Privacy policy

Last updated: September 2, 2026

English translation. This translation is provided for convenience only. In case of any discrepancy, the German version is the legally binding one: read the German original.

1. General information

We are pleased that you are visiting our website and thank you for your interest in our company and our products. We would like to take this opportunity to inform you which data we collect, when we collect it, how we use and process it, and how we handle your personal data.

The following notes provide a straightforward overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. For detailed information on the subject of data protection, please refer to the privacy policy set out below this text.

2. Data collection on this website

Personal data is information by means of which a person can be identified as such. This includes, for example, your name, your address, your email address or your telephone number.

(1) Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section “Information on the controller” in this privacy policy.

(2) Collection of personal data when using the website

Your data is collected, on the one hand, by you providing it to us. This may, for example, be data you enter into a contact form.

Other data is collected automatically, or with your consent, by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter this website.

Where you use the website purely for information — that is, where you do not register or otherwise transmit information to us — we collect only the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us in order to display our website to you and to ensure stability and security:

IP address
date and time of the request
time zone difference from Greenwich Mean Time (GMT)
content of the request (the specific page)
access status / HTTP status code
the volume of data transferred in each case
the website from which the request comes
browser
operating system and its interface
language and version of the browser software.
The legal basis for storing this data is Art. 6 (1) (f) GDPR.

(3) Collection of personal data on registration

We offer you the opportunity to register on our website or app by providing personal data.

Depending on the type of contract concluded, we store the following data:

surname, first name
address
billing address
email address
telephone number

The data is entered into an input form, transmitted to us and stored. The data is not passed on to third parties. Users can access their user account in order to place an order via the app.

As part of the registration process, the user’s consent to the processing of this data was obtained, Art. 6 (1) (a) GDPR. Registration is also necessary for the performance of a contract for the purchase of goods in our online shop, or for the implementation of pre-contractual measures, Art. 6 (1) (b) GDPR. The data collected serves to enable us to process the purchase of goods in our online shop.

The data is deleted as soon as it is no longer necessary for the purpose for which it was collected. This is the case when the registration on our website is cancelled or changed, or when the data is no longer required for the performance of the contract. Even after a contract has been concluded, it may still be necessary to store the contracting party’s personal data in order to comply with contractual or statutory obligations (for tax reasons, for example).

Users have the option of cancelling their registration at any time. You can have the data stored about you changed at any time, as follows:

Insofar as the data is required for the performance of a contract or for the implementation of pre-contractual measures, early deletion of the data is only possible where no contractual or statutory obligations prevent deletion.

The legal basis for processing the data is Art. 6 (1) (a) GDPR in the case of your consent and, where registration serves the performance of a contract with you or the implementation of pre-contractual measures, additionally Art. 6 (1) (b) GDPR.

(4) What do we use your data for?

Some of the data is collected in order to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour.

(5) What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have a right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw that consent at any time with effect for the future. You also have the right, in certain circumstances, to request the restriction of the processing of your personal data. You also have a right to lodge a complaint with the competent supervisory authority.

You can contact us at any time regarding this and any further questions on the subject of data protection.

3. Data collection in the Lab Mate app

The following information describes the processing of personal data when installing and using the Lab Mate mobile application. It also explains the choices you have with regard to your personal data.

(1) Processing of data when downloading the app:

By downloading our app you have identified yourself to the respective App Store or Google Play Store, e.g. via your ID. Lab Mate cannot rule out the possibility that Apple or Google may use the data collected in connection with the download or use of the applications in a way that does not comply with the EU General Data Protection Regulation (GDPR). Lab Mate has no influence over this. Lab Mate does not pass any data on to Apple or Google. Before downloading, or before first use, you are informed of the permissions the app requires and you consent to them when you download the app or agree to its use. These permissions can be deactivated at any time under “Settings”:

display notifications
access all networks
retrieve network connections
disable sleep mode
control vibration alert
read the number of new notifications
receive internet data
permission for advertising ID
Play Install Referrer API
run foreground service
Google Play billing service
Google Play licence check
run at start-up

(2) Processing of data when using the app: Certain data is collected automatically by Lab Mate IT systems when the app is used. This is primarily technical data (e.g. mobile device, operating system, or time and usage). This data is collected automatically as soon as you use the app, and is collected pursuant to Art. 6 (1) (b) and (f) GDPR respectively in order to enable use of the app as well as analysis and troubleshooting. The following data may be processed:

type of mobile device
operating system used
language used
technical information about the device used
date and time of the request
IP address
current geo-coordinates of the mobile device (for analytics only)

(3) Push notifications: You can sign up to receive what are known as push notifications. For this we use the service “CleverPush”, operated by CleverPush GmbH, Brauhausstraße 15A, 22041 Hamburg (“CleverPush”).

Via our push notifications you regularly receive information about news, discount campaigns, prize draws and more.

To sign up for push notifications you must confirm your browser’s or device’s prompt to receive notifications. This process is documented and stored by CleverPush. For this purpose the time of registration as well as a push token or device ID is stored. This data serves, on the one hand, to enable us to send you the push notifications and, on the other, as evidence of your registration. The legal basis for this processing is your consent and therefore Art. 6 (1) (a) GDPR.

CleverPush also evaluates our push notifications statistically. CleverPush can thus determine whether and when our push notifications were displayed and clicked. This enables us to establish which push notifications are of interest to recipients, in order to tailor future messages to the presumed interests of all recipients and thereby increase interest in what we offer. In addition to the push token or device ID, we also store the app’s subject area on which the push notifications were activated (e.g. business, sport, etc.). We likewise use this information in order to send push notifications to the relevant subscribers that are in their presumed interest. The legal basis for the processing is in each case Art. 6 (1) (f) GDPR. A push token or device ID is assigned to a specific person only where we should be legally obliged to do so, to defend against claims brought against us where this is required as evidence, and for the possible prosecution of legal violations.

You can withdraw your consent to the storage and use of your personal data for the receipt of our push notifications at any time with effect for the future. Withdrawing consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal. You may furthermore object at any time to the use of personal data described above on the basis of Art. 6 (1) (f). For this purpose please withdraw your consent. You can withdraw consent in the settings provided for the receipt of push notifications in the settings of your device or browser.

Your data is deleted as soon as it is no longer necessary for the purpose for which it was collected. Your data is therefore stored for as long as the subscription to our push notifications is active.

The unsubscribe process is explained in detail at the following link: https://cleverpush.com/faq.

To accelerate the retrieval of content (e.g. images) and to defend against attacks, CleverPush uses the services of cloudflare.com, a service of Cloudflare, Inc., under a processing agreement on the basis of the standard contractual clauses.

CleverPush does not store any data containing personal data on Cloudflare’s servers, only general content such as text or images. When this content is retrieved, the device you are using establishes a connection to Cloudflare, and the IP address of the device you are using is thereby processed.

Further information on the use of your personal data by CleverPush can be found at https://cleverpush.com/de/gdpr/.

(4) Tracking tools: The app uses various tracking and analysis tools. The data processing is in each case carried out on the basis of your consent pursuant to Art. 6 (1) sentence 1 (a) GDPR. Transfer to a third country takes place on the basis of Art. 49 (1) (a) GDPR. You can prevent the use of this tool via our consent tool and withdraw consent you have given at any time.

Google Analytics for Firebase and Google Play Store Analytics The app uses the technologies Google Analytics for Firebase and Google Play Store Analytics of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Firebase”). For the European area, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for all Google services. Google Analytics uses what are known as “cookies”, text files that are stored on your computer and that enable an analysis of your use of the website. The information generated by the cookies about your use of this website is generally transferred to a Google server in the USA and stored there. Where IP anonymisation is activated on this website, however, your IP address will first be truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and truncated there. As a matter of principle, an adequate level of data protection cannot be assumed in the USA. There is a risk that authorities may access the data for security and surveillance purposes without you being informed of this or being able to bring legal remedies. Further information on the Google Analytics privacy policies can be found at https://support.google.com/analytics/answer/6004245?sjid=3364535034656199429-EU.

Apple App Store Analytics

The app uses the Apple App Store Analytics technology of Apple Inc., One Apple Park Way, Cupertino, 95014 California, USA.

Apple may make statistics about your use of the app available to its partners and third-party developers. This serves Apple in the further development of its apps, products and services. The analysis data and statistics are aggregated or are transmitted in a form that does not allow any conclusions to be drawn about you personally.

You have the option of not sending any data on app usage to third-party app developers. To do so, open Settings, select “Privacy & Security”, tap “Analytics & Improvements” and then deactivate the “Share with App Developers” option. If “Share iPhone & Watch Analytics” is deactivated, the sharing of data on crashes and other statistics on your use of apps with third-party app developers is automatically deactivated.

Further information on Apple’s privacy policies can be found at www.apple.com/privacy.

(5) Orders via our website or the app In order to be able to place orders via our websites or via our app, the user must enter certain personal data, namely the following data: name, address, and where applicable payment data (credit card details). This data is stored by us and used exclusively for the purpose of processing the order. In addition, the following data is stored automatically: IP address, date and time of registration.

Data is only passed on to third parties if and to the extent that this is necessary for the proper processing of an order and of the purchase contract concluded.

PayPal:

Our online shop allows payment via PayPal. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If you pay with PayPal, the payment data you enter is transmitted to PayPal.

The transmission of your data to PayPal takes place on the basis of Art. 6 (1) (a) GDPR (consent) and Art. 6 (1) (b) GDPR (processing for the performance of a contract). You may withdraw consent you have already given at any time. Data processing operations that took place in the past remain effective in the event of withdrawal.

Stripe:

In order to enable you to pay via Stripe, your personal data (contact and delivery data) may be transmitted to Stripe. This is necessary so that Stripe can check your eligibility to use the payment method. Personal data transmitted to Stripe is processed in accordance with Stripe’s privacy policies.

General information and mandatory disclosures

(1) Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection provisions and with this privacy policy.

When you use this website, various items of personal data are collected. Personal data is data by which you can be personally identified. This privacy policy explains which data we collect and what we use it for. It also explains how and for what purpose this happens.

We point out that data transmission over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

(2) Information on the controller

The controller for data processing on this website is:

Lab Mate Nelly-Sachs-Str. 24 73760 Ostfildern, Germany

Telephone: +49 711 255 191 35 Email: [email protected]

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses or similar).

(3) Storage period

Unless a more specific storage period has been stated within this privacy policy, your personal data remains with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or withdraw consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once those grounds cease to apply.

(4) General information on the legal bases for data processing on this website

Insofar as you have consented to the data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR where special categories of data pursuant to Art. 9 (1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, the data processing is additionally carried out on the basis of Art. 49 (1) (a) GDPR. Insofar as you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), the data processing is additionally carried out on the basis of section 25 (1) TTDSG. Consent can be withdrawn at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 (1) (b) GDPR. We furthermore process your data where this is necessary for compliance with a legal obligation, on the basis of Art. 6 (1) (c) GDPR. Data processing may also be carried out on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The legal bases applicable in each individual case are set out in the following paragraphs of this privacy policy.

(5) Information on data transfer to the USA and other third countries

We use, among other things, tools of companies based in the USA or other third countries that are not secure under data protection law. When these tools are active, your personal data may be transferred to and processed in these third countries. We point out that no level of data protection comparable to that of the EU can be guaranteed in these countries. US companies, for example, are obliged to hand over personal data to security authorities without you as the data subject being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. intelligence services) process, evaluate and permanently store your data held on US servers for surveillance purposes. We have no influence over these processing activities.

(6) Withdrawal of your consent to data processing

Many data processing operations are only possible with your explicit consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out up to the point of withdrawal remains unaffected by the withdrawal.

(7) Right to object to data collection in particular cases and to direct marketing (Art. 21 GDPR)

Where the processing of your personal data is carried out on the basis of Art. 6 (1) (e) or (f) GDPR, you have the right at any time to object to the processing of your data on grounds relating to your particular situation. This also applies to profiling based on these provisions. The legal basis on which the processing is carried out can be found in this privacy policy.

In the event of an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. Alternatively, the processing may serve the establishment, exercise or defence of legal claims (objection pursuant to Art. 21 (1) GDPR).

If your personal data is used for direct marketing, you have the right to object at any time to the processing of your data for that purpose. This also applies to profiling insofar as it is connected with direct marketing. Following an objection, your personal data will no longer be used for direct marketing (objection pursuant to Art. 21 (2) GDPR).

(8) Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work or the place of the alleged infringement. This right to complain is without prejudice to any other administrative or judicial remedy.

(9) Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place insofar as it is technically feasible.

(10) Information, correction and deletion

Within the framework of the applicable statutory provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to have this data corrected or deleted. You can contact us at any time regarding this and any further questions on the subject of personal data.

(11) Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us about this at any time. The right to restriction of processing exists in the following cases:

If you contest the accuracy of your personal data stored with us, we generally need time to check this. For the duration of that check, you have the right to request the restriction of the processing of your personal data.
If the processing of your personal data took place or is taking place unlawfully, you can request the restriction of the data processing instead of deletion.
If we no longer need your personal data, but you need it for the exercise, defence or establishment of legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balancing of your interests and ours must be carried out. As long as it has not yet been established whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may — apart from being stored — only be processed with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or on grounds of an important public interest of the European Union or a member state.

(12) SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the padlock symbol in your browser line.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

(13) Objection to advertising emails

The use of contact data published under the obligation to provide a legal notice for the purpose of sending unsolicited advertising and information material is hereby objected to. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for instance by spam emails.

(14) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies. These are small text files that your web browser receives when you visit our pages and stores on your computer. Some of the cookies are deleted again immediately after the browser is closed. Other cookies remain on your computer permanently and enable us to recognise you or your computer on your next visit to our website.

This site uses the following types of cookies, whose scope and functioning are explained below:

a) Transient cookies: these are deleted automatically when you close your browser. These include session cookies in particular. They store what is known as a session ID, by means of which the various requests from your browser can be assigned to the shared session. This allows your computer to be recognised when you return to our website. Session cookies are deleted when you log out or close the browser.

b) Persistent cookies: these are deleted automatically after a set period, which can differ depending on the cookie. You can delete cookies at any time in your browser’s security settings.

Cookies can originate from us (first-party cookies) or from third-party companies (known as third-party cookies). Third-party cookies enable certain services of third-party companies to be integrated within websites (e.g. cookies for handling payment services).

You can influence the use of cookies by changing the settings of your browser. Most browsers have an option with which the storage of cookies can be restricted or prevented. Every browser is individual in the way it manages cookie settings. This is described in the help menu of the browser in question.

You can find this for the respective browsers at the following links:

Internet Explorer: http://windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: http://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Safari: https://support.apple.com/kb/ph21411?locale=de_DE

Please note, however, that deactivating cookies may mean that only limited functions of the website are available to you.

The legal basis for the use of cookies is Art. 6 (1) (f) GDPR.

When cookies are used, a distinction must be drawn between strictly necessary cookies and those used for further purposes (measurement of access figures, advertising purposes). Via our consent manager you generally have the choice of accepting or rejecting all or some of the non-necessary cookies. If you opt for the latter, it is possible that you will not be able to use everything we offer. You can control and withdraw this consent via our consent management (also known as the “cookie banner” or “cookie settings”).

(15) Contact form

If you send us enquiries via the contact form, the details you provide in the enquiry form, including the contact details you give there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass this data on without your consent.

The processing of this data is carried out on the basis of Art. 6 (1) (b) GDPR where your enquiry is connected with the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases the processing is based on our legitimate interest in the effective handling of the enquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) where this was requested; consent can be withdrawn at any time.

The data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your enquiry has been dealt with). Mandatory statutory provisions — retention periods in particular — remain unaffected.

(16) Enquiry by email or telephone

If you contact us by email or telephone, your enquiry including all personal data arising from it (name, enquiry) will be stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent.

The data you send us by way of contact enquiries remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your request has been dealt with). Mandatory statutory provisions — statutory retention periods in particular — remain unaffected.

(1) Use of social media plug-ins

On our website we use what are known as social plugins (“plugins”) from Instagram, which is operated by Instagram LLC., 1601 Willow Road, Menlo Park, CA 94025, USA (“Instagram”).

In doing so we use what is known as the two-click solution. This means that when you visit our page, no personal data is initially passed on to Instagram as a matter of principle. The plug-in, in the form of images, carries the heading “Follow us on Instagram”. We give you the opportunity to communicate directly with Instagram via the button. Only if you click on the marked field and thereby activate it does Instagram receive the information that you have visited our website. In addition, the data referred to in section 1 of this statement is transmitted. By activating the plug-in, personal data about you is therefore transmitted to Instagram and stored there (in the case of US providers, in the USA).

We have no influence over the data collected and the data processing operations, nor are we aware of the full extent of the data collection, the purposes of the processing or the storage periods. We likewise have no information about the deletion of the collected data by Instagram.

Instagram stores the data collected about you as usage profiles and uses these for the purposes of advertising, market research and/or the demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) in order to display demand-oriented advertising and to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles, whereby you must contact Instagram in order to exercise it.

For further information on the purpose and scope of the data collection and the further processing and use of the data by Instagram, as well as your rights in this respect and the settings available to protect your privacy, please refer to Instagram’s privacy notices: https://help.instagram.com/155833707900388/.

If you do not wish Instagram to assign the data collected via our web presence directly to your Instagram account, you must log out of Instagram before visiting our website. You can also block the loading of the Instagram plugins entirely with add-ons for your browser, for example with the script blocker “NoScript” (http://noscript.net/).

The legal basis for the use of the plug-ins is Art. 6 (1) sentence 1 (f) GDPR.

(2) Social media Shariff

Elements of social media are used on this website (e.g. Facebook, Twitter, Instagram, Pinterest, XING, LinkedIn, Tumblr).

You can generally recognise the social media elements by the respective social media logos. In order to ensure data protection on this website, we use these elements only together with what is known as the “Shariff” solution. This application prevents the social media elements integrated into this website from transmitting your personal data to the respective provider as soon as you first enter the page.

Only when you activate the respective social media element by clicking the associated button is a direct connection to the provider’s server established (consent). As soon as you activate the social media element, the respective provider receives the information that you have visited this website with your IP address. If you are simultaneously logged into your respective social media account (e.g. Facebook), the respective provider can assign the visit to this website to your user account.

Activating the plugin constitutes consent within the meaning of Art. 6 (1) (a) GDPR and section 25 (1) TTDSG. You can withdraw this consent at any time with effect for the future.

The service is used in order to obtain the legally required consents for the use of certain technologies. The legal basis for this is Art. 6 (1) (c) GDPR.

(3) Facebook

Elements of the social network Facebook are integrated into this website. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, however, the data collected is also transferred to the USA and to other third countries.

You can find an overview of the Facebook social media elements here: https://developers.facebook.com/docs/plugins/?locale=de_DE.

When the social media element is active, a direct connection is established between your device and the Facebook server. Facebook thereby receives the information that you have visited this website with your IP address. If you click the Facebook “Like” button while you are logged into your Facebook account, you can link the content of this website to your Facebook profile. Facebook can thereby assign the visit to this website to your user account. We point out that we, as the provider of the pages, receive no knowledge of the content of the transmitted data or of its use by Facebook. You can find further information on this in Facebook’s privacy policy at: https://de-de.facebook.com/privacy/explanation.

Insofar as consent has been obtained, the above-mentioned service is used on the basis of Art. 6 (1) (a) GDPR and section 25 TTDSG. Consent can be withdrawn at any time. Insofar as no consent has been obtained, the service is used on the basis of our legitimate interest in the widest possible visibility on social media.

Insofar as personal data is collected on our website and forwarded to Facebook with the help of the tool described here, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). This joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook. The processing carried out by Facebook after the transfer is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. You can find the wording of the agreement at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when using the Facebook tool and for implementing the tool on our website in a manner that is secure under data protection law. Facebook is responsible for the data security of the Facebook products. You can assert data subject rights (e.g. requests for information) in respect of the data processed by Facebook directly with Facebook. If you assert data subject rights with us, we are obliged to forward them to Facebook.

The transfer of data to the USA is based on the European Commission’s standard contractual clauses. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://de-de.facebook.com/help/566994660333381 and https://www.facebook.com/policy.php.

(4) Twitter

Functions of the Twitter service are integrated into this website. These functions are offered by Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland.

When the social media element is active, a direct connection is established between your device and the Twitter server. Twitter thereby receives information about your visit to this website. By using Twitter and the “Re-Tweet” function, the websites you visit are linked to your Twitter account and made known to other users. We point out that we, as the provider of the pages, receive no knowledge of the content of the transmitted data or of its use by Twitter. You can find further information on this in Twitter’s privacy policy at: https://twitter.com/de/privacy.

The transfer of data to the USA is based on the European Commission’s standard contractual clauses. You can find details here: https://gdpr.twitter.com/en/controller-to-controller-transfers.html.

You can change your privacy settings at Twitter in your account settings at https://twitter.com/account/settings.

(5) Instagram

Functions of the Instagram service are integrated into this website. These functions are offered by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

When the social media element is active, a direct connection is established between your device and the Instagram server. Instagram thereby receives information about your visit to this website.

If you are logged into your Instagram account, you can link the content of this website to your Instagram profile by clicking the Instagram button. Instagram can thereby assign the visit to this website to your user account. We point out that we, as the provider of the pages, receive no knowledge of the content of the transmitted data or of its use by Instagram.

Insofar as personal data is collected on our website and forwarded to Facebook or Instagram with the help of the tool described here, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). This joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook or Instagram. The processing carried out by Facebook or Instagram after the transfer is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in a joint processing agreement. You can find the wording of the agreement at: https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when using the Facebook or Instagram tool and for implementing the tool on our website in a manner that is secure under data protection law. Facebook is responsible for the data security of the Facebook and Instagram products. You can assert data subject rights (e.g. requests for information) in respect of the data processed by Facebook or Instagram directly with Facebook. If you assert data subject rights with us, we are obliged to forward them to Facebook.

The transfer of data to the USA is based on the European Commission’s standard contractual clauses. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875 and https://de-de.facebook.com/help/566994660333381.

You can find further information on this in Instagram’s privacy policy: https://instagram.com/about/legal/privacy/.

(6) Remarketing/retargeting

On our web pages we use “Custom Audiences” of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”) for the purposes of retargeting or remarketing. This service uses what are known as tracking or remarketing pixels. These are pixel image files that enable a log file analysis. Through the use of the pixels, the service provider can see when and how many users called up the pixel, or whether and when an email was opened or a website visited.

With the help of this service, users of the website can be shown interest-based advertisements (“Facebook ads”) while visiting the social network Facebook or other websites that likewise use the procedure. In doing so we pursue the interest of showing you advertising that is of interest to you, in order to make our website more interesting for you. When you visit our web page, a direct connection to Facebook’s servers is established via the pixel. Facebook is thereby put in a position to identify you by means of the browser ID, since this can be linked to your user account. We have no influence over the scope and further use of the data collected by Facebook through the use of this tool and therefore inform you in accordance with our state of knowledge: by integrating Facebook Custom Audiences, Facebook receives the information that you have called up the relevant page of our web presence, or clicked on an advertisement of ours. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered with Facebook or are not logged in, it is possible that the provider will find out and store your IP address and other identifying characteristics.

Deactivation of the “Facebook Custom Audiences” function is possible for logged-in users at https://www.facebook.com/settings/?tab=ads#_.

(The legal basis for the processing of your data is Art. 6 (1) sentence 1 (f) GDPR. Further information on data processing by Facebook can be obtained at https://www.facebook.com/about/privacy/.

Right to object: If you do not wish to be shown advertising generated by the respective targeting service, you can object to the use of retargeting technology on our web pages by sending us a message to [email protected].

(7) WhatsApp

For sending newsletters we use the instant messaging service WhatsApp Business of WhatsApp LLC, 1601 Willow Road, Menlo Park, California 94025, USA, via the service provider Charles GmbH, Gartenstr. 86-87, 10115 Berlin.

Registration for the WhatsApp newsletter takes place using the double opt-in procedure. After you register via a CTA or QR code, you will be sent a message asking you to confirm that you would like to receive messages from us via WhatsApp. If you no longer wish to receive messages, you can withdraw your consent at any time and unsubscribe from the newsletter using a keyword specified by us.

The only mandatory detail for sending the newsletter is your telephone number. After your confirmation, your telephone number is forwarded to our service provider Charles GmbH for the purpose of sending the newsletter and is processed and stored there. The legal basis is Art. 6 (1) sentence 1 (a) GDPR.

If you communicate with us via WhatsApp, certain data that you share with the app is stored and processed by WhatsApp. This is in particular information provided by the user such as messages, photos, videos, billing data and stored profile pictures. WhatsApp states that it stores this data only end-to-end encrypted. Some metadata is collected by WhatsApp unencrypted. This includes telephone number, location, IP address, information about your device, the type and frequency of app usage, location and information about the time and recipient of the messages you send. According to WhatsApp’s privacy policy, this information is sometimes shared with other Meta companies, which include Facebook and Instagram, based in the USA. In some cases such data is also shared with external companies, service providers or partners.

The data processing may also take place in the USA. In the view of the Court of Justice of the European Union, no adequate level of data protection can currently be assumed in the USA as a matter of principle.

As the basis for the processing or transfer of data to countries outside the EU, WhatsApp uses what are known as standard contractual clauses pursuant to Art. 46 (2) and (3) GDPR (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de). Through these clauses WhatsApp undertakes to comply with the EU data protection standard when processing your data, even where the data is transferred to third countries such as the USA and processed and stored there. You can find more on this in WhatsApp’s privacy policy at https://www.whatsapp.com/legal/privacy-policy-eea/?locale=de_DE.

(8) Emails

For sending emails we use the service provider HubSpot Inc., 25 First Street, Cambridge, MA 02141 USA. This applies to transactional emails such as order confirmations and dispatch confirmations, emails with promotional content and newsletters.

HubSpot has access to your data in the process. The data processing may also take place in the USA. In the view of the Court of Justice of the European Union, no adequate level of data protection can currently be assumed in the USA as a matter of principle.

As the basis for the processing or transfer of data to countries outside the EU, HubSpot uses what are known as standard contractual clauses pursuant to Art. 46 (2) and (3) GDPR (https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de). Through these clauses HubSpot undertakes to comply with the EU data protection standard when processing your data, even where the data is transferred to third countries such as the USA and processed and stored there. You can find more on this on HubSpot’s pages at https://legal.hubspot.com/privacy-policy

(6) Analysis tools

(1) Google Analytics 4

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use it exclusively for reach measurement: to see which pages are called up, for how long, and by which route visitors come to us.

Google Analytics is only loaded after you have consented in the cookie notice. Before your consent, no script is loaded from Google and no data is transmitted to Google. If you decline or make no decision, measurement does not take place at all; the website remains usable without restriction.

After your consent, Google Analytics sets the cookies _ga and _ga_T8R8SCEQPQ, each with a lifetime of two years. What is recorded is in particular the pages called up, time spent, approximate location on the basis of the truncated IP address, device type, browser and operating system, and the previously visited page. Google Analytics 4 truncates IP addresses as a matter of principle before any storage; a complete IP address is not stored.

In addition we measure three events without any personal reference: the successful submission of the contact form, signing up for early access, and the opening of an FAQ question. They tell us whether the site is serving its purpose, and contain none of the content you enter.

The legal basis is exclusively your consent pursuant to Art. 6 (1) (a) GDPR and section 25 (1) TDDDG. You can withdraw it at any time with effect for the future — via “Cookie settings” in the footer of every page. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

Advertising functions are switched off. We use Google’s consent mode; the consent signals for ad_storage, ad_user_data and ad_personalization are permanently set to “denied” — even where you consent to measurement. Google Signals are deactivated in our property. Neither cross-device consolidation nor advertising or retargeting processing takes place, and we pass no data on to Google advertising products.

Third-country transfer: Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR additionally apply. Insofar as a transfer takes place beyond that, we base it on your explicit consent pursuant to Art. 49 (1) (a) GDPR. In the view of the Court of Justice of the European Union, a level of data protection corresponding in every respect to EU standards cannot be guaranteed in the USA; in particular, access by US authorities cannot be ruled out.

A data processing agreement pursuant to Art. 28 GDPR is in place with Google. The data collected is deleted automatically after 14 months.

Further information: Google’s privacy policy and Google Analytics terms of service.

(1) Newsletter data

If you would like to receive the newsletter offered on the website, we require an email address from you as well as information that allows us to verify that you are the owner of the email address given and that you agree to receive the newsletter. No further data is collected, or only on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties.

The processing of the data entered into the newsletter registration form is carried out exclusively on the basis of your consent (Art. 6 (1) (a) GDPR). You can withdraw the consent given to the storage of the data, the email address and its use for sending the newsletter at any time, for instance via the “unsubscribe” link in the newsletter. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.

The data you deposit with us for the purpose of receiving the newsletter is stored by us or by the newsletter service provider until you unsubscribe from the newsletter and is deleted from the newsletter distribution list after you unsubscribe or after the purpose ceases to apply. We reserve the right to delete or block email addresses from our newsletter distribution list at our own discretion within the framework of our legitimate interest pursuant to Art. 6 (1) (f) GDPR.

Data stored with us for other purposes remains unaffected by this.

After you unsubscribe from the newsletter distribution list, your email address may be stored by us or by the newsletter service provider on a blacklist, insofar as this is necessary to prevent future mailings. The data from the blacklist is used only for this purpose and is not merged with other data. This serves both your interest and our interest in complying with the statutory requirements when sending newsletters (legitimate interest within the meaning of Art. 6 (1) (f) GDPR). Storage on the blacklist is not limited in time. You can object to the storage insofar as your interests outweigh our legitimate interest.

(8) Plugins and tools

(1) YouTube with extended data protection

This website embeds videos from the YouTube website. The operator of the pages is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

We use YouTube in extended data protection mode. According to YouTube, this mode has the effect that YouTube stores no information about visitors to this website before they watch the video. The passing on of data to YouTube partners is not, however, necessarily excluded by the extended data protection mode. YouTube establishes a connection to the Google DoubleClick network regardless of whether you watch a video.

As soon as you start a YouTube video on this website, a connection to YouTube’s servers is established. The YouTube server is thereby informed which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account.

Furthermore, after a video has been started, YouTube may store various cookies on your device or use comparable recognition technologies (e.g. device fingerprinting). In this way YouTube can obtain information about visitors to this website. This information is used, among other things, to compile video statistics, to improve user-friendliness and to prevent attempts at fraud.

Where applicable, further data processing operations over which we have no influence may be triggered after a YouTube video is started.

YouTube is used in the interest of an appealing presentation of what we offer online. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. Insofar as corresponding consent was requested, the processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and section 25 (1) TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be withdrawn at any time.

You can find further information on data protection at YouTube in their privacy policy at: https://policies.google.com/privacy.

(2) Google Fonts

For the uniform display of typefaces, this site uses what are known as Google Fonts, which are provided by Google. When a page is called up, your browser loads the required fonts into its browser cache in order to display texts and typefaces correctly.

For this purpose the browser you use must establish a connection to Google’s servers. Google thereby learns that this website was called up via your IP address. Google Fonts is used on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the uniform presentation of the typeface on their website. Insofar as corresponding consent was requested, the processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and section 25 (1) TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be withdrawn at any time.

If your browser does not support Google Fonts, a standard font from your computer is used.

You can find further information on Google Fonts at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://policies.google.com/privacy.

(3) Font Awesome

For the uniform display of typefaces and symbols, this site uses Font Awesome. The provider is Fonticons, Inc., 6 Porter Road Apartment 3R, Cambridge, Massachusetts, USA.

When a page is called up, your browser loads the required fonts into its browser cache in order to display texts, typefaces and symbols correctly. For this purpose the browser you use must establish a connection to Font Awesome’s servers. Font Awesome thereby learns that this website was called up via your IP address. Font Awesome is used on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in the uniform presentation of the typeface on our website. Insofar as corresponding consent was requested, the processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and section 25 (1) TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be withdrawn at any time.

If your browser does not support Font Awesome, a standard font from your computer is used.

You can find further information on Font Awesome in Font Awesome’s privacy policy at: https://fontawesome.com/privacy.

(4) Google Maps

This site uses the map service Google Maps. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

In order to use the functions of Google Maps it is necessary to store your IP address. This information is generally transferred to a Google server in the USA and stored there. The provider of this site has no influence over this data transfer. When Google Maps is activated, Google may use Google Fonts for the purpose of the uniform display of typefaces. When Google Maps is called up, your browser loads the required web fonts into its browser cache in order to display texts and typefaces correctly.

Google Maps is used in the interest of an appealing presentation of what we offer online and of making the locations we indicate on the website easy to find. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. Insofar as corresponding consent was requested, the processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and section 25 (1) TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be withdrawn at any time.

The transfer of data to the USA is based on the European Commission’s standard contractual clauses. You can find details here: https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

You can find more information on the handling of user data in Google’s privacy policy: https://policies.google.com/privacy.

Our own services

(1) OneDrive

We have integrated OneDrive into this website. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (hereinafter “OneDrive”).

OneDrive enables us to integrate an upload area into our website in which you can upload content. If you upload content, it is stored on OneDrive’s servers. When you enter our website, a connection to OneDrive is also established, so that OneDrive can determine that you have visited our website.

OneDrive is used on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in a reliable upload area on their website. Insofar as corresponding consent was requested, the processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR; consent can be withdrawn at any time.

(2) Google Drive

We have integrated Google Drive into this website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Drive enables us to integrate an upload area into our website in which you can upload content. If you upload content, it is stored on Google Drive’s servers. When you enter our website, a connection to Google Drive is also established, so that Google Drive can determine that you have visited our website.

Google Drive is used on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in a reliable upload area on their website. Insofar as corresponding consent was requested, the processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR; consent can be withdrawn at any time.

(9) Data security

We have taken a large number of security measures to protect your personal data. Our servers and databases are protected by physical and technical measures, among others.

When collecting and transmitting data via our website we use standardised SSL encryption technology. Personal data is transmitted as part of the ordering process via SSL encryption, recognisable by the padlock symbol in the browser and by the addition of “https://” in the address bar.

With encrypted communication, the payment data you transmit to us cannot be read by third parties. With communication by email, 100 % data security cannot be guaranteed.

(1) Changes to this privacy policy

This privacy policy may be changed by us at any time. All changes to this privacy policy will be published on this website and will take effect automatically 30 days after their publication. We will inform you of material changes to this privacy policy by email.