Privacy policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data means any data that can be used to personally identify you. For detailed information on data protection, please refer to our privacy policy set out below this text.

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. The operator's contact details can be found in the section “Information on the Controller” in this Privacy Policy.

How do we collect your data?

Your data is collected, firstly, when you provide it to us. This may include, for example, data that you enter into a contact form.

Other data is collected by our IT systems automatically or with your consent when you visit the website. This primarily includes technical data (e.g. internet browser, operating system, or time of the page view). This data is collected automatically as soon as you access this website.

What do we use your data for?

Some of the data is collected to ensure that the website functions properly. We currently do not use analytics programs to statistically evaluate your browsing behavior.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request that this data be rectified or deleted. If you have given your consent to data processing, you may withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request that the processing of your personal data be restricted. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this or any other questions regarding data protection.

No analytics tools

We currently do not use any analytics software (e.g. Google Analytics, Matomo, or comparable tracking/statistics services). Your browsing behavior is not statistically analyzed using such tools. Technical server log data generated as part of hosting and the integration of services such as Google Maps or YouTube are separate from this and are described in the relevant sections of this Privacy Policy.

2. Hosting and Content Delivery Networks (CDN)

We host the content of our website with the following provider:

Google Cloud Platform (Firebase Hosting)

We host our website and the associated serverless functions on Google Cloud Platform (GCP) via Firebase Hosting. The provider is Google Ireland Limited (“Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Firebase Hosting automatically uses Google Cloud CDN (Content Delivery Network) to distribute content worldwide via edge servers and optimize loading times. Requests are routed through the CDN network before reaching the actual servers.

When you visit our website, Google Cloud (including the CDN) automatically collects various technical data in log files to ensure the functionality and security of the services. This includes in particular:

• IP addresses
• Timestamps of requests
• Requested URLs and paths
• HTTP status codes
• User agent information (browser type, operating system)
• Referrer URLs
• Request metadata (e.g. request size, response time)

This data is required by Google Cloud to provide and maintain the services and is used for troubleshooting, security analysis and performance optimization. The log files are stored by Google Cloud for 30 days and then automatically deleted.

The use of Google Cloud Platform is based on Art. 6(1)(f) GDPR. We have a legitimate interest in presenting our website as reliably, securely, and efficiently as possible. Where corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Details can be found here: https://cloud.google.com/terms/sccs and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

You can find more information about security and data protection at Google Cloud here: https://cloud.google.com/security/privacy and https://policies.google.com/privacy?hl=en.

The company is certified under the “EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

Order processing

We have concluded a data processing agreement (DPA) for use of the aforementioned service. This is an agreement required by data protection law that ensures that the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

3. General information and mandatory information

Privacy policy

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

When you use this website, various types of personal data are collected. Personal data is data that can be used to identify you personally. This Privacy Policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that data transmission over the Internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to provide complete protection of data against access by third parties.

Information about the data controller

The controller responsible for data processing on this website is:

Winweb Informationstechnologie GmbH
Am Wiesenhang 8
52457 Aldenhoven
Germany

Phone: +49 2464 90991 0
Email: datenschutz@winweb.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g. names, email addresses or similar information).

Storage period

Unless a more specific retention period is stated in this privacy policy, we store personal data only for as long as is necessary for the respective purposes. We then delete the data or restrict its processing. The following factors in particular are decisive:

• Server and hosting log files: 30 days (see the “Hosting” or “Server log files” section)

• Contact and other inquiries: 6 months after final processing of the inquiry; longer only if statutory retention obligations apply or the data is required for the establishment, exercise, or defense of legal claims

• Cookie-/consent decisions: until revoked or until you delete the saved settings in your browser; evidentiary purposes may require longer documentation where required by law

• Newsletter data: until you unsubscribe or as specified in the “Newsletter” section

• Applicant data: in accordance with the information in the section “Handling applicant data”

• Documents relevant under tax and commercial law: up to 10 years in accordance with statutory requirements (in particular the German Fiscal Code and German Commercial Code), where applicable

If you submit a legitimate request for deletion or withdraw your consent, we will delete the data concerned, unless there are other legally permissible grounds for retaining it; in the latter case, the data will be deleted once these grounds cease to apply.

General information on the legal bases for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, where special categories of data pursuant to Art. 9 para. 1 GDPR are processed. If you have expressly consented to the transfer of personal data to third countries, the data processing is also carried out on the basis of Art. 49 para. 1 lit. a GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), the data processing is additionally carried out on the basis of § 25 para. 1 TDDDG. Consent may be withdrawn at any time. If your data is required for the performance of a contract or to take steps prior to entering into a contract, we process your data on the basis of Art. 6 para. 1 lit. b GDPR. Furthermore, we process your data where this is necessary for compliance with a legal obligation on the basis of Art. 6 para. 1 lit. c GDPR.

Data processing may also be carried out on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR. The specific legitimate interests are identified individually for the respective processing activities in this Privacy Policy. These include in particular:

• the reliable, secure, high-performance delivery and technical optimization of our website (hosting, CDN, server log files)

• ensuring the stability, security and performance of the website (including on the basis of technical server log data collected as part of the hosting services)

• the effective processing of inquiries addressed to us (e.g. contact form, email)

• ensuring that the website functions properly (necessary cookies or local storage of settings)

• the defense against legal claims (e.g. limited retention of application documents).

The following sections of this privacy policy provide information about the legal bases and legitimate interests applicable in each individual case.

Data protection officer

We have appointed a data protection officer.

Five Consulting
Dipl.-Ing. Klaus Pampuch
Frankenforster Str. 44
51427 Bergisch Gladbach
Germany

Phone: 02204-7060940
Email: pampuch@five.consulting

Notice concerning data transfers to third countries without adequate data protection and transfers to US companies that are not DPF-certified

Among other things, we use tools from companies based in third countries that are not considered secure under data protection law, as well as US tools whose providers are not certified under the EU-US Data Privacy Framework (DPF). If these tools are active, your personal data may be transferred to and processed in these countries. Please note that a level of data protection comparable to that of the EU cannot be guaranteed in third countries that are not considered secure under data protection law.

We would like to point out that, as a safe third country, the USA generally provides a level of data protection comparable to that of the EU. Accordingly, data may be transferred to the USA if the recipient is certified under the “EU-US Data Privacy Framework” (DPF) or has appropriate additional safeguards in place. Information on transfers to third countries, including the recipients of the data, can be found in this Privacy Policy.

Recipients of personal data

As part of our business activities, we work with various external parties. This may require us to transfer personal data to these parties. Data is transferred only if this is necessary for the performance of a contract, if we are legally obliged to do so (e.g. disclosure to tax authorities), if we have a legitimate interest pursuant to Art. 6(1)(f) GDPR, or if another legal basis permits the disclosure of data. When using processors, we disclose the personal data of our website visitors only on the basis of a valid data processing agreement. In the event of joint processing, a joint processing agreement will be concluded.

Below, we provide information about the categories of recipients to whom personal data may be transferred in connection with this website, as well as the respective purpose of the transfer:

• Hosting and infrastructure service provider (Google Ireland Limited / Google Cloud Platform, Firebase Hosting incl. CDN): Provision, delivery, and security of the website as well as storage of technical server log data (e.g. IP address, timestamp, URLs accessed).
• Database and storage service provider  (Google Ireland Limited / Google Cloud, in particular Firestore and Google Cloud Storage): storage and management of website content and personal data collected via the website (e.g. contact requests), insofar as storing such data is technically necessary.
• Map services (Google Maps / Google Ireland Limited): Display of interactive maps and location information; transmission of technical data (in particular the IP address) when the service is activated (generally after consent has been given).
• Video/marketing services (YouTube / Google Ireland Limited): Embedding of videos; transmission of technical data (in particular IP address) when accessing or playing them (usually after consent has been given).
• Email/communications service provider: Sending and delivering emails, particularly in connection with contact requests submitted via the contact form.
• IT service providers and technical support partners: Operation, maintenance, further development and security of the website and associated systems.
• Government authorities and other public bodies: Disclosure insofar as we are legally obliged to do so.
• Advisors (e.g. lawyers, tax advisors, data protection officers), insofar as this is necessary to exercise our rights and fulfill our obligations.

Further details on individual recipients, legal bases and, where applicable, transfers to third countries can be found in the relevant sections of this Privacy Policy (in particular regarding hosting, cookies, Google Maps and YouTube).

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You may withdraw consent that you have already given at any time. The withdrawal does not affect the lawfulness of the data processing carried out prior to the withdrawal.

Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)

If the data processing is carried out on the basis of Art. 6 para. 1 LET. E or F GDPR, you have the right at any time, on grounds relating to your particular situation, to object to the processing of your personal data; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this Privacy Policy. If you object, we will no longer process the personal data concerned, unless we can demonstrate compelling legitimate  grounds for the processing that override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims (objection pursuant to Art. 21 para. 1 GDPR).

If your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for direct marketing purposes (objection pursuant to Art. 21 para. 2 GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged violation. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Competent supervisory authority:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia

Kavalleriestraße 2-4

40213 Düsseldorf

Phone: 0211/38424-0

Email: poststelle@ldi.nrw.de

Website: www.ldi.nrw.de

Right to data portability

You have the right to receive data that we process automatically on the basis of your consent or in fulfillment of a contract, or to have it transmitted to a third party, in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where technically feasible.

Access, rectification and erasure

Within the framework of the applicable statutory provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients, and the purpose of the data processing, and, where applicable, the right to have this data corrected or deleted. You may contact us at any time regarding this or any other questions about personal data.

Right to restriction of processing

You have the right to request that the processing of your personal data be restricted. You may contact us at any time to exercise this right. The right to restriction of processing applies in the following cases:

• If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the review, you have the right to request that the processing of your personal data be restricted.
• If your personal data was/is being processed unlawfully, you may request the restriction of data processing instead of deletion.
• If we no longer need your personal data, but you need it to establish, exercise or defend legal claims, you have the right to request that the processing of your personal data be restricted instead of having it erased.
• If you have objected pursuant to Art. 21(1) GDPR, your interests must be weighed against ours. Until it has been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, such data may – apart from being stored – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

Automated decision-making, including profiling

Automated decision-making, including profiling, pursuant to Art. 22 GDPR does not take place.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the website operator, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock icon in your browser bar.

If SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

4. Data collection on this website

Cookies

Our websites use so-called “cookies”. Cookies are small data packets and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Persistent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser.

Cookies may originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies allow certain services from third-party companies to be integrated into websites (e.g. cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies may be used—if implemented and enabled—to evaluate user behavior or for advertising purposes. We currently do not use any cookies to analyze user behavior. Marketing and functional services (e.g. YouTube, Google Maps) are loaded only after the relevant consent has been given and are described in the respective sections.

Cookies that are required to carry out the electronic communication process, to provide certain functions requested by you (e.g. for the shopping cart function) or to provide certain functions requested by you (necessary cookies), are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure the technically error-free and optimized provision of its services. If consent to the storage of cookies and comparable recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG); consent may be revoked at any time.

You can configure your browser to notify you when cookies are set, allow cookies only on a case-by-case basis, reject cookies in certain cases or in general, and automatically delete cookies when you close your browser. Disabling cookies may limit the functionality of this website.

You can find out which cookies and services are used on this website in this privacy policy.

Necessary cookies (always active):

• __session: Authentication and session management for logged-in users (Next.js)
• _prerenderer: Prerendering optimization for better performance (Next.js)

These cookies are required for the website’s basic functions and cannot be disabled.

Cookie settings

Our website uses its own cookie dialog to obtain your consent to the storage of certain cookies on your device and to document this consent in compliance with data protection regulations. When you visit our website, you will be informed about the use of cookies and can set your preferences. Your cookie settings are stored in your browser’s local storage so that we can associate you with the consent you have given or its withdrawal. The data collected in this way will be stored until you ask us to delete it, delete the cookie settings yourself, or the purpose for storing the data no longer applies. Mandatory statutory retention obligations remain unaffected. 

When we use our cookie dialog, we do so to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6 para. 1 lit. c GDPR.

Consent management (consent banner)

We use our own consent management solution on our website to obtain, store and document your consent to the use of cookies and comparable technologies. For this purpose, a cookie with a randomly generated consent ID is set (duration: 12 months). We record the consent ID, the time, the selected categories and the version of the consent texts associated with your decision. This processing serves to fulfil our obligation to provide proof under Art. 7 para. 1 GDPR (legal basis: Art. 6 para. 1 point c GDPR); setting the cookie is strictly necessary under § 25 para. 2 No. 2 TDDDG. Your consent ID is displayed in the banner and under „Cookie settings"; there you can change or withdraw your consent at any time with effect for the future. We delete the log data three years after you withdraw or last change your consent.

LocalStorage

Our website uses local storage, a technology that makes it possible to store data in the user's browser. We use local storage for the following purposes:

• cookie-consent-preferences: Stores your cookie preferences (necessary, functional, analytics, marketing)
• winweb-locale: Stores the selected language in which the texts are displayed

This data is stored exclusively locally in your browser and is not transmitted to our servers. You can delete this data at any time via your browser settings. The legal basis for storage is Art. 6 para. 1 lit. f GDPR (legitimate interest in the functionality of the website) or Art. 6 para. 1 lit. a GDPR (consent) for optional cookies.

Order processing

We have concluded a data processing agreement (DPA) for the use of the aforementioned service. This is an agreement required by data protection law that ensures that the service processes our website visitors’ personal data only in accordance with our instructions and in compliance with the GDPR.

Server log files

The website provider (Google Cloud Platform / Firebase Hosting) automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• operating system used
• Referrer URL
• Host name of the accessing computer
• Time of server request
• IP address

These data are not combined with other data sources.

This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website – for this purpose, the server log files must be collected. The log files are stored by Google Cloud for 30 days and then automatically deleted.

Contact form

If you send us inquiries via the contact form, the information you provide in the inquiry form, including the contact details entered there, will be stored by us for the purpose of processing your inquiry and in case of follow-up questions. We will not share this data without your consent.

These data are processed on the basis of Art. 6(1)(f) GDPR (legitimate interest in handling your inquiry). If your inquiry is aimed at concluding a contract or is necessary in order to take steps prior to entering into a contract, the legal basis is Art. 6(1)(b) GDPR. If you optionally consent via the contact form to receiving informational materials or a callback, the related processing is carried out on the basis of your consent pursuant to Art. 6(1)(a) GDPR; you may withdraw your consent at any time.

We store the data you enter in the contact form to process your inquiry and any follow-up questions. Once processing has been completed, we generally delete the data after 6 months. The data will only be stored for longer where statutory retention obligations apply (e.g. retention periods under tax or commercial law) or where the data is required for the establishment, exercise or defense of legal claims. You may ask us to delete the data sooner at any time. If you have optionally consented to receiving information materials or a callback, you may withdraw this consent at any time.

Inquiry by email, telephone, or fax

If you contact us by email, telephone or fax, your enquiry, including all personal data arising from it (name, enquiry), will be stored and processed by us for the purpose of handling your request. We will not disclose this data without your consent.

These data are processed on the basis of Art. 6 para. 1 lit. f GDPR (legitimate interest in processing your inquiry). If your inquiry is aimed at concluding a contract or is necessary in order to take steps prior to entering into a contract, the legal basis is Art. 6 para. 1 lit. b GDPR. If you optionally consent in the contact form to receiving information material or a callback, the related processing is carried out on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR; consent may be withdrawn at any time.

We store the data you provide by email, telephone or fax in order to process your request and any follow-up questions. Once processing has been completed, we generally delete the data after 6 months. Data is stored for longer only where statutory retention obligations apply (e.g. retention periods under tax or commercial law) or where the data is required for the establishment, exercise or defence of legal claims. You may ask us to delete the data earlier at any time or – where processing is based on consent – withdraw your consent.

Order processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This agreement is required by data protection law and ensures that the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

5. Newsletter

Newsletter data

If you would like to subscribe to the newsletter offered on the website, we require your email address as well as information that allows us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter. No further data is collected, or is collected only on a voluntary basis. We use this data exclusively to send the requested information and do not disclose it to third parties.

The data entered in the newsletter subscription form is processed exclusively on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You may withdraw your consent to the storage of the data and email address and their use for sending the newsletter at any time, for example via the “Unsubscribe” link in the newsletter. The withdrawal of consent does not affect the lawfulness of data processing carried out prior to the withdrawal.

The data you provide to us for the purpose of subscribing to the newsletter will be stored by us or by the newsletter service provider until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe from the newsletter or once the purpose for which it was collected no longer applies. We reserve the right to delete or block email addresses from our newsletter distribution list at our discretion on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.

Data stored by us for other purposes remains unaffected by this.

After you unsubscribe from the newsletter mailing list, your email address may be stored by us or the newsletter service provider on a blacklist if this is necessary to prevent future mailings. The data on the blacklist will be used solely for this purpose and will not be combined with other data. This serves both your interests and our interest in complying with the legal requirements for sending newsletters (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). Storage on the blacklist is not limited in time. You may object to this storage if your interests outweigh our legitimate interest.

6. Plugins and tools

YouTube with enhanced privacy

This website embeds videos from YouTube. The website is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

We use YouTube in privacy-enhanced mode. According to YouTube, this mode means that YouTube does not store any information about visitors to this website before they watch the video. However, privacy-enhanced mode does not necessarily prevent data from being shared with YouTube partners. YouTube therefore establishes a connection to the Google Marketing Network, regardless of whether you watch a video.

As soon as you play a YouTube video on this website, a connection to YouTube's servers is established. The YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you allow YouTube to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account.

Furthermore, after you start a video, YouTube may store various cookies on your device or use comparable recognition technologies (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to compile video statistics, improve user-friendliness and prevent attempted fraud.

After a YouTube video is started, additional data processing operations may be triggered over which we have no control.

YouTube is used in the interest of presenting our online services in an appealing manner. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

You can find more information about data protection at YouTube in its privacy policy at: https://policies.google.com/privacy?hl=de.

The company is certified under the “EU-U.S. Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States intended to ensure compliance with European data protection standards when data is processed in the United States. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

Storage period: We do not create or store any separate user profiles in connection with the YouTube integration. Your consent to the “Marketing” category (required for loading the videos) is stored locally in your browser until you withdraw it or delete the relevant data in your browser. The storage period for cookies and other storage mechanisms set by YouTube/Google is determined by Google; further information can be found in Google’s Privacy Policy: https://policies.google.com/privacy?hl=en

Google Maps

This website uses the Google Maps service (embedding/embed) to display locations interactively – particularly on the contact page. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. The parent company is Google LLC, USA.

This service is not the same as the hosting of our website via Google Cloud Platform / Firebase. Google Maps is loaded as an additional service only after you have given your consent (functional cookies). Without your consent, the map will not be embedded and, consequently, no corresponding data will be transferred to Google for this purpose.

Purpose: Displaying location information and making it easier to find the places we specify.

Legal basis: Processing is carried out exclusively on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG, insofar as the consent covers the storage of cookies or access to information on your device. You may withdraw your consent at any time with effect for the future via the cookie settings.

Data processed / recipients: When the map is loaded, your IP address, device and browser information, and the date and time of access may in particular be transmitted to Google. Google may use cookies or comparable technologies in this process. The recipients are Google Ireland Limited or Google LLC and, where applicable, affiliated companies. We have no control over further data processing by Google.

Storage duration: The storage duration depends on the cookies or storage set by Google and on your browser settings. We store your consent decision locally in your browser (consent/cookie settings). Further information on Google's storage duration can be found in Google's Privacy Policy: https://policies.google.com/privacy?hl=en

Third-country transfer: Personal data may be transferred to the USA. The transfer is based on the EU-US Data Privacy Framework (where Google is certified) or the European Commission's Standard Contractual Clauses. Details: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/
Information on DPF certification: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active

Further information on the handling of user data: https://policies.google.com/privacy?hl=en

7. Proprietary services

Handling applicant data

We offer you the opportunity to apply to us (e.g. by email, post or via the online application form). Below, we inform you about the scope, purpose and use of your personal data collected as part of the application process. We assure you that your data will be collected, processed and used in accordance with applicable data protection law and all other legal provisions and that your data will be treated as strictly confidential.

Scope and purpose of data collection

If you submit an application to us, we process the associated personal data (for example contact and communication data, application documents, notes taken during job interviews etc.), insofar as this is necessary to decide whether to establish an employment relationship. The legal basis for this is § 26 BDSG under German law (initiation of an employment relationship), Art. 6 para. 1 lit. b GDPR (general steps prior to entering into a contract) and – if you have given your consent – Art. 6 para. 1 lit. a GDPR. Consent may be withdrawn at any time. Within our company, your personal data will be disclosed exclusively to persons involved in processing your application.

If your application is successful, the data you have submitted will be stored in our data processing systems on the basis of Section 26 of the Federal Data Protection Act and Art. 6(1)(b) GDPR for the purpose of administering the employment relationship.

Data retention period

If we are unable to offer you a position, you decline an offer of employment, or you withdraw your application, we reserve the right to retain the data you have provided for up to 6 months following the conclusion of the application process (rejection or withdrawal of the application), based on our legitimate interests (Art. 6(1)(f) GDPR). The data will then be deleted and the physical application documents destroyed. The data is retained in particular for evidentiary purposes in the event of a legal dispute. If it is apparent that the data will still be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), it will not be deleted until the purpose for its continued retention no longer applies.

A longer retention period may also apply if you have given your corresponding consent (Art. 6(1)(a) GDPR) or if statutory retention obligations prevent deletion.

Inclusion in the applicant pool

If we do not offer you a position, we may be able to add you to our candidate pool. If you are added, all documents and information from your application will be transferred to the candidate pool so that we can contact you regarding suitable vacancies.

Inclusion in the applicant pool is based exclusively on your express consent (Art. 6(1)(a) GDPR). Giving consent is voluntary and has no bearing on the ongoing application process. You may withdraw your consent at any time. In this case, the data will be permanently deleted from the applicant pool, provided there are no statutory grounds for retention.

The data in the applicant pool will be permanently deleted no later than two years after consent has been given.