We have drafted this privacy policy (version 24.02.2024-312061002) to explain to you, in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (referred to as data) we as the controller – and the processors commissioned by us (e.g. providers) – process, will process in the future, and what lawful options you have. The terms used are gender-neutral.
In short: We comprehensively inform you about the data we process about you.
Privacy policies usually sound very technical and use legal terminology. This privacy policy, however, aims to describe the most important matters to you as simply and transparently as possible. Where it serves transparency, technical terms are explained in a reader-friendly manner, links to further information are provided, and graphics are used. We thus inform you in clear and simple language that, in the course of our business activities, we only process personal data when a corresponding legal basis exists.
This is certainly not possible with the briefest, unclear, and legal-technical explanations that are often the standard on the internet when it comes to data protection. We hope you find the following explanations interesting and informative, and perhaps there is information here that you did not yet know.
If you still have questions, we ask you to contact the responsible party named below or in the legal notice, to follow the existing links, and to look at further information on third-party sites. You can of course also find our contact details in the legal notice.
This privacy policy applies to all personal data processed by us in the company and to all personal data processed by companies commissioned by us (processors). By personal data, we mean information within the meaning of Art. 4 No. 1 GDPR, such as a person's name, email address, and postal address. The processing of personal data ensures that we can offer and bill our services and products, whether online or offline. The scope of this privacy policy includes:
In short: The privacy policy applies to all areas in which personal data is processed in a structured manner in the company via the mentioned channels. Should we enter into legal relationships with you outside of these channels, we will inform you separately if necessary.
In the following privacy policy, we provide you with transparent information about the legal principles and regulations, i.e. the legal bases of the General Data Protection Regulation, that enable us to process personal data.
With regard to EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can of course read this EU General Data Protection Regulation online on EUR-Lex, the portal to EU law, at https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32016R0679.
We only process your data if at least one of the following conditions applies:
Other conditions such as the performance of tasks in the public interest and the exercise of official authority, as well as the protection of vital interests, generally do not apply to us. Should such a legal basis be relevant, it will be indicated at the appropriate point.
In addition to the EU regulation, national laws also apply:
If further regional or national laws apply, we will inform you about them in the following sections.
If you have questions about data protection or the processing of personal data, please find below the contact details of the responsible person or body:
IITR Datenschutz GmbH
Dr. Sebastian Kraska
Marienplatz 2
80331 Munich, Germany
Email: email@iitr.de
Phone: +49 (089) 18917360
Legal notice: https://www.iitr.de/unternehmen/impressum.html
Below you will find the contact details of the data protection officer:
IITR Datenschutz GmbH
Dr. Sebastian Kraska
Marienplatz 2
80331 Munich, Germany
Email: email@iitr.de
Phone: +49 (089) 18917360
That we only store personal data for as long as is absolutely necessary for the provision of our services and products is a general criterion for us. This means that we delete personal data as soon as the reason for data processing no longer exists. In some cases, we are legally required to store certain data even after the original purpose has ceased to exist, for example for accounting purposes.
If you wish to have your data deleted or revoke your consent to data processing, the data will be deleted as quickly as possible, provided there is no obligation to retain it.
We will inform you below about the specific duration of the respective data processing, provided we have further information.
In accordance with Articles 13 and 14 GDPR, we inform you of the following rights to which you are entitled to ensure fair and transparent processing of data:
In short: You have rights – do not hesitate to contact the responsible party listed above!
If you believe that the processing of your data violates data protection law or your data protection rights have been violated in any other way, you can lodge a complaint with the supervisory authority. For Austria, this is the Data Protection Authority, whose website you can find at https://www.dsb.gv.at/. In Germany, there is a data protection officer for each federal state. For further information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI). The following local data protection authority is responsible for our company:
State Commissioner for Data Protection: Prof. Dr. Tobias Keber
Address:
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Phone: +49 711 6155 41-0
Email: poststelle@lfdi.bwl.de
Website:
https://www.baden-wuerttemberg.datenschutz.de/
To protect personal data, we have implemented both technical and organisational measures. Where possible, we encrypt or pseudonymise personal data. This makes it as difficult as possible, within our capabilities, for third parties to derive personal information from our data.
Art. 25 GDPR speaks of "data protection by design and by default" and means that both software (e.g. forms) and hardware (e.g. access to the server room) should always consider security and implement appropriate measures. In the following, we will address specific measures if necessary.
Communication Summary
👥 Affected parties: Anyone who communicates with us by phone, email, or online form
📓 Data processed: e.g. phone number, name, email address, form data entered. More details can be found for each contact method used
🤝 Purpose: Handling communication with customers, business partners, etc.
📅 Storage duration: Duration of the business case and legal requirements
⚖️ Legal bases: Art. 6(1)(a) GDPR (Consent), Art. 6(1)(b) GDPR (Contract), Art. 6(1)(f) GDPR (Legitimate interests)
When you contact us and communicate by phone, email, or online form, personal data may be processed.
The data is processed for the handling and processing of your enquiry and the related business transaction. The data is stored for as long as necessary or as required by law.
All those who seek contact with us via the communication channels we provide are affected by the aforementioned processes.
When you call us, the call data is stored in pseudonymised form on the respective device and by the telecommunications provider used. In addition, data such as name and phone number may subsequently be sent by email and stored for answering enquiries. The data is deleted once the business case has ended and legal requirements permit.
When you communicate with us by email, data may be stored on the respective device (computer, laptop, smartphone, etc.) and data is stored on the email server. The data is deleted once the business case has ended and legal requirements permit.
When you communicate with us via an online form, data is stored on our web server and may be forwarded to one of our email addresses. The data is deleted once the business case has ended and legal requirements permit.
The processing of data is based on the following legal bases:
In this section, we would like to explain what a data processing agreement is and why it is needed. Because the term "data processing agreement" is quite a mouthful, we will also frequently use the abbreviation DPA here. Like most companies, we do not work alone but also use the services of other companies or individuals. Through the involvement of various companies or service providers, it may be that we pass on personal data for processing. These partners then act as processors, with whom we conclude a contract, the so-called data processing agreement (DPA). The most important thing for you to know is that the processing of your personal data takes place exclusively according to our instructions and must be regulated by the DPA.
As a company and website owner, we are responsible for all data we process from you. In addition to the controllers, there may also be so-called processors. This includes any company or person that processes personal data on our behalf. More precisely, according to the GDPR definition: any natural or legal person, authority, institution, or other body that processes personal data on our behalf is considered a processor. Processors can therefore be service providers such as hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.
For better understanding of the terminology, here is an overview of the three roles in the GDPR:
Data subject (you as a customer or interested party) → Controller (we as a company and client) → Processor (service providers such as web hosts or cloud providers)
As mentioned above, we have concluded a DPA with our partners who act as processors. Above all, it is stipulated that the processor processes the data to be processed exclusively in accordance with the GDPR. The contract must be concluded in writing, although in this context the electronic conclusion of a contract is also considered "in writing". The processing of personal data only takes place on the basis of the contract. The contract must contain the following:
Furthermore, the contract contains all obligations of the processor. The most important obligations are:
You can see what such a DPA looks like in concrete terms, for example, at https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-mustervertrag-auftragsverarbeitung.html. A sample contract is presented here.
Cookies Summary
👥 Affected parties: Visitors to the website
🤝 Purpose: Depends on the respective cookie. More details can be found below or from the manufacturer of the software that sets the cookie.
📓 Data processed: Depends on the cookie used. More details can be found below or from the manufacturer of the software that sets the cookie.
📅 Storage duration: Depends on the respective cookie, can vary from hours to years
⚖️ Legal bases: Art. 6(1)(a) GDPR (Consent), Art. 6(1)(f) GDPR (Legitimate interests)
Our website uses HTTP cookies to store user-specific data.
In the following, we explain what cookies are and why they are used, so that you can better understand the following privacy policy.
Whenever you browse the internet, you use a browser. Well-known browsers include Chrome, Safari, Firefox, Internet Explorer, and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.
One thing cannot be denied: cookies are really useful little helpers. Almost all websites use cookies. More precisely, they are HTTP cookies, as there are also other cookies for other areas of application. HTTP cookies are small files that our website stores on your computer. These cookie files are automatically placed in the cookie folder, essentially the "brain" of your browser. A cookie consists of a name and a value. When defining a cookie, one or more attributes must also be specified.
Cookies store certain user data from you, such as language or personal page settings. When you visit our site again, your browser transmits the "user-related" information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are used to. In some browsers, each cookie has its own file; in others, such as Firefox, all cookies are stored in a single file.
The following graphic shows a possible interaction between a web browser such as Chrome and the web server. The web browser requests a website and receives a cookie back from the server, which the browser uses again as soon as another page is requested.
There are both first-party cookies and third-party cookies. First-party cookies are created directly by our site, while third-party cookies are created by partner websites (e.g. Google Analytics). Each cookie must be evaluated individually, as each cookie stores different data. The expiry time of a cookie also varies from a few minutes to a few years. Cookies are not software programs and do not contain viruses, trojans, or other "malware". Cookies also cannot access information on your PC.
For example, cookie data can look like this:
Name: _ga
Value:
GA1.2.1326744211.152312061002-9
Purpose: Distinguishing website visitors
Expiry date: after 2 years
A browser should be able to support these minimum sizes:
The question of which cookies we use in particular depends on the services used and is clarified in the following sections of the privacy policy. At this point, we would like to briefly discuss the different types of HTTP cookies.
Four types of cookies can be distinguished:
Essential cookies
These cookies are necessary to ensure basic functions of the website. For example, these cookies are needed when a user places a product in the shopping cart, then continues browsing other pages, and only goes to checkout later. These cookies ensure the shopping cart is not deleted, even if the user closes the browser window.
Functional cookies
These cookies collect information about user behaviour and whether the user receives any error messages. In addition, these cookies also measure the loading time and behaviour of the website in different browsers.
Targeting cookies
These cookies provide better user-friendliness. For example, entered locations, font sizes, or form data are stored.
Advertising cookies
These cookies are also called targeting cookies. They serve to deliver individually tailored advertising to the user. This can be very practical but also very annoying.
Usually, when you first visit a website, you are asked which of these cookie types you wish to allow. And of course, this decision is also stored in a cookie.
If you want to learn more about cookies and are not afraid of technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Request for Comments of the Internet Engineering Task Force (IETF) called "HTTP State Management Mechanism".
The purpose ultimately depends on the respective cookie. More details can be found below or from the manufacturer of the software that sets the cookie.
Cookies are small helpers for many different tasks. Unfortunately, it is not possible to generalise which data is stored in cookies, but we will inform you about the data processed or stored in the following privacy policy.
The storage duration depends on the respective cookie and is specified further below. Some cookies are deleted after less than an hour, while others can remain stored on a computer for several years.
You also have influence over the storage duration yourself. You can manually delete all cookies at any time via your browser (see also "Right to Object" below). Furthermore, cookies based on consent will be deleted at the latest after you revoke your consent, whereby the lawfulness of the storage until then remains unaffected.
How and whether you want to use cookies is up to you. Regardless of which service or website the cookies come from, you always have the option of deleting, deactivating, or only partially allowing cookies. For example, you can block third-party cookies but allow all other cookies.
If you want to find out which cookies have been stored in your browser, or if you want to change or delete cookie settings, you can find this in your browser settings:
Chrome: Delete, enable, and manage cookies in Chrome
Safari: Manage cookies and website data with Safari
Firefox: Clear cookies and site data in Firefox
Internet Explorer: Delete and manage cookies
Microsoft Edge: Delete cookies in Microsoft Edge
If you fundamentally do not want cookies, you can set up your browser to always inform you when a cookie is to be set. This way, you can decide for each individual cookie whether you allow it or not. The procedure varies depending on the browser. It is best to search for instructions in Google with the search term "delete cookies Chrome" or "disable cookies Chrome" in the case of a Chrome browser.
Since 2009, there have been the so-called "cookie directives". These state that the storage of cookies requires your consent (Article 6(1)(a) GDPR). Within EU countries, however, there are still very different responses to these directives. In Austria, this directive was implemented in § 165(3) of the Telecommunications Act (2021). In Germany, the cookie directives were not implemented as national law. Instead, this directive was largely implemented in § 15(3) of the Telemedia Act (TMG).
For strictly necessary cookies, even without consent, there are legitimate interests (Article 6(1)(f) GDPR), which in most cases are of an economic nature. We want to provide visitors to the website with a pleasant user experience, and certain cookies are often absolutely necessary for this.
Web Hosting Summary
👥 Affected parties: Visitors to the website
🤝 Purpose: Professional hosting of the website and securing operations
📓 Data processed: IP address, time of website visit, browser used, and other data. More details can be found below or from the respective web hosting provider.
📅 Storage duration: Depends on the respective provider, but usually 2 weeks
⚖️ Legal bases: Art. 6(1)(f) GDPR (Legitimate interests)
When you visit websites today, certain information – including personal data – is automatically created and stored, including on this website. This data should be processed as sparingly as possible and only with justification. By website, we mean the entirety of all web pages on a domain, i.e. everything from the home page to the very last sub-page (like this one). By domain, we mean, for example, example.com or sample-example.com.
If you want to view a website on a computer, tablet, or smartphone, you use a program called a web browser. You probably know some web browsers by name: Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple Safari. We call them browsers or web browsers for short.
To display the website, the browser must connect to another computer where the website's code is stored: the web server. Operating a web server is a complicated and time-consuming task, which is why it is usually done by professional providers. These offer web hosting and thus ensure reliable and error-free storage of website data. A lot of technical terms, but please bear with us – it gets better!
When your computer's browser (desktop, laptop, tablet, or smartphone) connects and during data transfer to and from the web server, personal data may be processed. On the one hand, your computer stores data; on the other hand, the web server must also store data for a period of time to ensure proper operation.
A picture is worth a thousand words, so the following graphic illustrates the interplay between the browser, the internet, and the hosting provider.
The purposes of data processing are:
Even while you are visiting our website right now, our web server – the computer on which this website is stored – usually automatically stores data such as
As a rule, the above-mentioned data is stored for two weeks and then automatically deleted. We do not pass on this data, but cannot rule out that this data may be viewed by authorities in the event of unlawful behaviour.
In short: Your visit is logged by our provider (the company that runs our website on special computers (servers)), but we do not share your data without consent!
The lawfulness of the processing of personal data in the context of web hosting results from Art. 6(1)(f) GDPR (safeguarding of legitimate interests), as the use of professional hosting with a provider is necessary to present the company on the internet securely and in a user-friendly manner, and to be able to pursue attacks and claims arising therefrom if necessary.
Between us and the hosting provider, there is generally a contract for order processing in accordance with Art. 28 f. GDPR, which ensures compliance with data protection and guarantees data security.
👥 Affected parties: Visitors to the website
🤝 Purpose: Website storage and accessibility on the internet
📓 Data processed: IP address, but also technical data
📅 Storage duration: Visitor data is deleted after 8 weeks
⚖️ Legal bases: Art. 6(1)(f) GDPR (Legitimate interests)
To host our website, we use the web hosting services of IONOS by 1&1. In Germany, 1&1 IONOS SE is headquartered at Elgendorfer Str. 57, 56410 Montabaur. In Austria, you can find 1&1 IONOS SE at Gumpendorfer Straße 142/PF 266, 1060 Vienna.
IONOS offers the following services related to web hosting: Domain, Website & Shop, Hosting & WordPress, Marketing, Email & Office, IONOS Cloud, and Servers. With over 22 million domains, nearly 9 million customer contracts, and 100,000 servers, IONOS is one of the largest German web hosting providers.
As we mentioned in our introductory words on web hosting: through hosting, data from you and your device is also stored on the IONOS servers. First and foremost, your IP address, which is known to be personal data, is stored. In addition, technical data such as the URL of our website, the name of the internet browser, or which operating system you use is also stored.
IONOS was founded in Germany in 1988 and thus has over 30 years of experience. However, this does not mean that the company has not continuously evolved in technological terms. It is precisely this combination of experience and innovation that provides, in our view, a good foundation for our website. After all, we want our website to function smoothly 24 hours a day while ensuring a high level of security. Since IONOS does not limit monthly data traffic and provides plenty of storage space, our website remains powerful even with many visitors. We are very satisfied with the speed of the website, and the price-performance ratio currently meets our requirements.
1&1 IONOS Web Hosting may also process your personal data. When you visit our website, the following data from you or your computer is stored at IONOS:
The collected data is used to increase the security of the website, detect possible errors, and to carry out anonymous statistical analyses. According to IONOS, the anonymised IP address is only used to determine the location of access.
The data is stored on IONOS's own servers. In principle, IONOS stores the data for as long as is necessary to fulfil its obligations. Visitor data is stored for 8 weeks. However, it may also happen that data is stored for longer, for example, to have evidence for possible legal disputes. Visitor data is not passed on to third parties and is not transferred to a country outside the EU.
You have the right to access, correct, delete, and restrict the processing of your personal data at any time. You can also revoke your consent to data processing at any time. If you fundamentally want to deactivate, delete, or manage cookies, you can find the corresponding links to the instructions for the most popular browsers in the "Cookies" section.
From our side, there is a legitimate interest in using IONOS to be able to offer our online service. Professional hosting with a provider is necessary to present our company securely and in a user-friendly manner on the internet and to be able to pursue possible cyberattacks. The corresponding legal basis is Art. 6(1)(f) GDPR (Legitimate interests). You can find much more information about data protection at IONOS in the privacy policy at https://www.ionos.de/terms-gtc/datenschutzerklaerung/. If you have further questions about data protection, you can also contact the IONOS data protection team by email at datenschutz@ionos.de.
We have concluded a data processing agreement (DPA) with IONOS within the meaning of Article 28 of the General Data Protection Regulation (GDPR). What a DPA is and, above all, what must be contained in a DPA, you can read in our general section "Data Processing Agreement (DPA)". This contract is required by law because IONOS processes personal data on our behalf. It clarifies that IONOS may only process data it receives from us according to our instructions and must comply with the GDPR. You can find the link to the data processing agreement (DPA) at https://www.ionos.de/hilfe/datenschutz/allgemeine-informationen-zur-datenschutz-grundverordnung-dsgvo/auftragsverarbeitung/.
All texts are protected by copyright.
Source: Created with the Privacy Policy Generator by AdSimple
