Information about the processing of your data
- In the following, “website” means all of the controller’s pages at www.progros.de.
- “Personal data” means any information relating to an identified or identifiable natural person. A person is identifiable if they can be identified, either directly or indirectly, in particular by means of assignment to an identifier such as a name, to an identification number, to location data, to an online identifier or to one or more special features that are an expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person. Personal data is therefore, for example, a person’s name, email address and telephone number, but may also include information about preferences, hobbies and memberships.
- “Processing” means operations or sets of operations carried out with or without the aid of automated procedures in connection with personal data, such as the collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure or destruction.
- “Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data cannot be attributed to an identified or identifiable natural person.
- “Consent” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes in a particular case by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
- “Google” means Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; reachable in the European Union at: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001.
progros Einkaufsgesellschaft mbH
Frankfurter Straße 10-14
+49(0) 61 96 50 17 0
+49 (0) 61 96-50 17-890
c/o progros Einkaufsgesellschaft mbH
Frankfurter Straße 10-14
Data protection queries
If you have any questions about data protection with regard to our company or our website, you can contact our data protection officer:
Spirit Legal LLP Rechtsanwälte
Attorney-at-law and data protection officer
Data protection officer
c/o progros Einkaufsgesellschaft mbH, Frankfurter Straße 10-14 Eschborn
Contact via encrypted online form:
We have taken comprehensive technical and organisational precautions to protect your personal data from unauthorised access, abuse, loss and other external disruption. To this end, we regularly review our security measures and adapt them to current standards.
You have the following rights with regard to the personal data concerning you that you can assert against us:
- right of access (Art. 15 GDPR),
- right to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR),
- right to restriction of processing (Art. 18 GDPR),
- right to object to processing (Art. 21 GDPR),
- right to withdraw your consent (Art. 7(3) GDPR),
- right to receive the data in a structured, commonly used, machine-readable format (“data portability”) and the right to transfer the data to another controller, if the prerequisites of Art. 20(1) (a), (b) GDPR are fulfilled (Art. 20 GDPR).
You can assert your rights by informing us using the contact details specified above under ‘Responsible provider’ or by contacting the data protection officer designated by us.
You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR).
Use of the website, access data
In principle, you can use our website for purely informational purposes without disclosing your identity. When you access the individual pages of the website in this sense, this only results in access data being transferred to our web hosting service so that the website can be displayed to you. This is the following data:
- browser type/browser version
- operating system used
- language and version of the browser software
- hostname of the accessing device
- IP address
- website from which the request comes
- content of the request (specific page)
- date and time of the server request
- access status/HTTP status code
- referrer URL (website visited before)
- volume of data transferred
- time zone difference from Greenwich Mean Time (GMT)
Temporary processing of the IP address by the system is necessary to make it technically possible to deliver the website to your device. This requires processing of your IP address for the duration of the session. The legal basis of such processing is Art. 6(1) Sentence 1(f) GDPR.
The access data is not used to identify individual users and is not combined with other data sources. The access data is deleted when it is no longer required for achieving the purpose of its processing. In the case of recording the data to provide the website, this is the case when you end your visit to the website.
IP addresses are stored in log files to ensure the functionality of the website. In addition, the data serves us to optimise the website and to ensure the security of our information technology systems. No evaluation of the data for marketing purposes takes place in this context either. In principal, data is deleted after seven days at the latest; further processing is possible in individual cases. In this case, the IP address is deleted or so transformed that an assignment of the retrieving client is no longer possible.
The recording of data for the provision of the website and the processing of data in log files is an absolute necessity for the operation of the website. You may object to the processing. In the event that your objection is justified, we will examine the situation and either stop or adjust the data processing or point out to you the compelling legitimate reasons on the basis of which we will continue processing.
a) Technically necessary cookies
Some elements of our website require that the retrieving browser can be identified even after a page change. This involves processing the following data in the cookies:
- language settings
- items in shopping basket
- login information
The user data collected by technically necessary cookies is not processed to create user profiles. We also use session cookies, which store a session ID that can be used to assign various requests from your browser to the shared session. Session cookies are required for using the website. In particular, they enable us to recognise the device used when you return to the website. If you have an account with us, we use this cookie to recognise you on subsequent visits to the website; otherwise you would have to log in again each time you visited. The legal basis of this processing is Art. 6(1) Sentence 1(f) GDPR. We use session cookies to make using our website more attractive and effective. Session cookies are deleted as soon as you log out or close your browser.
Most browsers are preset to automatically accept cookies. You can object to the processing of your data by cookies. You can disable or restrict the transfer of cookies by changing the settings in your internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use the full functionality of the website.
b) Technically non-essential cookies
- entered search terms
- frequency of page views
- use of website functions
These cookies are used to make using the website more efficient and attractive. The legal basis of this processing is Art. 6(1) Sentence 1(f) GDPR. The technically non-essential cookies are automatically deleted after a specified period, which may vary depending on the cookie.
Where we integrate cookies from third-party providers into our website, we point this out to you separately below.
d) Cookie banner notice
Contacting our company
When contacting our company, e.g. by email or using the contact form on the website, we will process the personal data provided by you so that we can respond to your enquiry.
In order for us to process enquiries submitted via the contact form on the website, it is essential that you provide a name or pseudonym and a valid email address and your address. In addition to this, the following data may be processed: telephone number, fax number, room, position, first name, last name, VAT identification number, industry, type of company, distribution channels, products, range, services, delivery areas, references, certificates, awards, quality management system. At the moment when you submit the message to us, the following data will also be processed:
- IP address
- date/time of registration
The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR and Art. 6(1) Sentence 1(b) GDPR, if the contact is made with the intention of concluding a contract.
Processing the personal data from the form allows us alone to process the contact you make with us. Where you contact us by email, this also constitutes the necessary legitimate interest in the processing of the data. The other personal data processed during the submission process serves to prevent any misuse of the contact form and to ensure the security of our information technology systems.
The data will not be transmitted to third parties in this context. The data is only processed in order to process the conversation. As soon as processing is no longer necessary, we delete the data generated in this context or, if statutory retention obligations apply, restrict processing of the data.
You have the possibility to object to the processing of your personal data for contact requests at any time. This is the case if processing is not necessary in particular to fulfil a contract with you, which is described by us in the previous description of the functions. In such a case, it may not be possible to continue processing the request. In the event that your objection is justified, we will examine the situation and either stop or adjust the data processing or point out to you the compelling legitimate reasons on the basis of which we will continue processing.
Processing and transmission of personal data for contractual purposes
We process your personal data if and to the extent necessary for the initiation, creation, execution and/or termination of a legal transaction with our company. The legal basis of this results from Art. 6(1) Sentence 1(b) GDPR.
Once the purpose has been achieved (e.g. contract processing), the personal data will be blocked for further processing or erased, unless we are entitled to retain the data for a longer period and process it as required in the respective context on the basis of a consent granted by you (e.g. consent to the processing of your email address for sending promotional emails), a contractual agreement, a statutory authorisation (e.g. authorisation to send direct advertising) or on the basis of justified interests (e.g. retention for asserting claims).
Your personal data will be passed on if
- it is necessary for the creation, execution or termination of legal transactions with our company (e.g. when transmitting data to a payment service provider/a shipping company to process a contract with you) (Art. 6(1) Sentence 1(b) GDPR), or
- a subcontractor or party we use to perform our obligations, which we use exclusively within the framework of providing the offers or services requested by you, needs this data (unless you are expressly informed otherwise, such auxiliary parties are only entitled to process the data insofar as this is necessary for the provision of the offer or service), or
- there is an enforceable official order (Art. 6(1) Sentence 1(c) GDPR) or
- there is an enforceable court order (Art. 6(1) Sentence 1(c) GDPR) or
- we are legally obliged to do so (Art. 6(1) Sentence 1(c) GDPR) or
- the processing is necessary in order to protect the vital interests of the data subject or another natural person (Art. 6(1) Sentence 1(d) GDPR) or
- we are authorised or even obliged to pursue overriding legitimate interests (Art. 6(1) Sentence 1(f) GDPR).
Your personal data will not be transmitted to other persons, companies or bodies unless you have effectively consented to such transmission. The legal basis of the processing is then Art. 6(1) Sentence 1(a) GDPR.
Processing and transmission of personal data in the online ordering system
If you wish to submit an order or booking in our online shop, it is necessary for the initiation and conclusion of the contract that you provide personal data such as your name, your address and your email address. The mandatory data required for order and contract processing is marked as such; further information is provided voluntarily. We process your data for order processing; in particular, we will forward payment data to your chosen payment service provider or our main bank.
As soon as processing is no longer necessary, we delete the data generated in this context or, if statutory retention obligations apply, restrict processing of the data. Due to mandatory commercial and tax regulations, we are obliged to keep your address, payment and order data for a period of ten years. After two years after termination of the contract, we will restrict the processing and reduce the processing to compliance with our existing legal obligations.
Registration, password-protected area on the website
If you wish to use the password-protected area of our website, you must register by providing the following information:
- email address
- first and last name
- password chosen by you
- contract number
You do not have to enter a real name and are free to use the website pseudonymously.
Furthermore, the following data is processed at the time of registration:
- Datum/ Uhrzeit der Registrierung
The data will be deleted as soon as it is no longer required for achieving the purpose of its processing. This is the case for the data collected during the registration process if the registration on the website is cancelled or modified.
The following functions are available to you in the password-protected area:
- Edit your profile data,
- view past orders/bookings.
If you use the password-protected area of the website, e.g. to edit your profile data or to view orders and bookings made, we also process the data about your person required for the initiation or fulfilment of the contract, in particular address data and information about the payment method. The legal basis for the processing is Art. 6(1) Sentence 1(b) GDPR. The data will be deleted as soon as it is no longer required for achieving the purpose of its processing or as soon as there are no legitimate interests preventing its erasure. Due to mandatory commercial and tax regulations, we are obliged to keep your address, payment and order data for a period of ten years. After two years after termination of the contract, we will restrict the processing and reduce the processing to compliance with our existing legal obligations.
If you provided further data voluntarily (e.g. about interests, sizes, age, gender, children, preferences, wish lists), we process your data which is not necessary for the initiation or fulfilment of a contract, for as long as you use the password-protected area and if you do not delete it yourself beforehand. Our aim in this respect is to optimise the use of the website for you as a user. The legal basis for this is Art. 6(1) Sentence 1(f) GDPR.
You can object to the processing of the information provided by you voluntarily. You can manage, change or delete your voluntary information yourself at any time in the password-protected area. You are free to take measures in accordance with the ‘Your rights’ section, although if you do have any complaints we request that you first contact our company.
Registering for events
On the website, you can register as a guest or speaker for events organised by our company or events our company will attend. The basis for processing your data for participation in events is Art. 6(1) Sentence 1(b) GDPR. The processing is necessary for the creation, execution or termination of legal transactions with our company (e.g. also when transmitting data to a payment service provider/a shipping company to process a contract with you).
Among other information, in the registration form you are required to specify your name, your company and your email address. The purpose of the processing is to foster contacts and to improve our corporate image and our public relations work. If you have expressed your interest in a personal appointment, your data will also be processed for preparing and carrying out the appointment.
Your data will be passed on to third parties (e.g. payment service provider and/or shipping company if applicable as well as the organiser) for the purpose of payment processing, dispatch of event documents and registering the event with the organiser. A deliberate transfer of your personal data to a so-called third country is not planned.
As soon as processing is no longer necessary, we delete the data generated in this context or, if statutory retention obligations apply, restrict processing of the data.
Comment feature, guestbook on the website
On the website you can leave comments/reviews/posts in the guestbook.
When you post, we process the following personal data:
You do not have to enter a real name and are free to use the feature pseudonymously.
Furthermore, the following data is processed at the time of posting:
- IP address
- date/time of post
When your post is published, we will only publish the company you told us, and not the email address you provided. Your post will not be checked by us before publication. We reserve the right to remove posts at any time if they are found to be unlawful.
If necessary, we process your email address and your name/pseudonym in order to be able to determine whether the content shared in the post is genuine. Furthermore, we would like to be able to contact you if someone else objects to your post on the website, and to defend ourselves against complaints or claims that may be brought against us as a result of your post.
For this purpose, we also process your IP address. We delete the IP address after 1 week. We will process your email address as long as the post continues to exist on the website or we are involved with the post in the context of a legal dispute.
If you or we delete your post, we process the email address, the name provided and other voluntary information up to the expiry of the statutory limitation periods for the aforementioned reasons of prevention and defence, but restrict the processing of this data after 6 months.
We do not pass the data on to third parties, unless we are obliged to do so by law or by official or judicial order or transmission is necessary for the enforcement of our legitimate interests. The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR.
You can object to the processing of the information you provide. You can delete your post yourself at any time. You are free to take measures in accordance with the ‘Your right’' section, although if you do have any complaints we request that you first contact our company.
We are pleased that you are interested in us and that you wish to apply or have already applied for a position in our company. In the following, we would like to provide you with information about the processing of your personal data in connection with your application. We process the data necessary for the online application process (name, email address and town) as well as data that you have sent us in connection with your application in order to check your suitability for the position (or any other vacancies within our company) and to conduct the application process.
The legal basis for the processing of your personal data in this application process is primarily Section 26 of the German Federal Data Protection Act (BDSG) as amended on 25 May 2018. It allows the processing of data required in connection with hiring decisions. Should the data be required for the assertion of legal rights after completion of the application process, data may be processed on the basis of the requirements of Art. 6 GDPR, in particular to safeguard legitimate interests pursuant to Art. 6(1)(f) GDPR. In such cases, our interest is in asserting or defending claims.
In the event of a rejection, candidate data will be deleted after 6 months. In the event that you have agreed to further storage of your personal data, we will add your data to our applicant pool. There the data will be deleted after two years. If you are offered a job in the context of the application process, the data from the applicant data system will be transferred to our HR information system.
We use a specialist software provider for the application process. It acts as a service provider for us and may also become aware of your personal data in the context of system maintenance and support. We have concluded what’s known as a data processing agreement with this provider, which ensures that data processing is carried out in a permissible manner.
Upon receipt of your application, your application data will be reviewed by the HR department. Suitable applications are then forwarded internally to the department heads for the respective vacancies. The next steps to be taken are then agreed upon. In principle, only those persons in the company have access to your data who need this for the regular conduct of our application process.
You have the possibility to object to the processing of your data at any time. This is the case if processing is not necessary in particular to fulfil a contract with you, which is described by us in the previous description of the functions. In the event that your objection is justified, we will examine the situation and either stop or adjust the data processing or point out to you the compelling legitimate reasons on the basis of which we will continue processing.
We use external hosting services for the provision of the following services: infrastructure and platform services, computing capacity, storage resources and database services, security and technical maintenance services. This involves processing all data necessary for the operation and use of our website.
We use external hosting services to run this website. By using external hosting services, we aim to make the provision of our website efficient and secure. The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR.
The recording of data for the provision and use of the website and the processing of data using external web hosting services is an absolute necessity for the operation of the website. You may object to the processing. In the event that your objection is justified, we will examine the situation and either stop or adjust the data processing or point out to you the compelling legitimate reasons on the basis of which we will continue processing.
Brühler Str. 58
CH -6340 Baar
VR Diskontbank GmbH
DEHAG Hotel Service AG
Frankfurter Str. 10-14
DE- 65760 Eschborn
Steinacher Str. 6
DE- 90427 Nürnberg
MOKOM 01 direkt GmbH & Co. KG
DE - 60322 Frankfurt am Main
Advertising to existing customers
We reserve the right to process the email address provided by you when registering/ordering/booking in accordance with the statutory provisions in order to send you the following content by email whilst or after processing the contract, unless you have already objected to this processing of your email address:
- other interesting offers from our portfolio,
- information about company events,
- technical information,
- sending our catalogue,
- questions about special requirements,
- information on finding us by public transport.
The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR. We perform this processing for customer care and to enhance our services. We delete your data when you cancel your newsletter subscription, but no later than two years after termination of the contract.
Furthermore, we process the evaluation of the order/booking on the basis of user interests. If it is not essential to send information electronically for contract processing (e.g. email with payment information), the legal basis for processing is Art. 6(1) Sentence 1(f) GDPR. We carry out the above processing in order to optimise our service or website.
We would like to point out that you can object to receiving direct advertising at any time without incurring any costs other than the transmission costs according to the basic rates. To do this, click on the unsubscribe link in the newsletter or send us your objection using the contact data provided under ‘Responsible provider’.
You have the possibility to subscribe to our email newsletter on the website, which we use to inform you regularly about the following content:
- offers from our portfolio,
- information about company events,
- third-party offers (including events), provided you have consented to this,
- new articles/collections,
- special/time-limited offers.
- In order to receive the newsletter, you need to give us the following personal data.
- recipient (name or pseudonym)
- valid email address
To subscribe to our email newsletter, please use the double opt-in process. Once you have entered the data marked as mandatory, we will send you an email to the email address you have provided, in which we ask you to expressly confirm your subscription to the newsletter (by clicking on a confirmation link). This is how we ensure that you really want to receive our email newsletter. If no confirmation takes place within 24 hours, we block the information transferred to us and delete it automatically after one month at the latest. All contacts of companies with which we have a contractual business relationship receive a regular newsletter by email in accordance with their contract for the purpose of providing our services to those contractual partners. Recipients can unsubscribe from it at any time by clicking on a clearly marked ‘Unsubscribe’ button.
Furthermore, the following data is processed at the time of subscription:
- IP address,
- date/time of registration for the newsletter,
- time when you click on the confirmation link.
We process your IP address, the time of registration for the newsletter and the time of your confirmation in order to document your newsletter registration and to prevent abuse of your personal data. The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR. We process this data until two years after termination of the contract. If registration for the newsletter takes place and it is unrelated to the conclusion of a contract, we process this data until two years after termination of the usage. We delete this data when the newsletter subscription ends.
After your confirmation, we will process the email address and name/pseudonym of the recipient concerned for the purpose of sending our email newsletter. The legal basis of the processing is Art. 6(1) Sentence 1(a) GDPR. We delete this data when you unsubscribe from the newsletter.
You can revoke your consent to the processing of your email address for receiving the newsletter at any time, either by sending us a message (see the contact details under ‘Responsible provider’) or by clicking directly on the unsubscribe link in the newsletter.
MailChimp email marketing service
We use the email marketing service MailChimp, provided by Rocket Science Group, LLC (675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA, web: mailchimp.com; hereinafter referred to as “MailChimp”).
If you have registered for the newsletter, the data provided during registration will be stored and processed on MailChimp’s servers in the USA. MailChimp processes this information for sending and analysing the newsletters on our behalf. MailChimp newsletters contain what are known as web beacons, which are pixel-sized files that are retrieved from the MailChimp server when the newsletter is opened. In the context of the retrieval, technical information, such as the browser used, time of the page retrieval and IP address, is collected. This information is processed to analyse and technically improve the services. Furthermore, it is analysed whether newsletters are opened, when they are opened and which links are clicked on by the reader. This information can theoretically be assigned to individual newsletter recipients. However, neither we nor MailChimp have any intention of monitoring individual recipients; the analysis of the information mentioned serves rather to recognise the reading habits of the recipients so as to better adapt and distribute our newsletter content accordingly. The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR. We have no knowledge of how long MailChimp stores data and have no way of influencing this.
You can object to the processing in the future at any time by clicking on the unsubscribe link at the end of the newsletter. This will simultaneously end the processing of data for you being sent the newsletter and for statistical analysis. It is not possible to object to the distribution via MailChimp or the statistical evaluation separately.
Alternatively, you can object at www.aboutads.info/choices/ and www.youronlinechoices.com (for the European Union area
Furthermore, MailChimp has informed us that it may use the transferred data to optimise or improve its own services, e.g. to technically optimise the sending and presentation of newsletters. According to its own information, MailChimp neither processes the data in order to write to you with its own advertising nor transmits the data to third parties.
As the recipient of the newsletter, you may be redirected to the MailChimp website, for example if there are problems displaying the newsletter in your email client and you follow the link contained in the newsletter to retrieve the newsletter online. In this context, we would like to point out that further analysis services and cookies may be used on the MailChimp website, which may process your personal data on behalf of MailChimp. We have no influence on this processing.
MailChimp is certified under Privacy Shield, the US-EU data protection agreement, and is thus committed to complying with the European Union’s data protection regulations. Please refer to MailChimp’s website for more information: mailchimp.com/legal/privacy/.
In order to be able to communicate with you better and answer questions about the online platform quickly, we use the survey feature of SurveyMonkey, provided by the company SurveyMonkey Europe UC (2nd Floor, 2 Shelbourne Buildings, Shelbourne Road, Dublin, Ireland, web: www.surveymonkey.de hereinafter referred to as “SurveyMonkey”). SurveyMonkey’s survey tool is used as a communication medium and enables communication with website visitors.
The data is only processed in order to process the survey. As soon as processing is no longer necessary, we delete the data generated in this context or, if statutory retention obligations apply, restrict processing of the data. The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR. If the survey is conducted as part of a contest, the legal basis for the processing is Art. 6(1) Sentence 1(b) GDPR. We perform this processing for customer care and to enhance our services.
You can object to the processing in the future at any time by clicking on the unsubscribe link at the end of the newsletter, provided the survey is conducted by email. Alternatively, you can exercise your right of objection by sending us a message (see the contact details under ‘Responsible provider’).
Integration of third-party content
The website integrates third-party content such as videos, maps, RSS feeds and graphics from other websites. This integration always requires that the providers of this content (“third-party providers”) perceive the IP addresses of users. This is because without the IP address they would not be able to send the content to the browser of the respective user. As such, the IP address is required to display this content.
We endeavour to only use content from third-party providers who process the IP address solely for delivering the content. We do however have no influence over whether the third-party providers process the IP addresses, e.g. for statistical purposes. If we are aware of such activity, we inform you of this in the following.
Some of the third parties may process data outside the European Union.
Hierdurch kann es allerdings zu Funktionseinschränkungen auf der Website kommen.
Google Web Fonts
Wir nutzen zur einheitlichen Darstellung von Schriftarten sogenannte Web Fonts, die von Google bereitgestellt werden. Beim Aufruf einer Seite lädt Ihr Browser die benötigten Web Fonts in ihren Browsercache, um Texte und Schriftarten korrekt anzuzeigen.
Zu diesem Zweck muss der von Ihnen verwendete Browser Verbindung zu den Servern von Google aufnehmen. Hierdurch erlangt Google Kenntnis darüber, dass über Ihre IP-Adresse unsere Website aufgerufen wurde. Die Nutzung von Google Web Fonts erfolgt im Interesse einer einheitlichen und ansprechenden Darstellung unserer Online-Angebote. Dies stellt ein berechtigtes Interesse im Sinne von Art. 6 Abs. 1 S. 1 lit. f) DSGVO dar. Von der Speicherdauer bei Google haben wir keine Kenntnis und auf sie keine Einflussmöglichkeit.
This may however result in functional restrictions on the website.
Google Web Fonts
We use web fonts provided by Google for the uniform display of fonts. When you retrieve a page, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.
For this purpose, the browser you are using must connect to Google’s servers. By doing so, Google becomes aware that our website has been accessed via your IP address. Our use of Google Fonts is in the interest of a uniform and visually appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6(1) Sentence 1(f) GDPR. We have no knowledge of how long Google stores data and have no way of influencing this.
You can object to the processing by changing your browser settings in such a way that the browser does not support web fonts – although then your device will use a default font.
Google Tag Manager
We use Google Tag Manager on our website. Google Tag Manager is a solution that allows marketers to manage website tags through a single interface. The Tag Manager tool itself (which implements the tags) is a cookieless domain and does not record any personal data. The tool triggers other tags, which in turn may record data. Google Tag Manager does not access this data. If deactivation has occurred at the domain or cookie level, it will remain effective for all tracking tags implemented with Google Tag Manager.
Integration of Google Maps
This website also uses the Google Maps service from Google to display maps or sections of maps, thus enabling you to conveniently use the map function on the website.
By visiting the website, Google receives the information that you have retrieved the corresponding subpage of our website. In addition, the data mentioned under ‘Access data’ is transferred to Google. This occurs regardless of whether Google provides a user account that you are logged in with or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish for this data to be associated with your Google profile, you must log out before activating the button.
Google stores your data as usage profiles and processes it for purposes of advertising, market research and/or the demand-oriented design of its website. Such analysis takes place in particular (even for users who are not logged in) to provide demand-oriented advertising and to inform other users of the social network about your activities on our website.
The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR. The processing serves to make our website more attractive and to offer you additional services. We have no knowledge of how long Google stores data and have no way of influencing this.
You have the right to object to the processing, although you must contact Google to exercise this right. You can disable or restrict the transfer of cookies by changing the settings in your internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use the full functionality of the website.
Our website uses plug-ins from the image agency Getty Images, which offers pictures and other image material. The Getty Images components are provided by Getty Images International, 1st Floor, The Herbert Building, The Park, Carrickmines, Dublin 18, Ireland (“Getty Images”).
The legal basis of the processing is Art. 6(1) Sentence 1(f) GDPR. The processing serves to make our website more attractive and to offer you additional services. We have no knowledge of how long Getty Images stores data and have no way of influencing this.
You have the right to object to the processing, although you must contact Getty Images to exercise this right. You can disable or restrict the transfer of cookies by changing the settings in your internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use the full functionality of the website.
Services for statistical, analysis and marketing purposes
Some of the third-party providers offer users the option of directly objecting to the use of the respective feature, e.g. by placing an opt-out cookie.
If you activate such an opt-out cookie, the third-party provider will no longer process data about your usage behaviour in the future. It is also possible to merely object individually to a partial selection of external services. If you change the browser or device used or delete all cookies, you will be required to set the opt-out cookie again.
In the following, we inform you about the services from external providers currently in use on our website, about the purpose and scope of the respective processing in each case, and about how you can object.
In order to tailor our website perfectly to your interests, we use Google Analytics, a web analytics service from Google. Google Analytics uses ‘cookies’ (see 'Cookies' above), which are stored on your device to enable the analysis of how you use the website. The information generated in this way about your use of this website is transferred to and stored by Google on a server in the USA.
However, if IP anonymisation is activated on this website, then within European Union Member States or in other member states of the European Economic Area Google will shorten your IP address before transferring it. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. On our behalf, Google will use this information for the purpose of evaluating your use of this website, compiling reports for us on website activity, and providing us with other services relating to website usage and internet usage.
Google will not associate your browser’s IP address transmitted for Google Analytics purposes with any other data held by Google.
This website uses Google Analytics with the “_anonymizeIp()” extension. As a result, IP addresses are further processed in abbreviated form, meaning that any association with individual persons can be ruled out. As far as the data collected about you relates to you personally, that relation is therefore excluded immediately and the personal data thus erased without delay.
We use Google Analytics to analyse and regularly improve the use of our website. The statistics help us to improve our website and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has subjected itself to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework. The legal basis of the processing by Google Analytics is Art. 6(1) Sentence 1(f) GDPR. The Analytics cookies are deleted after fourteen months at the latest.
You have the right to object. You can prevent the storage of cookies using the corresponding settings in your browser software; however, we would like to point out that if you do this you may not be able to use the full functionality of this website. Furthermore, you can prevent the recording of data generated by the cookie about your use of the website (including your IP address) and its processing by Google by downloading and installing the browser plug-in available via the following link: tools.google.com/dlpage/gaoptout.
For more information about the third-party provider Google, please refer to:
www.google.com/analytics/terms/de.html, www.google.com/intl/de/analytics/learn/privacy.html, www.google.de/intl/de/policies/privacy.
This website also uses Google Analytics for a cross-device analysis of visitor flows, which is performed by means of user IDs
Social network plug-ins
Social network plug-ins are integrated into our website. These are provided by the following providers:
- Facebook (the provider is Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, email: firstname.lastname@example.org, data protection information at: www.facebook.com/privacy/explanation; www.facebook.com/about/privacy/your-info-on-other and www.facebook.com/about/privacy/your-info. Facebook has subjected itself to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework; hereinafter: “Facebook”);
- Instagram Inc., 1601 Willow Road, Menlo Park, California 94025, USA;
- Kununu GmbH, Neutorgasse 4-8, Top 3.02, 1010 Vienna, Austria (the provider is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany, data protection information at: privacy.xing.com/de/datenschutzerklaerung
- Twitter, Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA (https://twitter.com/privacy. Twitter has subjected itself to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework);
- XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany (http://www.xing.com/privacy);
The plug-ins can be recognised on our website by the aforementioned lettering or by small stylised symbols.
We offer you the possibility to communicate directly with the provider of the plug-in via the button. Only if you click on the marked field and thereby activate it does the plug-in provider receive the information that you have accessed the corresponding page of our website. In addition, the data mentioned under ‘Access data’ is transmitted.
In the case of Facebook and Xing, according to the respective providers' own information, IP addresses in Germany are anonymised immediately after their collection. By activating the plug-in, personal data about you is therefore transferred to the respective plug-in provider and processed there (in the USA in the case of US providers). Since the plug-in provider collects data via cookies in particular, we recommend that before clicking on the greyed-out box you delete all cookies using your browser’s security settings.
We have no influence on the data collected and processing procedures, and nor are we aware of the full scope of data processing, the purposes of processing, or the storage periods. We also have no information about the erasure of the data collected by the plug-in provider.
The plug-in provider stores the data collected about you as usage profiles and processes this for purposes of advertising, market research and/or the demand-oriented design of its website. Such analysis takes place in particular (including for users who are not logged in) to display demand-oriented advertising and to inform other users of the social network about your activities on our website.
The legal basis for the use of the plug-ins is Art. 6(1) Sentence 1(f) GDPR. Through the plug-ins we offer you the possibility to interact with social networks and other users, so that we can improve our website and make it more interesting for you as a user.
You have the right to object to the creation of these user profiles, although you must contact the respective plug-in provider to exercise this right. There are also various ways in which you can prevent the creation of user profiles and thus make use of your right to object:
- by setting your browser software accordingly; in particular, disabling third-party cookies means that you will not receive any ads from third-party providers;
- by disabling interest-based ads from providers who are part of the “About Ads” self-regulation initiative via the link www.aboutads.info/choices, please note that this setting will be erased if you erase your cookies.
The data is transferred regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in with the plug-in provider, the data about you collected by us will be directly assigned to your existing account with that plug-in provider. If you click or tap on the activated button and, for example, share a link to the page, the plug-in provider will also store this information in your user account and share it publicly with your contacts.
After using a social network, we recommend that you log out regularly, especially however before activating the button, as in this way you can avoid being assigned to your profile with the respective plug-in provider.
Copyright by Spirit Legal LLP
Data protection officer
Spirit Legal LLP Rechtsanwälte
Attorney-at-law and data protection officer Peter Hense