Privacy Policy

Welcome to our website. Below you will find our privacy policy:

I. General information

Contact details of the controller
Contact details of our data protection officer
Data not collected from the data subject

II. Specific information on the collection of
personal data

Visiting the website
Cookies
Performance of the contract
Contacting us
Customer account
Direct advertising
Aircall
Newsletter
Application process
YouTube
Blog
Google Ads
Microsoft Bing Ads
Twitter Ads
TikTok Pixel
Adobe Fonts
Google Analytics
SurveyMonkey
Visual Website Optimizer (VWO)
Heyflow
Facebook, Instagram, YouTube, Twitter, Google+ and Heyflow buttons
Facebook tracking
Cloudflare
Single sign-on and payment services
Join.me
Customer support tools
Pinterest
Outbrain
Taboola
Customer.io
Tracify
Posthog
truephone
WhatsApp communication
Use of the ordering and reservation functions of resmio
e-bot7
statuspage.io
Collection of further data in individual cases

III. Rights of the data subject

Right of access under Article 15 GDPR
Right to rectification under Article 16 GDPR
Right to erasure under Article 17 GDPR
Right to restriction of processing under Article 18 GDPR
Right to notification under Article 19 GDPR
Right to data portability under Article 20 GDPR
Right to object under Article 21 GDPR
Automated decisions in individual cases including profiling under Article 22 GDPR
Right to lodge a complaint with a supervisory authority under Article 77 GDPR
Right to an effective judicial remedy under Article 79 GDPR

I. General information

Contact details of the controller
Name: orderbird GmbH
Street: Ritterstraße 12, entrance 3
Postal code, city: 10969 Berlin
Tel.: +49 30 208 983 099
Email: [email protected]
Contact details of our data protection officer
Sebastian Dramburg/orderbird GmbH
Ritterstraße 12, Aufg. 3
10969 Berlin
E-Mail: [email protected]
Website: www.orderbird.com
Data not collected from the data subject
Where data has not been collected from the data subject, it concerns company and contact data and comes from AboutLocal GmbH, from Jordan, Vataman & Dr. Thiel GbR and from publicly accessible sources such as debtor registers, social networks such as Google+, Facebook and LinkedIn, and platforms such as Google My Business, OpenTable and Yelp.

II. Specific information on the collection of personal data

Visiting the website
1. Purpose of the processing
  Each time a user accesses a page of our offering and each time a file stored on the website is called up,
  access data about this operation is stored in a log file. Each record consists of:
  (1) the page from which the file was
  requested,
  (2) the name of the file,
  (3) the date and time of the request,
  (4) the volume of data transferred,
  (5) the access status (file transferred, file not found, etc.),
  (6) a description of the type of operating system and web browser used
  (7) referrer URL,
  (8) host name of the accessing computer,
  (9) the client IP address.
  We use this data to operate our website, in particular to determine the load on the website and any malfunctions of the website and to be able to make adjustments or improvements. The client IP address is used for the purpose of transmitting the requested data; once it is no longer technically required, it is anonymized by deleting the last block of digits (IPv4) or the last octet (IPv6).
2. Storage period
  Each time a user accesses a page of our offering and each time our website is called up, data is stored. This data is deleted again as soon as it is no longer required for the purpose for which it was collected. This is the case three months after the visit to our website at the latest.
3. Legal basis
  The temporary storage of the aforementioned data takes place on the basis of Article 6 (1) (f) of the EU General Data Protection Regulation
  (hereinafter "GDPR"). The legitimate interest required for this lies in making our website available and in detecting and protecting against improper use.
4. Right to object and to erasure
  The data subject can object to the processing by refraining from using our website and, subject to the conditions set out in more detail in point III.3. of this policy, can request the erasure of collected data by informal declaration.
Cookies
1. Purpose of the processing
  In order to make visiting our website and the ordering process technically possible, we transfer what are known as cookies to the data subject's device. Cookies are small text files by means of which the data subject's device can be identified. This identification takes place by recording, as a rule, the name of the domain from which the cookie data was sent, information about the age of the cookie and an alphanumeric identifier. Because the cookie is stored on the device used, without interfering with the operating system, it is recognized again and allows us to make any preferences available immediately. We use this information to adapt our website and the services offered to your needs and to speed up the loading of our website.
2. Storage period
  1. Technically necessary cookies
    Most of the cookies we use are technically necessary to enable you to use our website and the services offered on it ("session cookies"). These cookies enable, for example, goods to be placed in a shopping basket or a login to the protected area. The data is not combined with other personal data and is not used for advertising purposes.
  2. Functional cookies
    We also set temporary cookies to improve usability. These cookies are stored on your device for a certain period and make it possible for you to be recognized when you call up our page again, and for entries and settings reflecting your usage preferences to be applied automatically.
  3. Web analytics cookies
    We use cookies to create pseudonymous usage profiles for the purpose of web analytics ("web analytics cookies"). These cookies allow us to recognize returning users (device owners), to analyze their behavior on our website, to optimize our website and to measure its reach. We do not combine the data with other personal data, nor do we use it to target individual users for advertising purposes.
  4. Legal basis
    The storage period of the various cookies varies, but is a maximum of two years. The cookies are not stored on our server, but on your local device.
    
    Session cookies are deleted after the end of the respective browser session, at the latest after seven days. The actual deletion period therefore depends on the configuration of your browser software. For how to delete cookies set by us, either as the occasion arises or automatically, please refer to the operating instructions for your browser software.
3. Legal basis
  The legal basis for setting technically necessary cookies is Article 6 (1) sentence 1 (b) GDPR; the legal basis for setting functional cookies is Article 6 (1) sentence 1 (f) GDPR. The legal basis for the data processing via web analytics cookies is Article 6 (1) sentence 1 (a) GDPR, that is, your consent.
  
  The legitimate interest required for setting cookies consists, on the one hand, in being able to optimize the quality of our website through analysis and, on the other hand, in making it possible to visit our website; in particular, some functions on our website cannot be used without cookies, because the user and the settings they have already made would otherwise not be recognized when changing pages, language settings would be lost and searches could not be carried out.
  
  Storage also takes place on the basis of Article 6 (1) (b) GDPR for the performance of the contract.
4. Right to object and to erasure
  If you want to prevent the use of cookies, you can generally do the following:
  - You can delete existing cookies in your browser
  - You can prevent the storage of (third party) cookies in your browser settings.
  - You can use tools such as "Ghostery" (https://www.ghostery.com) that block tracking tools.
  - You can deactivate personalized ads from providers that are part of the "About Ads" self-regulation campaign (http://www.aboutads.info/choic...)
  - You can use the functions of the deactivation page of the Network Advertising Initiative (https://optout.networkadvertis...) or of the page http://www.youronlinechoices.c... to prevent tracking. 
  
  Please note that if you prevent cookies you may not be able to use all functions of our website. You will find a detailed overview of the cookies used on our website, the respective provider, the purpose and the storage period in our Cookie Policy.
Performance of the contract
1. Purpose of the processing
  Name, address, bank details, email address, telephone number and client IP address at the time a customer order is placed are collected, stored and processed solely for the purpose of establishing or performing the contract, and in particular for invoicing and settling the contract.
  
  Personal data is only passed on to third parties where this is necessary for the purpose of performing the contract, for example when commissioning a shipping company or using a payment service provider.
2. Storage period
  The data is erased as soon as it is no longer required for the purposes for which it was collected or otherwise processed. The period for this is six years for personal data covered by Section 147 AO and ten years for personal data covered by Section 257 HGB. These periods begin at the end of the calendar year in which the data in question was collected.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (b) GDPR and serves the purpose of fulfilling the obligations arising from the contract and enabling the services required to perform the contract.
4. Right to object and to erasure
  Objection or erasure is not possible. This is because statutory retention periods apply in this context and the data must remain stored and processed in order to make performance of the contract possible.
Contacting us
1. Purpose of the processing
  A user can contact us by chat, email, contact form, fax, telephone or via our
  accounts on social networks. We store the data transmitted to us and provided by the data subject in order to process the enquiry.
  The data stored is name, address, email address, telephone and/or fax number, date and time of the enquiry, the description
  of the matter and, where applicable, contract data, provided that the enquiry is made in
  the context of entering into or settling a contract.
  
  The data is not passed on to third parties. It serves solely to process the data subject's contact enquiry.
2. Storage period
  As soon as the data is no longer required to achieve the purpose, it is erased. The purpose ceases to apply in particular
  when the conversation has been conclusively dealt with, the matter has been clarified and/or no contractual or tax retention periods stand in the way. The period
  is six years for personal data covered by Section 147 AO and ten years for personal data covered by Section 257 HGB. The periods begin at the end of the calendar year in which the data was collected.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (b) GDPR, provided that this takes place in the context of entering into or performing a contract, and/or on the basis of Article 6 (1) (f) GDPR, provided that there is a legitimate interest. The controller's legitimate interest in this context lies in being able to process the contact enquiry and to prevent the misuse of contact enquiries.
4. Right to object and to erasure
  The data subject has the option to object to the storage of their personal data at any time. The data stored for the operation is then erased. If a contract has been concluded, the provisions in point II.3 of this policy apply.
Customer account
1. Purpose of the processing
  The data subject can register with us by providing personal data that is transmitted to us and stored by us. The data stored is the data entered in the input mask or otherwise collected. This is name, email address, IP address, and the date and time of registration. Registration is necessary in order to make certain content and services available and also serves to establish and perform our contract with the data subject.
2. Storage period
  As soon as the data is no longer required to achieve the purpose, it is erased. In the case of registration without a further contract being concluded, this is the case when the registration is deleted or the data is changed. In the case of a registration that leads to a further contract being concluded, the data is erased as soon as the legal and tax requirements permit contract data to be erased. This period is six years for personal data covered by Section 147 AO and ten years for personal data covered by Section 257 HGB. These periods begin at the end of the calendar year in which the data was collected.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (b) GDPR, provided that this takes place in the context of entering into or performing a contract, and/or on the basis of Article 6 (1) (f) GDPR, provided that there is a legitimate interest. Our legitimate interest in this context lies in being able to make certain content and services available to users.
4. Right to object and to erasure
  The data subject has the option at any time to delete the registration or to adjust the data. The account is deleted or changed by notifying the contact named under point I. There is no right to object to or to have the registration and the data erased if the registration was used to establish or perform a contractual relationship; in this case only the account can be deleted. The account is deleted by means of the steps described above.
Direct advertising
1. Purpose of the processing
  We will use the data received from the data subject in connection with the sale of goods or services for direct advertising of our offering. In this context the data subject's email address is used only to advertise our own similar goods or services, provided that the data subject has not objected to this use. The option to object is pointed out when the data is collected (including by means of this policy); in addition, the continuing option to object is pointed out each time the data is used.
2. Storage period
  As soon as the data is no longer required to achieve the purpose, it is erased. The purpose ceases to apply in particular when the data subject has objected to direct advertising or when a period of 12 months has elapsed since the last advertising measure in which the right of withdrawal was pointed out.
3. Legal basis
  The legal basis for advertising following a purchase of goods or use of services is Article 6 (1) (f) GDPR. The legitimate interest required in this context is the promotion of sales through direct advertising.
4. Right to object and to erasure
  The data subject can object to the use at any time with effect for the future, without incurring any transmission costs other than those of the base rate.
Customer support by telephone
For support services by telephone we use a cloud telephone system provided by Aircall. Aircall is offered by Aircall SAS, 11-15 rue Saint-Georges, 75009 Paris, France. Using Aircall allows us to give our customers an easier way to get in touch and to handle their respective concerns in a targeted way. For this purpose the following personal data of calling customers is processed:
- IP address (with IP telephony)
- data that customers provide during the call
- telephone number
We link this data with the contract data stored with us for the customer as a contracting party. The purpose of the data processing is to deal with the concern of the caller as our customer in the context of performing the contract (Article 6 (1) (b) GDPR). You can find out more about the data processed through the use of Aircall in the privacy policy at https://aircall.io/privacy/.

We use the option of creating call transcripts of some calls so that we can handle your concern optimally after the call as well. As a rule, the call transcript and the data of your call are stored in connection with your customer account. Otherwise the data is erased by us as soon as the purpose of the data processing has been fulfilled.

Aircall is an international company with its headquarters in the USA. Although we use storage locations in the EU for Aircall, the call transcripts are processed in the USA. The European Union has issued an adequacy decision (EU-U.S. Data Privacy Framework) governing the transfer of personal data to the USA. Aircall has undertaken to comply with the data protection provisions of the U.S. Data Privacy Framework and is certified accordingly.
Newsletter
1. Purpose of the processing
  There is the option of subscribing to a newsletter. If the data subject subscribes to the newsletter, the data entered by the data subject in the input mask on subscription is transmitted to us. The data transmitted is the email address provided, the telephone number, the name, the postal code and the city, the IP address, and the time and date of the subscription. The data collected is required in order to be able to send the newsletter to the data subject.
2. Storage period
  The stored data is erased as soon as the data subject has unsubscribed from the newsletter and the data is no longer required to achieve the purpose. After that it is retained for ten years from the last newsletter mailing for the purpose of proof in the event of queries about existing consents, taking the limitation period into account.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (a) GDPR only if the data subject gave their consent when subscribing. Withdrawal of consent, which is possible at any time, does not affect the lawfulness of the processing of personal data carried out on the basis of the consent up to the withdrawal.
4. Right to object and to erasure
  The use of the data for receiving the newsletter can be objected to at any time with effect for the future by unsubscribing from the newsletter, without incurring any transmission costs other than those of the base rate. This can be done by a simple declaration to orderbird. If the data subject wants to unsubscribe from the newsletter, they will find, for example, in every newsletter
  a correspondingly marked link that they only have to click.
Application process
1. Purpose of the processing
  Name, address, email address, telephone number, marital status, date of birth, place of birth, nationality, school education, training and professional activities and further data transmitted to us by the data subject in the context of an application (for example by cover letter, CV or references) are collected, stored and processed solely for the purpose of establishing or performing the contract. Only when an employment contract is concluded is the collected data transferred to the personnel file.
  
  Personal data is only passed on to third parties where this is necessary for the purpose of performing the contract.
2. Storage period
  Where this data is made available to us electronically, we erase the data as soon as it is no longer required to achieve the purpose. This is the case at the latest six months after we have sent the data subject an acceptance or rejection, unless the data is needed to assert, exercise or defend claims in the context of legal proceedings. In the case of applications in paper form, we destroy the data after this period has expired, unless the data is needed to assert, exercise or defend claims in the context of legal proceedings.
  
  After that, data is only retained if the data subject has been invited by us into our "applicant database" for future job descriptions and has expressly declared by their consent that they wish to be included until they declare a withdrawal, in order to be considered for future vacancies without having to send their application documents again.
3. Legal basis
  The aforementioned data is stored before a rejection is received, and when an employment contract is concluded and the data is transferred to the personnel file, on the basis of Article 6 (1) (b) GDPR and Section 26 BDSG, in order to be able to provide the services required to establish the contract. If the data is included in our applicant database after consent has been given, it is stored on the basis of Article 6 (1) (a) GDPR.
4. Right to object and to erasure
  The data subject has the option at any time to object to the use of the data by making a declaration to the contact named under point I.
YouTube
1. Purpose of the processing
  We use the YouTube embedding function to display and play videos from the provider "YouTube", YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA, which is represented by a subsidiary of Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").
  
  When a page containing a YouTube video is called up, a connection to YouTube's servers is established, which is assigned to the user's personal profile and reports the pages of the website visited if the user is logged in to their YouTube account. You can prevent this by logging out of your YouTube account beforehand.
  YouTube also processes your data in the USA, among other places. We point out that, according to prevailing case law, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks for the lawfulness and security of the data processing.
  As a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we therefore use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in the USA.
2. Storage period
  Information on data protection and on the storage of personal data at "YouTube" can be found in the provider's privacy policy at https://www.google.de/intl/de/policies/privacy.
3. Legal basis
  The use of YouTube serves to protect our legitimate interest, which prevails when interests are weighed, in an appealing presentation of our online offering in accordance with Article 6 (1) sentence 1 (f) GDPR.
4. Right to object and to erasure
  At https://myadcenter.google.com/... you will find an opt-out function.
Blog
1. Purpose of the processing
  On our blog we publish various posts on topics relating to our offers and services. There you can leave public comments. Your comment is published under the post with the name you provide. Providing a name and an email address is strictly necessary in order to use the comment function; all other details are voluntary. We also store the IP address. Storing the IP address is necessary so that we can defend ourselves against liability claims in the event that unlawful content is published. We need your email address in order to contact you if a third party objects to your comment as unlawful. The email address is not used beyond this, in particular not for advertising purposes.
2. Storage period
  Your published comment remains visible on the blog under the name provided until you request its deletion or we remove the comment. We store your email address and the IP address only for as long as this is necessary to defend against possible liability claims, at most for three months after the comment is published.
3. Legal basis
  The aforementioned data is processed on the basis of Article 6 (1) (f) GDPR. Our legitimate interest lies in providing our blog, in preventing misuse of the comment function and in being able to defend ourselves against liability claims.
4. Right to object and to erasure
  You can object to the storage at any time. We will then erase the data stored for the operation, unless further storage is necessary to assert, exercise or defend legal claims.
Google Ads
1. Purpose of the processing
  We use the Google Ads Conversion service in order to draw attention to our attractive offers on external websites by means of advertising media (known as Google Ads). This service is provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States.
  In relation to the data of the advertising campaigns, we can determine how successful the individual advertising measures are. In doing so we pursue the interest of showing you advertising that is of interest to you, of making our website more interesting for you and of achieving a fair calculation of advertising costs. These advertising media are delivered by Google via what are known as ad servers. For this we use ad server cookies, by means of which certain parameters for measuring success, such as the display of the ads or clicks by users, can be measured. If you reach our website via a Google ad, Google Ads stores a cookie on your device. These cookies generally expire after 30 days and are not intended to identify you personally. The analysis values usually stored for this cookie are the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions) and the opt-out information (a marker that the user no longer wishes to be addressed). These cookies enable Google to recognize your internet browser. If a user visits certain pages of the website of an Ads customer and the cookie stored on their computer has not yet expired, Google and the customer can recognize that the user clicked on the ad and was forwarded to this page. A different cookie is assigned to each Ads customer. Cookies can therefore not be tracked across the websites of Ads customers. We ourselves do not collect or process any personal data in the advertising measures named. We are only provided with statistical evaluations by Google. On the basis of these evaluations we can see which of the advertising measures used are particularly effective. Further
  data from the use of the advertising media is not provided to us; in particular, we cannot identify users on the basis of this information.
  
  Because of the marketing tools used, your browser automatically establishes a direct connection with Google's server. We have no influence on the scope and the further use of the data collected by Google through the use of this tool and therefore inform you in line with what we know: through the integration of Ads Conversion, Google receives the information that you have called up the relevant part of our website or clicked on an ad of ours. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or are not logged in, it is possible for the provider to find out and store your IP address.  
  
  We also use the remarketing function within the Google Ads service. With the remarketing function we can present users of our website with advertisements based on their interests on other websites within the Google advertising network (in Google Search or on YouTube, known as Google ads, or on other websites). For this purpose users' interaction on our website is analyzed, for example which offers the user was interested in, so that targeted advertising can be shown to users on other pages even after they have visited our website. For this, Google stores a number in the browsers of users who visit certain Google services or websites in the Google Display Network. Visits by these users are recorded via this number, which is referred to as a cookie. This number serves to uniquely identify a web browser on a particular device and not to identify a person; personal data is not stored.
  
  You can prevent participation in this tracking procedure in various ways:
  1. by setting your browser software accordingly; in particular, suppressing third-party cookies means that you will not receive any ads from third-party providers;
  2. by installing the plug-in provided by Google at the following link: https://www.google.com/settings/ads/plugin;
  3. by deactivating interest-based ads from providers that are part of the "About Ads" self-regulation campaign, via the link http://www.aboutads.info/choices, whereby this setting is deleted if you delete your cookies;
  4. by permanent deactivation in your Firefox, Internet Explorer or Google Chrome browsers, via the link http://www.google.com/settings/ads/plugin,
  5. by setting cookies accordingly. Please note that in this case you may not be able to use all functions of this offering in full.
  Google also processes your data in the USA, among other places. We point out that, according to prevailing case law, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks for the lawfulness and security of the data processing.
  
  As a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we therefore use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in the USA.
  
  We also use the enhanced conversions service from Google Ads. With this function, the existing conversion tags are supplemented and can therefore be recorded even more precisely. The conversion data from our website is sent to Google as hash values, encrypted using the one-way hash algorithm SHA256. You can find further information on data protection at Google here:
  http://www.google.com/intl/de/policies/privacy. Alternatively, you can visit the website of the Network Advertising Initiative (NAI) at http://www.networkadvertising.org .
2. Storage period
  The cookie is valid for between 7 and 90 days and is deleted after it expires, unless you delete it yourself beforehand, for example through suitable settings in your browser or manually.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (f) GDPR.
4. Right to object and to erasure
  You can block the use of cookies; for the
  corresponding steps, please refer to the instructions for
  your browser software.
Microsoft Bing Ads
1. Purpose of the processing
  We use Microsoft marketing and remarketing services ("Microsoft Advertising" for short) from Microsoft (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA) in order to draw attention to our offers on external
  websites. For this we use cookies, by means of which certain parameters such as the display of the ads or clicks by users can be used to measure success. If you reach our website via a Bing ad, Microsoft stores a cookie on your device. These cookies are not intended to identify you personally. The analysis values usually stored for this cookie are the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions) and the opt-out information (a marker that the user no longer wishes to be addressed).
  
  These cookies enable Microsoft to recognize your internet browser. If a user visits certain pages of the website of a Microsoft Advertising customer and the cookie stored on their device has not yet expired, Microsoft and the customer can recognize that the user clicked on the ad and was forwarded to this page. A different cookie is assigned to each Microsoft Advertising customer. Cookies can therefore not be tracked across the websites of Microsoft Advertising customers.
  
  We ourselves do not collect or process any personal data in the advertising measures named. We only receive statistical evaluations from Microsoft. On the basis of these evaluations we can see which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising media; in particular, we cannot identify users on the basis of this information.
  
  Because of the marketing tools used, your browser automatically establishes a direct connection with Microsoft's server. We have no influence on the scope and the further use of the data collected by Microsoft through the use of this tool and therefore inform you in line with what we know: through the integration of Microsoft Advertising, Microsoft receives the information that you have called up the relevant part of our website or clicked on an ad of ours. If you are registered with a Microsoft service, Microsoft can assign the visit to your account. Even if you are not registered with Microsoft or are not logged in, it is possible for the provider to find out and store your IP address.
  
  Microsoft also processes your data in the USA, among other places. We point out that, according to prevailing case law, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks for the lawfulness and security of the data processing. As a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we therefore use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en.
  Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in the USA.
  At the internet address below you can obtain further information about Microsoft Bing Ads' data protection provisions: https://privacy.microsoft.com/de-de/privacystatement
  You can find more detailed information on Microsoft Advertising's analytics services at: https://help.microsoft.com/#apex/3/de/53056/2 You can object to interest-based advertising from Microsoft
  Advertising via the following link: https://choice.microsoft.com/de-DE/opt-out. Alternatively, you can prevent the tracking procedure by deactivating the storage of cookies in your browser settings.
2. Storage period
  The cookies are valid for 180 days and are deleted after they expire, unless you delete them yourself beforehand, for example through suitable settings in your browser or manually.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (f) GDPR.
4. Right to object and to erasure
  You can block the use of cookies; for the corresponding steps, please refer to the instructions for your browser software.
Twitter Ads
1. Purpose of the processing
  We use the conversion tracking technology "Twitter Ads", a service of Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (hereinafter referred to as "Twitter"), in order to draw attention to our offers on external websites. Twitter Ads stores and processes information about your user behavior on our website. For this we use ad server cookies, by means of which certain parameters, such as the display of the ads or clicks by users, can be used to measure success. If you reach our website via a Twitter ad, a cookie is stored on your device by
  Twitter Ads. These cookies are not intended to identify you personally. The analysis values usually stored for this cookie are the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions) and the opt-out information (a marker that the user no longer wishes to be addressed).
  
  These cookies enable Twitter to recognize your internet browser. If a user visits certain pages of the website of a Twitter Ads customer and the cookie stored on their device has not yet expired, Twitter and the customer can recognize that the user clicked on the ad and was forwarded to this page. A different cookie is assigned to each Twitter Ads customer. Cookies can therefore not be tracked across the websites of Twitter Ads customers.
  
  We ourselves do not collect or process any personal data in the advertising measures named. We only receive statistical evaluations from Twitter. On the basis of these evaluations we can see which of the advertising measures used are particularly effective. We do not receive any further data from the use of the advertising media; in particular, we cannot identify users on the basis of this information.
  
  Because of the marketing tools used, your browser automatically establishes a direct connection with Twitter's server. We have no influence on the scope and the further use of the data collected by Twitter through the use of this tool and therefore inform you in line with what we know: through the integration of Twitter Ads, Twitter receives the information that you have called up the relevant part of our website or clicked on an ad of ours. If you are registered with a Twitter service, Twitter can assign the visit to your account. Even if you are not registered with Twitter or are not logged in, it is possible for the provider to find out and store your IP address. Twitter may also process your data in the USA, among other places. We point out that, according to prevailing case law, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks for the lawfulness and security of the data processing.
  
  As a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we therefore use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in the USA.
2. Storage period
  The cookies are valid for 30 days and are deleted after they expire, unless you delete them yourself beforehand, for example through suitable settings in your browser or manually.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (f) GDPR.
4. Right to object and to erasure
  You can block the use of cookies; for the corresponding steps, please refer to the instructions for your browser software. You can also prevent Twitter from collecting the aforementioned information by setting an opt-out cookie on one of the websites linked below:
  - https://twitter.com/personalization
  -http://optout.aboutads.info/?c=2#!/
  Please note that this setting is deleted if you delete your cookies. You can object to the collection and forwarding of personal data, or prevent the processing of this data, by deactivating the execution of JavaScript in your browser. You can also prevent the execution of JavaScript code altogether by installing a JavaScript blocker (for example https://noscript.net/ or https://www.ghostery.com). Please note that in this case you may not be able to use all functions of our website in full.
TikTok Pixel
1. Purpose of the processing
  We use the TikTok Pixel service in order to draw attention to our attractive offers on external websites by means of advertising media (known as conversion tracking). This service (advertiser tool) is provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, WeWork, 125 Kingsway, London, WC2B 6NH, United Kingdom (both referred to together below as "TikTok").
  If consent is given to the use of personalization cookies, the "TikTok Pixel" provided by and the responsibility of TikTok is used or activated on our websites and cookies are stored on the user's device. With the help of the TikTok Pixel, TikTok is able to determine the visitors to the website as a target group for displaying ads. Accordingly, we use the TikTok Pixel in order to show the TikTok ads we place only to those TikTok users who have also shown an interest in our online offering or who have certain characteristics that we transmit to TikTok. The TikTok Pixel also allows us to evaluate the TikTok advertisements placed statistically.
  As a rule, the data subject's data is processed within the EU or the EEA. A corresponding data protection agreement has been concluded with TikTok for this purpose. Where personal data is transferred to countries outside the EU or the EEA, this takes place within the framework of the Commission's model contracts for the transfer of personal data to third countries (known as standard contractual clauses). TikTok's data protection policy can be found here: https://www.tiktok.com/legal/p....
2. Storage period
  The data is stored for as long as is necessary for the provision of the service and for the other purposes. The data is also retained where this is necessary in order to fulfill contractual and statutory obligations.
3. Legal basis
  The data is stored on the basis of the data subject's consent in accordance with Article 6 (1) (a) GDPR.
4. Right to object and to erasure
  You can object to the collection by the TikTok Pixel and to the use of your data for displaying TikTok ads. An opt-out option can be found in our cookie declaration (https://www.orderbird.com/en/cookies-policy). You can also block the use of cookies; for the corresponding steps, please refer to the instructions for your browser software.
Adobe Fonts
This website uses web fonts from Adobe for a uniform display of certain typefaces. The provider is Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA (Adobe).
When you call up this website, your browser loads the required fonts directly from Adobe in order to display them correctly on your device. In doing so, your browser establishes a connection to Adobe's servers in the USA. This means that Adobe learns that this website was called up via your IP address. According to Adobe, no cookies are stored when the fonts are provided.
The data is stored and analyzed on the basis of Article 6 (1) (f) GDPR. The website operator has a legitimate interest in a uniform presentation of the typeface on its website. Where corresponding consent has been requested (for example consent to the storage of cookies), the processing takes place exclusively on the basis of Article 6 (1) (a) GDPR; the consent can be withdrawn at any time.
The transfer of data to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://www.adobe.com/de/privacy/eudatatransfers.html.
You can obtain more detailed information about Adobe Fonts at: https://www.adobe.com/de/privacy/policies/adobe-fonts.html. You can find Adobe's privacy policy at: https://www.adobe.com/de/privacy/policy.html.
Google Analytics
1. Purpose of the processing
  Our website uses Google Analytics, a web analytics service of Google Inc. ("Google"). Your client IP address is recorded in order to use this service. Google Analytics uses what are known as "cookies",
  text files that are stored on the data subject's device and that make it possible to analyze the use of the website. The information collected by the cookie about the use of this website is generally transferred to a Google server in the USA and stored there.
  However, because IP anonymization is activated on this website, the data subject's IP address is truncated by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate the use of the website. These evaluations are used to compile reports on website activity and to provide the website operator with further services connected with website use and internet use. The IP address transmitted by your browser in the context of Google Analytics is not combined with other data held by Google.
  Google also processes your data in the USA, among other places. We point out that, according to prevailing case law, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks for the lawfulness and security of the data processing.
  As a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we therefore use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in the USA.
2. Storage period
  As soon as the data is no longer required to achieve the purpose, it is erased. The purpose ceases to apply in particular once the anonymization, which takes place within the European
  Union, has been completed. This takes less than a second. The data sent by us and linked to cookies, user identifiers (for example user ID) or advertising IDs is automatically deleted after 14
  months. Data whose retention period has been reached is deleted automatically once a month. You can find further information at https://www.google.com/analytics/terms/de.html
  and https://policies.google.com/?hl=de.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (f) GDPR. The legitimate interest required lies in the fact that it allows us to analyze the use of the website by users as a whole, without drawing conclusions about the behavior of individually identifiable persons; this allows us to optimize our website and our offers.
4. Right to object and to erasure
  The data subject can prevent the storage of cookies by setting their browser software accordingly; we point out to the data subject, however, that in this case it may not be possible to use all functions of this website in full.
  The data subject can also prevent the collection of the data recorded by the cookie and relating to the use of the website (including the IP address), the transmission to Google and the processing of this data by Google, by downloading and installing the browser plug-in available at the following link.
SurveyMonkey
1. Purpose of the processing
  We use the software "SurveyMonkey" from SurveyMonkey Europe UC, 2 Shelbourne Buildings, Shelbourne Road, Dublin, Ireland, in order to create surveys, to evaluate the survey results for internal purposes, to analyze satisfaction with our company and our products and to further improve our offering on the basis of the data processed via the survey mask. In doing so, what are known as cookies, that is, text files, are used which are stored on the data subject's device and serve the purpose of making the survey possible. The information collected by the cookie is generally transferred to a SurveyMonkey server and stored there in order to carry out the analysis. SurveyMonkey Europe UC is a subsidiary of SurveyMonkey Inc., based in the USA. It cannot be ruled out that your data collected by SurveyMonkey is also transferred to the USA. We point out that, according to prevailing case law, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks for the lawfulness and security of the data processing.
  As a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we therefore use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in the USA.
  You can find further information on the cookies used by SurveyMonkey, on data protection and on the storage period at the following link: www.surveymonkey.de/mp/legal/privacy-policy.
2. Storage period
  When a user takes part in a survey, personal data is stored in some cases. It is erased as soon as the data is no longer required for the purpose for which it was collected, which is the case three months after the end of the survey at the latest.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (f) GDPR. The legitimate interest required lies in the optimization of our website and our offers, which is made possible for us by an analysis of the survey results.
4. Right to object and to erasure
  The data subject can prevent the storage of cookies by setting their browser software accordingly; we point out to the data subject, however, that in this case it may not be possible to use all functions of this website in full.
Visual Website Optimizer (VWO)
1. Purpose of the processing
  We use the web analytics service Visual Website Optimizer, which is operated by Wingfy Software Pvt Ltd., 14th Floor, KLJ Tower North, Netaji Subhash Place, Pitam Pura, New Delhi 110034, India. Visual Website Optimizer serves to test the usability of certain pages. In doing so, measurements of user behavior are collected anonymously. The service sends information to our server in order to understand how the user moves around the website (for example which links they click and how they move the mouse) and how changes to the website, such as to the design, the navigation elements and/or individual input forms, affect the usage behavior of data subjects (such as time spent and use of elements). For this purpose cookies, that is, small text files stored by the internet browser on the user's device, are used in order to recognize the user. For this, Visual Website Optimizer records IP addresses, but pseudonymizes them immediately after collection in order to rule out any reference to the data subjects. You can find further information at https://vwo.com/privacy-policy/.
2. Storage period
  As soon as the data is no longer required to achieve the purpose, it is erased. This is the case once the pseudonymization has taken place. For technical reasons this process takes less than a second. You can find further details here: https://vwo.com/knowledge/cookies-used-by-vwo/.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (f) GDPR. The legitimate interest required lies in allowing us to analyze the browsing behavior of users who cannot be identified; this analysis helps us to optimize our website and our offering.
4. Right to object and to erasure
  You can block the use of cookies; for the corresponding steps, please refer to the instructions for your browser software. To object to the collection and storage of your pseudonymized visitor data in the future, you can obtain an opt-out cookie from VWO at the following link, which has the effect that no visitor data from your browser is collected and stored by VWO in future: https://vwo.com/opt-out/.
Heyflow
1. Purpose of the processing
  We use the service "Heyflow" from Heyflow GmbH, Jungfernstieg 49, 20354 Hamburg, in order to provide interactive landing pages and forms and to analyze user behavior on these pages. The aim is to optimize user guidance and to improve our marketing measures on the basis of data. In the course of this use, information about users' interaction with the landing pages is processed, including IP address, device information (for example browser type, operating system), usage behavior (for example click paths, time spent) and personal data entered by you (for example name, email address, telephone number) if you enter it in a form.
  In doing so, Heyflow acts on our behalf and on the basis of a data processing agreement in accordance with Article 28 GDPR. The data processing takes place exclusively for the specified purpose of analyzing and evaluating the use of the pages and forms provided.
  You can find further information on data protection at Heyflow at: https://www.heyflow.app/privac...
2. Storage period
  The personal data is erased as soon as it is no longer required to achieve the purpose, provided that no statutory retention obligations stand in the way.
3. Legal basis
  The legal basis for the data processing is Article 6 (1) (a) GDPR, provided that you have given your consent via our cookie banner. If the use serves exclusively to provide the landing pages functionally (for example without tracking), the processing is based on Article 6 (1) (f) GDPR. Our legitimate interest lies in optimizing our online marketing measures and in designing our content in a user-friendly way. If you use the contact form and provide us with further personal data through it, the data is processed for the purpose of pre-contractual measures (Article 6 (1) (b) GDPR).
4. Right to object and to erasure
  You can prevent the storage of cookies by setting your browser software accordingly, or set this individually via our cookie consent tool. You can also prevent collection by Heyflow by not consenting to the use of the corresponding cookies or by deleting cookies that have already been set. You will find your other data protection rights at the end of this privacy policy.
Facebook, Instagram, YouTube, Twitter and Google+ buttons
1. Purpose of the processing
  We do not collect any personal data via the social network buttons. Nevertheless, for the sake of completeness, we would like to explain the technical background below:
  We only use deactivated buttons of the social networks Facebook, Instagram, Twitter, Google+ and YouTube. This means that no data is transmitted to these networks. The data subject decides for themselves, by clicking the buttons, to activate them and thereby to establish a connection to the servers of the operators of the social networks and so to transmit data to the servers of the social networks in accordance with the agreement concluded between the data subject and the social network. Activation leads to content of the social networks being called up. The nature, purpose and scope of the data collection and use can be found in the corresponding privacy policies of the social networks.
  
  After clicking the button a second time, the user can transmit their recommendation to the social networks. If the data subject wants to recommend several pages, consent is required on each page. If the data subject wants the social network to have permanent access to their data, the data subject can activate the buttons permanently. To do this, the appropriate box can be ticked under a gearwheel icon, with the result that the selected button is always directly active.
2. Storage period
  The storage period is governed by the requirements of the operators of the social networks.
3. Legal basis
  The operators of the social networks inform data subjects about the legal basis.
4. Right to object and to erasure
  Via the gearwheel icon through which the data subject activated the social media buttons, they can also change their consent later and deactivate the buttons.
Facebook tracking
1. Purpose of the processing
  On our website we use tracking technology of the social network "Facebook" from "Meta Platforms Inc.", based in the USA. In the course of this, your IP address at the time of access, the browser used, the operating system used and the page you called up are transmitted to the external provider. Alongside us, Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland is also responsible for the data processing in this respect. At the same time a cookie is set that makes it possible to track by which route, possibly via advertisements we have placed on Facebook, but also by other routes, you found your way to our website. At the same time it is recorded whether our advertising measure led to a contract being concluded (known as a conversion). In addition we use what are known as offline conversions, in the course of which measurement and analysis reports are produced. These allow us to understand how often the ads led to offline events, such as a purchase in a shop or an order by telephone.
  The collection of this data is necessary in order, on the one hand, to be able to track the effectiveness of our advertising measures and, on the other hand, to enable Facebook to invoice us for our advertising measures. The data is also used to link the information that this website was visited with your Facebook profile, if you happen to be a Facebook customer and log in there during or after your visit to our website. From Facebook's side this procedure serves to determine your interests and preferences so that tailored advertising can be presented to you. The data recorded in this respect is made available to us by Facebook only in anonymized form; we ourselves do not store any personal data in this connection.
  As a rule, the data subject's data is processed within the EU or the EEA. A corresponding data protection agreement has been concluded with Facebook for this purpose. Where personal data is transferred to countries outside the EU or the EEA, we point out that, according to prevailing case law, there is currently no adequate level of protection for the data transfer. This can involve various risks for the lawfulness and security of the data processing. As a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we therefore use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in third countries.
  For the rest we refer to Facebook's data protection information at https://www.facebook.com/priva....
2. Storage period
  According to Facebook, the data collected in this way is stored for a period of 90 days. After 90 days have elapsed, the data is anonymized so that it can no longer be connected with you.
3. Right of withdrawal and to erasure
  You can object to the collection of the data by deactivating the use of cookies in your browser settings. We point out, however, that this may impair the functionality of our website.
  You can withdraw your consent regarding the Facebook conversion pixel at https://www.facebook.com/settings .
Cloudflare
1. Purpose of the processing
  To protect the website against denial-of-service attacks we use the services of the US provider cloudflare Inc. A data processing agreement is in place with this service provider, so that it is ensured that the data processed there on our behalf is in safe hands. The data transmitted is IP address, browser type, operating system used and the file called up in each case.
  cloudflare also processes your data in the USA, among other places. Cloudflare, based in the USA, is an active participant in the US-European data protection agreement "Privacy Shield Framework", which guarantees compliance with the level of data protection applicable in the EU.
  In addition, as a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in the USA.
2. Storage period
  The data is erased immediately after the page is called up; logging on our side takes place only as described under point II.1.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (f) GDPR ("legitimate interest"). The legitimate interest lies in maintaining the functionality of our website and in secure operation.
4. Right to object and to erasure
  The data subject can prevent the data processing by ceasing to use our website.
Single sign-on and payment services
1. Purpose of the processing
  To simplify the ordering process and payment processing we use the following third-party tools:
  - PayPal, a service of PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg;
  - Sofort, a service of Sofort GmbH, Munich, Theresienhöhe 12, 80339 Munich.
  When the shopping basket is called up, these providers use scripts integrated into our website to check whether the user is a customer of the respective provider and whether they are logged in there. This is done by comparing any cookies stored by the provider in the user's browser.
  For this, the IP address, browser used, operating system and the page called up in each case are transmitted to the third-party provider. Data is only collected on our side once a customer of a provider makes use of the third party's service and thereby arranges for the details about their person stored there, namely order and invoice address, to be transmitted to us and, where applicable, for the payment process to be handled in accordance with the terms of use of the service with which the customer has a contractual relationship.
2. Storage period
  On our side only the data transmitted to us by the third-party provider on behalf of the customer for the purpose of performing the contract is processed. In this respect the statements on the storage period in point II.3. b) apply. Where the third-party providers process data on behalf of the data subjects, the storage period follows from their data protection provisions, to which reference is made at this point.
3. Legal basis
  The legal basis for the processing is Article 6 (1) (b) GDPR, insofar as the data is used to settle contracts via our website. Insofar as payment services are concerned, the storage is at the same time based on Article 6 (1) (c) GDPR, because the data collected in this way is of tax relevance and is therefore necessary to fulfill our tax obligation. The processing is at the same time based on Article 6 (1) (e) GDPR, because it serves our legitimate interest in enabling the customers of the relevant service providers to use the services of their contractual partners and in ensuring quick and pleasant settlement of the contract.
4. Right to object and to erasure
  Because there are statutory retention periods here and the data must remain stored and processed in order to perform the contract, objection or erasure is not possible.
Join.me
1. Purpose of the processing
  We use the software solution (collaboration tool) join.me from LogMeIn, Inc. 333 Summer Street, Boston, MA 02210 USA. LogMeIn, Inc. is the controller for the provision of this service and the associated data processing. In order to hold a webinar we transmit your registration or customer data to LogMeIn, Inc. You receive an access link by email in advance of the webinar; no further registration is required here. For the webinar to be held, an encrypted connection is established between you and the organizer of the webinar. Statistical data is collected during and after the webinar.
  LogMeIn also processes your data in the USA, among other places. We point out that, according to prevailing case law, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks for the lawfulness and security of the data processing.
  As a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we therefore use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in the USA.
  You can find LogMeIn's privacy policy at https://www.logmeininc.com/de/legal/privacy.
2. Storage period
  The data is erased after the end of the webinar.
3. Legal basis
  The aforementioned data is stored on the legal basis of Article 6 (1) (a) GDPR. The legitimate interest lies in the optimization of our website and our offers, which is made possible for us by an analysis of the statistical data.
4. Right to object and to erasure
  The data subject can prevent the data processing by ceasing to use our website and this tool.
Customer support tools
1. Purpose of the processing
  For communication with our customers we use the tools of the providers Intercom, Inc., Helpjuice Inc. and Zendesk, Inc., based in the USA. When these are used, the name, the customer's connection identifier (telephone number, email address, etc.) and the content of the communication are collected by the provider. They process the data on the basis of a data processing agreement concluded with us. The data is at the same time collected and stored for the purpose of future direct advertising; in this respect reference is made to our explanations under the heading "Direct advertising".
  The providers named also process your data in the USA, among other places. We point out that, according to prevailing case law, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks for the lawfulness and security of the data processing.
  As a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we therefore use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in the USA.
2. Storage period
  Unless it is stored for longer for the purpose of direct advertising, the data is stored for the duration of the contractual relationship with our customer and, for non-customers, until the communication process is concluded. If the data is of tax or commercial law relevance, the data is stored in accordance with Section 147 AO for a period of ten years and in accordance with Section 257 HGB for a period of six years, beginning at the end of the year in which the data was collected.
3. Legal basis
  The data is collected and stored for the purpose of performing or entering into contracts, Article 6 (1) (b) GDPR, to fulfill our tax and commercial law retention requirements, Article 6 (1) (c) GDPR, and on the basis of our legitimate interest in our customers being easily able to reach us and in an efficient organization and handling of enquiries, Article 6 (1) (e) GDPR.
4. Right to object and to erasure
  Unless statutory retention obligations exist, data subjects can object to the processing in accordance with the conditions summarized below under the heading "Rights" and, where applicable, request the erasure of stored data. An informal notification is sufficient for this.
Pinterest
1. Purpose of the processing
  On our page we use social plugins of the social network Pinterest, which is operated by Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA ("Pinterest"). If you call up a page that contains such a plugin, your browser establishes a direct connection to Pinterest's servers. In doing so the plugin transmits log data to Pinterest's server in the USA. This log data may contain your IP address, the address of the websites visited that also contain Pinterest functions, the type and settings of the browser, the date and time of the request, the way you use Pinterest, and cookies.
  Pinterest also processes your data in the USA, among other places. We point out that, according to prevailing case law, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks for the lawfulness and security of the data processing.
  As a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we therefore use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in the USA.
2. Storage period
  The storage period is governed by the requirements of the operators of Pinterest. You can find further information here: https://about.pinterest.com/de/privacy-policy
3. Legal basis
  The operator of Pinterest provides information about the legal basis.
4. Right to object and to erasure
  You can object to the collection of the data by deactivating the use of cookies in your browser settings. We point out, however, that this may impair the functionality of our website. You can find further information on the purpose, scope and further processing and use of the data by Pinterest, as well as your related rights and options for protecting your privacy, in Pinterest's data protection notices: https://about.pinterest.com/de/privacy-policy
Outbrain
1. Purpose of the processing
  We use the technology of the provider Outbrain UK Ltd., Outbrain UK Limited, 5 New Bridge Street, London, EC4V 6JA, UK. With the help of what is known as a widget, users are pointed to further content within our website and on third-party websites that may also be of interest to them. The content displayed in the Outbrain widget is controlled and delivered automatically by Outbrain, in terms of both content and technology. The reading recommendations, which are usually integrated below an article, are determined on the basis of the content the user has read so far. To display this interest-based further content, Outbrain uses cookies that are stored on the user's device or in their browser. Outbrain collects the device source, the browser type and the user's IP address, of which the last octet is deleted for anonymization. Outbrain assigns what is known as a universally unique identifier (UUID), which can identify the user in relation to their device when they visit a website on which the Outbrain widget is implemented. Outbrain creates user profiles in which user interactions (for example page views and clicks) of a browser or device are aggregated in order to derive the preferences of the UUID.
2. Storage period
  The storage period is governed by the requirements of the operators of Outbrain. You can find further information here: http://www.outbrain.com/de/legal/privacy
3. Legal basis
  The legal basis for the data processing is your consent in accordance with Article 6 (1) (a) GDPR.
4. Right to object and to erasure
  You can object at any time to tracking for the display of interest-based recommendations by Outbrain; to do so, click the "Reject" field (opt-out) below Outbrain's privacy policy, available at http://www.outbrain.com/de/legal/privacy. Here you will also find further information on data protection at Outbrain UK Ltd. The opt-out applies only to the device you are using in each case and also loses its validity if you delete your cookies.
Taboola
1. Purpose of the processing
  On our website we use the service of Taboola, which makes it possible to deliver user-specific recommendations for content and ads on the basis of browsing behavior and customer interests, in order to improve the usability of our offering. The service provider is the American company Taboola, Inc., 16 Madison Square West, 7th fl., New York, NY, USA. The usage profiles are created using pseudonyms, they are not combined with the data about the bearer of the pseudonym and do not allow any conclusions to be drawn about personal data. Taboola collects the following user information by means of cookies:
  - the user's operating system
  - websites/content called up on our websites
  - referrer/link via which the user came to our website
  - time and number of website visits
  - visits to error pages
  - location information (city and federal state)
  - IP addresses in truncated form
  Taboola also processes your data in the USA, among other places. We point out that, according to prevailing case law, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks for the lawfulness and security of the data processing.
  As a basis for data processing by providers based in third countries (outside the European Union), or for a transfer of data to such countries, we therefore use what are known as standard contractual clauses (SCC). These are model templates provided by the EU Commission which ensure that your data also complies with European data protection standards when it is transferred to third countries (such as the USA) and stored there. You can view these model templates here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en. Through these clauses our contractual partner undertakes to comply with the high European level of data protection when processing your personal data, even if the data is stored, processed and managed in the USA.
2. Storage period
  The storage period is governed by the requirements of the operators of Taboola. You can find further information here: https://policies.taboola.com/en/privacy-policy/.
3. Legal basis
  The legal basis for the data processing is your consent in accordance with Article 6 (1) (a) GDPR.
4. Right to object and to erasure
  You can object to tracking by Taboola at any time at https://policies.taboola.com/en/privacy-policy/ in the "User Choices" section. Once you have opted out, no more personalized content/advertising will be delivered to you.
Customer communication and personalization with Customer.io
We use the service "Customer.io" from the provider Peaberry Software Inc., 9450 SW Gemini Dr. Suite 43920, Beaverton, OR 97008, USA, in order to make our communication with you more efficient, to inform you about our products and to continuously improve our offering.
1. Scope of the data processing
  The following categories of personal data are processed in the course of using Customer.io:
  (1) Master data: name, email address, telephone and/or mobile number.
  (2) Location data: postal code
  (3) Product usage data: information about your active licenses and the orderbird products you use (type of product, time and duration of use and the corresponding prices).
  (4) Analytics data: information about how you interact with our communication (for example emails).
  (5) Important note: no IP addresses and no information whatsoever about invoices, bank details or payment terms are transmitted to Customer.io or processed there.
2. Purpose of the processing
  It is used to carry out multi-channel communication (email, WhatsApp, SMS and direct messages in the app). The data also enables us to carry out personalized analysis: we can trace interactions down to the level of the individual user in order to send you precisely tailored information about the products you use and to tailor the communication individually to your needs.
3. Use of artificial intelligence
  Within Customer.io we use optional AI-supported functions for creating content. We ensure that Customer.io does not use raw data of our customers to train shared or third-party AI models. The AI operates exclusively within our closed workspace. All AI-generated suggestions are checked by our staff before they are used.
4. Legal basis
  The processing takes place on the basis of your consent (Article 6 (1) (a) GDPR), for example when you subscribe to the newsletter, or in order to fulfill contractual or pre-contractual measures (Article 6 (1) (b) GDPR) when you send us enquiries. In addition, we base the processing on our legitimate interest (Article 6 (1) (f) GDPR) in optimized and personalized customer communication.
5. Data transfer and security:
  We have concluded a data processing agreement (Data Processing Addendum) with Customer.io, including the EU standard contractual clauses. This ensures that a level of protection meeting the requirements of the GDPR is maintained even when processing takes place on servers in the USA.
6. Storage period and objection
  The data is erased as soon as it is no longer required to achieve the purpose or you withdraw your consent. Statutory retention periods remain unaffected. You can object to the analysis and to the sending of messages at any time (for example via the unsubscribe link or a message to [email protected]).
Tracify
1. Purpose of the processing
  We use Tracify for cross-platform marketing attribution (in particular Facebook, Google, LinkedIn). The tool analyzes the entire customer journey, calculates the cost per lead (CPL) and enables a precise measurement of the success of our ads through privacy-friendly, server-side aggregation and pseudonymization.
2. Storage period
  The data is stored for as long as this is necessary for the attribution purposes (as a rule 12 months) or until you object to the processing.
3. Legal basis
  The processing takes place on the basis of our legitimate interest in the statistical evaluation and economic optimization of our advertising measures in accordance with Article 6 (1) (f) GDPR.
4. Right to object and to erasure
  You can object to the processing informally to us at any time or deactivate the collection in our consent manager. Further information: https://tracify.ai/datenschutz.
Posthog
1. Purpose of the processing
  PostHog serves to analyze user behavior on our website. This includes identifying drop-off points (funnels), measuring content engagement and recording individual user sessions (session recording) for error analysis and to improve usability.
2. Storage period
  The data is stored for as long as your consent is in place or this is necessary for the statistical evaluation. Session recordings are generally deleted automatically after 90 days.
3. Legal basis
  The processing takes place exclusively on the basis of your express consent in accordance with Article 6 (1) (a) GDPR.
4. Right to object and to erasure
  You can withdraw your consent at any time with effect for the future by adjusting the settings in our consent manager. Further information: https://posthog.com/privacy.
truephone
1. Purpose of the processing
  For the transmission of transactions we use mobile services from Truephone GmbH ("truephone"), Mergenthalerallee 79-81, 65760 Eschborn. Truephone processes the following personal data: name, email address and MSISDN. This serves the provision of the service(s) of data use, the invoicing and billing records and the customer support records.
2. Storage period
  truephone stores the customer's data as follows: provision of the services: 3 years; call and SMS usage: 12 months or as required by law; data usage: 30 days or as required by law; invoicing and billing records: 7 years; customer service records: 3 years.
3. Legal basis
  The legal basis for the processing is the user's consent, Article 6 (1) (a) GDPR, or Article 6 (1) (b) GDPR insofar as the data is used to settle contracts. The storage is at the same time based on Article 6 (1) (c) GDPR, because the data collected in this way is of tax relevance and is therefore necessary to fulfill the provider's tax obligation.
4. Right to object and to erasure
  Because there are statutory retention periods here and the data must remain stored and processed in order to perform the contract, objection or erasure is not possible. Further information on data protection and on the storage of personal data at truephone can be found in the provider's privacy policy at https://www.truphone.com/de/alle-rechtsdokumente/datenschutzrichtlinien/.
WhatsApp communication
1. Purpose of the processing
  For communication with our customers we use the instant messaging service "WhatsApp" from WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The use of WhatsApp is entirely voluntary. WhatsApp assures that the communication content (that is, the content of your message) is end-to-end encrypted. This means that the content of the messages cannot be viewed, not even by WhatsApp itself. We point out that although WhatsApp cannot see the content, it can find out that and when communication partners communicate with us, as well as technical information about the device used by the communication partners and, depending on the settings of their device, also location information (known as metadata). Apart from the encrypted content, a transfer of communication partners' data within the Facebook group of companies is possible, in particular for the purposes of optimizing the respective services and for security purposes. It must also be assumed that your data processed by WhatsApp may be used for marketing purposes or for displaying advertising tailored to users. We also point out that we do not transmit the contact details provided to us to WhatsApp without your consent (for example by contacting you via WhatsApp on our initiative). Further details on the purposes, types and scope of the processing of your data by WhatsApp, as well as the related rights and setting options for protecting your privacy, can be found in WhatsApp's data protection notices: https://www.WhatsApp.com/legal/.
2. Storage period
  We store your data for as long as we have your consent to process it. If consent is withdrawn, the data is erased from the systems we use within 90 days. This also applies when we can assume that any enquiries have been answered, that no reference back to a previous conversation is to be expected and that no statutory retention obligations stand in the way of erasure.
3. Legal basis
  The legal basis for the processing is the user's consent, Article 6 (1) (a) GDPR. The storage also takes place on the basis of Article 6 (1) (f) GDPR ("legitimate interest"). The legitimate interest required lies in optimizing our communication with the customer and in improving our range of services.
4. Right to object and to erasure
  You can object to communicating with us via WhatsApp at any time, for example by sending the message "STOP" via WhatsApp or an email to [email protected]. If you subscribe to messages (also known as broadcasts) or subscribe to status messages via WhatsApp, you can delete our corresponding telephone number from your contacts and ask us to remove your contact from our directory. In the case of ongoing individual enquiries or communications, you can likewise ask us not to continue the communication via WhatsApp.
Use of the ordering and reservation functions of resmio
1. Purpose of the processing
  Functions of the Resmio service are integrated into our pages. These functions are offered by resmio GmbH, Katzwanger Straße 150, 90461 Nuremberg ("resmio"). By using resmio on our page, your data is processed by resmio. In the course of this, data may also be transferred to resmio. In the course of this use, resmio processes the data as a processor within the meaning of Article 28 GDPR. You can find the notices and provisions on data protection in resmio's privacy policy at https://www.resmio.com/datenschutzerklaerung/.
2. Storage period
  The data is stored for the duration of the contractual relationship with our customer and, for non-customers, until the communication process is concluded. If the data is of tax or commercial law relevance, the data is stored in accordance with Section 147 AO for a period of ten years and in accordance with Section 257 HGB for a period of six years, beginning at the end of the year in which the data was collected. For the rest, the storage period is governed by resmio's requirements. You can find further information here: https://www.resmio.com/datenschutzerklaerung/.
3. Legal basis
  The legal basis for the data processing is your consent in accordance with Article 6 (1) (a) GDPR, and Article 6 (1) (a) GDPR or Article 6 (1) (b) GDPR insofar as the data is used to settle contracts.
4. Right to object and to erasure
  Because there are statutory retention periods here and the data must remain stored and processed in order to perform the contract, objection or erasure is not possible. The data subject can, however, prevent the data processing by ceasing to use this tool. Further information on data protection and on the storage of personal data at resmio can be found in resmio's privacy policy at https://www.resmio.com/datenschutzerklaerung/.
e-bot7
1. Purpose of the processing
  On our website we use a chatbot to provide answers to customer enquiries. Personal data is processed in order to deal with your concerns and to manage and improve our business and service processes. The provider of this service is e-bot 7 GmbH, Perusastraße 7, 80333 Munich.
2. Storage period
  Your enquiries in the chat and the usage data such as IP address, chat duration, timestamps of the messages and number of dialogues are stored for 7 days. The chat histories are deleted after this time has elapsed. The usage data is stored in anonymized form for statistical purposes. This means that no personal data is evaluated.
3. Legal basis
  The aforementioned data is stored on the basis of Article 6 (1) (f) GDPR ("legitimate interest"). The legitimate interest required lies in the optimization of our website and in improving our range of services with regard to customer communication.
4. Right to object and to erasure
  The data subject has the option to object to the storage at any time. The chat history is stored in your browser; this data can be deleted at any time by clearing the browser cache in your browser settings.
statuspage.io
1. Purpose of the processing
  We use the Statuspage.io service in order to give clients (such as merchants) the option of subscribing to general notifications with important technical information by email, SMS, RSS feed or Atom feed. This concerns in particular information about maintenance work or disruptions.
  The provider of the service is: Dogwood Labs, Inc., 1098 Harrison Street, San Francisco, CA 94103, USA ("Dogwood Labs"), a subsidiary of Atlassian, Inc., 341 George Street, Sydney, NSW 2000, Australia / 350 Bush Street, San Francisco, CA 94104, USA ("Atlassian").
  Statuspage.io also processes personal data in countries outside the EU or the EEA. Dogwood Labs, Inc. and its parent company Atlassian, Inc. have submitted to the EU-US Privacy Shield, which establishes a level of data protection that is adequate within the meaning of the GDPR.
2. Storage period
  When our Statuspage account is terminated, and at the customer's request, the customer data is removed from the live production database. The customer data remains in encrypted Statuspage database backups until these backups fall outside the 30-day backup retention window and are destroyed in accordance with Atlassian's data retention policy. Should a restoration of the database be necessary within 30 days of a requested data deletion, the Statuspage operations team will delete the data again as quickly as possible after the live production system has been fully restored.
3. Legal basis
  The legal basis for processing your personal data for the purpose of sending notifications with technical information is your consent (Article 6 (1) sentence 1 (a) GDPR), which you give when you subscribe to notifications. You can withdraw your consent at any time with effect for the future by ending your subscription to the corresponding notifications.
  The legal basis for orderbird commissioning a processor for this data processing is Article 28 GDPR. For this purpose orderbird has concluded with Dogwood Labs, Inc. the data processing contract required by law under Article 28 GDPR, which also contains the EU standard contractual clauses.
4. Right to object and to erasure
  The data subject has the option to unsubscribe from the notifications at any time. The unsubscribe link in the information emails and SMS messages can be used for this. Sending the word "STOP" by SMS is also sufficient to unsubscribe from the service.
Collection of further data in individual cases
Where we collect further personal data of our users and customers in the context of individual customer and user enquiries, in particular in connection with customer support, we will inform them separately about the purpose, duration and legal basis of the data processing and about the option to object.

III. Rights of the data subject

Right of access under Article 15 GDPR
The data subject has the right to the following information:
a) the purposes of the processing;
b) the categories of personal data that are processed;
c) the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations;
d) if possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
e) the existence of a right to rectification or erasure of the personal data concerning them, or to restriction of processing by the controller, or of a right to object to such processing;
f) the existence of a right to lodge a complaint with a supervisory authority;
g) where the personal data is not collected from the data subject, any available information about the origin of the data;
h) the existence of automated decision-making, including profiling, in accordance with Article 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the data subject.
i) where personal data is transferred to a third country or to an international organization, the data subject has the right to be informed of the appropriate safeguards in accordance with Article 46 GDPR relating to the transfer.

We provide the data subject with a copy of the personal data that is the subject of the processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.
Right to rectification under Article 16 GDPR
The data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure under Article 17 GDPR
The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay. The controller is also obliged to erase personal data without undue delay where one of the following grounds applies:

a) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
b) the data subject withdraws the consent on which the processing was based in accordance with Article 6 (1) (a) or Article 9 (2) (a) GDPR, and there is no other legal basis for the processing;
c) the data subject objects to the processing in accordance with Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing in accordance with Article 21 (2) GDPR;
d) the personal data has been unlawfully processed;
e) the erasure of the personal data is necessary for compliance with a legal obligation under Union law or the law of the member states to which the controller is subject;
f) the personal data was collected in relation to information society services offered in accordance with Article 8 (1) GDPR.
Right to restriction of processing under Article 18 GDPR
The data subject has the right to obtain from the controller the restriction of processing where one of the following conditions applies:
a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data,
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of the use of the personal data,
c) the controller no longer needs the personal data for the purposes of the processing, but the data subject needs it to assert, exercise or defend legal claims, or
d) the data subject has objected to the processing in accordance with Article 21 (1) GDPR, pending verification of whether the controller's legitimate grounds override those of the data subject.
Right to notification under Article 19 GDPR
Where the data subject has asserted against the controller, with regard to their personal data, a rectification under Article 16 GDPR, an erasure under Article 17 (1) GDPR or a restriction of processing under Article 18 GDPR, and the controller has informed all recipients to whom the data subject's personal data was disclosed about the data subject's request (unless this proved impossible or involved disproportionate effort), the data subject has the right to be informed about those recipients by the controller.
Right to data portability under Article 20 GDPR
The data subject has the right to receive the personal data concerning them that they have provided to a controller in a structured, commonly used and machine-readable format, and they have the right to transmit this data to another controller without hindrance from us, provided that

a) the processing is based on consent in accordance with Article 6 (1) (a) or Article 9 (2) (a), or on a contract in accordance with Article 6 (1) (b) GDPR, and

b) the processing is carried out by automated means. The rights and freedoms of other persons must not be adversely affected by this.

When exercising the right to data portability in accordance with paragraph 1, the data subject has the right to have the personal data transmitted directly by controllers, where this is technically feasible.

The exercise of the right to data portability does not affect the right to erasure under Article 17 GDPR. The right to data portability does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Right to object under Article 21 GDPR
The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them that takes place on the basis of Article 6 (1) (e) or (f) GDPR; this also applies to profiling based on those provisions.

We no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for the purposes of such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to processing for direct marketing purposes, the personal data is no longer processed for those purposes. Consent given by the data subject can be withdrawn by them at any time. The collection and processing that has taken place up to that point remains lawful, however.
Automated decisions in individual cases including profiling under Article 22 GDPR
The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
This does not apply if the decision

a) is necessary for entering into, or performing, a contract between the data subject and us,
b) is authorized by Union or member state law to which we are subject and which lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or
c) is based on the data subject's explicit consent.

These decisions must not be based on special categories of personal data under Article 9 (1) GDPR, unless Article 9 (2) (a) or (g) GDPR applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests have been taken.

In the cases named in points a) and c) we take suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, which include at least the right to obtain human intervention on our side, to express their own point of view and to contest the decision.
Right to lodge a complaint with a supervisory authority under Article 77 GDPR
Every data subject has the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a supervisory authority, in particular in the member state of their residence, place of work or the place of the alleged infringement, if the data subject considers that the processing of personal data concerning them infringes this Regulation. The supervisory authority with which the complaint was lodged informs the complainant about the status and the outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.
Right to an effective judicial remedy under Article 79 GDPR
Every data subject has the right, without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority under Article 77 GDPR, to an effective judicial remedy if they consider that the rights to which they are entitled under this Regulation have been infringed as a result of processing of their personal data that is not in compliance with this Regulation.

Actions against us or against a processor fall within the jurisdiction of the courts of the member state in which we or the processor have an establishment. Alternatively, such actions may also be brought before the courts of the member state in which the data subject has their residence, unless we or the processor are a public authority of a member state acting in the exercise of its public powers.

Privacy Policy

Contents

I. General information

II. Specific information on the collection of personal data

III. Rights of the data subject

Choose your preferred country and language