This Privacy Policy informs you about the nature, scope, and purpose of the processing of personal data (hereinafter referred to as “data”) within our online offering and the websites, functions, and content associated with it, as well as external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”). With regard to the terminology used, such as “processing” or “controller,” we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR). Types of data processed: Inventory data (e.g., names, addresses). Contact data (e.g., email, phone numbers). Content data (e.g., text entries, photographs, videos). Usage data (e.g., websites visited, interest in content, access times). Meta/communication data (e.g., device information, IP addresses).

Categories of data subjects Visitors and users of the online offering (hereinafter we also collectively refer to the data subjects as “users”). Purpose of processing Provision of the online offering, its functions, and content. Responding to contact inquiries and communication with users. Security measures. Reach measurement/marketing Terminology used “Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and encompasses practically any handling of data. “Pseudonymization” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures ensuring that the personal data are not attributed to an identified or identifiable natural person. “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. “Controller” means the natural or legal person, public authority, agency, or other body which alone or jointly with others determines the purposes and means of the processing of personal data. “Processor” means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller. Relevant legal bases In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. If the legal basis is not mentioned in the Privacy Policy, the following applies: The legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; the legal basis for processing for the performance of our services and the implementation of contractual measures as well as responding to inquiries is Art. 6(1)(b) GDPR; the legal basis for processing to fulfill our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing to safeguard our legitimate interests is Art. 6(1)(f) GDPR. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis. Security measures In accordance with Art. 32 GDPR, taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. The measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical access to the data, as well as access to, input of, disclosure of, safeguarding of availability, and separation of the data. Furthermore, we have established procedures that ensure the exercise of data subject rights, deletion of data, and response to data risks. We also take the protection of personal data into account during the development and/or selection of hardware, software, and processes, in accordance with the principle of data protection by design and by default (Art. 25 GDPR). Cooperation with processors and third parties If, as part of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them, or otherwise grant them access to the data, this occurs only on the basis of a legal permission (e.g., if transmission of data to third parties, such as payment service providers, is necessary for contract performance pursuant to Art. 6(1)(b) GDPR), you have consented, a legal obligation provides for this, or on the basis of our legitimate interests (e.g., when using agents, web hosts, etc.). If we commission third parties to process data on the basis of a so-called “data processing agreement,” this is done on the basis of Art. 28 GDPR. Transfers to third countries If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or this occurs in the context of using third-party services or disclosure or transfer of data to third parties, this occurs only if it is necessary to fulfill our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation, or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have data processed in a third country only if the special requirements of Art. 44 et seq. GDPR are met. This means, for example, that processing occurs on the basis of special safeguards, such as an officially recognized determination of a level of data protection equivalent to that of the EU (e.g., for the USA through the “Privacy Shield”) or compliance with officially recognized special contractual obligations (so-called “Standard Contractual Clauses”). Rights of data subjects You have the right to request confirmation as to whether data concerning you is being processed and to obtain information about this data as well as further information and a copy of the data in accordance with Art. 15 GDPR. In accordance with Art. 16 GDPR, you have the right to request completion of the data concerning you or correction of inaccurate data concerning you. In accordance with Art. 17 GDPR, you have the right to request that data concerning you be deleted without undue delay, or alternatively, in accordance with Art. 18 GDPR, to request restriction of processing of the data. You have the right to request that the data concerning you that you have provided to us be received in accordance with Art. 20 GDPR and to request its transfer to other controllers. You also have the right pursuant to Art. 77 GDPR to lodge a complaint with the competent supervisory authority. Right of withdrawal You have the right to withdraw any consents given pursuant to Art. 7(3) GDPR with effect for the future. Right to object You may object at any time to the future processing of data concerning you in accordance with Art. 21 GDPR. The objection may in particular be made against processing for purposes of direct advertising. Cookies and right to object to direct advertising “Cookies” are small files that are stored on users’ computers. Different information may be stored within the cookies. A cookie primarily serves to store information about a user (or the device on which the cookie is stored) during or even after their visit within an online offering. Temporary cookies, or “session cookies” or “transient cookies,” are cookies that are deleted after a user leaves an online offering and closes their browser. In such a cookie, for example, the contents of a shopping cart in an online shop or a login status may be stored. “Permanent” or “persistent” cookies are cookies that remain stored even after the browser is closed. For example, the login status may be stored if users visit again after several days. Likewise, user interests may be stored in such a cookie and used for reach measurement or marketing purposes. “Third-party cookies” are cookies that are offered by providers other than the controller who operates the online offering (otherwise, if only the controller’s cookies are used, these are “first-party cookies”). We may use temporary and permanent cookies and explain this within the scope of this Privacy Policy. If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings. Excluding cookies may lead to functional restrictions of this online offering. A general objection to the use of cookies used for online marketing purposes can be declared for a large number of services, especially in the case of tracking, via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/ . Furthermore, the storage of cookies can be prevented by disabling them in the browser settings. Please note that in this case not all functions of this online offering may be available. Deletion of data The data processed by us will be deleted or restricted in processing in accordance with Art. 17 and 18 GDPR. Unless expressly stated otherwise within this Privacy Policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent deletion. If data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted. This means the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons. According to statutory requirements in Germany, retention takes place in particular for 10 years pursuant to Sections 147(1) AO, 257(1) Nos. 1 and 4, (4) HGB (books, records, management reports, accounting documents, trading books, documents relevant for taxation, etc.) and for 6 years pursuant to Section 257(1) Nos. 2 and 3, (4) HGB (commercial letters). According to statutory requirements in Austria, retention takes place in particular for 7 years pursuant to Section 132(1) BAO (accounting documents, receipts/invoices, accounts, receipts, business papers, statement of income and expenses, etc.), for 22 years in connection with real estate, and for 10 years for documents in connection with electronically supplied services, telecommunications, broadcasting and television services provided to non-entrepreneurs in EU Member States for which the Mini-One-Stop-Shop (MOSS) is used. Agency services We process our customers’ data within the scope of our contractual services, which include conceptual and strategic consulting, campaign planning, software and design development/consulting or maintenance, implementation of campaigns and processes/handling, server administration, data analysis/consulting services, and training services. In doing so, we process inventory data (e.g., customer master data, such as names or addresses), contact data (e.g., email, telephone numbers), content data (e.g., text entries, photographs, videos), contract data (e.g., subject matter of the contract, term), payment data (e.g., bank details, payment history), usage and meta data (e.g., in the context of evaluation and measurement of success of marketing measures). We generally do not process special categories of personal data unless they are part of commissioned processing. Data subjects include our customers, prospects, as well as their customers, users, website visitors, or employees, and third parties. The purpose of processing is the provision of contractual services, invoicing, and our customer service. The legal bases for processing arise from Art. 6(1)(b) GDPR (contractual services), Art. 6(1)(f) GDPR (analysis, statistics, optimization, security measures). We process data that is necessary for establishing and fulfilling contractual services and point out the necessity of providing such data. Disclosure to external parties occurs only if required as part of an assignment. When processing data provided to us as part of an assignment, we act in accordance with the instructions of the client and the statutory provisions of commissioned processing pursuant to Art. 28 GDPR and do not process the data for any purposes other than those of the assignment. We delete the data after expiration of statutory warranty and comparable obligations. The necessity of retaining the data is reviewed every three years; in the case of statutory archiving obligations, deletion occurs after their expiration (6 years pursuant to Section 257(1) HGB, 10 years pursuant to Section 147(1) AO). In the case of data disclosed to us by the client as part of an assignment, we delete the data in accordance with the requirements of the assignment, generally after the end of the assignment. Therapeutic services and coaching We process the data of our clients and prospects and other principals or contractual partners (collectively referred to as “clients”) in accordance with Art. 6(1)(b) GDPR in order to provide our contractual or pre-contractual services to them. The data processed in this context, the type, scope, and purpose, and the necessity of processing are determined by the underlying contractual relationship. The data processed generally includes inventory and master data of the clients (e.g., name, address, etc.), as well as contact data (e.g., email address, phone, etc.), contract data (e.g., services used, fees, names of contact persons, etc.), and payment data (e.g., bank details, payment history, etc.). Within the scope of our services, we may also process special categories of data pursuant to Art. 9(1) GDPR, in particular information regarding the health of clients, possibly with reference to their ethnic origin or religious or philosophical beliefs. For this purpose, where required, we obtain explicit consent from clients pursuant to Art. 6(1)(a), Art. 7, Art. 9(2)(a) GDPR and otherwise process the special categories of data for purposes of preventive health care on the basis of Art. 9(2)(h) GDPR, Section 22(1) No. 1(b) BDSG. If necessary for contract performance or required by law, we disclose or transmit the clients’ data in the context of communication with other professionals, to third parties necessarily or typically involved in contract performance, such as billing offices or comparable service providers, insofar as this serves the provision of our services pursuant to Art. 6(1)(b) GDPR, is required by law pursuant to Art. 6(1)(c) GDPR, serves our interests or the clients’ interests in efficient and cost-effective health care as a legitimate interest pursuant to Art. 6(1)(f) GDPR, or is necessary pursuant to Art. 6(1)(d) GDPR to protect vital interests of clients or another natural person, or on the basis of consent pursuant to Art. 6(1)(a), Art. 7 GDPR. Data is deleted when it is no longer necessary for fulfilling contractual or statutory duties of care and for dealing with any warranty and comparable obligations, whereby the necessity of retaining the data is reviewed every three years; otherwise, the statutory retention obligations apply. Administration, financial accounting, office organization, contact management We process data in the context of administrative tasks and organization of our operations, financial accounting, and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process in the course of providing our contractual services. The legal bases for processing are Art. 6(1)(c) GDPR, Art. 6(1)(f) GDPR. Data subjects affected include customers, prospects, business partners, and website visitors. The purpose and our interest in processing lie in administration, financial accounting, office organization, archiving of data—i.e., tasks that serve to maintain our business activities, perform our duties, and provide our services. Deletion of data with regard to contractual services and contractual communication corresponds to the information stated for those processing activities. We disclose or transmit data to the tax authorities, consultants, such as tax advisors or auditors, as well as other fee collection offices and payment service providers. Furthermore, on the basis of our business interests, we store information about suppliers, organizers, and other business partners, e.g., for later contact. These predominantly company-related data are generally stored on a permanent basis. Business analyses and market research In order to operate our business economically and to recognize market trends and the wishes of contractual partners and users, we analyze the data available to us regarding business transactions, contracts, inquiries, etc. We process inventory data, communication data, contract data, payment data, usage data, and metadata on the basis of Art. 6(1)(f) GDPR. Data subjects include contractual partners, prospects, customers, visitors, and users of our online offering. The analyses are carried out for the purpose of business evaluations, marketing, and market research. In doing so, we may take into account the profiles of registered users with information, e.g., about the services they have used. The analyses serve to increase user-friendliness, optimize our offering, and improve economic efficiency. The analyses serve only us and are not disclosed externally unless they are anonymous analyses with aggregated values. If these analyses or profiles are personal, they will be deleted or anonymized upon termination by users; otherwise, after two years from the conclusion of the contract. Otherwise, the overall business analyses and general trend determinations are created anonymously wherever possible. Participation in affiliate partner programs Within our online offering, on the basis of our legitimate interests (i.e., interest in analysis, optimization, and economic operation of our online offering) pursuant to Art. 6(1)(f) GDPR, we use industry-standard tracking measures insofar as these are necessary for the operation of the affiliate system. Below we inform users about the technical background. Services offered by our contractual partners may also be advertised and linked on other websites (so-called affiliate links or after-buy systems, e.g., when links or services of third parties are offered after a contract is concluded). The operators of the respective websites receive a commission if users follow the affiliate links and subsequently use the offers. In summary, it is necessary for our online offering that we can track whether users who are interested in affiliate links and/or the offers available with us subsequently use the offers as a result of the affiliate links or our online platform. For this purpose, the affiliate links and our offers are supplemented by certain values, which can be part of the link or set elsewhere, e.g., in a cookie. The values include in particular the originating website (referrer), time, an online identifier of the operator of the website on which the affiliate link was placed, an online identifier of the respective offer, an online identifier of the user, as well as tracking-specific values such as advertising material ID, partner ID, and categorizations. The online identifiers of users used by us are pseudonymous values. This means the online identifiers themselves do not contain personal data such as names or email addresses. They only help us determine whether the same user who clicked an affiliate link or was interested in an offer via our online offering actually used the offer, e.g., concluded a contract with the provider. However, the online identifier is personal insofar as the partner company and we have the online identifier together with other user data. Only in this way can the partner company inform us whether the user has used the offer and we can, for example, pay out the bonus. Amazon partner program On the basis of our legitimate interests (i.e., interest in the economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), we participate in the Amazon EU partner program, which was designed to provide a medium for websites through which advertising fees can be earned by placing advertisements and links to Amazon.de (so-called affiliate system). This means that as an Amazon partner we earn from qualifying purchases. Amazon uses cookies to track the origin of orders. Among other things, Amazon can recognize that you clicked the partner link on this website and subsequently purchased a product from Amazon. Further information on Amazon’s use of data and options to object can be found in the company’s Privacy Policy: https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010 . Note: Amazon and the Amazon logo are trademarks of Amazon.com, Inc. or one of its affiliates. Comments and posts If users leave comments or other posts, their IP addresses may be stored for 7 days on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. This is done for our security in case someone leaves unlawful content in comments and posts (insults, prohibited political propaganda, etc.). In this case, we ourselves may be held liable for the comment or post and are therefore interested in the identity of the author. Furthermore, we reserve the right, on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR, to process users’ information for the purpose of spam detection. On the same legal basis, we reserve the right to store users’ IP addresses for the duration of surveys and to use cookies to prevent multiple votes. The data provided in the context of comments and posts is stored permanently by us until the users object. Comment subscriptions Subsequent comments may be subscribed to by users with their consent pursuant to Art. 6(1)(a) GDPR. Users receive a confirmation email to verify that they are the owner of the email address entered. Users may unsubscribe from ongoing comment subscriptions at any time. The confirmation email will contain information on withdrawal options. For the purpose of proving users’ consent, we store the time of registration along with users’ IP address and delete this information when users unsubscribe. You can cancel receiving our subscription at any time, i.e., withdraw your consents. We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them in order to be able to prove a previously granted consent. Processing of this data is limited to the purpose of possible defense against claims. An individual deletion request is possible at any time provided that the previous existence of consent is confirmed at the same time. Retrieval of emojis and smilies Within our WordPress blog, graphic emojis (or smilies), i.e., small graphic files that express emotions, are used and retrieved from external servers. In doing so, the providers of the servers collect users’ IP addresses. This is necessary so that the emoji files can be transmitted to users’ browsers. The emoji service is provided by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. Automattic privacy notice: https://automattic.com/privacy/ . The server domains used are s.w.org and twemoji.maxcdn.com, which to our knowledge are so-called content delivery networks, i.e., servers that serve only the fast and secure transmission of the files and delete users’ personal data after transmission. The use of emojis is based on our legitimate interests, i.e., interest in an attractive design of our online offering pursuant to Art. 6(1)(f) GDPR. Contact When contacting us (e.g., via contact form, email, phone, or via social media), the user’s details are processed for handling the contact inquiry and its processing pursuant to Art. 6(1)(b) GDPR. Users’ details may be stored in a customer relationship management system (“CRM system”) or comparable inquiry organization. We delete inquiries if they are no longer necessary. We review necessity every two years; furthermore, statutory archiving obligations apply. Hosting and email delivery The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, email delivery, security services, and technical maintenance services that we use for the purpose of operating this online offering. In doing so, we and/or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, prospects, and visitors of this online offering on the basis of our legitimate interests in an efficient and secure provision of this online offering pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement). Collection of access data and log files We and/or our hosting provider collect data on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR about every access to the server on which this service is located (so-called server log files). Access data includes name of the accessed website, file, date and time of access, amount of data transferred, message about successful access, browser type and version, user’s operating system, referrer URL (the previously visited page), IP address, and the requesting provider. Log file information is stored for security reasons (e.g., to clarify misuse or fraud) for a maximum of 7 days and then deleted. Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified. Facebook Pixel, Custom Audiences and Facebook Conversion Within our online offering, on the basis of our legitimate interests in analysis, optimization, and economic operation of our online offering, and for these purposes, we use the so-called “Facebook Pixel” of the social network Facebook, operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or if you are located in the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). Facebook is certified under the Privacy Shield agreement and thereby provides a guarantee to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active ). With the help of the Facebook Pixel, Facebook is able, on the one hand, to determine visitors to our online offering as a target group for the display of advertisements (so-called “Facebook Ads”). Accordingly, we use the Facebook Pixel in order to display the Facebook Ads placed by us only to those Facebook users who have also shown an interest in our online offering or who have certain characteristics (e.g., interests in certain topics or products that are determined based on the websites visited) that we transmit to Facebook (so-called “Custom Audiences”). With the help of the Facebook Pixel, we also want to ensure that our Facebook Ads correspond to the potential interest of users and do not have a harassing effect. With the help of the Facebook Pixel, we can also track the effectiveness of Facebook advertisements for statistical and market research purposes by seeing whether users were redirected to our website after clicking a Facebook advertisement (so-called “conversion”). Facebook processes the data within the framework of Facebook’s Data Use Policy. Accordingly, general information about the display of Facebook Ads can be found in Facebook’s Data Use Policy: https://www.facebook.com/policy.php . Specific information and details about the Facebook Pixel and how it works can be found in Facebook’s help area: https://www.facebook.com/business/help/651294705016616 . You can object to collection by the Facebook Pixel and use of your data for the display of Facebook Ads. To set which types of advertisements are displayed to you within Facebook, you can visit the page set up by Facebook and follow the instructions on settings for usage-based advertising: https://www.facebook.com/settings?tab=ads . The settings are platform-independent, i.e., they are applied to all devices, such as desktop computers or mobile devices. You can also object to the use of cookies used for reach measurement and advertising purposes via the opt-out page of the Network Advertising Initiative (http://optout.networkadvertising.org/ ) and additionally via the US website (http://www.aboutads.info/choices ) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/ ). Online presences in social media We maintain online presences within social networks and platforms in order to communicate with customers, prospects, and users active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply. Unless otherwise stated within the scope of this Privacy Policy, we process users’ data if they communicate with us within social networks and platforms, e.g., write posts on our online presences or send us messages. Integration of third-party services and content Within our online offering, on the basis of our legitimate interests (i.e., interest in analysis, optimization, and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), we use content or service offerings of third-party providers in order to integrate their content and services, such as videos or fonts (hereinafter collectively referred to as “content”). This always presupposes that the third-party providers of this content perceive the users’ IP address, as they could not send the content to their browser without the IP address. The IP address is therefore required for the display of this content. We endeavor to use only content whose respective providers use the IP address solely for delivering the content. Third parties may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. Through “pixel tags,” information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the users’ device and may include, among other things, technical information about the browser and operating system, referring websites, visit time, and other information about the use of our online offering, and may also be combined with such information from other sources. YouTube We embed videos from the “YouTube” platform of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/ , Opt-Out: https://adssettings.google.com/authenticated . Google Fonts We embed fonts (“Google Fonts”) from the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/ , Opt-Out: https://adssettings.google.com/authenticated . Google reCAPTCHA We embed the function for detecting bots, e.g., in entries in online forms (“reCAPTCHA”) from the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/ , Opt-Out: https://adssettings.google.com/authenticated . Google Maps We embed maps from the “Google Maps” service of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The processed data may in particular include users’ IP addresses and location data, which, however, are not collected without their consent (as a rule within the settings of their mobile devices). The data may be processed in the USA. Privacy Policy: https://www.google.com/policies/privacy/ , Opt-Out: https://adssettings.google.com/authenticated . Use of Facebook social plugins On the basis of our legitimate interests (i.e., interest in analysis, optimization, and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), we use social plugins (“plugins”) of the social network facebook.com, operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”). The plugins can display interaction elements or content (e.g., videos, graphics, or text contributions) and are identifiable by one of the Facebook logos (white “f” on a blue tile, the terms “Like”, “Gefällt mir” or a “thumbs up” icon) or are marked with the addition “Facebook Social Plugin”. The list and appearance of Facebook social plugins can be viewed here: https://developers.facebook.com/docs/plugins/ . Facebook is certified under the Privacy Shield agreement and thereby provides a guarantee to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active ). When a user accesses a function of this online offering that contains such a plugin, the user’s device establishes a direct connection to Facebook’s servers. The content of the plugin is transmitted by Facebook directly to the user’s device and integrated into the online offering. Usage profiles of users can be created from the processed data. We therefore have no influence on the scope of data that Facebook collects with the help of this plugin and inform users accordingly based on our level of knowledge. By integrating the plugins, Facebook receives the information that a user has accessed the corresponding page of the online offering. If the user is logged into Facebook, Facebook can assign the visit to the user’s Facebook account. If users interact with the plugins, for example by pressing the Like button or leaving a comment, the corresponding information is transmitted directly from their device to Facebook and stored there. If a user is not a member of Facebook, there is still the possibility that Facebook learns and stores their IP address. According to Facebook, in Germany only an anonymized IP address is stored. Purpose and scope of data collection and further processing and use of the data by Facebook as well as the corresponding rights and setting options to protect users’ privacy can be found in Facebook’s privacy notices: https://www.facebook.com/about/privacy/ . If a user is a Facebook member and does not want Facebook to collect data about them via this online offering and link it with the member data stored on Facebook, they must log out of Facebook and delete their cookies before using our online offering. Further settings and objections regarding the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/ . The settings are platform-independent, i.e., they are applied to all devices, such as desktop computers or mobile devices. Twitter Within our online offering, functions and content of the Twitter service, provided by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, may be integrated. This may include content such as images, videos, or text and buttons with which users can share content of this online offering within Twitter. If users are members of the Twitter platform, Twitter can assign access to the aforementioned content and functions to the users’ profiles there. Twitter is certified under the Privacy Shield agreement and thereby provides a guarantee to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active ). Privacy Policy: https://twitter.com/de/privacy , Opt-Out: https://twitter.com/personalization . Instagram Within our online offering, functions and content of the Instagram service, offered by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA, may be integrated. This may include content such as images, videos, or text and buttons with which users can share content of this online offering within Instagram. If users are members of the Instagram platform, Instagram can assign access to the aforementioned content and functions to the users’ profiles there. Instagram Privacy Policy: http://instagram.com/about/legal/privacy/ . Google+ Within our online offering, functions and content of the Google+ platform, offered by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), may be integrated. This may include content such as images, videos, or text and buttons with which users can share content of this online offering within Twitter. If users are members of the Google+ platform, Google can assign access to the aforementioned content and functions to the users’ profiles there. Google is certified under the Privacy Shield agreement and thereby provides a guarantee to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active ). Further information on Google’s use of data, setting and objection options can be found in Google’s Privacy Policy (https://policies.google.com/technologies/ads ) as well as in the settings for the display of ads by Google (https://adssettings.google.com/authenticated ). AddThis sharing functions Within our online offering, the “AddThis” service (1595 Spring Hill Rd Suite 300 Vienna, VA 22182, USA) is used to share content of this online offering within social networks (so-called sharing). Use is based on our legitimate interests, i.e., interest in dissemination of our online offering pursuant to Art. 6(1)(f) GDPR. AddThis uses users’ personal information to provide and perform the sharing functions. In addition, AddThis may use pseudonymous information of users for marketing purposes. These data are stored on users’ computers by means of so-called “cookie” text files. Privacy Policy: http://www.addthis.com/privacy , Opt-Out: http://www.addthis.com/privacy/opt-out . Created with Datenschutz-Generator.de by Attorney Dr. Thomas Schwenke Spam protection with Google reCAPTCHA We have implemented Google reCAPTCHA in forms on our website to verify whether the data entered in the forms is provided by human visitors or by machines or automated programs, also known as “bots.” This tool automatically analyzes the behavior of website visitors as soon as they interact with the website, using various information such as IP address, length of stay, and mouse movements. The processed data includes usage data such as the accessed webpage, date and time of access, and mouse movements, as well as communication data such as IP addresses, browser type, and operating system. This processing is aimed at website visitors and users of online services. The primary purpose of this processing is to prevent abuse of our contact form and thereby increase security. The legal basis for this is our legitimate interest pursuant to Art. 6(1) sentence 1 lit. f GDPR. The recipients of the data are Google Ireland Ltd, located at Google Building Gordon House, Barrow St, Dublin 4, Ireland, (https://policies.google.com/privacy ) and our website hosting provider. While your personal data is processed within the EU, the retention period for the processed data is determined by Google Ireland Limited. Further information can be found in Google reCAPTCHA’s Privacy Policy: https://policies.google.com/privacy Website analysis (Jimdo statistics) When you visit our website, we collect information about your use via a web analytics tool provided by our hosting service. This tool collects and combines your IP address and your user agent, shortens them, and stores these data using a hash function. This process creates a visitor identifier that is encrypted with a randomly generated value (SALT) that changes every 24 hours. This method ensures that your IP address cannot be reconstructed from the stored visitor identifier, thereby preserving your anonymity. We also do not combine this information with other data, and it is stored only on the hosting provider’s server. We also process web analytics data, HTTP data, and web analytics profile data. The web analytics tool we use creates and stores a web analytics profile that contains details about your use of the website, such as page views, frequency of visits, time spent on each page, and the user agent of your device. This includes usage data (such as visited webpages and access times) and communication data (such as browser type, operating system, and IP addresses). By processing these data, we aim to analyze user behavior in aggregated form in order to improve the presentation and content of our website. The legal basis for this processing is our legitimate interest (Art. 6(1)(f) GDPR), in particular in conducting web measurements to improve our products and our website. The collected data is shared with our website hosting provider and processed within the EU.