods being determined by the respective specific law.
We will then delete your data unless data processing, including in other systems if applicable, remains permissible on the basis of another legal basis.
7.2. Exercise or defense of legal claims
Description of data processing and purpose
In addition, we process your data in individual cases for the purpose and in the interest of asserting legal claims, for example to enforce our claims arising from unpaid invoices, provided your data is relevant to a legal dispute.
We also process your data in individual cases for the purpose and in the interest of defending against legal claims brought against us, for example in the assertion of claims for liability for material defects, provided your data is relevant to a legal dispute.
Legal basis for data processing
The legal basis for the processing of your data is Art. 6(1)(f) of the GDPR.
Recipients
In the course of data processing, your data is transferred to the following categories of recipients or recipients whom we engage in the course of data processing to achieve the stated purposes:
- Tax advisors,
- Auditors,
- Financial or investigative authorities,
- Attorneys,
- expert witnesses,
- courts.
Retention Period
We store your data on a case-by-case basis to the extent necessary, for as long as this is required to achieve the aforementioned purpose. We then delete your data, unless data processing – including, where applicable, in other systems – remains permissible on another legal basis or is mandatory for us (e.g., in the case of statutory retention obligations).
8. Your Rights
Below you will find information regarding the data subject rights granted to you by applicable data protection law vis-à-vis the controller with respect to the processing of your personal data:
The right, pursuant to Art. 15 GDPR, to request information about your personal data processed by us. In particular, you may request information regarding the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing, or objection; the existence of a right to lodge a complaint; the origin of your data, if it was not collected by us; as well as information regarding the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.
The right, pursuant to Art. 16 GDPR, to request the immediate rectification of inaccurate personal data or the completion of your personal data stored by us.
The right, pursuant to Article 17 of the GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.
The right, pursuant to Article 18 of the GDPR, to request the restriction of the processing of your personal data, provided that you contest the accuracy of the data, the processing is unlawful but you oppose its erasure and we no longer need the data, but you require it for the establishment, exercise, or defend legal claims, or you have objected to the processing pursuant to Article 21 of the GDPR.
The right, pursuant to Art. 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format or to request its transmission to another controller.
The right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR. As a rule, you may contact the supervisory authority of the federal state where our registered office is located (as indicated above at ) or, if applicable, the supervisory authority of your usual place of residence or workplace.
The right to withdraw consent pursuant to Art. 7(3) GDPR: You have the right to withdraw your consent to the processing of data at any time with future effect. In the event of withdrawal, we will delete the relevant data immediately, unless further processing can be based on a legal basis for processing without consent. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to withdrawal.
Right to Object
If we process your personal data on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right under Article 21 of the GDPR to object to the processing of your personal data, provided that this is based on reasons arising from your particular situation. If the objection is directed against the processing of personal data for the purpose of direct marketing, you have a general right to object without the need to specify a particular situation.
If you wish to exercise your right to withdraw consent or object, please contact us using the contact details listed above under “Data Controller.”
9. Status of the Privacy Policy
This Privacy Policy was last updated on May 28, 2026.
