PlentyONE Privacy Policy

§ 1 Name and contact details of the body responsible for the data processing (“Controller”)

This Privacy Policy applies to the data processing by:

PlentyONE GmbH

Johanna-Waescher-Straße 7,

34131 Kassel, Germany

This Privacy Policy applies for the following domains and their subdomains as well as all services offered by PlentyONE GmbH and other responsible domains.

www.plentyone.com

www.plentymarkets.com

www.plentysystems.com

§ 2 Collection and use of your data

The scope and nature of the collection and use of your data differ according to whether you only visit our website for obtaining information or use any offers we propose on our website which require you to disclose further data concerning you.

§ 2a When you visit our website

When you visit our website, the browser which you use on your terminal automatically sends information to the server of our website. This information is temporarily stored in a so-called log file.

The following information is collected without any contribution on your part and stored until its automated deletion:

IP address of the requesting computer,

Date and time of access,

Name and URL of the retrieved file,

Website from which the access is made (referrer URL),

the browser used and, as the case may be, the operating system of your computer and the name of your access provider.

If you visit our website for information purposes only, we only collect and use the aforesaid information as non-personalised data. The collection and use of this data is indispensable to enable the use of the web pages you have accessed and to enable us to control whether the web pages are displayed to you in an optimal manner.

We use the IP address only for the duration of your visit and store the data exclusively in anonymised form for logging purposes; for this, we shorten the IP address such that it can no longer be related to a specific computer.

The legal basis for the processing is Art. 6 (1) sentence 1 point (f) GDPR (weighing of interests) and the processing is based on our interest in displaying our web pages to you in a reliable and preferably failure-free manner.

§ 2b When you subscribe to our newsletter

Subject to your explicit consent given under Art. 6 (1) sentence 1 point (a) GDPR, we will also use your email address for sending you our regular newsletter. If you have subscribed to our newsletter, we will send you emails at regular intervals to provide you with current information and offers regarding our services. If you want to receive the newsletter, you only need to provide us with an email address.

For the subscription to our newsletter, we use the so-called double opt-in procedure. This means that, after you have provided us with your email address, we will send you a confirmation email to the email address provided by you, in which we ask you to confirm that you want us to send you our newsletter. If you do not confirm our email within 24 hours, your subscription will be deleted automatically. If you confirm your subscription to the newsletter, we will store your email address until you unsubscribe. The storage only serves the purpose of enabling the sending of the newsletter. In addition, we store the IP addresses from which you subscribe to the newsletter and confirm your subscription as well as the times when you do that, in order to prevent any misuse of your personal data.

The only required field for sending the newsletter is your email address. If you disclose further data to us, these will be used for personalising the newsletter. These data, too, will be deleted completely when you unsubscribe or withdraw your consent. You may at any time withdraw your consent to receiving the newsletter. You can withdraw your consent by clicking the link which is provided in every newsletter email.

The sending of the newsletter is implemented via Brevo, a service of Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. The data are transferred to that service provider exclusively for the purpose of sending the newsletter.

In addition, subject to your explicit consent, newsletter tracking is carried out for statistical purposes using an embedded web beacon (tracking pixel). This allows the collection of the time of access, your IP address, and details about the email client used in order to optimize our newsletter distribution and better tailor future content to your interests. You can prevent this tracking at any time by disabling the automatic loading of images in your email software or by unsubscribing from the newsletter.

§ 2c When you use the contact form

We can propose the option to contact us through the contact form provided on our website. In this case, you will be asked to fill in certain required fields, which may differ depending on the nature and purpose of the request or contact form.

We collect your personal data if you voluntarily disclose them to us for the purposes of your request or when you contact us. Required fields are specifically marked. You can see from the entry forms which data we collect.

The data processing for the purpose of contacting us is based on your voluntary consent according to Art. 6 (1) sentence 1 point (a) GDPR. The personal data we collect when you use the contact form will be deleted after your request has been processed.

If you are already our customer and send us a request in the context of our contractual relationship, we will use the data you have provided to us for processing your requests in accordance with Art. 6 (1) sentence 1 point (b) GDPR (necessary for contract performance). After the request has been finally processed or the contract has been performed, the further processing of your data will be restricted and the data will be deleted after expiry of the statutory retention periods.

§ 3 Registration / Customer account

If you use our website or another communication channel to enter into a contract with us for the use of our services, your data will be stored in a customer account.

We collect personal data if you disclose them to us voluntarily in the context of contract initiation or when you contact us or when a customer account is established. Required fields are specifically marked because we are in need of these data for contract performance, for processing your contact request or for establishing the customer account. The purchase order and/or opening of the customer account cannot be completed and/or the contact request cannot be processed without these data.

You can see from the entry forms and/or the fields in the forms which data are collected. We use the data you have disclosed to us for performing the contract and for processing your requests, as provided for by Art. 6 (1) sentence 1 point (b) GDPR (necessary for contract performance). After the contract performance has been completed or your customer account has been deleted, the further processing of your data will be restricted and the data will be deleted after expiry of the retention periods prescribed by tax law and commercial law.

The use of the data will only be continued if you have explicitly consented to the further processing of your data or we have reserved the right of further use of the data, provided this is permitted by law and we have informed you about such further use in this Privacy Policy. You can delete the customer account at any time, either by sending a message to the contact address stated herein or by using the appropriate feature in the customer account.

§ 4 Forum

You can only access our forum after registration.

If we provide an active forum and you wish to participate in it, you must be a customer and authorise its use in your user account.

If you establish a forum account, this account will be linked to your user account. We will store your user name, your password and your email address as well as all information and content you enter in the forum, i.e. public posts or contributions, pinboard entries, friendships, private messages (we cannot access the latter) etc. for operating the forum.

If you delete your account, your public statements, in particular your contributions to the forum, will continue to be visible for all readers; however, your account cannot be accessed any longer and will be marked “[Guest]” in the forum. All other data will be deleted.

The data processing for the purposes of your participation in the forum is based on your voluntary consent according to Art. 6 (1) sentence 1 point (a) GDPR and is also carried out for contract performance according to Art. 6 (1) sentence 1 point (b) GDPR.

§ 5 Transfer of data

Your personal data are not transferred to third parties for purposes other than those stated in this Privacy Policy.

We only disclose or transfer your personal data to third parties if:

you have explicitly consented to the disclosure or transfer according to Art. 6 (1) sentence 1 point (a) GDPR,

the disclosure or transfer is necessary for the establishment, exercise or defence of legal claims according to Art. 6 (1) sentence 1 point (f) GDPR and there is no reason to assume that you have an overriding interest in the non-disclosure of your data,

there is a legal obligation to disclose or transfer the data according to Art. 6 (1) sentence 1 point (c) GDPR, and

this is permitted by law and necessary for performing contractual relationships with you according to Art. 6 (1) sentence 1 point (b) GDPR.

§ 6 Marketplace

When you use the plug-in and service platform provided by us, data is transferred to the respective service provider. First of all, the user of the platform is a customer of the PlentyONE GmbH, which means that § 3 above applies.

If the user purchases a plug-in or purchases/books any other service, customer data are made available to the plug-in/service provider through the platform. The provider can access the invoice which has been generated and which we send to the customer on the provider’s behalf.

If the user purchases/books a service, customer datasets are transferred to a URL terminal specified by the provider. This enables direct contact between the customer and the provider in order to perform the services which have been contractually agreed between them. The legal basis for data transfer for the purpose of contract performance is Art. 6 (1) sentence 1 point (b) GDPR. The data transfer is also based on the consent given by the user and the provider according to Art. 6 (1) sentence 1 point (a) GDPR.

§ 7 Payment service provider

We use paypal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg) as a payment service provider whose platforms can be used by us and the users for processing payment transactions for plug-in purchases on Marketplace. The Privacy Policy of paypal is available under the following link:

https://www.paypal.com/de/webapps/mpp/ua/privacy-full

The legal basis for involving the payment service providers in the context of contract performance is Art. 6 (1) sentence 1 point (b) GDPR. Otherwise, we involve external payment service providers based on our legitimate interests according to Art. 6 (1) sentence 1 point (f) GDPR to provide our users with an efficient and secure payment option.

The processing of payment transactions is governed by the terms and conditions of business and the data protection information of the payment service provider, which can be retrieved directly from the payment service providers during the payment process. With respect to the data stored by the payment service provider, you may assert against the payment service provider the right of access to, and information about, the stored data as well as all other rights to which you are entitled as a data subject.

The data processed by the payment service provider include, for instance, names and addresses, bank details (e.g. account numbers or credit card numbers, access data and checksums) as well as the details of the payment and the payment recipient. This information is necessary for processing the payment transaction. The data provided by you are processed and stored exclusively by the payment service provider. We only get informed about whether the payment has been confirmed or rejected. However, the payment service providers may transfer the data to credit enquiry agencies. For this, please read the GTC and data protection information of the relevant payment service provider.

§ 8a Hosting

In order to provide the services we offer and keep our online offer available, we engage service providers who provide the technical infrastructure. If and to the extent necessary, we have concluded with our service providers agreements for data processing on our behalf. We have informed our contractual partners that the relevant service providers act as our sub-suppliers.

If your data are not processed within the European Union (EU), they may only be processed in a third country if the special conditions of Art. 44 et seq. GDPR are fulfilled. This means that the processing of your data is subject to compliance with appropriate safeguards. Such safeguards may consist either in a so-called adequacy decision whereby the EU Commission decides that the relevant third country ensures an adequate data protection level equal to that of the EU or in the compliance with officially acknowledged special contractual obligations - the so-called “standard contractual clauses”.

§ 8b LaunchNotes

We use the services of the provider Shiny Planes Inc. for the provision and operation of part of our website (Product Information Hub). These services are provided by Shiny Planes, Inc. d/b/a LaunchNotes, 340 S. Lemon Avenue, #3304, Walnut, California 91789, USA.

Further information on data processing by LaunchNotes and the services can be found in the privacy policy of Shiny Planes Inc (LaunchNotes):

https://www.launchnotes.com/privacy-policy

LaunchNotes is a hosting provider for us. A section of our website is provided by this provider. The legal basis for the processing is Art. 6 (1) sentence 1 point (f) GDPR (weighing of interests) and the processing is based on our interest in displaying our web pages in a reliable and preferably failure-free manner.

LaunchNotes also provides newsletter services and contact form functions. With regard to these functions, we refer to the information in § 2 of this privacy policy. The user can use these functions to register for information services on various content and topics relating to our software. Feedback on the information provided can be sent to us via the contact form.

Data processing for the purpose of contacting us is carried out in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR on the basis of your consent.

Insofar as a contractual relationship exists or is established, we use the data you provide to fulfil the contract in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR.

§ 8c ImgIX (Hosting and Real-Time Image Optimization)

To optimize, scale, and deliver image files on our website quickly and in real-time, we use the Content Delivery Network (CDN) provided by ImgIX. The provider is imgix, Inc., 535 Mission St, 14th Floor, San Francisco, CA 94105, USA. When you access a page containing images, your browser establishes a direct connection to ImgIX's servers. During this process, your IP address and device-specific metadata (e.g., your user agent) are processed to deliver the requested image in the optimal resolution and format matching your terminal equipment. The use of this service is based on our legitimate interest in providing a fast, stable, and efficient online experience pursuant to Art. 6 (1) point (f) GDPR. Data transfer to the USA is safeguarded via EU Standard Contractual Clauses.

§ 9 Video Streaming

Our video streaming (livestream) service is provided by an external service provider. The personal data that is collected in the process is stored on the provider's servers. This may include IP addresses, meta and communication data, contact data, names, website accesses and other data generated via a website and during log-in.

The provider is used for the purpose of fulfilling the contract with the audience of the livestream (Art. 6 para. 1 lit. b DSGVO) and in the interest of a secure, fast and efficient provision of the service by a professional provider (Art. 6 para. 1 lit. f DSGVO).

Our service provider will only process the data insofar as this is necessary for the fulfilment of its service obligations and follow our instructions with regard to this data.

We use the following service provider:

numeo GmbH, Schwarze Breite 7a, 34260 Kaufungen.

In order to ensure data protection-compliant processing, we have concluded a data processing agreement with our service provider.

§ 10 Cookies and Analysis Functions

We use cookies on our website. These are small files which are automatically generated by your browser and stored on your terminal (laptop, tablet, smartphone or the like) when you visit our website. Cookies do not cause any harm to your terminal, they do not contain viruses, trojans or other malware.

In the cookie, information is stored which arises in connection with the specific terminal used. However, this does not mean that we can immediately identify you by that information.

First of all, the use of cookies helps us make the use of our website more comfortable for you. We use so-called session cookies to recognise that you have already visited individual pages of our website before. These cookies are deleted automatically when you have left our website.

In addition, also for the purpose of optimising the user-friendliness of our website, we use temporary cookies which are stored on your terminal for a certain specified period. If you come back to our website and use our services again, we automatically recognise that you have already visited us before and we know which entries you have made and which settings you have chosen before to spare you from entering them again.

You can in your discretion set your browser to accept or block the setting and retrieval of cookies. You can, for instance, completely disable the storage of cookies in your browser or restrict their storage to certain websites or configure your browser to alert you automatically when a cookie is being set and ask you for acceptance or refusal. You can also block or delete certain individual cookies. This may however cause certain features of our website to be impaired for technical reasons so that they no longer work properly.

Essential cookies enable the basic features and functions and are necessary to ensure faultless operation of the website.

Statistics cookies collect information in anonymous form. This information helps us understand how our visitors interact with our website.

Contents of video platforms and social media platforms are blocked by default. If cookies of external media are accepted, access to these contents no longer requires manual acceptance.

Functional cookies allow user choices and preferred user settings to be saved (e.g. the disabling of automatic language redirection).

We only use statistics cookies, cookies of external media and largely functional cookies if you consent to their use. You can accept or refuse these cookies by clicking a banner which appears when the cookie which is necessary for choosing the aforesaid functions has not yet been set (consent cookie). The acceptance or refusal is saved in this consent cookie which is an essential cookie.

§ 10a Mixpanel (Backend User Analytics)

We use the analytics tool Mixpanel within the closed backend of our PlentyONE software. The provider is Mixpanel, Inc. (Pier 1, Bay 2, The Embarcadero, San Francisco, CA 94111, USA). Data processing takes place by default on servers located in the Netherlands (EU) under Mixpanel’s EU Data Residency Program.

Purpose and Legal Basis: The use of Mixpanel serves exclusively the operational optimization of the user interface (UI/UX) and the targeted prevention of operational and booking errors in critical business processes by our customers (merchants) and their employees (e.g., within the context of item listing or warehouse management). As a closed B2B ERP system, the analysis of workflow efficiency constitutes a measure to safeguard operational stability and economic-functional necessity. The legal basis for this processing is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Our legitimate interests outweigh the privacy interests of the users because the processing occurs entirely in a professional B2B context, the data is immediately pseudonymized, and no profiling for marketing purposes takes place. Access to terminal equipment under the TDDDG only occurs insofar as it is strictly and technically necessary for this operationally vital optimization of the service explicitly requested by the user (§ 25 para. 2 no. 2 TDDDG).

Technical Protective Measures (Privacy by Design): To safeguard user rights, extensive technical protective measures have been implemented:

Masking of Personal Data: Real names, email addresses, or Plenty-IDs are never transmitted in plain text but are protected via anonymized hashes.

IP Truncation: Before transmission to the third-party tool, IP addresses are truncated by the last two octets (e.g., 1.2.XXX.XXX), eliminating any direct personal reference.

Input Filtering: Technical configurations ensure that click-tracking does not transmit any content from text fields (such as customer addresses, prices, supplier data, or product specifications).

Server-Side Proxy: Tracking data is not sent directly from the browser to the provider; instead, it is routed through a PlentyONE interface to sanitize metadata (e.g., User-Agent) beforehand.

Data is deleted as soon as it is no longer required for the purpose of its collection and optimization.

§ 10b Axeptio (Consent Management)

We use the cookie consent management tool Axeptio on our website. The provider is Agilitation SAS, 15 rue du général Campredon, 34000 Montpellier, France. The service is used for the purpose of obtaining, managing, and legally documenting the data protection consent required for the storage of cookies and the use of third-party technologies. For this purpose, a technically necessary cookie is stored on your device to remember your choice (acceptance or refusal) for future page visits. Processing is carried out to fulfill a legal obligation pursuant to Art. 6 (1) point (c) GDPR in conjunction with Section 25 (1) TDDDG, as well as based on our legitimate interest in providing a legally compliant online offer pursuant to Art. 6 (1) point (f) GDPR. The data will be deleted once you clear the cookies in your browser settings.

§ 11 Integration of third-party services

On our website, we use content or services offered by third parties; the legal basis for this use is either our legitimate interest (Art. 6 (1) sentence 1 point (f) GDPR) or the consent you have given (Art. 6 (1) sentence 1 point (a) GDPR).

The functioning of the said contents requires the parties providing them to identify the IP addresses of the users. The IP address is necessary for displaying and using the contents.

However, the third-party providers may also use pixel tags or cookies for statistical purposes or marketing purposes. Pixel tags are invisible graphics, which are also called “web beacons”. They allow the providers to collect and analyse additional information about the interaction with websites. This Privacy Policy explains to you how you can disable or restrict the use of these data which are usually anonymous.

Where third-party services are integrated into our website, the usage, meta, and communication data (e.g., IP addresses, device information) required for displaying and providing the functionality of the respective content are processed. The legal basis for this data processing is either your consent (Art. 6 (1) sentence 1 point (a) GDPR) or our legitimate interest (Art. 6 (1) sentence 1 point (f) GDPR). Please refer to the subsequent specific descriptions of the respective services for the exact data categories, specific purposes, and individual security measures.

If your data are not processed within the European Union, they may only be processed in a third country if the special conditions of Art. 44 et seq. GDPR are fulfilled. This means that the processing of your data is subject to compliance with appropriate safeguards. Such safeguards may consist either in a so-called adequacy decision whereby the EU Commission decides that the relevant third country ensures an adequate data protection level equal to that of the EU or in the compliance with officially acknowledged special contractual obligations - the so-called “standard contractual clauses”.

§ 12 Consent and withdrawal of consent

If and to the extent that we are not allowed to process personal data for the purposes of our legitimate interests (Art. 6 (1) sentence 1 point (f) GDPR) or for the purposes of contract performance (Art. 6 (1) sentence 1 point (b) GDPR), as described in the foregoing provisions, the processing is based on the consent given by you (Art. 6 (1) sentence 1 point (a) GDPR). As far as our website is concerned, a banner is displayed to you asking for your consent. There you can give or deny consent to the features and functions specified in § 9 and § 10 of this Privacy Policy.

You may at any time withdraw your consent with effect for the future by adjusting your personal settings in the field “Cookie settings” or “See/change my privacy settings” at the bottom of our websites where you can activate or deactivate the relevant buttons.

For the purposes of the contractual services we provide, we conclude with our customers agreements for data processing on behalf, which contain further information and regulations regarding the data processing.

We explicitly refer to the data protection information of the relevant providers and the proposed opt-out options. If no opt-out option is offered in any individual case, you may in any case disable the cookies in your browser settings. This may however cause restrictions of the features and functions of our website.

You can also use general opt-out options. The following options are available:

Europe: https://www.youronlinechoices.eu

and for all territories:

https://optout.aboutads.info.

§ 13 Google services

In the European Economic Area (EEA) and Switzerland, Google services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is the data controller for the processing of information for users of Google services who have their habitual residence in the European Economic Area or Switzerland.

§ 13a Google Analytics

Our website uses Google Analytics, which is a web analysis service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

Google Analytics, too, uses cookies, which are text files that are stored on your computer and allow the service provider to analyse how you interact with our website. The information which cookies generate about your interaction with our website is normally transmitted to a Google server in the USA and stored there.

Data processing within the scope of Google Analytics may also include the "Google Signals" feature, which enables aggregated and cross-platform reports on user trends, provided you have activated personalized advertising in your Google account.

IP anonymisation is activated on our website so that your IP address, before it is transmitted, is shortened by Google within the European Union member states or in any other country member of the Agreement on the European Economic Area. Only in exceptional cases, the full IP address is transmitted to a Google server and shortened only there.

We commission Google to use this information to analyse how you interact with our website, prepare reports on your website activities and provide additional services to us as the website operator that are related to the use of the website and the Internet. The IP address which your browser transmits for the purposes of Google Analytics is not combined with other Google data.

The Google Analytics cookies will only be stored and thus your user behaviour will only be tracked if you have consented to the tracking before. You can also set your browser software to disable the storage of cookies; in this case, please be aware that you may not be able to use all features and functions of this website without restrictions. You can also prevent the collection of the data (including your IP address) relating to your interaction with the website which are generated by the cookie and their transmission to Google as well as the processing of these data by Google by downloading and installing the browser plug-in which is available under the following link:

https://tools.google.com/dlpage/gaoptout?hl=de.

The Privacy Policy of Google for all Google services referred to in this Privacy Policy is available at:

https://policies.google.com/privacy

§ 13b Google Ads conversion tracking

We also use Google Ads conversion tracking to statistically document the interaction with our website and analyse these data for the purpose of optimising our website for you. Google Ads conversion tracking places a cookie (see § 9) on your computer if you have been referred to our website by a Google advertisement.

These cookies expire after a period of 30 days and do not allow us to identify you. When the user visits certain pages of the Ads customer’s website and the cookie has not expired yet, Google and the customer can see that the user clicked the ad and was redirected to this page.

Each Ads customer is given a different cookie. Thus cookies cannot be tracked through the websites of Ads customers. The information collected by the conversion cookie helps prepare conversion statistics for the Ads customers who have chosen conversion tracking. The Ads customers see the total number of users who clicked their ad and were redirected to a page with a conversion tracking tag. They do however not receive any information by which the users can be identified.

§ 13c Google remarketing

On our website, we use the remarketing / “similar audiences targeting” feature of Google. This feature allows us to approach the website visitors with targeted ads, which are personalised ads geared to the visitors’ interests that are displayed when they visit other websites within the Google network.

In order to analyse the visitors’ interaction with the website, which is the basis for generating the targeted ads, Google uses so-called cookies. The latter record the website visits and collect anonymised data on the visitors’ interaction with the website. If you visit another website of the Google network afterwards, you will see ads which are very likely to be related to the product and information categories which you have accessed before.

You can permanently disable the use of cookies by Google by adjusting your personal ad settings within your Google account at:

https://myadcenter.google.com/

Otherwise, you can use any of the options described in § 11. Further information about Google remarketing as well as the Privacy Policy of Google are available at:

https://policies.google.com/technologies/ads

§ 13d Google Ads Customer Match

As part of our Google advertising activities, we use Google Ads Customer Match Lists and Google Enhanced Conversions. The recipient of the data is Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC, based in California, USA, and, if applicable, US authorities can access the data stored by Google.

To use Customer Match, lists of encrypted (hashed) user data (e.g. email addresses, names, addresses, customer-specific identifiers) are uploaded to Google. Google then compares whether these match existing Google customers. This can be used to create target groups that can be used to target adverts/campaigns. The hash is created using the SHA256 method.

Once the customer match lists have been created, the encrypted data is automatically deleted again. This means that providers do not receive any new addresses.

In addition, the Enhanced Conversion function is used to optimise our advertising measures by better identifying groups of people within the Google network who are most likely to carry out conversion results (e.g. purchase transactions) on our website. For the use of Google Enhanced Conversion, encrypted user data is transmitted to Google after you have carried out a conversion event (e.g. mouse click, booking, purchase) on our website.

Data processing for the purpose of matching the hashed user data to create target groups and the more precise recording of conversions is carried out in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR on the basis of your voluntarily given consent.

You can find more information on Google Customer Match, Google Enhanced Conversion and data processing by Google under the following links:

https://support.google.com/google-ads/answer/10550383?hl=en-GB

https://support.google.com/google-ads/topic/10550182?hl=en-GB&ref_topic=6296507

§ 13e Google Tag Manager & Google Infrastructure Services (Google Static, Google Syndication)

We use the Google Tag Manager and supplementary Google infrastructure services (such as Google Static and Google Syndication) on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager: This tool is used to centrally manage and deploy website tags (scripts and trackers) via an interface. The Tag Manager itself does not set cookies and does not collect personal data (other than technically necessary connection data such as the IP address). It merely triggers other analytical or marketing tags in a structured manner.

Google Static (gstatic.com): This service delivers static website assets (such as libraries, fonts, or platform resources) quickly and optimally via Google's distributed server network.

Google Syndication: Used for the technical management of ad delivery and script execution across the Google network.

The use of the Tag Manager and related infrastructure services is based on our legitimate interest in ensuring a high-performance, secure, and efficient operation of our website pursuant to Art. 6 (1) point (f) GDPR. Insofar as consent-based tracking tools are executed via the Tag Manager, their activation occurs strictly after your explicit choice via the cookie banner pursuant to Art. 6 (1) point (a) GDPR. Data transmission to Google LLC in the USA cannot be entirely ruled out; this is safeguarded via EU Standard Contractual Clauses.

§ 14 Google Maps

Our website uses the Google Maps API for the visual presentation of geographic information. When Google Maps is used, Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) also collects, processes and uses data about how the Maps features are used by the visitors of the websites. These data may include, without limitation, IP addresses and position data of the users and the data may be processed in the USA.

Further details regarding the data processing by Google are contained in the data protection information of Google which is available under the following link:

https://policies.google.com/privacy

§ 15 Google reCAPTCHA

On our website, we use the reCAPTCHA tool of Google. The contractual partner for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The tool helps distinguish whether the input is made by a human or by automated machine processing. For such purposes, your input is transmitted to Google and further processed there. In addition, the IP address and, as the case may be, further data which Google requires for the reCAPTCHA service are transmitted to Google. Google processes these data within the European Union and may also transmit them to the USA.

The legal basis for the processing is Art. 6 (1) sentence 1 point (f) GDPR because we have a legitimate interest in protecting our website from automated espionage, misuse and SPAM.

Further details regarding Google reCAPTCHA and the appropriate Privacy Policy are available at:

www.google.com/recaptcha/about/

https://policies.google.com/privacy

§ 16 YouTube

Our website partly uses the services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“YouTube”) to display video content. When you access the relevant pages, your browser loads the YouTube code which is necessary to view the video. For this purpose, your browser must connect to the YouTube servers; by this, YouTube learns that our website has been accessed from your IP address. At the same time, YouTube can store cookies on your terminal, unless you have disabled the use of cookies in your browser settings, and YouTube can also read cookies. We use YouTube plug-ins to ensure an attractive design of our websites and enable the presentation of video content. We record your IP address to enable the transmission to YouTube. You are not obliged to provide us with these personal data but you will not be able to use these special parts of our website without providing the data. Data are only exchanged with YouTube as a Google service if you have consented to the use of external media (see § 9 to § 11 of this Privacy Policy.

The privacy policy of Google is available at:

https://policies.google.com/privacy

You can disable the feature or change the settings at:

https://myadcenter.google.com/

In addition, we have our own channel on YouTube which can also be accessed directly. For this, we refer to the general information on social media platforms in § 21 of this Privacy Policy. The above references to the address and privacy policy of the provider are also valid for the account on the platform.

§ 17 Vimeo

On some of our Internet pages, we use plug-ins of the service provider Vimeo. We can embed videos from the “Vimeo” platform of Vimeo Inc., Attention: Legal Department, 555 West 18th Street New York, New York 10011, USA.

If you visit those pages of our website with plug-ins, a connection is established to the Vimeo servers and the plug-in is installed. By this, the Vimeo server learns which pages of our website you have visited. If you are at that time logged in to Vimeo as a member, Vimeo will assign this information to your personal user account. If you use the plug-in, for instance by clicking the start button of a video, this information will also be assigned to your personal user account. You can prevent the assigning of information to your user account by logging out from your Vimeo user account before you access our Internet page and deleting the corresponding cookies of Vimeo.

Further details on the data processing and information on data protection by Vimeo are available at https://vimeo.com/privacy.

Please be aware that Vimeo might use Google Analytics. For this, please read the privacy policy (https://policies.google.com/privacy).

In addition, we have an account on the Vimeo platform, which can also be accessed directly. For this, we refer to the general information on social media platforms in § 22 of this Privacy Policy. The above references to the address and privacy policy of the provider are also valid for the account on the platform.

§ 18 Meta Pixel, Conversions API

We use the Meta Pixel and Conversions API on our website. These services are provided for users from the EU by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland as operator. This is our contract partner.

With the Meta Pixel, it is possible for Meta to identify users of our websites as a target group for the display of advertisements (so-called "Facebook ads" or ads from the services Instagram or WhatsApp). Accordingly, we use the meta pixel to display the ads placed by us only to those users who have also shown an interest in our online services or have certain characteristics (e.g. interests in certain topics or products identified on the basis of the websites visited), which we transmit to Meta (so-called "custom audiences"). With the meta pixel, we also want to ensure that our meta ads correspond to the potential interest of the users and do not have a harassing effect. The meta pixel allows us to track the effectiveness of the ads for statistical and market research purposes by seeing whether users have been redirected to our website after clicking on a Facebook ad and have performed previously defined actions there (so-called "conversion").

Meta provides information on data protection and the way it is processed.

Data policy:

https://www.facebook.com/privacy/policy/

Help section with information on how it works:

https://www.facebook.com/business/help/742478679120153

https://www.facebook.com/business/help/2041148702652965?id=818859032317965

Lifetime of cookies: up to 180 days after the last interaction (this only applies to cookies set via our website).

The Meta Pixel is only used with consent. The use of the MetaPixel is based on Art. 6 para. 1 lit. a DSGVO.

§ 19 LinkedIn Insight-Tag

We use the so-called LinkedIn Insight Tag on our website. This service is provided for users from the EU by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. This is our contractual partner.

Through the LinkedIn Insight Tags, we receive information about the visitors of our website. If a website visitor is registered with LinkedIn, we can, among other things, analyse the key professional data of our website visitors stored on LinkedIn and thus better align our site to the respective target groups. Furthermore, we can use LinkedIn Insight Tags to measure whether visitors to of our websites take an action (conversion measurement). Conversion measurement can also be performed across devices (e.g. from PC to tablet). LinkedIn Insight Tag also offers a retargeting function that allows us to display targeted advertising outside the website to visitors to our website, whereby, according to LinkedIn's information, the advertising addressee is not identified.

LinkedIn also collects so-called log files (URL, referrer URL, IP address, device and browser properties and time of access). The IP addresses are shortened or (if they are used to reach LinkedIn members across devices) pseudonymised. The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymised data is then deleted within 180 days. The data collected by LinkedIn cannot be assigned to specific individuals by us as a website provider.

LinkedIn provides information on privacy and how data is processed. The privacy policy can be viewed at the following URL:

https://de.linkedin.com/legal/privacy-policy

Further information on the Insight Tag can be found under LInkedIn's Marketing Solutions information:

https://www.linkedin.com/help/linkedin/answer/87150/linkedin-marketing-solutions-und-die-datenschutz-grundverordnung-dsgvo

The LinkedIn Insight tag is only used with the consent of the website visitor. The use is based on Art. 6 para. 1 lit. a DSGVO.

§ 20 Lead generation tools

We use lead generation tools to acquire new customers. A lead is a prospective customer who sends his or her contact details to a company whose services or products he or she is interested in for the purpose of making contact. A lead generation form is an advertising placement in social networks that enables the integration of contact forms in sponsored content.

We use the following providers:

LinkedIn (LinkedIn Lead Generation)

With the provision of these lead form services, we offer prospective customers a function with which a user of the social network can send his or her e-mail address or other contact and user information in order to acquire new customers. We use these functions to better address prospective customers.

The use of lead generation tools serves to communicate with interested parties and advertising addressees. The data processing of the data and information sent to us is based on the consent given by sending. The legal basis is Art. 6 para. 1 lit. a GDPR.

Once the purpose has been achieved, we delete the data submitted to us via Lead Forms, unless we are legally obliged to retain it for a longer period of time or we still need the personal data for the performance or settlement of an existing contractual relationship or for verification purposes.

Further information on data protection and LinkedIn's lead generation tools can be found here:

https://www.linkedin.com/legal/privacy-policy

§ 21 Microsoft Advertising

We use Microsoft Advertising (formerly "Bing Ads") to advertise online and we monitor the advertising. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.

More information is available at https://about.ads.microsoft.com/de-de/h/a/microsoft-advertising.

We use cookies to record the closing and processing of transactions. This involves processing personal data in the form of online identifiers (including cookie identifiers), IP addresses, device identifiers and information about device and browser settings. This allows us to serve targeted advertisements via the Microsoft Bing search engine. For this purpose, we use a technology (conversion tracking tool) from Microsoft, which stores data of the user regarding his or her behaviour on the website; this data only concerns user behaviour. Microsoft Advertising ensures that all data collected remains anonymous and cannot be used to identify individuals.

This service is only used on the basis of your consent. The legal basis is Art. 6 para. 1 lit. a DSGVO.

In the case of Microsoft services, the transmission of data to Microsoft Corp. in the USA cannot be ruled out.

Further information on data protection at Microsoft is available in Microsoft's data protection notices:

https://privacy.microsoft.com/de-de/privacystatement.

§ 21a Microsoft Clarity (Behavioral Analytics)

We use the web analysis service Microsoft Clarity on our website. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft Clarity enables us to visually analyze user behavior (e.g., mouse movements, clicks, scrolling activities, and anonymized click-paths) on our website in the form of heatmaps and session recordings. This allows us to identify UX hurdles or user issues and continuously improve the interface. Clarity utilizes cookies and similar technologies to capture information about your device, browser, and actions. IP addresses are processed in a de-identified form. Data processing is carried out strictly based on your prior, explicit consent pursuant to Art. 6 (1) point (a) GDPR. You can withdraw your consent at any time with future effect via our cookie settings.

§ 22 Hotjar

We use the web analysis service Hotjar from Hotjar Limited, Dragonara Business Centre, 5th Floor, Dragonara Road, St Julian's, STJ 3141, Malta (‘Hotjar’) on our website. Hotjar enables us to measure and evaluate user behaviour (clicks, mouse movements, scroll height, etc.) on our website.

Hotjar uses cookies and other technologies to collect data on the behaviour of our users and their devices. This includes the IP address of a device (processed during your session and stored in a de-identified form), the screen size of the device, the device type (unique device identifiers), browser information, geographical locations (country only), and the preferred language used to display our website. Hotjar stores this information in a pseudonymised user profile on our behalf. Hotjar is contractually obliged not to sell any of the data collected on our behalf.

Hotjar also uses third-party services to provide its services, such as Google Analytics and Optimizely. These third-party companies may store information that your browser sends when you visit the website, such as cookies or IP requests. For more information on how Google Analytics and Optimizely store and use data, please refer to their respective privacy policies.

Data processing for the purpose of web analysis is carried out in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR on the basis of your consent.

Further information on data protection at Hotjar can be found at

https://www.hotjar.com/legal/policies/privacy/

§ 23 Outbrain

We use the service outbrain on our website. This service is provided by Outbrain Inc, Delaware, USA, as provider. Outbrain UK Limited, 5th Floor, The Place, 175 High Holborn, London, WC1V 7AA, United Kingdom, is responsible for the data processing of all persons in the EU, UK and European Economic Area.

Outbrain enables us to point website visitors to further, possibly interesting content on our website as well as on websites of third parties. The reading recommendations are determined on the basis of the content previously read by the website visitor. The content displayed by Outbrain is automatically controlled and delivered by Outbrain in terms of content and technology

Outbrain collects the device source, the browser type and the user's IP address, with the last octet removed for anonymisation. Outbrain assigns a so-called Universally Unique Identifier (UUID), which can identify the user by device when he visits a website on which the Outbrain widget is implemented. Outbrain creates user profiles in which user interactions (e.g. page views and clicks) of a browser or device are aggregated to derive the preferences of the UUID.

If you do not receive an Outbrain user ID, the Outbrain pixel does not collect any data at all. This data processing helps us understand how our website is being used and whether our ads are helping to successfully connect with customers. All data, such as page views and clicks, associated with a user ID are stored for 13 months and then deleted.

In addition to Outbrain, we use "Outbrain Amplify" and "Outbrain Pixel" for marketing and optimisation purposes of our website. These tools allow us to analyse the usage behaviour of our website visitors and to improve our services. In this way, we can automatically display advertising that matches your interests.

Outbrain ensures that the transfer complies with EU data protection laws by providing an adequate level of protection and that appropriate safeguards are in place to protect the data.

(https://www.outbrain.com/legal#data-processing-agreement).

At http://www.outbrain.com/de/legal/privacy you will find further information on Outbrain's data protection.

Data processing only takes place after consent. The legal basis is Art. 6 para. 1 lit. a DSGVO.

§ 23a Taboola (Personalized Recommendations & Advertising)

We use the advertising and recommendation service Taboola on our website. The provider is Taboola Europe Limited, Aldgate House, 33 Aldgate High Street, 2nd Floor, London, England, EC3N 1DL. Taboola records user-specific behaviors and interest profiles to present personalized content, article recommendations, and targeted advertisements matching your preferences. For this purpose, the service utilizes cookies, pixels, and device identifiers to analyze user actions across different domains. Processing is carried out strictly based on your prior, explicit consent pursuant to Art. 6 (1) point (a) GDPR. You can withdraw your consent at any time with future effect via our cookie management interface.

§ 24 SalesViewer

Use of SalesViewer® technology:

Our websites use SalesViewer® technology from SalesViewer® GmbH (Bongardstraße 29, 44787 Bochum, Germany) on the basis of the website operator’s legitimate interests (Section 6 paragraph 1 lit.f GDPR) in order to collect and save data on marketing, market research and optimisation purposes.

In order to do this, a javascript based code, which serves to capture company-related data and according website usage. The data captured using this technology are encrypted in a non-retrievable one-way function (so-called hashing). The data is immediately pseudonymised and is not used to identify website visitors personally.

The data stored by Salesviewer will be deleted as soon as they are no longer required for their intended purpose and there are no legal obligations to retain them.

The data recording and storage can be repealed at any time with immediate effect for the future, by clicking on https://www.salesviewer.com/opt-out in order to prevent SalesViewer® from recording your data. In this case, an opt-out cookie for this website is saved on your device. If you delete the cookies in the browser, you will need to click on this link again.

§ 25 Hubspot

We use the services of the provider Hubspot for the hosting and management of our websites. Our contractual partner for users in the EEA is HubSpot Ireland Limited, 2 Dockland Central, Guild Street, Dublin 1, Ireland.

Further information on data processing by Hubspot and Hubspot's services can be found in HubSpot's privacy policy:

https://legal.hubspot.com/privacy-policy

We use the following Hubspot services:

API

We use the service to access additional services and data from HubSpot Your IP address is transmitted in the process. The use is based on our legitimate interests in the provision of our website and its optimisation (pursuant to Art. 6 para. 1 lit. f. GDPR).

CDN

A CDN is used to make the content of our websites, in this case files such as graphics or scripts, available more quickly with the help of regionally or internationally distributed servers. When you access this content, you establish a connection to HubSpot's servers, whereby your IP address and possibly browser data such as your user agent are transmitted. This data is processed exclusively for the above-mentioned purposes and to maintain the security and functionality of the HubSpot CDN. The use of the CDN is based on our legitimate interests, i.e. interest in the secure and efficient provision of our websites within the meaning of Art. 6 para. 1 lit. f. GDPR.

LeadFlow

LeadFlow identifies complete contact data and provides insights into the visit history. LeadFlow uses cookies and other browser technologies to evaluate user behaviour and recognise users. HubSpot LeadFlow collects and processes data about companies such as company name, telephone number, address, web address, industry, company profile, turnover. We process your data for the purpose of optimising our website and for marketing purposes on the basis of your consent in accordance with Art. 6 para. 1 lit. a. GDPR.

Banner

We have integrated HubSpot Cookie Banner on our website. HubSpot Cookie Banner is a consent solution that can be used to request and document consent to the use of cookies and data processing. HubSpot Cookie Banner uses cookies or other web technologies to recognise users and store the consent given or revoked. The service is used to request the required consent to the use of cookies (Art. 6 para. 1 lit. c. GDPR).

Forms

We have integrated HubSpot Forms on our website. HubSpot Forms is used to save data entered in forms, e.g. when contacting us via the contact form. The data entered can be stored in our customer relationship management system (CRM system). We process your data with the help of HubSpot Forms for the purpose of processing the contact enquiry and handling it in accordance with Art. 6 para. 1 lit. b. GDPR.

Analytics

We use HubSpot Analytics as an analysis service for the statistical evaluation of our websites. This includes, for example, the number of visits to our website, subpages visited and the time spent by visitors. HubSpot Analytics uses cookies and other browser technologies to evaluate user behaviour and recognise users. We process data with the help of HubSpot Analytics for the purpose of optimising our website and for marketing purposes on the basis of your consent in accordance with Art. 6 para. 1 lit. a. GDPR.

Pixel

We use HubSpot Pixel to create custom audiences, i.e. to segment groups of visitors to our online offering, determine conversion rates and subsequently optimise them. This happens in particular when you interact with adverts that we have placed with HubSpot. We process your data with the help of HubSpot Pixel for marketing purposes on the basis of your consent in accordance with Art. 6 para. 1 lit. a. GDPR.

Chatbot

We use a chat with an automatic reply function on our website. This is software that responds to service enquiries around the clock with suitable answers from an information database. We process your data exclusively to answer your enquiry, on the basis of your consent (Art. 6 para. 1 lit. a GDPR) and to process the contractual relationship (Art. 6 para. 1 lit. b GDPR).

§ 25a Use of HubSpot Breeze (AI function):

§ 25a Use of HubSpot Breeze (AI Function)

We use the AI-based functions "Breeze Intelligence", "Breeze Copilot", and "Breeze Agents" within our HubSpot CRM system to improve the use of the data received and to optimize our customer support. Personal data such as name, email address, communication content, usage behavior, or interaction data may be processed. The functions are preset to be data protection-friendly. We utilize a paid Pro account for this purpose, which contractually ensures and guarantees that the transmitted data is excluded from being used for training global AI models.

Processing is carried out on the basis of our legitimate interest in efficient customer communication and process optimization in accordance with Art. 6 para. 1 lit. f GDPR, for the processing of contract data in accordance with Art. 6 para. 1 lit. b GDPR or - if necessary - on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR. Automated decision-making within the meaning of Art. 22 GDPR does not take place. Your data may be transferred to technical service providers such as OpenAI (USA). HubSpot is certified in accordance with the EU-U.S. Data Privacy Framework. In addition, we have signed a data processing agreement with HubSpot in accordance with Art. 28 GDPR, which also includes processing by AI components. Processing is basically based on servers located in the EU. Any data transfer to the USA takes place on the basis of adequate guarantees. Further information on data processing by HubSpot can be checked at: https://legal.hubspot.com/privacy-policy

§ 25b Use of Koalify (CRM Data Cleansing)

Within our CRM system, we utilize the service Koalify. The contractual relationship is governed by Koalify (with exclusive jurisdiction in Ghent, Belgium; contact: info@koalify.io). The service is used for the automated detection, cleansing, and merging of duplicate data records (duplicate contacts, companies, or tickets) within our database.

Purpose and Legal Basis: Koalify analyzes the data stored in our CRM (e.g., names, email addresses, company names) to prevent administrative errors and ensure data integrity. We utilize a Pro account for this service; any use of the processed data for training the underlying algorithms is contractually excluded. Processing is based on our legitimate interest in error-free and efficient data management pursuant to Art. 6 para. 1 lit. f GDPR. The data is processed within the storage retention periods of our CRM system and is automatically deleted if the tool is uninstalled.

§ 25c Use of Google Gemini (AI Support Optimization)

We use AI-based services from Google Gemini for automated text processing, analysis, and optimization of our support workflows. The provider for users in the EEA is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

Purpose and Legal Basis: Personal data from customer inquiries, communication histories, or support tickets (e.g., names, email addresses, message content) may be processed to generate fast, accurate responses and enhance service quality. We use paid Business/Pro accounts for this purpose, which contractually guarantees that the transmitted customer data is not used to train Google’s global AI models. Processing is carried out on the basis of our legitimate interest in efficient and quality-assured customer communication pursuant to Art. 6 para. 1 lit. f GDPR, as well as for contract performance or the implementation of pre-contractual measures pursuant to Art. 6 para. 1 lit. b GDPR. Data transmission to Google LLC in the USA cannot be entirely ruled out; this is safeguarded via EU Standard Contractual Clauses and strict technical security measures.

§ 26 Userlike

We use a chat function with an automatic reply function on our website. This service is provided by our contractual partner Userlike GmbH, Komödienstraße 18-24, 50667 Köln, Germany. (hereinafter referred to as "Userlike").

By using the chat, the following data is collected, processed and stored: chat content, date and time of the call, browser type/version, IP address, operating system, URL of the previously visited website, amount of data sent, first name, surname and, if applicable, the e-mail address.

The use of the chat and the provision of your data are voluntary. We use the chat on the basis of the contact you have made by using it to process the enquiry triggered by it. We process your data exclusively to answer your enquiry, on the basis of your consent (Art. 6 para. 1 lit. a GDPR) and to process the contractual relationship (Art. 6 para. 1 lit. b GDPR).

We also use the chatbot function. This is a computer programme that answers your written service requests around the clock with suitable answers from an information database. In order to improve the quality of service, we can log the progress of the automated and anonymised dialogues and subsequently check manually if the correct answers have been provided.

Further information can be found in Userlike's privacy policy:

https://www.userlike.com/de/terms#privacy-policy

§ 27 Zendesk (Customer Support Ticket System)

For processing customer inquiries, support tickets, and managing customer communications, we use the ticketing system provided by Zendesk. The provider for users in the EEA is Zendesk International Limited (55 Charlemont Place, Dublin 2, D02 F990, Ireland). The contract is concluded with Zendesk International Limited.

Purpose and Legal Basis: When you contact us via email, contact form, or other channels, your details (name, email address, phone number, content of the inquiry, as well as meta and communication data) are recorded in our ticket system to efficiently process, categorize, and answer your request. Data processing is carried out for the performance of a contract or to implement pre-contractual measures pursuant to Art. 6 para. 1 lit. b GDPR, as well as on the basis of our legitimate interest in professional, fast, and optimized customer service pursuant to Art. 6 para. 1 lit. f GDPR.

Data Processing and International Transfers: We have concluded a Data Processing Agreement (DPA) with Zendesk in accordance with Art. 28 GDPR. Since Zendesk is a global company headquartered in the USA (Zendesk, Inc., 989 Market Street, San Francisco, CA 94103, USA), data may be transferred to servers in the USA. This transfer is safeguarded by EU Standard Contractual Clauses (SCCs) and Zendesk's Binding Corporate Rules (BCRs) to guarantee an adequate level of data protection. Data is deleted as soon as your inquiry has been conclusively resolved and no statutory retention obligations apply.

§ 28 Algolia DocSearch

On our website, we use Algolia Instantsearch, which is a search engine service of Algolia Inc. (“Algolia”) for searching and indexing contents. In the context of Algolia Instantsearch, your IP address and your search request are transmitted to a server of Algolia and stored there for statistical purposes for a period of 90 days. Further information is available in Algolia’s Terms of Service and in the Algolia privacy policy:

https://www.algolia.com/policies/terms

https://www.algolia.com/policies/privacy

Algolia does not transfer the collected data to third parties but processes them internally for statistical analysis and for monitoring its services.

Algolia Docsearch is used for facilitating the search for, and finding of, information on our website and thus for ensuring user-friendliness. This is also our legitimate interest within the meaning of Art. 6 (1) sentence 1 point (f) GDPR.

§ 29 Elasticsearch

We use a search service on our website provided by Elasticsearch B.V. (Keizersgracht 281, 1016 ED Amsterdam, Netherlands). The service is used to index the content of our website and it serves the search function for users. By using the service, your IP address and search query are transmitted to a server of Elasticsearch and stored there for statistical purposes. Elastic may only collect the information that is also necessary to achieve the purpose. For more information, please see Elasticsearch's Terms of Use, General Privacy Statement, and Elasticsearch's Product Privacy Statement:

www.elastic.co/de/legal/terms-of-use

www.elastic.co/de/legal/privacy-statement

www.elastic.co/de/legal/product-privacy-statement

Elasticsearch does not share the collected data with third parties outside of its own data processing. The data is only processed internally for statistical analysis and monitoring of its services.

Elasticsearch is used for the findability of the information contained on our website. A search function is necessary for the functionality and usability of our site. This is also our legitimate interest within the meaning of Art. 6 para. 1 sentence 1 lit f. DSGVO.

§ 30 Social media

We have pages on the social networks. This is another channel for us to inform our customers and potential customers about the services we offer. The networks can also be used for simple communication or interaction regarding our services and our company. For this, the terms and conditions of business and the privacy policies of the platform operators apply. The processing is based on your consent (Art. 6 (1) sentence 1 point (a) GDPR) or on the purpose of contract performance (Art. 6 (1) sentence 1 point (b) GDPR) or on our legitimate interest (Art. 6 (1) sentence 1 point (f) GDPR).

The provider of the following Meta services (Instagram, Facebook) for users within the EEA is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Instagram: Online platform by Meta. Website: https://www.instagram.com; Privacy policy: https://www.instagram.com/legal/privacy/

LinkedIn: Provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

§ 31 Privacy on our Facebook page

For our Facebook page, we use the technical platform and the services of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Please be aware that, when you visit Facebook pages, your IP address and also other data are stored. This information is used to provide the operators of the Facebook pages with statistical information about how the users interact with the Facebook page ("Insights").

We are responsible for the collection of data on our page (fan page) together with Meta as joint controllers (Agreement under Art. 26 GDPR). Further information about the agreement with Meta is available at:

https://www.facebook.com/legal/terms/page_controller_addendum

Meta processes the usage data which are collected in the context of the platform and may also transfer them to countries outside the European Union (e.g., USA). Meta describes in its privacy policy which data are processed:

https://www.facebook.com/privacy/policy

§ 32 XING

We integrate features and contents of the XING service provided by New Work SE, Am Strandkai 1, 20457 Hamburg, Germany, into our website.

These include in particular the feature for booking events and workshops. If the users are members of the XING platform, New Work SE can assign the use of the feature to the user profiles there. In addition, the user’s IP address is transmitted to New Work SE as soon as the XING Events ticket shop is accessed.

The XING privacy policy is available at:

https://privacy.xing.com/de/datenschutzerklaerung

When you register for an event, your name, address and further contact details, if available (e.g. email address, telephone number), are transmitted to us. These data are processed for handling the registration and implementing the event.

The processing of the personal data on our website is carried out on the basis of Art. 6 (1) sentence 1 point (b) GDPR for the initiation and/or performance of a contract for participation in a workshop or event.

In addition, we have an account on the XING platform, which can be accessed directly. For this, we refer to the general information on social media platforms in § 19 of this Privacy Policy. The above references to the address and privacy policy of the provider are also valid for our account on the platform.

§ 33 Data protection in applications and application procedures

We collect and process personal data of applicants for handling and processing application procedures. The data may also be processed electronically, which in particular occurs when an applicant sends his/her application documents electronically, e.g. by email. If we enter into an employment contract with an applicant, the data provided to us are stored in accordance with the statutory provisions for the purpose of processing the employment relationship. If we do not enter into an employment contract with the applicant, the application documents will be deleted three months after the application has been rejected unless there are other legitimate interests preventing the deletion. Such a legitimate interest may for instance be the burden of proof in proceedings under the Allgemeines Gleichbehandlungsgesetz (German General Act on Equal Treatment - “AGG”).

The legal basis for the data processing is Art. 6 (1) sentence 1 point (b) GDPR if and to the extent the processing is necessary in order to take steps prior to entering into a contract. If no employment contract is concluded, the data processing is based on Art. 6 (1) sentence 1 point (f) GDPR.

§ 34 Termination, correction and deletion

As a user, you can at any time terminate the registration. You can have your personal data which have been stored by us corrected at any time. Please let us know if you want to renounce digital provision of the data. Please use the contact details provided or contact the data protection officer named below.

If the data are necessary for the performance of a contract or in order to take steps prior to entering into a contract, early deletion of the data is only possible if there is no contractual or legal obligation preventing the deletion.

§ 35 Rights of the data subject

You have the right

under Art. 15 GDPR to obtain information about, and access to, your personal data processed by us. You may in particular (without limitation) request information about the purposes of the processing, the categories of the personal data concerned, the categories of recipients to whom your data have been or are being disclosed, the envisaged period of storage, the existence of the right to request rectification or erasure of personal data or restriction of processing or the right to object to the processing, the existence of the right to lodge a complaint, the source of the data if they have not been collected by us as well as about the existence of automated decision-making including profiling and, if applicable, meaningful information about the details thereof.

under Art. 16 GDPR to request and obtain without undue delay the rectification of inaccurate, or completion of incomplete, personal data concerning you which we have stored;

under Art. 17 GDPR to request and obtain the erasure of your personal data stored by us unless the processing is necessary for exercising the right of freedom of expression and the right to information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;

under Art. 18 GDPR to request and obtain the restriction of the processing of your personal data if the accuracy of the personal data is contested by you, the processing is unlawful and you oppose the erasure of the personal data and we no longer need the personal data but they are required by you for the establishment, exercise or defence of legal claims or if you have objected to the processing pursuant to Art. 21 (1) GDPR;

under Art. 20 GDPR to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request the transmission of the data to another controller;

under Art. 7 (3) GDPR to withdraw your consent given to us at any time. As a consequence, we will no longer be allowed to continue the data processing, which was based on that consent, in the future; and

under Art. 77 GDPR to lodge a complaint with a supervisory authority. As a rule, you can lodge the complaint with the supervisory authority at the place of your habitual residence or your place of work or our company domicile.

§ 36 Right to object

You have the right under Art. 21 GDPR to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on legitimate interests according to Art. 6 (1) sentence 1 point (f) GDPR, or if your data are processed for direct marketing purposes. In the latter case, you have an unconditional right to object to the processing, which we will admit and implement without any need for you to state a particular situation.

For exercising your right of withdrawal or objection, it will be sufficient to send an email to the email address indicated in this Privacy Policy.

§ 37 Data security

While you are visiting our website, we use the common SSL procedure (Secure Socket Layer) in combination with the highest encryption level that is supported by your browser. This usually is the 256-bit encryption. If your browser does not support 256-bit encryption, we use the 128-bit v3 technology instead. You can see by the closed key or lock symbol in the status bar at the bottom of your browser window whether or not the transmission of individual pages of our website is encrypted.

In addition, we use appropriate technical and organisational measures to protect your data from accidental or wilful manipulation, partial or total loss, destruction or unauthorised access by third parties. Our security measures are continuously improved according to technological progress.

§ 38 Language version

This document is drafted in German and English. The English version is for convenience purposes only. In the case of discrepancies or differences in the interpretation of the German version on the one hand and the English version on the other hand, the German version shall be authoritative and exclusively binding.

Data protection officer

Christian Mische

PlentyONE GmbH

Johanna-Waescher-Straße 7

34131 Kassel

Germany

legal@plentyone.com