PrivacyPrivacy Policy

Introduction and Overview

We have written this privacy policy to explain, in accordance with the General Data Protection Regulation (EU) 2016/679 and applicable national law, which personal data (referred to as data below) we as controller and the processors we engage (such as service providers) process now or will process in the future, and what legal options you have. The terms used are gender-neutral.

In short: We explain in detail what data we process about you.

Privacy policies often sound technical and use legal terminology. This policy aims to explain the most important points as simply and transparently as possible. Where it helps, we explain technical terms, link to further information and use graphics. We explain in clear, simple language that we only process personal data in our business activities where there is a legal basis for doing so. Brief, unclear explanations full of legal and technical jargon, as often found online, cannot achieve this. We hope you find the explanations below interesting and informative, and perhaps learn something new.

If you still have questions, please contact the controller listed below or in the legal notice, follow the links provided, or consult the information on the linked third-party websites. Our contact details are also in the legal notice.

Scope

This privacy policy covers all personal data processed by our company and by companies we engage as processors. Personal data means information within the meaning of Article 4(1) GDPR, such as a person’s name, email address or postal address. Processing personal data allows us to offer our services and products and bill for them, both online and offline. This policy covers:

• all online services we operate, including websites and online shops
• social media profiles and email communication
• mobile apps for smartphones and other devices

In short: This policy applies wherever our company processes personal data in a structured way through the channels listed above. If we enter into a legal relationship with you outside these channels, we will inform you separately where necessary.

Legal basis

This privacy policy explains the legal principles and rules that allow us to process personal data, including the legal bases under the General Data Protection Regulation.

For EU law, we refer to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. You can read the EU General Data Protection Regulation online on EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679 .

We only process your data if at least one of the following conditions applies:

1. Consent (Article 6(1)(a) GDPR): You have consented to processing your data for a specific purpose, such as storing the information you enter in a contact form.
2. Contract (Article 6(1)(b) GDPR): We process your data to fulfil a contract or pre-contractual obligations with you. For example, we need personal information before entering into a purchase agreement with you.
3. Legal obligation (Article 6(1)(c) GDPR): We process your data where we have a legal obligation to do so. For example, we must retain invoices for accounting purposes, and these usually contain personal data.
4. Legitimate interests (Article 6(1)(f) GDPR): We reserve the right to process personal data for legitimate interests that do not restrict your fundamental rights. For example, we need to process certain data to operate our website securely and cost-effectively. This processing therefore serves a legitimate interest.

Other grounds, such as carrying out tasks in the public interest, exercising official authority or protecting vital interests, do not generally apply to us. If such a legal basis does apply, we will identify it in the relevant section.

In addition to the EU Regulation, national laws also apply:

• In Austria this is the Federal Act for the Protection of Individuals with regard to the Processing of Personal Data (Data Protection Act), abbreviated as DSG.
• In Germany the following law applies: Data Protection Act, abbreviated as DSG.

If further regional or national laws are applied, we will inform you in the following sections.

Contact details of the controller

If you have questions about data protection or the processing of personal data, the controller’s contact details are below:

Retention period

As a general rule, we retain personal data only for as long as is strictly necessary to provide our services and products. We delete the data once the reason for processing it no longer applies. In some cases, we must retain certain data after its original purpose has ended, for example to meet accounting requirements.

If you request deletion of your data or withdraw your consent to processing, we will delete the data as soon as possible, provided no retention obligation applies.

Where further information is available, we explain specific retention periods below.

Rights under the General Data Protection Regulation

In accordance with Articles 13 and 14 GDPR, we explain the following rights to ensure fair and transparent data processing:

• Under Article 15 GDPR, you have a right of access to information about whether we process your data. If we do, you have the right to a copy of the data and the following information:
  • for what purpose we carry out the processing;
  • the categories, i.e. the types of data processed;
  • who receives this data and when the data are transmitted to third countries, how security can be guaranteed;
  • how long the data are stored;
  • the existence of the right to rectification, erasure or restriction of processing and the right to object to processing;
  • that you can complain to a supervisory authority (links to these authorities can be found below);
  • the origin of the data if we have not collected it from you;
  • whether profiling is carried out, meaning that data is automatically analysed to create a personal profile of you.
• Under Article 16 GDPR, you have a right to rectification of your data, meaning that we must correct any errors you identify.
• Under Article 17 GDPR, you have the right to erasure (the right to be forgotten), which means specifically that you may request the deletion of your data.
• Under Article 18 GDPR, you have the right to restriction of processing, meaning that we may continue to store the data but may no longer use it.
• Under Article 20 GDPR, you have the right to data portability, meaning that we will provide your data in a commonly used format on request.
• Under Article 21 GDPR, you have a right to object, which, if upheld, results in a change to the processing.
  • If processing is based on Article 6(1)(e) GDPR (public interest or exercise of official authority) or Article 6(1)(f) GDPR (legitimate interests), you may object to it. We will review as soon as possible whether we can legally comply with your objection.
  • If we use your data for direct marketing, you may object at any time. We may then no longer use your data for that purpose.
  • If data is used to perform profiling, you can object to this type of data processing at any time. We may no longer use your data for profiling.
• According to Article 22 GDPR, you may have the right not to be subject to a decision based solely on automated processing (for example profiling).
• Under Article 77 GDPR, you have the right to lodge a complaint. This means you may complain to the data protection authority at any time if you believe the processing of your personal data infringes the GDPR.

In short: You have rights — please feel free to contact the controller listed above.

If you believe the processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you may complain to the supervisory authority. In Austria, this is the Data Protection Authority, whose website is https://www.dsb.gv.at/ . In Germany, each federal state has a data protection commissioner. For more information, contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI) . The following local data protection authority is responsible for our company:

Security of data processing

We have implemented technical and organisational measures to protect personal data. Wherever possible, we encrypt or pseudonymise it. These measures make it as difficult as possible for third parties to infer personal information from our data.

Article 25 GDPR refers to “data protection by design and by default”. This means considering security and taking appropriate measures in both software, such as forms, and hardware, such as access to a server room. Where relevant, we explain specific measures below.

TLS encryption with https

We use HTTPS (Hypertext Transfer Protocol Secure) to transmit data securely over the internet. This protects the entire transfer between your browser and our web server against eavesdropping.

This adds a layer of security and implements data protection by design (Article 25(1) GDPR). TLS (Transport Layer Security), an encryption protocol for secure online data transmission, helps us protect confidential data.

You can recognise secure transmission by the small padlock symbol 🔒 to the left of the address in your browser and by “https” rather than “http” in the address. To learn more about encryption, search Google for “Hypertext Transfer Protocol Secure wiki”.

Communication

If you contact us and communicate by phone, e-mail or online form, personal data may be processed.

We process the data to handle your enquiry and the related business matter. We retain it for the duration of that matter and for as long as required by law.

People affected

This applies to everyone who contacts us through the communication channels we provide.

Phone

When you call us, call data is stored in pseudonymised form on the relevant device and by the telecommunications provider. Your name and phone number may also be sent by email and retained to answer your enquiry. The data is deleted once the business matter is closed and legal requirements permit deletion.

Email

If you contact us by email, data may be stored on the relevant device, such as a computer, laptop or smartphone, and on the email server. The data is deleted once the business matter is closed and legal requirements permit deletion.

Online forms

If you contact us through an online form, data is stored on our web server and may be forwarded to one of our email addresses. The data is deleted once the business matter is closed and legal requirements permit deletion.

Media kit generator for creators

When you use the media kit generator, we process your name, email address and any social media profiles, metrics, demographic information and media value you choose to enter. We use these to create and provide your media kit and answer questions about it. With your separate consent, we also email you about suitable campaigns, tips and updates from Digiknall. You can withdraw this consent at any time with effect for the future. Photos and logos selected in the form are embedded in the media kit only in your browser and are not sent to our server.

Lead management and newsletters with Brevo

We use Brevo to manage enquiries and leads, send double opt-in confirmation emails and, after your confirmation, send newsletters and marketing messages. Your email address, name, enquiry source, submission time and any form data you choose to enter may be sent to the Brevo Group company named in our contract. We process this data to handle your enquiry, provide requested results or downloads and, only with separate consent, send marketing messages. You can withdraw your consent at any time with effect for the future. Further information is available in the Brevo privacy policy.

Transactional emails with Amazon SES

We use Amazon Simple Email Service (Amazon SES) to send certain emails triggered by technical events or your use of the website. These include results from the social campaigning analysis and media value calculator, as well as system emails from our content management system. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Data processed includes the recipient’s name and email address, sender and reply-to addresses, subject, message content, and technical sending and delivery data. Emails are sent through our selected AWS region, Europe (Frankfurt).

Depending on the reason for the message, processing is necessary to perform a contract or take pre-contractual steps under Article 6(1)(b) GDPR, or is based on our legitimate interest in secure and reliable delivery under Article 6(1)(f) GDPR. We retain sending-related data only as long as needed for delivery, error analysis, abuse prevention and statutory record-keeping requirements. AWS processes the data on our behalf. If AWS or its subprocessors process data in a third country without an adequacy decision, the EU standard contractual clauses included in the AWS terms apply. Further information is available in the AWS privacy policy.

Legal basis

The processing of the data is based on the following legal bases:

• Article 6(1)(a) GDPR (consent): You consent to us storing your data and using it for purposes related to the business matter;
• Article 6(1)(b) GDPR (contract): Processing is necessary to fulfil a contract with you or a processor such as a telephone provider, or to take pre-contractual steps such as preparing an offer;
• Art. 6(1)(f) GDPR (legitimate interests): We want to handle customer enquiries and business communications professionally. To communicate efficiently, we need technical services such as email programs, Exchange servers and mobile operators.

Cookies

What are cookies?

Our website uses HTTP cookies to store user-specific data. Below, we explain what cookies are and why they are used, to help you understand this privacy policy.

You use a browser whenever you browse the internet. Examples include Chrome, Safari, Firefox, Internet Explorer and Microsoft Edge. Most websites store small text files in your browser, known as cookies.

Cookies are useful, and almost all websites use them. More precisely, these are HTTP cookies; other kinds of cookies serve other applications. HTTP cookies are small files our website stores on your computer. They are placed automatically in your browser’s cookie folder, which acts as a kind of memory. A cookie consists of a name and a value, with one or more additional attributes.

Cookies store user information such as your language and site preferences. When you return, your browser sends this information back to our website so it can recognise you and restore your usual settings. Some browsers store each cookie in its own file; others, such as Firefox, store them in a single file.

First-party cookies are created by our website, while third-party cookies are created by partner websites, such as Google Analytics. Each cookie needs to be considered individually because it stores different data and may expire after anything from a few minutes to several years. Cookies are not software programs and contain no viruses, Trojans or other malware. They cannot access information on your PC.

For example, cookie data can look like this:

• Name: _ga
• Value: GA1.2.1326744211.152122708995-9
• Purpose: Distinguishing between website visitors
• Expiry date: after 2 years

A browser should support at least:

• At least 4096 bytes per cookie
• At least 50 cookies per domain
• At least 3000 cookies in total

What types of cookies are there?

The cookies we use depend on the services involved and are explained in the relevant sections below. First, here is a brief overview of the different types of HTTP cookies.

There are 4 types of cookies:

When you visit a website for the first time, you are usually asked which of these types of cookies you want to allow. And of course, this decision is also stored in a cookie.

If you would like to learn more about cookies and are comfortable with technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Internet Engineering Task Force (IETF) Request for Comments document “HTTP State Management Mechanism”.

Purpose of processing via cookies

The purpose depends on the cookie. Details are provided below or by the provider of the software that sets it.

Which data are processed?

Cookies perform many different tasks, so there is no single answer to what data they store. The sections below explain the data processed or stored in each case.

Cookie retention periods

The retention period depends on the cookie and is specified below. Some cookies are deleted in less than an hour; others may remain on a computer for several years.

You can also control retention periods yourself by deleting cookies manually through your browser at any time (see “Right to object” below). Cookies that rely on consent are deleted no later than when you withdraw it. This does not affect the lawfulness of storage before withdrawal.

Right to object – how can I delete cookies?

You decide whether and how to use cookies. Whatever service or website they come from, you can delete, disable or selectively allow them. For example, you can block third-party cookies while allowing others.

To see which cookies are stored in your browser, or to change or delete cookie settings, open your browser settings:

• Chrome: Delete, activate and manage cookies in Chrome
• Safari: Managing cookies and website data with Safari
• Firefox: Delete cookies to remove data that websites have stored on your computer
• Internet Explorer: Deleting and managing cookies
• Microsoft Edge: Delete and manage cookies

If you prefer not to use cookies, you can set your browser to notify you whenever a website wants to set one, then decide whether to allow it. The steps depend on your browser. For Chrome, for example, search for “delete cookies Chrome” or “disable cookies Chrome”.

Legal basis

The “Cookie Directives” have been in place since 2009. They state that storing cookies requires Consent (Article 6(1)(a) GDPR). EU countries have implemented these directives in different ways. In Austria, the directive was implemented through section 165(3) of the Telecommunications Act (2021). In Germany, the cookie directives were not implemented as a separate national law; instead, implementation largely took place through section 15(3) of the E-Commerce Act (ECG).

For strictly necessary cookies, even without consent, there are legitimate interests (Article 6(1)(f) GDPR), which are usually economic in nature. We aim to give website visitors a pleasant experience, and certain cookies are often essential for this.

We use non-essential cookies only with your consent. The legal basis is Article 6(1)(a) GDPR.

Where software uses cookies, the following sections explain how those cookies are used.

Customer data

What is customer data?

To provide our services and fulfil our contracts, we process data about customers and business partners. This always includes personal data. Customer data means all information processed as part of a contractual or pre-contractual relationship to provide our services — in other words, the information we collect and process about our customers.

Why do we process customer data?

We collect and process customer data for several reasons. Above all, we need it to provide our services. Sometimes an email address is enough; when you buy a product or service, we may also need your name, address, bank details or contract information. We also use the data to improve our marketing and sales activities and our service to customers. Customer support matters to us too. We want you to be able to ask us about our services at any time, and need at least your email address to respond.

Which data are processed?

The exact data stored depends on the services you use, so we can only list categories here. In some cases, you provide only an email address so we can contact you or answer questions. If you buy a product or service, we need more information, such as contact details, payment details and contract data.

Here is a list of possible data that we receive and process from you:

• Name
• Contact address
• E-mail address
• Telephone number
• Date of birth
• Payment data (invoices, bank details, payment history, etc.)
• Contract data (duration, content)
• Usage data (visited websites, access data, etc.)
• Metadata (IP address, device information)

How long will the data be stored?

We delete customer data once it is no longer needed to fulfil our contractual obligations or business purposes, or for potential warranty and liability obligations. This may be the case when a business contract ends. The limitation period is then generally 3 years, although longer periods may apply in individual cases. We also comply with statutory retention obligations. We do not share your customer data with third parties without your explicit consent.

Legal basis

The legal bases for processing your data are Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract or pre-contractual steps), Article 6(1)(f) GDPR (legitimate interests) and, in specific cases such as medical services, Article 9(2)(a) GDPR (processing special categories of data).

In the case of protection of vital interests, data processing is carried out in accordance with Art. 9 para. 2 lit. c. GDPR. For the purposes of health care, occupational medicine, medical diagnostics, health or social care or management of health or social systems and services, the processing of personal data shall be carried out in accordance with Art. 9 para. 2 lit. h. GDPR. If you voluntarily provide data of the special categories, the processing takes place on the basis of Art. 9 para. 2 lit. a. GDPR.

Website operation, hosting and delivery

When you visit our website, we process technically necessary access data. This may include your IP address, the date and time of access, the requested URL or file, the amount of data transferred, referrer URL, browser type, operating system and response status. This processing is necessary to deliver the website, maintain its stability and security, analyse errors and prevent attacks or abuse. It is based on our legitimate interest under Article 6(1)(f) GDPR. Where the website is used to initiate or fulfil a contract, Article 6(1)(b) GDPR is an additional legal basis.

Hosting at Hetzner

Our website, content management system and the databases they require are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. We use its server location in Falkenstein, Germany. Hetzner processes the access data, content and technical logs generated by website operation on our behalf under an agreement pursuant to Article 28 GDPR. The data processed in this hosting environment and its backups remain at this location within the European Union.

We retain technical logs only as long as necessary for secure operation, error analysis and investigation of abuse or security incidents. We delete content stored through forms or the CMS once its purpose no longer applies, provided no statutory retention or record-keeping obligation prevents deletion. Further information is available in the Hetzner privacy notice.

Cloudflare: Network, Media and Bot Protection

We use Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA for DNS services, secure and fast delivery of the website, and protection against attacks. Cloudflare processes in particular IP address, URL accessed, timestamps, HTTP headers, browser and device information as well as technical security features. We also store publicly available website media in Cloudflare R2 Object Storage. The R2-Bucket used is set to the EU jurisdiction; the objects stored there are therefore stored and processed within the European Union.

We also use Cloudflare Turnstile in the social campaigning analysis form to detect automated access and abuse. It processes technically necessary browser, device, network and interaction signals, but not the content you enter in the form. This processing is based on our legitimate interest in a secure, available website protected against abuse under Article 6(1)(f) GDPR. Data is processed or retained only as long as necessary for delivery, security, error analysis and abuse prevention.

Cloudflare processes data on our behalf. Its global network means data may also be processed outside the European Economic Area. For transfers to third countries without an adequacy decision, the EU standard contractual clauses agreed in the Cloudflare Data Processing Addendum apply. Further information is available in the Cloudflare Privacy Policy and the Cloudflare Data Processing Addendum.

Introduction to web analytics

What is Web Analytics?

We use software known as web analytics to analyse how visitors use our website. The tool provider, also called a tracking provider, collects, stores, manages and processes data to produce analyses of user behaviour for us as the website operator. Most tools also support testing. For example, we can show visitors two different offers for a limited period to see which offer or content they prefer. After this A/B test, we know which they found more interesting. These tests and other analytics methods may involve creating user profiles and storing data in cookies.

Why do we use web analytics?

Our goal is to provide the best online offering in our industry. We aim to offer useful, interesting services and make sure you feel comfortable on our website. Web analytics tools help us understand visitor behaviour and improve the website for you and for us. For example, we can see visitors’ average age, where they come from, when the site is most frequently visited, and which content or products are most popular. This information helps us adapt the website to your needs, interests and preferences.

Which data are processed?

The exact data stored depends on the analytics tools used. Typically, it includes the content you view, buttons or links you click, when you visit a page, your browser, device type (such as a PC, tablet or smartphone) and operating system. If you have consented to the collection of location data, the analytics provider may process that too.

Your IP address is also stored. Under the GDPR, IP addresses are personal data. However, your IP address is generally pseudonymised, meaning it is stored in a masked, shortened form. For testing, web analytics and website optimisation, we generally do not store directly identifying data such as your name, age, address or email address. If such data is collected, it is stored in pseudonymised form so you cannot be identified as an individual.

The following diagram illustrates how Google Analytics works as an example of client-side web tracking using JavaScript.

How long the respective data is stored always depends on the provider. Some cookies only store data for a few minutes or until you leave the website again, other cookies can store data over several years.

Duration of data processing

Where further information is available, we explain processing periods below. In general, we process personal data only as long as strictly necessary to provide our services and products. Longer retention periods may apply where required by law, for example for accounting.

right to object

You can withdraw your consent to the use of cookies or third-party services at any time through our cookie management tool or other opt-out options. You can also prevent cookies from collecting data by managing, disabling or deleting them in your browser.

Legal basis

Web analytics requires your consent, which we obtain through our cookie popup. Under Art. 6 para. 1 lit. a GDPR (consent) , this consent provides the legal basis for processing personal data collected through web analytics tools.

Alongside consent, we have a legitimate interest in analysing visitor behaviour to improve our website technically and commercially. Web analytics helps us identify website errors and attacks, and improve profitability. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interests). We nevertheless use these tools only if you have given consent.

Because web analytics tools use cookies, we also recommend reading our general information about cookies. To find out exactly what data about you is stored and processed, read the privacy policies of the tools concerned.

Where applicable, the following sections provide information about specific web analytics tools.

PostHog Privacy Policy

We use PostHog, a software for web analysis and product analysis on our website. The service provider is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. For European users, the data is processed on servers in the EU (Frankfurt).

PostHog collects data such as IP addresses (anonymized), page views, click behavior and technical information about your browser and device. This data helps us to improve our website and understand user behaviour. We have configured PostHog to create personal profiles only for identified users.

For more information about data processed through PostHog, see its privacy policy at https://posthog.com/privacy.

Use of SalesViewer® technology

This website uses SalesViewer® technology from SalesViewer® GmbH to collect and store data for marketing, market research and optimisation, based on the website operator’s legitimate interests (Article 6(1)(f) GDPR).

JavaScript-based code collects company-related data for these purposes. The data is encrypted using a one-way function that cannot be reversed (hashing). It is immediately pseudonymised and is not used to identify individual website visitors.

Data stored through SalesViewer is deleted once it is no longer needed for its purpose and no statutory retention obligation prevents deletion.

You can object to future collection and storage of data at any time by clicking https://www.salesviewer.com/opt-out to prevent SalesViewer® from collecting data on this website in future. This stores an opt-out cookie on your device. If you delete your browser’s cookies, you will need to click the link again.

Introduction to blogs and publishing platforms

What are blogs and publishing platforms?

We use blogs and other communication tools on our website so that we can communicate with you and you can communicate with us. This may involve storing and processing your data to display content, support communication and improve security. This policy explains in general terms what data about you may be processed. The details depend on the tools and features used; each provider’s privacy notice gives more information.

Why do we use blogs and publishing platforms?

We want to offer interesting, engaging content and value your opinions and contributions. Blogs and publishing features allow us to exchange ideas with you. For example, you can comment on our content, reply to other comments or, in some cases, write posts yourself.

Which data are processed?

The data processed depends on the communication features we use. It often includes your IP address, username and published content, primarily to maintain security, prevent spam and address unlawful content. Cookies may also be used to store data. These are small text files stored in your browser. Details of the data collected and stored are provided in the relevant sections of this policy and in each provider’s privacy policy.

Duration of data processing

Where further information is available, we explain processing periods below. For example, posting and comment features retain data until you withdraw your consent to storage. In general, personal data is retained only as long as strictly necessary to provide our services.

right to object

You can withdraw your consent to the use of cookies or third-party communication services at any time through our cookie management tool or other opt-out options. You can also prevent cookies from collecting data by managing, disabling or deleting them in your browser.

Because publishing platforms may use cookies, we also recommend reading our general information about cookies. To find out exactly what data about you is stored and processed, read the privacy policies of the tools concerned.

Legal basis

We use these communication tools primarily on the basis of our legitimate interest in prompt, effective communication with you, other customers, business partners and visitors (Article 6(1)(f) GDPR). If their use serves to fulfil or initiate a contractual relationship, Article 6(1), sentence 1, point (b) GDPR is an additional legal basis.

Certain processing activities, particularly the use of cookies and comment or messaging features, require your consent. Where you consent to your data being processed and stored through embedded publishing platforms, that consent is the legal basis under Article 6(1)(a) GDPR. Most communication features we use set cookies in your browser to store data. Please read our information about cookies and the relevant provider’s privacy policy or cookie policy.

Information on special tools can be found in the following sections, if available.

Privacy policy for blog posts and comments

We may use various online communication tools on our website, such as blog posts and comment features. These allow you to comment on content or write posts. If you use these features, your IP address may be stored for security reasons, helping us address unlawful content such as insults, unauthorised advertising or prohibited political propaganda. We may also store and process user information on the basis of our legitimate interest in detecting spam. If we run a survey, we retain your IP address for its duration to ensure each participant votes only once. Cookies may also be used to store data. All data we store about you, such as content or personal information, is retained until you object.

Introduction to web design

What is web design?

We use various tools to support our website’s design. Web design concerns functionality and performance as well as appearance. As a part of media design, it covers a website’s visual, structural and functional design, with the aim of improving your experience. User experience (UX) covers all the impressions and experiences you have on a website. Usability is one aspect of this: it concerns how easy a website is to use, particularly whether content, pages and products are clearly organised so you can quickly find what you need. We use third-party web design tools to help provide this experience. In this policy, “web design” includes services that improve our website’s design, such as fonts, plugins and other embedded design features.

Why do we use web design tools?

How you take in information on a website depends heavily on its structure, functionality and visual design. Professional web design is therefore increasingly important to us. We continually improve our website as part of the service we offer visitors. An attractive, functional website also benefits our business: you are more likely to visit and use our services if you feel comfortable here.

What data is stored by web design tools?

When you visit our website, embedded web design elements may process data. The data involved depends on the tools used. Below, we identify those tools; we also recommend reading their privacy policies for details of the data processed, cookies used and retention periods. Fonts such as Google Fonts can, for example, automatically send language settings, IP addresses, browser versions, screen resolutions and browser names to Google’s servers.

Duration of data processing

Processing periods vary depending on the web design elements used. Cookies, for example, may be retained for a minute or for several years. Please consult our general section on cookies and the relevant tools’ privacy policies. These usually explain which cookies are used and what they store. Google font files, for example, are retained for one year to improve website loading times. In general, data is retained only as long as needed to provide the service; longer periods may apply where required by law.

right to object

You can withdraw your consent to the use of cookies or third-party services at any time through our cookie management tool or other opt-out options. You can also prevent cookies from collecting data by managing, disabling or deleting them in your browser. Some web design elements, usually fonts, involve data that is harder to delete because it is collected automatically when a page loads and sent directly to a third party such as Google. In these cases, contact the provider’s support team. Google support is available at https://support.google.com/?hl=de.

Legal basis

If you consent to the use of web design tools, that consent provides the legal basis under Article 6(1)(a) GDPR for the associated processing of personal data. We also have a legitimate interest in improving our website’s design to provide an attractive, professional online offering, under Article 6(1)(f) GDPR. We nevertheless use web design tools only if you have given consent.

For information on special web design tools, please refer to the following sections if available.

Privacy policy for locally hosted Google Fonts

Our website uses Google Fonts from Google Inc. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for Europe. We host the fonts locally on our own web server, rather than Google’s servers. This means no connection is made to Google’s servers and no data is transferred to or stored by Google.

What are Google Fonts?

Google Fonts, formerly Google Web Fonts, is an interactive directory of over 800 fonts provided free of charge by Google. It allows fonts to be used without uploading them to your own server. To prevent data being transferred to Google’s servers, we have downloaded the fonts to our own server. This lets us use them in compliance with data protection requirements without sending data to Google Fonts.

Explanation of terms used

We aim to make this privacy policy as clear and understandable as possible. Technical and legal topics sometimes require legal terms such as personal data, or technical terms such as cookies and IP addresses. We explain these rather than leaving them undefined. Below is an alphabetical list of important terms that may need further explanation. Where a definition comes from the GDPR, we reproduce it and, where helpful, add our own explanation.

Processors

Consent

Health data

Personal data

Profiling

Controller

Processing

All texts are protected by copyright.