Version as of 1 October 2023

PRIVACY POLICYCURADEN AG – GDPR
Table of contents
PRIVACY POLICY ........................................................................................................................ 1
CURADEN AG – GDPR ................................................................................................................ 1
1. An overview of data protection ...................................................................................... 5
1.1.

General information .................................................................................................... 5

1.2.

Data recording on this website ................................................................................... 5

1.3.

Analysis tools and tools provided by third parties ...................................................... 6

2. General information and mandatory information ......................................................... 7
2.1.

Data protection ........................................................................................................... 7

2.2. Information about the responsible party (referred to as the “controller” in theGDPR) ..................................................................................................................................... 8
2.3.

Storage duration ......................................................................................................... 8

2.4.

General information on the legal basis for the data processing on this website ....... 8

2.5.

Designation of a data protection officer ..................................................................... 9

2.6.

Information on data transfer to the USA and other non-EU countries ...................... 9

2.7.

Revocation of your consent to the processing of data ............................................. 10

2.8. Right to object to the collection of data in special cases; right to object to directadvertising (Art. 21 GDPR) ................................................................................................... 10
2.9.

Right to log a complaint with the competent supervisory agency ........................... 10

2.10.

Right to data portability ........................................................................................ 11

2.11.

SSL and/or TLS encryption ..................................................................................... 11

2.12.

Encrypted payment transactions on this website ................................................. 11

2.13.

Information about, rectification and eradication of data ..................................... 11

2.14.

Right to demand processing restrictions............................................................... 12

3. General Recording of data on this website .................................................................. 12
3.1.

Cookies ...................................................................................................................... 13

3.2.

Consent with Cookiebot ............................................................................................ 14

3.3.

Contact form ............................................................................................................. 15

3.4.

Request by e-mail, telephone, or fax ........................................................................ 15

3.5.

Typeform ................................................................................................................... 16

page 1 of 68

Version as of 1 October 2023
3.6.

Hubspot CRM ............................................................................................................ 17

3.7.

Registration on this website...................................................................................... 18

3.8.

Registration with Google ........................................................................................... 18

3.9.

Registration with Facebook Connect ........................................................................ 19

4. Social media on this website......................................................................................... 21
4.1.

Social media elements with Shariff ........................................................................... 21

4.2.

Facebook ................................................................................................................... 22

4.3.

Twitter ....................................................................................................................... 24

4.4.

Instagram................................................................................................................... 25

4.5.

LinkedIn ..................................................................................................................... 26

4.6.

XING ........................................................................................................................... 27

5. Analysis tools and advertising....................................................................................... 28
5.1.

Google Tag Manager ................................................................................................. 28

5.2.

Google Analytics ........................................................................................................ 29

5.3.

Hotjar......................................................................................................................... 31

5.4.

WP Statistics .............................................................................................................. 32

5.5.

Google Ads ................................................................................................................ 33

5.6.

Google AdSense (not personalised) .......................................................................... 34

5.7.

Google Remarketing .................................................................................................. 35

5.8.

Google Conversion-Tracking ..................................................................................... 35

5.9.

Google DoubleClick ................................................................................................... 36

5.10.

Facebook Pixel ....................................................................................................... 37

5.11.

LinkedIn Insight Tag ............................................................................................... 39

5.12.

Sentry ..................................................................................................................... 42

5.13.

Outbrain ................................................................................................................. 43

5.14.

TikTok..................................................................................................................... 44

6. Newsletter..................................................................................................................... 47
6.1.

Newsletter data ......................................................................................................... 47

6.2.

Shared use of customer data of Curaden AG ............................................................ 47

6.3.

Mailchimp .................................................................................................................. 48

6.4.

SendGrid/Twilio ......................................................................................................... 50

7. Plug-ins and Tools ......................................................................................................... 51
7.1.

YouTube with expanded data protection integration .............................................. 51

7.2.

Vimeo Without Tracking (Do-Not-Track) .................................................................. 52

7.3.

Google Maps ............................................................................................................. 53

page 2 of 68

Version as of 1 October 2023
7.4.

Google reCAPTCHA.................................................................................................... 54

7.5.

Wordfence ................................................................................................................. 55

7.6.

ManageWP ................................................................................................................ 56

8. eCommerce and payment service providers ................................................................ 57
8.1.

Processing of Customer and Contract Data .............................................................. 57

8.2. Data transfer upon closing of contracts for online stores, retailers, and theshipment of merchandise .................................................................................................... 57
8.3.

Data transfer upon closing of contracts for services and digital content ................. 58

8.4.

Credit checks ............................................................................................................. 58

8.5.

Payment services....................................................................................................... 58

8.6.

PayPal ........................................................................................................................ 59

8.7.

Stripe ......................................................................................................................... 59

8.8.

Instant transfer Sofort ............................................................................................... 60

8.9.

Unzer ......................................................................................................................... 60

8.10.

American Express .................................................................................................. 61

8.11.

Mastercard ............................................................................................................ 61

8.12.

VISA ........................................................................................................................ 61

8.13.

PayU ....................................................................................................................... 62

8.14.

Payment services ................................................................................................... 62

8.15.

Apple Pay ............................................................................................................... 62

8.16.

Google Pay ............................................................................................................. 62

8.17.

Amazon Pay ........................................................................................................... 63

8.18.

Afterpay ................................................................................................................. 63

9. Online-based Audio and Video Conferences ................................................................ 64(Conference tools) ............................................................................................................... 64
9.1.

Data processing ......................................................................................................... 64

9.2.

Purpose and legal bases ............................................................................................ 65

9.3.

Duration of storage ................................................................................................... 65

9.4.

Conference tools used............................................................................................... 66

9.5.

Webex ....................................................................................................................... 66

10.

Custom Services ........................................................................................................ 67

10.1.

Handling applicant data ......................................................................................... 67

10.2.

Scope and purpose of the collection of data......................................................... 67

10.3.

Data Archiving Period ............................................................................................ 68

10.4.

Admission to the applicant pool ............................................................................ 68

page 3 of 68

Version as of 1 October 2023

page 4 of 68

Version as of 1 October 2023

1. An overview of data protection

1.1.

General information

The following information will provide you with an easy to navigate overview of what will
happen with your personal data when you visit this website. The term “personal data”
comprises all data that can be used to personally identify you. For detailed information
about the subject matter of data protection, please consult our Data Protection Declaration,
which we have included beneath this copy.

1.2.

Data recording on this website

Who is the responsible party for the recording of data on this website (i.e., the“controller”)?
The data on this website is processed by the operator of the website, whose contact
information is available under section “Information about the responsible party (referred toas the “controller” in the GDPR)” in this Privacy Policy.
How do we record your data?
We collect your data as a result of your sharing of your data with us. This may, for instancebe information you enter into our contact form.
Other data shall be recorded by our IT systems automatically or after you consent to its
recording during your website visit. This data comprises primarily technical information(e.g., web browser, operating system, or time the site was accessed). This information isrecorded automatically when you access this website.
What are the purposes we use your data for?
A portion of the information is generated to guarantee the error free provision of thewebsite. Other data may be used to analyse your user patterns.

page 5 of 68

Version as of 1 October 2023
What rights do you have as far as your information is concerned?
You have the right to receive information about the source, recipients, and purposes of yourarchived personal data at any time without having to pay a fee for such disclosures. You also
have the right to demand that your data are rectified or eradicated. If you have consented
to data processing, you have the option to revoke this consent at any time, which shallaffect all future data processing. Moreover, you have the right to demand that theprocessing of your data be restricted under certain circumstances. Furthermore, you havethe right to log a complaint with the competent supervising agency.
Please do not hesitate to contact us at any time if you have questions about this or any
other data protection related issues.

1.3.

Analysis tools and tools provided by third parties

There is a possibility that your browsing patterns will be statistically analysed when yourvisit this website. Such analyses are performed primarily with what we refer to as analysis
programs.
For detailed information about these analysis programs please consult our Data Protection
Declaration below.

page 6 of 68

Version as of 1 October 2023

2. General information and mandatory information

2.1.

Data protection

The operators of this website and its pages take the protection of your personal data very
seriously. Hence, we handle your personal data as confidential information and incompliance with the statutory data protection regulations and this Data Protection
Declaration.
Whenever you use this website, a variety of personal information will be collected. Personal
data comprises data that can be used to personally identify you. This Data Protection
Declaration explains which data we collect as well as the purposes we use this data for. It
also explains how, and for which purpose the information is collected.
We herewith advise you that the transmission of data via the Internet (i.e., through e-mailcommunications) may be prone to security gaps. It is not possible to completely protect
data against third-party access.

page 7 of 68

Version as of 1 October 2023

2.2.

Information about the responsible party (referred to as the“controller” in the GDPR)
The data processing controller on this website is:

Curaden AG
Amlehnstrasse 22
CH-6010 Kriens
Switzerland
Phone: +41 41 319 45 00
E-mail: info@curaden.ch

The controller is the natural person or legal entity that single-handedly or jointly with others
makes decisions as to the purposes of and resources for the processing of personal data
(e.g., names, e-mail addresses, etc.).

2.3.

Storage duration

Unless a more specific storage period has been specified in this privacy policy, your personal
data will remain with us until the purpose for which it was collected no longer applies. If you
assert a justified request for deletion or revoke your consent to data processing, your data
will be deleted, unless we have other legally permissible reasons for storing your personal
data (e.g., tax or commercial law retention periods); in the latter case, the deletion will takeplace after these reasons cease to apply.

2.4.

General information on the legal basis for the dataprocessing on this website
If you have consented to data processing, we process your personal data on the basis of Art.
6 (1)(a) GDPR or Art. 9 (2)(a) GDPR, if special categories of data are processed according toArt. 9 (1) GDPR. In the case of explicit consent to the transfer of personal data to third
countries, the data processing is also based on Art. 49 (1)(a) GDPR. If you have consented tothe storage of cookies or to the access to information in your end device (e.g., via device

page 8 of 68

Version as of 1 October 2023
fingerprinting), the data processing is additionally based on § 25 (1) TTDSG. The consent canbe revoked at any time. If your data is required for the fulfillment of a contract or for the
implementation of pre-contractual measures, we process your data on the basis of Art.
6(1)(b) GDPR. Furthermore, if your data is required for the fulfillment of a legal obligation,
we process it on the basis of Art. 6(1)(c) GDPR. Furthermore, the data processing may be
carried out on the basis of our legitimate interest according to Art. 6(1)(f) GDPR. Informationon the relevant legal basis in each individual case is provided in the following paragraphs ofthis privacy policy.

2.5.

Designation of a data protection officer

We have appointed a data protection officer for our company.
Curaden AG
Amlehnstrasse 22
6010 Kriens
Switzerland
Phone: +41 79 458 18 33
E-mail: gdpr@curaden.ch

2.6.

Information on data transfer to the USA and other non-EU

countries
Among other things, we use tools of companies domiciled in the United States or other froma data protection perspective non-secure non-EU countries. If these tools are active, yourpersonal data may potentially be transferred to these non-EU countries and may beprocessed there. We must point out that in these countries, a data protection level that iscomparable to that in the EU cannot be guaranteed. For instance, U.S. enterprises are undera mandate to release personal data to the security agencies and you as the data subject do
not have any litigation options to defend yourself in court. Hence, it cannot be ruled outthat U.S. agencies (e.g., the Secret Service) may process, analyse, and permanently archive
your personal data for surveillance purposes. We have no control over these processing
activities.

page 9 of 68

Version as of 1 October 2023

2.7.

Revocation of your consent to the processing of data

A wide range of data processing transactions are possible only subject to your express
consent. You can also revoke at any time any consent you have already given us. This shallbe without prejudice to the lawfulness of any data collection that occurred prior to yourrevocation.

2.8.

Right to object to the collection of data in special cases; rightto object to direct advertising (Art. 21 GDPR)
IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU
HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR PERSONAL DATABASED ON GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANYPROFILING BASED ON THESE PROVISIONS. TO DETERMINE THE LEGAL BASIS, ON WHICH ANYPROCESSING OF DATA IS BASED, PLEASE CONSULT THIS DATA PROTECTION DECLARATION.
IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL
DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHYGROUNDS FOR THE PROCESSING OF YOUR DATA, THAT OUTWEIGH YOUR INTERESTS,
RIGHTS AND FREEDOMS OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING,
EXERCISING OR DEFENCE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21(1)GDPR).
IF YOUR PERSONAL DATA IS BEING PROCESSED IN ORDER TO ENGAGE IN DIRECT
ADVERTISING, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR AFFECTEDPERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING AT ANY TIME. THIS ALSOAPPLIES TO PROFILING TO THE EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT
ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE
USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).

2.9.

Right to log a complaint with the competent supervisoryagencyIn the event of violations of the GDPR, data subjects are entitled to log a complaint with asupervisory agency, in particular in the member state where they usually maintain theirpage 10 of 68

Version as of 1 October 2023
domicile, place of work or at the place where the alleged violation occurred. The right to log
a complaint is in effect regardless of any other administrative or court proceedings available
as legal recourses.

2.10.

Right to data portability

You have the right to demand that we hand over any data we automatically process on thebasis of your consent or in order to fulfil a contract be handed over to you or a third party in
a commonly used, machine readable format. If you should demand the direct transfer of thedata to another controller, this will be done only if it is technically feasible.

2.11.

SSL and/or TLS encryption

For security reasons and to protect the transmission of confidential content, such aspurchase orders or inquiries you submit to us as the website operator, this website uses
either an SSL or a TLS encryption program. You can recognise an encrypted connection bychecking whether the address line of the browser switches from “http://” to “https://” andalso by the appearance of the lock icon in the browser line.

2.12.

Encrypted payment transactions on this website

If there is an obligation to transmit your payment data (e.g. account number in the case of
direct debit authorisation) to us after the conclusion of a contract with costs, this data will
be required for payment processing.
Payment transactions via the common means of payment (Visa/MasterCard, direct debit)
are made exclusively via an encrypted SSL or TLS connection. You can recognise an
encrypted connection by the fact that the address line of the browser changes from"http://" to "https://" and by the lock symbol in your browser line.
With encrypted communication, your payment data that you transmit to us cannot be readby third parties.

2.13.

Information about, rectification and eradication of data

page 11 of 68

Version as of 1 October 2023
Within the scope of the applicable statutory provisions, you have the right to at any time
demand information about your archived personal data, their source and recipients as wellas the purpose of the processing of your data. You may also have a right to have your data
rectified or eradicated. If you have questions about this subject matter or any otherquestions about personal data, please do not hesitate to contact us at any time.

2.14.

Right to demand processing restrictions

You have the right to demand the imposition of restrictions as far as the processing of yourpersonal data is concerned. To do so, you may contact us at any time. The right to demand
restriction of processing applies in the following cases:
In the event that you should dispute the correctness of your data archived by us, we willusually need some time to verify this claim. During the time that this investigation is
ongoing, you have the right to demand that we restrict the processing of your personaldata.
If the processing of your personal data was/is conducted in an unlawful manner, you havethe option to demand the restriction of the processing of your data in lieu of demanding theeradication of this data.
If we do not need your personal data any longer and you need it to exercise, defend or claim
legal entitlements, you have the right to demand the restriction of the processing of yourpersonal data instead of its eradication.
If you have raised an objection pursuant to Art. 21(1) GDPR, your rights and our rights will
have to be weighed against each other. As long as it has not been determined whose
interests prevail, you have the right to demand a restriction of the processing of yourpersonal data.

If you have restricted the processing of your personal data, these data – with the exceptionof their archiving – may be processed only subject to your consent or to claim, exercise or
defend legal entitlements or to protect the rights of other natural persons or legal entities
or for important public interest reasons cited by the European Union or a member state of
the EU.

3. General Recording of data on this website
page 12 of 68

Version as of 1 October 2023

3.1.

Cookies

Our websites and pages use what the industry refers to as “cookies.” Cookies are small text
files that do not cause any damage to your device. They are either stored temporarily forthe duration of a session (session cookies) or they are permanently archived on your device(permanent cookies). Session cookies are automatically deleted once you terminate yourvisit. Permanent cookies remain archived on your device until you actively delete them, orthey are automatically eradicated by your web browser.
In some cases, it is possible that third-party cookies are stored on your device once youenter our site (third-party cookies). These cookies enable you or us to take advantage of
certain services offered by the third party (e.g., cookies for the processing of payment
services).
Cookies have a variety of functions. Many cookies are technically essential since certain
website functions would not work in the absence of the cookies (e.g., the shopping cartfunction or the display of videos). The purpose of other cookies may be the analysis of user
patterns or the display of promotional messages.
Cookies, which are required for the performance of electronic communication transactions,or for the provision of certain functions you want to use (e.g., for the shopping cartfunction) or those that are necessary for the optimisation (required cookies) of the website(e.g., cookies that provide measurable insights into the web audience), shall be stored on
the basis of Art. 6(1)(f) GDPR, unless a different legal basis is cited. The operator of thewebsite has a legitimate interest in the storage of required cookies to ensure the technicallyerror free and optimised provision of the operator’s services. If your consent to the storageof the cookies and similar recognition technologies has been requested, processing occurs
exclusively on the basis of the consent obtained (Art. 6(1)(a) GDPR and § 25 (1) TTDSG); thisconsent may be revoked at any time.
You have the option to set up your browser in such a manner that you will be notified any
time cookies are placed and to permit the acceptance of cookies only in specific cases. You
may also exclude the acceptance of cookies in certain cases or in general or activate thepage 13 of 68

Version as of 1 October 2023
delete function for the automatic eradication of cookies when the browser closes. If cookies
are deactivated, the functions of this website may be limited.
In the event that third-party cookies are used or if cookies are used for analytical purposes,
we will separately notify you in conjunction with this Data Protection Policy and, if
applicable, ask for your consent.

3.2.

Consent with Cookiebot

Our website uses consent technology from Cookiebot to obtain your consent to the storageof certain cookies on your end device or for the use of certain technologies and to
document this in a data protection-compliant manner. The provider of this technology is
Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter “Cookiebot”).
When you enter our website, a connection is established with the Cookiebot servers to
obtain your consent and provide you with other explanations regarding the use of cookies.
Cookiebot will then store a cookie in your browser to identify the consent you have given or
its revocation. The data collected in this way is stored until you request us to delete it,delete the Cookiebot cookie itself or the purpose for which the data is stored no longer
applies. Mandatory legal storage obligations remain unaffected.
Cookiebot is used to obtain the legally required consent for the use of cookies. The legal
basis for this is Art. 6(1)(c) GDPR.
Data processing
We have concluded a data processing agreement (DPA) with the above-mentioned provider.
This is a contract mandated by data privacy laws that guarantees that they process personal
data of our website visitors only based on our instructions and in compliance with the GDPR.

page 14 of 68

Version as of 1 October 2023

3.3.

Contact form

If you submit inquiries to us via our contact form, the information provided in the contact
form as well as any contact information provided therein will be stored by us in order tohandle your inquiry and in the event that we have further questions. We will not share thisinformation without your consent.
The processing of these data is based on Art. 6(1)(b) GDPR, if your request is related to the
execution of a contract or if it is necessary to carry out pre-contractual measures. In allother cases the processing is based on our legitimate interest in the effective processing of
the requests addressed to us (Art. 6(1)(f) GDPR) or on your agreement (Art. 6(1)(a) GDPR) if
this has been requested; the consent can be revoked at any time.
The information you have entered into the contact form shall remain with us until you ask
us to eradicate the data, revoke your consent to the archiving of data or if the purpose forwhich the information is being archived no longer exists (e.g., after we have concluded our
response to your inquiry). This shall be without prejudice to any mandatory legal provisions,in particular retention periods.

3.4.

Request by e-mail, telephone, or fax

If you contact us by e-mail, telephone or fax, your request, including all resulting personal
data (name, request) will be stored and processed by us for the purpose of processing yourrequest. We do not pass these data on without your consent.
These data are processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to thefulfillment of a contract or is required for the performance of pre-contractual measures. In
all other cases, the data are processed on the basis of our legitimate interest in the effective
handling of inquiries submitted to us (Art. 6(1)(f) GDPR) or on the basis of your consent (Art.
6(1)(a) GDPR) if it has been obtained; the consent can be revoked at any time.
The data sent by you to us via contact requests remain with us until you request us todelete, revoke your consent to the storage or the purpose for the data storage lapses (e.g.
after completion of your request). Mandatory statutory provisions - in particular statutory
retention periods - remain unaffected.

page 15 of 68

Version as of 1 October 2023

3.5.

Typeform

We have integrated Typeform on this website. The provider is TYPEFORM S.L., Carrer Bac deRoda, 163, 08018 Barcelona, Spain (hereinafter “Typeform”).
Typeform enables us to create online forms and integrate them into our website. The data
you enter in our Typeform forms is stored on Typeform’s servers until you ask us to delete
it, revoke any consent you have given to store it, or the purpose for storing the data nolonger applies (e.g., after we have finished processing your request). Mandatory legal
provisions – in particular, retention periods – remain unaffected by this.
The use of Typeform is based on Art. 6(1)(f) GDPR. The website operator has a legitimate
interest in functioning online forms. If appropriate consent has been obtained, theprocessing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TTDSG,
insofar the consent includes the storage of cookies or the access to information in the user’s
end device (e.g., device fingerprinting) within the meaning of the TTDSG. This consent canbe revoked at any time.
Data processing
We have concluded a data processing agreement (DPA) for the use of the above-mentioned
service. This is a contract mandated by data privacy laws that guarantees that they process
personal data of our website visitors only based on our instructions and in compliance with
the GDPR.

page 16 of 68

Version as of 1 October 2023

3.6.

Hubspot CRM

We use Hubspot CRM on this website. The provider is Hubspot Inc. 25 Street, Cambridge,
MA 02141 USA (hereafter Hubspot CRM).
Hubspot CRM enables us, among other things, to manage existing and potential customers
and customer contacts, to communicate with you and to plan and execute marketing
activities in line with your interests. Hubspot CRM enables us to capture, sort and analysecustomer interactions via email, social media, or phone across multiple channels. The
personal data collected in this way can be evaluated and used for communication with thepotential customer or marketing measures (e.g., newsletter mailings). Hubspot CRM alsoenables us to collect and analyse the user behaviour of our contacts on our website.
The use of Hubspot CRM is based on Art. 6(1)(f) GDPR. The website operator has alegitimate interest in the most efficient customer management and customer
communication. If appropriate consent has been obtained, the processing is carried out
exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TTDSG, insofar the consent includes
the storage of cookies or the access to information in the user’s end device (e.g., device
fingerprinting) within the meaning of the TTDSG. This consent can be revoked at any time.
For details, please refer to Hubspot’s privacy policy: https://legal.hubspot.com/de/privacypolicy.
Data transmission to the US is based on the standard contractual clauses of the EU
Commission. Details can be found here: https://www.hubspot.de/data-privacy/privacyshield.
Data processing
We have concluded a data processing agreement (DPA) with the above-mentioned provider.
This is a contract mandated by data privacy laws that guarantees that they process personal
data of our website visitors only based on our instructions and in compliance with the GDPR.

page 17 of 68

Version as of 1 October 2023

3.7.

Registration on this website

You have the option to register on this website to be able to use additional website
functions. We shall use the data you enter only for the purpose of using the respective offer
or service you have registered for. The required information we request at the time ofregistration must be entered in full. Otherwise, we shall reject the registration.
To notify you of any important changes to the scope of our portfolio or in the event oftechnical modifications, we shall use the e-mail address provided during the registration
process.
We shall process the data entered during the registration process on the basis of yourconsent (Art. 6(1)(a) GDPR).
The data recorded during the registration process shall be stored by us as long as you areregistered on this website. Subsequently, such data shall be deleted. This shall be without
prejudice to mandatory statutory retention obligations.

3.8.

Registration with Google

Instead of registering directly on this website, you can register with Google. The provider ofthis service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4,
Ireland.
To register with Google, you must only enter your Google name and password. Google will
identify you and confirm your identity to our website.
When you sign in with Google, we may be able to use certain information in your account tocomplete your profile with us. You decide whether you want this information to be used
and if so, which information it is, within the framework of your Google security settings,
which you can find here: https://myaccount.google.com/security andhttps://myaccount.google.com/permissions.
The data processing associated with Google’s registration is based on our legitimate interestin making the registration process as simple as possible for our users (Art. 6(1)(f) GDPR).
Since the use of the registration function is voluntary and the users themselves can decideon the respective access options, no conflicting predominant rights of the data subjects areapparent.

page 18 of 68

Version as of 1 October 2023

3.9.

Registration with Facebook Connect

Instead of registering directly on this website, you also have the option to register using
Facebook Connect. The provider of this service is Meta Platforms Ireland Limited, 4 Grand
Canal Square, Dublin 2, Ireland. According to Facebook’s statement the collected data willbe transferred to the USA and other third-party countries too.
If you decide to register via Facebook Connect and click on the “Login with
Facebook”/„Connect with Facebook” button, you will be automatically connected to the
Facebook platform. There, you can log in using your username and password. As a result,
your Facebook profile will be linked to this website or our services. This link gives us accessto the data you have archived with Facebook. These data comprise primarily the following:•

Facebook name•Facebook profile photo and cover photo•

Facebook cover photo•

E-mail address archived with Facebook•

Facebook-ID•

Facebook friends lists•

Facebook Likes (“Likes” information)•

Date of birth•

Gender•Country•

LanguageThis information will be used to set up, provide and customise your account.
The registration via Facebook Connect and the affiliated data processing transactions are
implemented on the basis of your consent (Art. 6(1)(a) GDPR). You may revoke this consent
at any time, which shall affect all future transactions thereafter.
Insofar as personal data is collected on our website with the help of the tool described here
and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square,
Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art.
26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its
forwarding to Facebook. The processing by Facebook that takes place after the onward

page 19 of 68

Version as of 1 October 2023
transfer is not part of the joint responsibility. The obligations incumbent on us jointly havebeen set out in a joint processing agreement. The wording of the agreement can be foundunder: https://www.facebook.com/legal/controller_addendum. According to thisagreement, we are responsible for providing the privacy information when using theFacebook tool and for the privacy-secure implementation of the tool on our website.
Facebook is responsible for the data security of Facebook products. You can assert data
subject rights (e.g., requests for information) regarding data processed by Facebook directlywith Facebook. If you assert the data subject rights with us, we are obliged to forward themto Facebook.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here:
https://www.facebook.com/legal/EU_data_transfer_addendum, https://dede.facebook.com/help/566994660333381 and https://www.facebook.com/policy.php.
For more information, please consult the Facebook Terms of Use and the Facebook Data
Privacy Policies. Use these links to access this information:
https://www.facebook.com/about/privacy/ and https://www.facebook.com/legal/terms/.

page 20 of 68

Version as of 1 October 2023

4. Social media on this website

4.1.

Social media elements with Shariff

We do use elements of social media networks on this website and its pages (e.g. Facebook,
Twitter, Instagram, Pinterest, XING, LinkedIn, Tumblr).
As a rule, you will be able to recognise these social media elements because of therespective social media logos that appear. To warrant the protection of data on this website,
we use these elements only in combination with the so-called “Shariff” solution. Thisapplication prevents the social media elements that have been integrated into this website
from transferring personal data to the respective provider as soon as you enter our website.
A direct connection to the provider’s server shall not be established until you have activated
the respective social media element by clicking on the affiliated button (which indicatesyour consent). As soon as you activate the social media element, the respective provider
receives the information that you have visited this website with your IP address. If you are
simultaneously logged into your respective social media account (e.g. Facebook), therespective provider will be able to allocate your visit to this website to your user account.
The activation of the plug-in constitutes a declaration of consent as defined in Art. 6(1)(a)GDPR and und § 25 (1) TTDSG. You have the option to revoke this consent at any time,
which shall affect all future transactions.
This service is used to obtain the consent to the use of certain technologies required by law.
The legal basis for this is Art. 6(1)(c) GDPR.

page 21 of 68

Version as of 1 October 2023

4.2.

Facebook

We have integrated elements of the social network Facebook on this website. The providerof this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
According to Facebook’s statement the collected data will be transferred to the USA andother third-party countries too.
An overview of the Facebook social media elements is available under the following link:
https://developers.facebook.com/docs/plugins/.
If the social media element has been activated, a direct connection between your device
and the Facebook server will be established. As a result, Facebook will receive information
confirming your visit to this website with your IP address. If you click on the Facebook Like
button while you are logged into your Facebook account, you can link content of thiswebsite to your Facebook profile. Consequently, Facebook will be able to allocate your visit
to this website to your user account. We have to emphasise that we as the provider of thewebsite do not receive any information on the content of the transferred data and its use by
Facebook. For more information, please consult the Data Privacy Policy of Facebook at:https://de-de.facebook.com/privacy/explanation.
If your approval (consent) has been obtained the use of the abovementioned service shalloccur on the basis of Art. 6 Sect. 1 lit. a GDPR and § 25 TTDSG (German Telecommunications
Act). Such consent may be revoked at any time. If your consent was not obtained, the use of
the service will occur on the basis of our legitimate interest in making our information ascomprehensively visible as possible on social media.
Insofar as personal data is collected on our website with the help of the tool described here
and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square,
Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art.
26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its
forwarding to Facebook. The processing by Facebook that takes place after the onward
transfer is not part of the joint responsibility. The obligations incumbent on us jointly havebeen set out in a joint processing agreement. The wording of the agreement can be foundunder: https://www.facebook.com/legal/controller_addendum. According to thispage 22 of 68

Version as of 1 October 2023
agreement, we are responsible for providing the privacy information when using theFacebook tool and for the privacy-secure implementation of the tool on our website.
Facebook is responsible for the data security of Facebook products. You can assert data
subject rights (e.g., requests for information) regarding data processed by Facebook directlywith Facebook. If you assert the data subject rights with us, we are obliged to forward themto Facebook.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here:
https://www.facebook.com/legal/EU_data_transfer_addendum, https://dede.facebook.com/help/566994660333381 and https://www.facebook.com/policy.php.

page 23 of 68

Version as of 1 October 2023

4.3.

Twitter

We have integrated functions of the social media platform Twitter into this website. These
functions are provided by Twitter International Company, One Cumberland Place, Fenian
Street, Dublin 2, D02 AX07, Ireland.
If the social media element has been activated, a direct connection between your device
and Twitter’s server will be established. As a result, Twitter will receive information on yourvisit to this website. While you use Twitter and the “Re-Tweet” function, websites you visit
are linked to your Twitter account and disclosed to other users. We must point out, that we,the providers of the website and its pages do not know anything about the content of thedata transferred and the use of this information by Twitter. For more details, please consult
Twitter’s Data Privacy Declaration at: https://twitter.com/en/privacy.
If your approval (consent) has been obtained the use of the abovementioned service shalloccur on the basis of Art. 6(1)(a) GDPR and § 25 TTDSG (German Telecommunications Act).
Such consent may be revoked at any time. If your consent was not obtained, the use of theservice will occur on the basis of our legitimate interest in making our information ascomprehensively visible as possible on social media.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here: https://gdpr.twitter.com/en/controllerto-controller-transfers.html.
You have the option to reset your data protection settings on Twitter under the accountsettings at https://twitter.com/account/settings.

page 24 of 68

Version as of 1 October 2023

4.4.

Instagram

We have integrated functions of the public media platform Instagram into this website.
These functions are being offered by Meta Platforms Ireland Limited, 4 Grand Canal Square,
Grand Canal Harbour, Dublin 2, Ireland.
If the social media element has been activated, a direct connection between your device
and Instagram’s server will be established. As a result, Instagram will receive information on
your visit to this website.
If you are logged into your Instagram account, you may click the Instagram button to linkcontents from this website to your Instagram profile. This enables Instagram to allocate
your visit to this website to your user account. We have to point out that we as the providerof the website and its pages do not have any knowledge of the content of the datatransferred and its use by Instagram.
If your approval (consent) has been obtained the use of the abovementioned service shalloccur on the basis of Art. 6(1)(a) GDPR and § 25 TTDSG (German Telecommunications Act).
Such consent may be revoked at any time. If your consent was not obtained, the use of theservice will occur on the basis of our legitimate interest in making our information ascomprehensively visible as possible on social media.
Insofar as personal data is collected on our website with the help of the tool described here
and forwarded to Facebook or Instagram, we and Meta Platforms Ireland Limited, 4 Grand
Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this dataprocessing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of
the data and its forwarding to Facebook or Instagram. The processing by Facebook or
Instagram that takes place after the onward transfer is not part of the joint responsibility.
The obligations incumbent on us jointly have been set out in a joint processing agreement.
The wording of the agreement can be found under:
https://www.facebook.com/legal/controller_addendum. According to this agreement, weare responsible for providing the privacy information when using the Facebook or Instagram
tool and for the privacy-secure implementation of the tool on our website. Facebook is
responsible for the data security of Facebook or Instagram products. You can assert data
subject rights (e.g., requests for information) regarding data processed by Facebook or

page 25 of 68

Version as of 1 October 2023
Instagram directly with Facebook. If you assert the data subject rights with us, we are
obliged to forward them to Facebook.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here:
https://www.facebook.com/legal/EU_data_transfer_addendum,
https://help.instagram.com/519522125107875 and https://dede.facebook.com/help/566994660333381.
For more information on this subject, please consult Instagram’s Data Privacy Declaration
at: https://instagram.com/about/legal/privacy/.

4.5.

LinkedIn

This website uses elements of the LinkedIn network. The provider is LinkedIn Ireland
Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Any time you access a page of this website that contains elements of LinkedIn, a connection
to LinkedIn’s servers is established. LinkedIn is notified that you have visited this website
with your IP address. If you click on LinkedIn’s “Recommend” button and are logged into
your LinkedIn account at the time, LinkedIn will be in a position to allocate your visit to thiswebsite to your user account. We have to point out that we as the provider of the websites
do not have any knowledge of the content of the transferred data and its use by LinkedIn.
If your approval (consent) has been obtained the use of the abovementioned service shalloccur on the basis of Art. 6 (1)(a) GDPR and § 25 TTDSG (German Telecommunications Act).
Such consent may be revoked at any time. If your consent was not obtained, the use of theservice will occur on the basis of our legitimate interest in making our information ascomprehensively visible as possible on social media.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here:
https://www.linkedin.com/help/linkedin/answer/62538/datenubertragung-aus-der-eudem-ewr-und-der-schweiz?lang=en.
For further information on this subject, please consult LinkedIn’s Data Privacy Declaration
at: https://www.linkedin.com/legal/privacy-policy.

page 26 of 68

Version as of 1 October 2023

4.6.

XING

This website uses elements of the XING network. The provider is the New Work SE,
Dammtorstraße 30, 20354 Hamburg, Germany.
Any time one of our sites/pages that contains elements of XING is accessed, a connection
with XING’s servers is established. As far as we know, this does not result in the archiving ofany personal data. In particular, the service does not store any IP addresses or analyse user
patterns.
If your approval (consent) has been obtained the use of the abovementioned service shalloccur on the basis of Art. 6 (1)(a) GDPR and § 25 TTDSG (German Telecommunications Act).
Such consent may be revoked at any time. If your consent was not obtained, the use of theservice will occur on the basis of our legitimate interest in making our information ascomprehensively visible as possible on social media.
For more information on data protection and the XING share button please consult the Data
Protection Declaration of Xing at: https://www.xing.com/app/share?op=data_protection.

page 27 of 68

Version as of 1 October 2023

5. Analysis tools and advertising

5.1.

Google Tag Manager

We use the Google Tag Manager. The provider is Google Ireland Limited, Gordon House,
Barrow Street, Dublin 4, Ireland.
The Google Tag Manager is a tool that allows us to integrate tracking or statistical tools andother technologies on our website. The Google Tag Manager itself does not create any user
profiles, does not store cookies, and does not carry out any independent analyses. It only
manages and runs the tools integrated via it. However, the Google Tag Manager does collect
your IP address, which may also be transferred to Google’s parent company in the UnitedStates.
The Google Tag Manager is used on the basis of Art. 6(1)(f) GDPR. The website operator hasa legitimate interest in the quick and uncomplicated integration and administration ofvarious tools on his website. If appropriate consent has been obtained, the processing iscarried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TTDSG, insofar theconsent includes the storage of cookies or the access to information in the user’s end device(e.g., device fingerprinting) within the meaning of the TTDSG. This consent can be revokedat any time.

page 28 of 68

Version as of 1 October 2023

5.2.

Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider of thisservice is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4,
Ireland.
Google Analytics enables the website operator to analyse the behaviour patterns of website
visitors. To that end, the website operator receives a variety of user data, such as pages
accessed, time spent on the page, the utilised operating system and the user’s origin. Thisdata is summarised in a user-ID and assigned to the respective end device of the website
visitor.
Furthermore, Google Analytics allows us to record your mouse and scroll movements andclicks, among other things. Google Analytics uses various modelling approaches to augment
the collected data sets and uses machine learning technologies in data analysis.
Google Analytics uses technologies that make the recognition of the user for the purpose ofanalysing the user behaviour patterns (e.g., cookies or device fingerprinting). The website
use information recorded by Google is, as a rule transferred to a Google server in the UnitedStates, where it is stored.
The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR
and § 25(1) TTDSG. You may revoke your consent at any time.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here:
https://privacy.google.com/businesses/controllerterms/mccs/.
Browser plug-in
You can prevent the recording and processing of your data by Google by downloading andinstalling the browser plugin available under the following link:
https://tools.google.com/dlpage/gaoptout?hl=en.
For more information about the handling of user data by Google Analytics, please consult
Google’s Data Privacy Declaration at:https://support.google.com/analytics/answer/6004245?hl=en.
Google Signals
We use Google Signals. Whenever you visit our website, Google Analytics records, among
other things, your location, the progression of your search and YouTube progression as well

page 29 of 68

Version as of 1 October 2023
as demographic data (site visitor data). This data may be used for customised advertisingwith the assistance of Google Signal. If you have a Google account, your site visitor
information will be linked to your Google account by Google Signal and used to send you
customised promotional messages. The data is also used to compile anonymised statistics of
our users’ online patterns.
Contract data processing
We have executed a contract data processing agreement with Google and are implementing
the stringent provisions of the German data protection agencies to the fullest when using
Google Analytics.
Google Analytics E-Commerce-Tracking
This website uses the “E-Commerce Tracking” function of Google Analytics. With theassistance of E-Commerce Tracking, the website operator is in a position to analyse thepurchasing patterns of website visitors with the aim of improving the operator’s online
marketing campaigns. In this context, information, such as the orders placed, the averageorder values, shipping costs and the time from viewing the product to making thepurchasing decision are tracked. These data may be consolidated by Google under atransaction ID, which is allocated to the respective user or the user’s device.

page 30 of 68

Version as of 1 October 2023

5.3.

HotjarThis website utilises Hotjar. The provider is Hotjar Ltd., Level 2, St Julians Business Centre, 3,
Elia Zammit Street, St Julians STJ 1000, Malta, Europe (website: https://www.hotjar.com).
Hotjar is a tool used to analyse your user patterns on this website. Hotjar allows us to for
instance record your mouse and scroll movements as well as your click. During this process,Hotjar also has the capability to determine how long your cursor remained in a certain
position. Based on this information, Hotjar compiles so-called Heatmaps, that make possible
to determine which parts of the website the website visitor reviews with preference.
We are also able to determine how long you have stayed on a page of this website andwhen you left. We can also determine at which point you suspended making entries into a
contact form (so-called conversion funnels).
Furthermore, Hotjar can be deployed to obtain direct feedback from website visitors. Thisfunction aims at the improvement of the website offerings of the website operator.
Hotjar uses technologies that make it possible to recognise the user for the purpose ofanalysing the user patterns (e.g., cookies or the deployment of device fingerprinting).
If your approval (consent) has been obtained the use of the abovementioned service shalloccur on the basis of Art. 6(1)(a) GDPR and § 25 TTDSG (German Telecommunications Act).
Such consent may be revoked at any time. If your consent was not obtained, the use of theservice will occur on the basis of Art. 6(1)(f) GDPR; the website operator has a legitimate
interest in the analysis of user patterns to optimise both, the web presentation and theoperator’s advertising activities.
Deactivation of Hotjar
If you would like to deactivate the recording of data by Hotjar, please click on the link below
and follow the instructions provided under the link: https://www.hotjar.com/policies/donot-track/.
Please keep in mind that you will have to separately deactivate Hotjar for every browser andevery device.
For more detailed information about Hotjar and the data to be recorded, please consult theData Privacy Declaration of Hotjar under the following link:
https://www.hotjar.com/privacy.

page 31 of 68

Version as of 1 October 2023
Data processing
We have concluded a data processing agreement (DPA) with the above-mentioned provider.
This is a contract mandated by data privacy laws that guarantees that they process personal
data of our website visitors only based on our instructions and in compliance with the GDPR.

5.4.

WP Statistics

This website uses the WP Statistics analysis tool to evaluate visitor accesses statistically. The
provider is Veronalabs, ARENCO Tower, 27th Floor, Dubai Media City, Dubai, Dubai 23816,
UAE (https://veronalabs.com).
WP Statistics can be used to analyse the use of our website. In doing so, WP Statistics
records, among other things, log files (IP address, referrer, browser used, origin of the user,
search engine used) and actions that the website visitors have taken on the site (e.g. clicks
and views).
The data collected with WP Statistics is stored exclusively on our own server.
The use of this analysis tool is based on Art. 6(1)(f) GDPR. We have a legitimate interest in
the anonymised analysis of user behaviour in order to optimise both our websites and ouradvertising. If appropriate consent has been obtained, the processing is carried out
exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TTDSG, insofar the consent includes
the storage of cookies or the access to information in the user’s end device (e.g., device
fingerprinting) within the meaning of the TTDSG. This consent can be revoked at any time.

page 32 of 68

Version as of 1 October 2023

5.5.

Google Ads

The website operator uses Google Ads. Google Ads is an online promotional program of
Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Ads enables us to display ads in the Google search engine or on third-party websites,
if the user enters certain search terms into Google (keyword targeting). It is also possible toplace targeted ads based on the user data Google has in its possession (e.g., location dataand interests; target group targeting). As the website operator, we can analyse these data
quantitatively, for instance by analysing which search terms resulted in the display of ourads and how many ads led to respective clicks.
The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR
and § 25(1) TTDSG. You may revoke your consent at any time.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here:
https://policies.google.com/privacy/frameworks andhttps://privacy.google.com/businesses/controllerterms/mccs/.

page 33 of 68

Version as of 1 October 2023

5.6.

Google AdSense (not personalised)This website uses Google AdSense, an ad embedding service provided by Google Ireland
Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
We use Google AdSense in the “non-personalised” mode. Contrary to the personalisedmode, the ads are not based on your previous user patterns and the service does not
generate a user profile for you. Instead, the service uses so-called “context information” tochoose the ads that are posted for you to view. The selected ads are thus based e.g. on yourlocation, the content of the website you are visiting at the time, or the search terms you areusing. To learn more about the distinct differences between personalised targeting andtargeting that has not been personalised by Google AdSense, please click on the following
link: https://support.google.com/adsense/answer/9007336.
Please keep in mind that if Google Adsense is used in the non-personalised mode, it ispossible that cookies are stored or comparable recognition technologies (e.g., device
fingerprinting) are used.
The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR
and § 25(1) TTDSG. You may revoke your consent at any time.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here:
https://privacy.google.com/businesses/controllerterms/mccs/.
You have the option to autonomously adjust the advertising settings in your user account.
To do so, please click on the link provided below and log in:https://adssettings.google.com/authenticated.
For more information about Google’s advertising technologies, please click here:
https://policies.google.com/technologies/ads andhttps://www.google.de/intl/de/policies/privacy/.

page 34 of 68

Version as of 1 October 2023

5.7.

Google Remarketing

This website uses the functions of Google Analytics Remarketing. The provider of thesesolutions is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4,
Ireland.
Google Remarketing analyses your user patterns on our website (e.g., clicks on specificproducts), to allocate a certain advertising target groups to you and to subsequently display
matching online offers to you when you visit other online offers (remarketing or
retargeting).
Moreover, it is possible to link the advertising target groups generated with Google
Remarketing to device encompassing functions of Google. This makes it possible to display
interest-based customised advertising messages, depending on your prior usage andbrowsing patterns on a device (e.g., cell phone) in a manner tailored to you as well as on anyof your devices (e.g., tablet or PC).
If you have a Google account, you have the option to object to personalised advertisingunder the following link: https://www.google.com/settings/ads/onweb/.
The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR
and § 25(1) TTDSG. You may revoke your consent at any time.
For further information and the pertinent data protection regulations, please consult theData Privacy Policies of Google at: https://policies.google.com/technologies/ads?hl=en.
Formation of Target Groups with Customer Reconciliation
For the formation of target groups, we use, among other things, the Google Remarketingcustomer reconciliation feature. To achieve this, we transfer certain customer data (e.g.,email addresses) from our customer lists to Google. If the respective customers are Google
users and are logged into their Google accounts, matching advertising messages within the
Google network (e.g., YouTube, Gmail or in a search engine) are displayed for them to view.

5.8.

Google Conversion-Tracking

This website uses Google Conversion Tracking. The provider of this service is Google Ireland
Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
With the assistance of Google Conversion Tracking, we are in a position to recognise
whether the user has completed certain actions. For instance, we can analyse the how

page 35 of 68

Version as of 1 October 2023
frequently which buttons on our website have been clicked and which products arereviewed or purchased with particular frequency. The purpose of this information is tocompile conversion statistics. We learn how many users have clicked on our ads and which
actions they have completed. We do not receive any information that would allow us topersonally identify the users. Google as such uses cookies or comparable recognition
technologies for identification purposes.
The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR
and § 25(1) TTDSG. You may revoke your consent at any time.
For more information about Google Conversion Tracking, please review Google’s dataprotection policy at: https://policies.google.com/privacy?hl=en

5.9.

Google DoubleClick

This website uses features of Google DoubleClick. The provider is Google Ireland Limited(“Google”), Gordon House, Barrow Street, Dublin 4, Ireland, (hereinafter “DoubleClick”).
DoubleClick is used to show you interest-based ads across the Google Network.
Advertisements can be tailored to the interests of the viewer using DoubleClick. For
example, our ads may appear in Google search results or in banners associated with
DoubleClick.
To be able to display interest adequate promotional content to users, DoubleClick must
recognise the respective visitor so that it can allocate the websites visited, the clicks andother user pattern information to the user. To do this, DoubleClick deploys cookies orcomparable recognition technologies (e.g., device fingerprinting). The recorded informationis consolidated into a pseudonym user profile so that the respective user can be shown
interest adequate advertising.
The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR
and § 25(1) TTDSG. You may revoke your consent at any time.
For further information on how to object to the advertisements displayed by Google, please
see the following links: https://policies.google.com/technologies/ads andhttps://adssettings.google.com/authenticated.

page 36 of 68

Version as of 1 October 2023

5.10.

Facebook Pixel

To measure conversion rates, this website uses the visitor activity pixel of Facebook. The
provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2,
Ireland. According to Facebook’s statement the collected data will be transferred to the USA
and other third-party countries too.
This tool allows the tracking of page visitors after they have been linked to the website of
the provider after clicking on a Facebook ad. This makes it possible to analyse theeffectiveness of Facebook ads for statistical and market research purposes and to optimise
future advertising campaigns.
For us as the operators of this website, the collected data is anonymous. We are not in aposition to arrive at any conclusions as to the identity of users. However, Facebook archives
the information and processes it, so that it is possible to make a connection to therespective user profile and Facebook is in a position to use the data for its own promotional
purposes in compliance with the Facebook Data Usage Policy. This enables Facebook todisplay ads on Facebook pages as well as in locations outside of Facebook. We as theoperator of this website have no control over the use of such data.
The use of these services occurs on the basis of your consent pursuant to Art. 6(1)(a) GDPR
and § 25(1) TTDSG. You may revoke your consent at any time.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here:
https://www.facebook.com/legal/EU_data_transfer_addendum and https://dede.facebook.com/help/566994660333381.
Insofar as personal data is collected on our website with the help of the tool described here
and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square,
Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art.
26 DSGVO). The joint responsibility is limited exclusively to the collection of the data and its
forwarding to Facebook. The processing by Facebook that takes place after the onward
transfer is not part of the joint responsibility. The obligations incumbent on us jointly havebeen set out in a joint processing agreement. The wording of the agreement can be foundunder: https://www.facebook.com/legal/controller_addendum. According to thisagreement, we are responsible for providing the privacy information when using thepage 37 of 68

Version as of 1 October 2023
Facebook tool and for the privacy-secure implementation of the tool on our website.
Facebook is responsible for the data security of Facebook products. You can assert data
subject rights (e.g., requests for information) regarding data processed by Facebook directlywith Facebook. If you assert the data subject rights with us, we are obliged to forward themto Facebook.
In Facebook’s Data Privacy Policies, you will find additional information about the protectionof your privacy at: https://www.facebook.com/about/privacy/.
You also have the option to deactivate the remarketing function “Custom Audiences” in the
ad settings section underhttps://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. To dothis, you first have to log into Facebook.
If you do not have a Facebook account, you can deactivate any user-based advertising by
Facebook on the website of the European Interactive Digital Advertising Alliance:
http://www.youronlinechoices.com/de/praferenzmanagement/.

page 38 of 68

Version as of 1 October 2023

5.11.

LinkedIn Insight Tag

This website uses the Insight tag from LinkedIn. This service is provided by LinkedIn Ireland
Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Data processing by LinkedIn Insight tag
We use the LinkedIn Insight tag to obtain information about visitors to our website. Once a
website visitor is registered with LinkedIn, we can analyse the key occupational data (e.g.,
career level, company size, country, location, industry, job title) of our website visitors to
help us better target our site to the relevant audience. We can also use LinkedIn Insight tags
to measure whether visitors to our websites make a purchase or perform other actions(conversion measurement). Conversion measurement can also be carried out across devices(e.g. from PC to tablet). LinkedIn Insight Tag also features a retargeting function that allows
us to display targeted advertising to visitors to our website outside of the website.
According to LinkedIn, no identification of the advertising addressee takes place.
LinkedIn itself also collects log files (URL, referrer URL, IP address, device and browser
characteristics and time of access). The IP addresses are shortened or (if they are used toreach LinkedIn members across devices) hashed (pseudonymised). The direct identifiers ofLinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymised
data will then be deleted within 180 days.
The data collected by LinkedIn cannot be assigned by us as a website operator to specificindividuals. LinkedIn will store the personal data collected from website visitors on its
servers in the USA and use it for its own promotional activities. For details, please see
LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy#choices-oblig.
Legal basis
If your approval (consent) has been obtained the use of the abovementioned service shalloccur on the basis of Art. 6(1)(a) GDPR and § 25 TTDSG (German Telecommunications Act).
Such consent may be revoked at any time. If your consent was not obtained, the use of theservice will occur on the basis of Art. 6(1)(f) GDPR; the website operator has a legitimate
interest in effective advertising promotions that include the utilisation of social media.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa
and https://www.linkedin.com/legal/l/eu-sccs.

page 39 of 68

Version as of 1 October 2023
Objection to the use of LinkedIn Insight Tag
You can object to LinkedIn’s analysis of user behaviour and targeted advertising at thefollowing link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
In addition, LinkedIn members can control the use of their personal information for
promotional purposes in the account settings. To prevent LinkedIn from linking informationcollected on our site to your LinkedIn account, you must log out of your LinkedIn accountbefore you visit our site.
Data processing
We have concluded a data processing agreement (DPA) with the above-mentioned provider.
This is a contract mandated by data privacy laws that guarantees that they process personal
data of our website visitors only based on our instructions and in compliance with the GDPR.
Data Processing for advertising purposes
On the basis of Article 6(1)(f) GDPR, the data controller has a legitimate interest inprocessing data for advertising purposes. For the use of a personalised customer approach,
we also reserve the use of first name, last name, date of birth, street, zip code and the city,on this legal basis. The duration of the storage of personal data for advertising purposes is
to be derived from the principle of whether the storage is necessary for the advertising
approach. We follow the principle of deleting data no later than two years after it is nolonger used for advertising purposes.
Own advertising purposes and advertising purposes of third parties
Insofar as you have concluded a contract with us or have had advertising material sent toyou, we manage you as an existing customer or interested party. In these cases, we process
your name and address in order to send you information about new products and services.
Within the scope of our legitimate interests, we reserve the right to transmit your postal
contact data to companies of our group of companies and, if applicable, to selected
contractual partners, so that they can also inform you about their products.

Interest-based advertising
To ensure that you only receive advertising information that is of supposed interest to you,we categorise and add further information to your customer profile. Statistical information
as well as information about you (e.g. basic data of your customer profile) is used for thispage 40 of 68

Version as of 1 October 2023
purpose. The aim is to send you advertising that is geared solely to your actual or perceived
needs and accordingly not to bother you with uninteresting advertising.
Processing of the advertising mailings
The advertising mailings are processed on our behalf by a service provider, to whom wepass on your data for this purpose.
Right of objection
You can object to data processing for the aforementioned purposes at any time, free ofcharge, separately for the respective communication channel and with effect for the future.
For this purpose, it is sufficient to send an e-mail or a postal letter to the above contact
details.
If you object, the contact address concerned will be blocked for further data processing foradvertising purposes. We would like to point out that in exceptional cases, advertisingmaterial may still be sent temporarily after receipt of your objection. This is technically due
to the necessary lead time of advertisements and does not mean that we will not
implement your objection.

page 41 of 68

Version as of 1 October 2023

5.12.

SentryWe use the Sentry service of Functional Software, Inc., Sentry 45 Fremont Street, 8th Floor,
San Francisco, CA 94105, USA (hereinafter "Sentry") for the logging of errors within thescope of our legitimate interest in a technically flawless online offering and its economicallyefficient design and optimisation pursuant to Art. 6 Par. 1 lit. f GDPR.
Sentry can be used to collect, log and analyse errors in the code for the purpose of systemstability. For this purpose, Sentry also collects your usage data, such as your operating
system, the software installed on your device, your IP address, your browser type, operating
system or the previously visited website ('referring URL'). This data is collected by Sentry
pseudonymously and does not allow us to identify you as a user.
This may result in a transfer of your data to the USA. We have concluded an orderprocessing agreement with Sentry, according to which Sentry processes your data only inaccordance with our instructions. This GCU also provides that the transfer of data to the
USA by Sentry only takes place within the scope of the standard contractual clauses.
For more information on Sentry's use of your data, please refer to Sentry's privacy policy athttps://sentry.io/privacy/.

page 42 of 68

Version as of 1 October 2023

5.13.

Outbrain

We have integrated Outbrain into this website. The provider is Outbrain Inc., 39 West 13thStreet, 3rd floor, New York, NY 10011, USA (hereinafter referred to as “Outbrain”).
Whenever you access a website into which Outbrain has been integrated, Outbrain will
generate as pseudonymous user profile (User ID) in which the content you have viewed orread is archived. As a result, our website, or other websites into which Outbrain has been
integrated, can recommend other content appropriate to the shown interests or display
advertisements. For this purpose, your device type, your IP address, the type of browser you
use, visited websites, read articles, the time of access and the device ID are archived andconsolidated under your User ID.
Furthermore, we use the Outbrain Pixel. Whenever you access our website, this Pixel allows
us to determine whether you already have an Outbrain User ID. This solution enables
advertisers from the Outbrain advertising network to measure the effectiveness of theircampaigns.
If your approval (consent) has been obtained the use of the abovementioned service shalloccur on the basis of Art. 6(1)(a) GDPR and § 25 TTDSG (German Telecommunications Act).
Such consent may be revoked at any time. If your consent was not obtained, the use of theservice will occur on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate
interest in the analysis of user patterns to optimise both, the operator’s web presentation
and advertising activities.
For more information, please consult the Data Privacy Policy of Outbrain under:
https://www.outbrain.com/legal/privacy#privacy-policy.
Moreover, if you click on the following link, you will receive a list of all utilized cookies:
https://www.outbrain.com/privacy/cookies/.
If you would like to view your Outbrain User Profile or make changes to it, please click on
the following link: https://my.outbrain.com/recommendations-settings/home.
Data processing
We have concluded a data processing agreement (DPA) for the use of the above-mentioned
service. This is a contract mandated by data privacy laws that guarantees that they process
personal data of our website visitors only based on our instructions and in compliance with
the GDPR.

page 43 of 68

Version as of 1 October 2023

5.14.

TikTokDescription and scope of data processing
The social media application TikTok is an international video portal. It is used for the socalled lip-syncing of music videos and other short video clips.
TikTok is operated by the Chinese company ByteDance.
TikTok's privacy policy forms the basis on which TikTok processes all data collected by
TikTok from users or provided by users.
According to the Privacy Policy, the controller of personal data is TikTok Technology Limited("TikTok Ireland"), and TikTok Information Technologies UK Limited ("TikTok UK"). The
Privacy Policy usually refers to "TikTok", "we" or "us" for short.
If you have given advertising consent, TikTok will use your data to show you personalised
advertising.
Legal basis
The personalised advertising that TikTok displays to you is based on your consent. In allother respects, TikTok processes user data on the basis of a contract (Art. 6 para. 1 sentence
1 letter b GDPR), as a result of a balancing of interests (Art. 6 para. 1 sentence 1 letter f
GDPR) or for the fulfillment of legal obligations (Art. 6 para. 1 sentence 1 letter c GDPR).
Consents can be revoked by the user and the processing based on a balance of interests canbe objected to in accordance with Art. 21 GDPR. For details, please refer to the privacy
policy and terms of use of TikTok (link see below).
Purpose
TikTok processes personal data for various purposes, including to provide its services, to beable to notify users of changes to the services, to provide support to users, to allow users toshare user content with other users, for the development of new services or to comply withlegal obligations.
TikTok collects, among other things, the following data about its users: profile data, user
content and usage data, location data, information about the respective contacts/friends.
For more information on how your data is used and what data is processed, please refer to
TikTok's Privacy Policy and Terms of Use (link below).

page 44 of 68

Version as of 1 October 2023
Duration of storage
TikTok retains Users' information for as long as necessary to provide the Service to Users, tofulfill its contractual obligations, and to exercise its rights with respect to the information inquestion. In the event that User information is not needed to provide the Service, User
information will be retained by TikTok only for as long as TikTok has a legitimate businesspurpose in retaining such information.
When a User requests TikTok to delete their account, the account will initially be
deactivated for a few weeks. Subsequently, the account will be deleted. In this process, thepersonal data of users regarding the in-app messaging function will also be deleted.
Messages which you have sent to other users of the TikTok service will remain stored on
their devices.
In its privacy policy (see link below), TikTok also points out any longer deletion periods orretention periods.
Revocation, objection and end of processing
TikTok offers its users the possibility to control and manage their own user data (personaldata) via the settings options. TikTok also provides its users with automated information
services that allow you to obtain information about how your data is processed. Within theframework of the legal requirements, you also have the right to have your data deleted andcorrected, and you can object to the use of your data or have the use restricted, as well as
revoke the consents you have declared at any time.
Supplementary note
Please note that TikTok's terms of use and privacy policy may change at any time. Therefore,
please inquire about the topicality of these texts at regular intervals. Curaden does notwarrant the timeliness, accuracy or completeness of the aforementioned information, which
relates to TikTok's Terms of Use and Privacy Policy. Our present privacy policy serves toprovide the information required under Articles 12 et seq. GDPR to the extent that Curaden
uses services of TikTok by embedding videos in one of our websites or TikTok is used by our
employees for customers.
Terms of Use-TikTok:
https://www.tiktok.com/legal/terms-of-use?lang=dePrivacy Policy:
https://www.tiktok.com/legal/privacy-policy?lang=de#section-1
page 45 of 68

Version as of 1 October 2023
Questions about TikTok's privacy policy:
For users who have questions about TikTok's privacy policy or who wish to contact TikTok's
privacy officer, TikTok provides a contact form linked through the privacy policy.

page 46 of 68

Version as of 1 October 2023

6. Newsletter

6.1.

Newsletter data

If you would like to receive the newsletter offered on the website, we require an e-mailaddress from you as well as information that allows us to verify that you are the owner ofthe e-mail address provided and that you agree to receive the newsletter. Further data is
not collected or only on a voluntary basis. For the handling of the newsletter, we use
newsletter service providers, which are described below.

6.2.

Shared use of customer data of Curaden AG

We are a contractual partner of the Curaden AG group of companies, Amlehnstrasse 22,6010 Kriens, Switzerland. Curaden AG develops our products and services and makes themavailable to us. Together with Curaden AG we also design our advertising measures as well
as newsletters and our websites. We collect customer data such as e-mail addresses for use
for advertising purposes and general communication jointly with Curaden AG and are joint
controllers within the meaning of Art. 26 GDPR. The collection and processing of the data isbased on Art. 6 (1) f) GDPR. We and Curaden AG shall make the information required
pursuant to Art. 13 and 14 GDPR available to the data subjects free of charge in a precise,transparent, comprehensible, and easily accessible form in a clear and simple language. In
doing so, each party shall provide the other party with all necessary information from its
sphere of influence.

page 47 of 68

Version as of 1 October 2023

6.3.

Mailchimp

This website uses the services of Mailchimp to send out its newsletters. The provider is theRocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.
Among other things, Mailchimp is a service that can be deployed to organise and analyse
the sending of newsletters. Whenever you enter data for the purpose of subscribing to a
newsletter (e.g. your e-mail address), the information is stored on Mailchimp servers in the
United States.
With the assistance of the Mailchimp tool, we can analyse the performance of our
newsletter campaigns. If you open an e-mail that has been sent through the Mailchimp tool,a file that has been integrated into the e-mail (a so-called web-beacon) connects to
Mailchimp’s servers in the United States. As a result, it can be determined whether anewsletter message has been opened and which links the recipient possibly clicked on.
Technical information is also recorded at that time (e.g. the time of access, the IP address,
type of browser and operating system). This information cannot be allocated to therespective newsletter recipient. Their sole purpose is the performance of statistical analysesof newsletter campaigns. The results of such analyses can be used to tailor future
newsletters to the interests of their recipients more effectively.
If you do not want to permit an analysis by Mailchimp, you must unsubscribe from thenewsletter. We provide a link for you to do this in every newsletter message.
The data is processed based on your consent (Art. 6(1)(a) GDPR). You may revoke any
consent you have given at any time by unsubscribing from the newsletter. This shall be
without prejudice to the lawfulness of any data processing transactions that have takenplace prior to your revocation.
The data deposited with us for the purpose of subscribing to the newsletter will be stored
by us until you unsubscribe from the newsletter or the newsletter service provider anddeleted from the newsletter distribution list after you unsubscribe from the newsletter.
Data stored for other purposes with us remain unaffected.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here: https://mailchimp.com/eu-us-datatransfer-statement/ and https://mailchimp.com/legal/data-processingaddendum/#Annex_C_-_Standard_Contractual_Clauses.

page 48 of 68

Version as of 1 October 2023
After you unsubscribe from the newsletter distribution list, your e-mail address may be
stored by us or the newsletter service provider in a blacklist, if such action is necessary to
prevent future mailings. The data from the blacklist is used only for this purpose and not
merged with other data. This serves both your interest and our interest in complying withthe legal requirements when sending newsletters (legitimate interest within the meaning ofArt. 6(1)(f) GDPR). The storage in the blacklist is indefinite. You may object to the storage if
your interests outweigh our legitimate interest.
For more details, please consult the Data Privacy Policies of Mailchimp at:https://mailchimp.com/legal/terms/.
Data processing
We have concluded a data processing agreement (DPA) with the above-mentioned provider.
This is a contract mandated by data privacy laws that guarantees that they process personal
data of our website visitors only based on our instructions and in compliance with the GDPR.

page 49 of 68

Version as of 1 October 2023

6.4.

SendGrid/Twilio

This website uses the cloud-based email marketing software SendGrid by Twilio for sending
newsletters. The provider is Twilio Germany GmbH, Rosenheimer Str. 143C, 81671 Munich,Germany. SendGrid is a service with which newsletter dispatch can be organised andanalysed. The data you enter for the purpose of receiving newsletters (e.g., e-mail address)
is stored on SendGrid's servers.
The servers that SendGrid uses for data processing are located in the USA, among otherplaces, which means that your e-mail address may be transmitted to their US servers. To
learn what SendGrid does to comply with EU data protection regulations, please see their
Privacy Policy at https://www.twilio.com/legal/privacy andhttps://www.twilio.com/legal/data-protection-addendum.
Our newsletters sent with SendGrid allow us to analyse the behaviour of newsletter
recipients. Among other things, we can analyse how many recipients have opened thenewsletter message and how often which link in the newsletter was clicked. With the helpof so-called conversion tracking, it can also be analysed whether a predefined action (e.g.,purchase of a product on our website) has taken place after clicking on the link in the
newsletter.
The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can revoke thisconsent at any time by unsubscribing from the newsletter. The legality of the dataprocessing operations already carried out remains unaffected by the revocation.
If you do not want any analysis by SendGrid, you must unsubscribe from the newsletter. For
this purpose, we provide a corresponding link in each newsletter message. Furthermore,
you can also unsubscribe from the newsletter directly on the website.
The data you provide for the purpose of receiving the newsletter will be stored by us until
you unsubscribe from the newsletter and will be deleted from our servers as well as fromthe servers of SendGrid after you unsubscribe from the newsletter. Data that has been
stored by us for other purposes remains unaffected by this.
For more details, please refer to the privacy policy of SendGrid at:https://sendgrid.com/policies/privacy/.

page 50 of 68

Version as of 1 October 2023

7. Plug-ins and Tools

7.1.

YouTube with expanded data protection integration

Our website embeds videos of the website YouTube. The website operator is Google Ireland
Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
We use YouTube in the expanded data protection mode. According to YouTube, this modeensures that YouTube does not store any information about visitors to this website before
they watch the video. Nevertheless, this does not necessarily mean that the sharing of datawith YouTube partners can be ruled out as a result of the expanded data protection mode.
For instance, regardless of whether you are watching a video, YouTube will always establish
a connection with the Google DoubleClick network.
As soon as you start to play a YouTube video on this website, a connection to YouTube’sservers will be established. As a result, the YouTube server will be notified, which of ourpages you have visited. If you are logged into your YouTube account while you visit our site,
you enable YouTube to directly allocate your browsing patterns to your personal profile. You
have the option to prevent this by logging out of your YouTube account.
Furthermore, after you have started to play a video, YouTube will be able to place various
cookies on your device or comparable technologies for recognition (e.g. device
fingerprinting). In this way YouTube will be able to obtain information about this website’svisitors. Among other things, this information will be used to generate video statistics withthe aim of improving the user friendliness of the site and to prevent attempts to commit
fraud.
Under certain circumstances, additional data processing transactions may be triggered after
you have started to play a YouTube video, which are beyond our control.
The use of YouTube is based on our interest in presenting our online content in an appealing
manner. Pursuant to Art. 6(1)(f) GDPR, this is a legitimate interest. If appropriate consent
has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR
and § 25 (1) TTDSG, insofar the consent includes the storage of cookies or the access to
information in the user’s end device (e.g., device fingerprinting) within the meaning of the
TTDSG. This consent can be revoked at any time.

page 51 of 68

Version as of 1 October 2023
For more information on how YouTube handles user data, please consult the YouTube Data
Privacy Policy under: https://policies.google.com/privacy?hl=en.

7.2.

Vimeo Without Tracking (Do-Not-Track)

This website uses plugins of the Vimeo video portal. The provider is Vimeo Inc., 555 West
18th Street, New York, New York 10011, USA.
Whenever you visit one of our pages featuring Vimeo videos, a connection with the serversof Vimeo is established. In conjunction with this, the Vimeo server receives information
about which of our sites you have visited. Vimeo also receives your IP address. However, wehave set up Vimeo in such a way that Vimeo cannot track your user activities and does notplace any cookies.
We use Vimeo to make our online presentation attractive for you. This is a legitimate
interest on our part pursuant to Art. 6(1)(f) GDPR. If a respective declaration of consent was
requested (e.g. concerning the storage of cookies), processing shall occur exclusively on thebasis of Art. 6(1)(a) GDPR; the given consent may be revoked at any time.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission and, according to Vimeo, on “legitimate business interests”. Details
can be found here: https://vimeo.com/privacy.
For more information on the handling of user data, please consult Vimeo’s data privacy
policy at: https://vimeo.com/privacy

page 52 of 68

Version as of 1 October 2023

7.3.

Google Maps

This website uses the mapping service Google Maps. The provider is Google Ireland Limited(“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
To enable the use of the Google Maps features, your IP address must be stored. As a rule,
this information is transferred to one of Google’s servers in the United States, where it isarchived. The operator of this website has no control over the data transfer. In case Google
Maps has been activated, Google has the option to use Google web fonts for the purpose of
the uniform depiction of fonts. When you access Google Maps, your browser will load therequired web fonts into your browser cache, to correctly display text and fonts.
We use Google Maps to present our online content in an appealing manner and to make thelocations disclosed on our website easy to find. This constitutes a legitimate interest as
defined in Art. 6(1)(f) GDPR. If appropriate consent has been obtained, the processing iscarried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TTDSG, insofar theconsent includes the storage of cookies or the access to information in the user’s end device(e.g., device fingerprinting) within the meaning of the TTDSG. This consent can be revokedat any time.
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here:
https://privacy.google.com/businesses/gdprcontrollerterms/ andhttps://privacy.google.com/businesses/gdprcontrollerterms/sccs/.
For more information on the handling of user data, please review Google’s Data Privacy
Declaration under: https://policies.google.com/privacy?hl=en.

page 53 of 68

Version as of 1 October 2023

7.4.

Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter referred to as “reCAPTCHA”) on this website. The
provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4,
Ireland.
The purpose of reCAPTCHA is to determine whether data entered on this website (e.g.,
information entered into a contact form) is being provided by a human user or by anautomated program. To determine this, reCAPTCHA analyses the behaviour of the website
visitors based on a variety of parameters. This analysis is triggered automatically as soon as
the website visitor enters the site. For this analysis, reCAPTCHA evaluates a variety of data
(e.g., IP address, time the website visitor spent on the site or cursor movements initiated by
the user). The data tracked during such analyses are forwarded to Google.
reCAPTCHA analyses run entirely in the background. Website visitors are not alerted that an
analysis is underway.
Data are stored and analysed on the basis of Art. 6(1)(f) GDPR. The website operator has alegitimate interest in the protection of the operator’s websites against abusive automatedspying and against SPAM. If appropriate consent has been obtained, the processing iscarried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25 (1) TTDSG, insofar theconsent includes the storage of cookies or the access to information in the user’s end device(e.g., device fingerprinting) within the meaning of the TTDSG. This consent can be revokedat any time.
For more information about Google reCAPTCHA please refer to the Google Data Privacy
Declaration and Terms Of Use under the following links:
https://policies.google.com/privacy?hl=en and https://policies.google.com/terms?hl=en.

page 54 of 68

Version as of 1 October 2023

7.5.

Wordfence

We have included Wordfence on this website. The provider is Defiant Inc, Defiant, Inc, 800
5th Ave Ste 4100, Seattle, WA 98104, USA (hereinafter “Wordfence”).
Wordfence is designed to protect our website from unwanted access or malicious
cyberattacks. To accomplish this, our website establishes a permanent connection withWordfence’s servers, which check and block their databases against access to our website.
The use of Wordfence is based on Art. 6(1)(f) GDPR. The website operator has a legitimate
interest in the most effective protection of his website against cyberattacks. If appropriate
consent has been obtained, the processing is carried out exclusively on the basis of Art.
6(1)(a) GDPR and § 25 (1) TTDSG, insofar the consent includes the storage of cookies or theaccess to information in the user’s end device (e.g., device fingerprinting) within themeaning of the TTDSG. This consent can be revoked at any time.
Data transmission to the USA is based on the standard contractual clauses of the EU
Commission. Details can be found here: https://www.wordfence.com/help/general-dataprotection-regulation/.
Data processing
We have concluded a data processing agreement (DPA) with the above-mentioned provider.
This is a contract mandated by data privacy laws that guarantees that they process personal
data of our website visitors only based on our instructions and in compliance with the GDPR.

page 55 of 68

Version as of 1 October 2023

7.6.

ManageWP

We administrate this website with the assistance of the ManageWP tool. The provider is
GoDaddy.com WP Europe, Trg republike 5, 11000 Belgrade, Serbia (hereinafter referred to
as ManageWP).
Among other things, ManageWP ensures that we can monitor the security and performanceof our website as well as generate automatic backups. Consequently, ManageWP has accessto all of the website’s content, including our databases. ManageWP is being hosted on theprovider’s servers.
The use of ManageWP is based on Art. 6 (1)(f) GDPR. The website operator has a legitimate
interest in a website(s) that work(s) as effectively and securely as possible. If appropriate
consent has been obtained, the processing is carried out exclusively on the basis of Art.
6(1)(a) GDPR and § 25 (1) TTDSG, insofar the consent includes the storage of cookies or theaccess to information in the user’s end device (e.g., device fingerprinting) within themeaning of the TTDSG. This consent can be revoked at any time.
Data processing
We have concluded a data processing agreement (DPA) with the above-mentioned provider.
This is a contract mandated by data privacy laws that guarantees that they process personal
data of our website visitors only based on our instructions and in compliance with the GDPR.

page 56 of 68

Version as of 1 October 2023

8. eCommerce and payment service providers

8.1.

Processing of Customer and Contract Data

We collect, process, and use personal customer and contract data for the establishment,
content arrangement and modification of our contractual relationships. Data with personalreferences to the use of this website (usage data) will be collected, processed, and used only
if this is necessary to enable the user to use our services or required for billing purposes.
The legal basis for these processes is Art. 6(1)(b) GDPR.
The collected customer data shall be deleted upon completion of the order or terminationof the business relationship and upon expiration of any existing statutory archiving periods.
This shall be without prejudice to any statutory archiving periods.

8.2.

Data transfer upon closing of contracts for online stores,

retailers, and the shipment of merchandise
Whenever you order merchandise from us, we will share your personal data with thetransportation company entrusted with the delivery as well as the payment service
commissioned to handle the payment transactions. Only the data these respective service
providers require to meet their obligations will be shared. The legal basis for this sharing is
Art. 6 (1)(b) GDPR, which permits the processing of data for the fulfillment of contractual or
pre-contractual obligations. If you give us your respective consent pursuant to Art. 6 (1)(a)GDPR, we will share your email address with the transportation company entrusted with thedelivery so that this company can notify you on the shipping status for your order via email.
You have the option to revoke your consent at any time.

page 57 of 68

Version as of 1 October 2023

8.3.

Data transfer upon closing of contracts for services anddigital content
We share personal data with third parties only if this is necessary in conjunction with thehandling of the contract; for instance, with the financial institution tasked with theprocessing of payments.
Any further transfer of data shall not occur or shall only occur if you have expressly
consented to the transfer. Any sharing of your data with third parties in the absence of yourexpress consent, for instance for advertising purposes, shall not occur.
The basis for the processing of data is Art. 6(1)(b) GDPR, which permits the processing ofdata for the fulfilment of a contract or for pre-contractual actions.

8.4.

Credit checks

We may conduct a credit check in the event that purchases are made on account or basedon other payment terms that require us to extend credit (scoring). For this purpose, wetransmit the data you have entered (e.g., name, address, age, or banking information) to acredit information agency. Based on this data, the probability of non-payment isdetermined. If the likelihood of non-payment is excessive, we may reject the respective
payment term.
The credit check is performed on the basis of contractual fulfillment (Art. 6(1)(b) GDPR) andto avert non-payment (justified interest pursuant to Art. 6(1)(f) GDPR). If consent has beenobtained, the credit check shall be performed on the basis of this consent (Art. 6(1)(a)GDPR); the consent may be revoked at any time.

8.5.

Payment services

We integrate payment services of third-party companies on our website. When you make apurchase from us, your payment data (e.g. name, payment amount, bank account details,
credit card number) are processed by the payment service provider for the purpose of
payment processing. For these transactions, the respective contractual and data protection
provisions of the respective providers apply. The use of the payment service providers isbased on Art. 6(1)(b) GDPR (contract processing) and in the interest of a smooth,page 58 of 68

Version as of 1 October 2023
convenient, and secure payment transaction (Art. 6(1)(f) GDPR). Insofar as your consent isrequested for certain actions, Art. 6(1)(a) GDPR is the legal basis for data processing;consent may be revoked at any time for the future.
We use the following payment services / payment service providers within the scope of thiswebsite:

8.6.

PayPalThe provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24
Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”).
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here:
https://www.paypal.com/de/webapps/mpp/ua/pocpsa-full.
Details can be found in PayPal’s privacy policy:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

8.7.

StripeThe provider for customers within the EU is Stripe Payments Europe, Ltd,1 Grand Canal
Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter “Stripe”).
Data transmission to the US is based on the Standard Contractual Clauses (SCC) of theEuropean Commission. Details can be found here: https://stripe.com/de/privacy andhttps://stripe.com/de/guides/general-data-protection-regulation.
Details can be found in Stripe’s Privacy Policy at the following link:
https://stripe.com/de/privacy.

page 59 of 68

Version as of 1 October 2023

8.8.

Instant transfer Sofort

The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich,Germany (hereinafter “Sofort GmbH”). With the help of the “Sofortüberweisung”
procedure, we receive a payment confirmation from Sofort GmbH in real time and can
immediately begin to fulfill our obligations. If you have chosen the payment method“Sofortüberweisung”, please send the PIN and a valid TAN to Sofort GmbH, with which it can
log into your online banking account. Sofort GmbH automatically checks your accountbalance after logging in and carries out the transfer to us with the help of the TAN you havetransmitted. Afterwards, it immediately sends us a transaction confirmation. After you log
in, your turnover, the credit limit of the overdraft facility and the existence of otheraccounts and their balances are also checked automatically. In addition to the PIN and theTAN, the payment data entered by you as well as personal data will be transmitted to Sofort
GmbH. The data about your person are first and last name, address, telephone number(s),email address, IP address and possibly other data required for payment processing. The
transmission of this data is necessary to determine your identity beyond doubt and toprevent fraud attempts. For details on payment with immediate bank transfer, please referto the following links: https://www.sofort.de/datenschutz.html andhttps://www.klarna.com/sofort/.

8.9.

Unzer

The provider of this payment service is the Unzer GmbH, Vangerowstraße 18, 69115
Heidelberg (hereinafter referred to as “Unzer”).
For details, please consult Unzer’s data privacy policy at:https://www.unzer.com/de/datenschutz/.

page 60 of 68

Version as of 1 October 2023

8.10.

American Express

The provider of this payment service is the American Express Europe S.A., Theodor-HeussAllee 112, 60486 Frankfurt am Main, Germany (hereinafter “American Express”).
American Express may transfer data to its parent company in the US. The data transfer tothe US is based on the Binding Corporate Rules. Details can be found here:
https://www.americanexpress.com/en-pl/company/legal/privacy-centre/europeanimplementing-principles/.
For more information, please see the American Express privacy policy:
https://www.americanexpress.com/de/legal/online-datenschutzerklarung.html.

8.11.

Mastercard

The provider of this payment service is the Mastercard Europe SA, Chaussée de Tervuren
198A, B-1410 Waterloo, Belgium (hereinafter “Mastercard”).
Mastercard may transfer data to its parent company in the US. The data transfer to the US isbased on Mastercard's Binding Corporate Rules. Details can be found here:
https://www.mastercard.de/de-de/datenschutz.html andhttps://www.mastercard.us/content/dam/mccom/global/documents/mastercard-bcrs.pdf.

8.12.

VISA

The provider of this payment service is the Visa Europe Services Inc, London Branch, 1
Sheldon Square, London W2 6TT, United Kingdom (hereinafter “VISA”).
Great Britain is considered a secure non-EU country as far as data protection legislation isconcerned. This means that the data protection level in Great Britain is equivalent to thedata protection level of the European Union.
VISA may transfer data to its parent company in the US. The data transfer to the US is basedon the standard contractual clauses of the EU Commission. Details can be found here:
https://www.visa.de/nutzungsbedingungen/visa-globale-datenschutzmitteilung/mitteilungzu-zustandigkeitsfragen-fur-den-ewr.html.
For more information, please refer to VISA’s privacy policy:
https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

page 61 of 68

Version as of 1 October 2023

8.13.

PayU

Curaden offers the payment option via PayU, MIH PayU B.V. having its registered office inAmsterdam, the Netherlands, registration number 52117839 ("PayU"), such as prepayment,
payment by credit card and payment on account. For this purpose, payment data may betransmitted to PayU. For more information about the processing of personal data by thispayment service provider, please see PayU's privacy policy:
https://corporate.payu.com/privacy/

8.14.

Payment services

We integrate payment services from third-party companies on our website. When you makea purchase from us, your payment details (e.g. name, payment amount, account details,
credit card number) are processed by the payment service provider for the purpose ofprocessing the payment. The respective contractual and data protection provisions of therespective providers apply to these transactions. The payment service providers are used on
the basis of Art. 6(1)(b) GDPR (contract processing) as well as in the interest of a smooth,convenient and secure payment process (Art. 6(1)(f) GDPR). Insofar as your consent isrequested for certain actions, Art. 6 (1)(a) GDPR is the legal basis for data processing;consents can be revoked at any time for the future. We use the following payment services /payment service providers within the scope of this website:

8.15.

Apple Pay

The payment service provider is Apple Inc, Infinite Loop, Cupertino, CA 95014, USA. Apple's
privacy policy can be found at: https://www.apple.com/legal/privacy/en-ww/

8.16.

Google Pay

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. You
can find Google's privacy policy here: https://policies.google.com/privacy?hl=en-GB

page 62 of 68

Version as of 1 October 2023

8.17.

Amazon Pay

The provider of this payment service is Amazon Payments Europe S.C.A., 38 Avenue J.F.
Kennedy, L-1855 Luxembourg.
Details on the handling of your data can be found in the Amazon Pay privacy policy under
the following link: https://pay.amazon.co.uk/?ld=1

8.18.

Afterpay

The provider of this payment service is Riverty GmbH, Gütersloher Straße 123, 33415 Verl,
Germany.
Details can be found in the following privacy policy:
https://documents.riverty.com/privacy_statement/checkout/en_de/default.

page 63 of 68

Version as of 1 October 2023

9. Online-based Audio and Video Conferences(Conference tools)

9.1.

Data processing

We use online conference tools, among other things, for communication with ourcustomers. The tools we use are listed in detail below. If you communicate with us by video
or audio conference using the Internet, your personal data will be collected and processedby the provider of the respective conference tool and by us. The conferencing tools collect
all information that you provide/access to use the tools (email address and/or your phone
number). Furthermore, the conference tools process the duration of the conference, startand end (time) of participation in the conference, number of participants and other “context
information” related to the communication process (metadata).
Furthermore, the provider of the tool processes all the technical data required for theprocessing of the online communication. This includes, in particular, IP addresses, MAC
addresses, device IDs, device type, operating system type and version, client version,
camera type, microphone or loudspeaker and the type of connection.
Should content be exchanged, uploaded, or otherwise made available within the tool, it isalso stored on the servers of the tool provider. Such content includes, but is not limited to,cloud recordings, chat/ instant messages, voicemail uploaded photos and videos, files,
whiteboards, and other information shared while using the service.
Please note that we do not have complete influence on the data processing procedures of
the tools used. Our possibilities are largely determined by the corporate policy of therespective provider. Further information on data processing by the conference tools can befound in the data protection declarations of the tools used, and which we have listed below
this text.

page 64 of 68

Version as of 1 October 2023

9.2.

Purpose and legal bases

The conference tools are used to communicate with prospective or existing contractual
partners or to offer certain services to our customers (Art. 6(1)(b) GDPR). Furthermore, theuse of the tools serves to generally simplify and accelerate communication with us or ourcompany (legitimate interest in the meaning of Art. 6(1)(f) GDPR). Insofar as consent has
been requested, the tools in question will be used on the basis of this consent; the consent
may be revoked at any time with effect from that date.

9.3.

Duration of storage

Data collected directly by us via the video and conference tools will be deleted from oursystems immediately after you request us to delete it, revoke your consent to storage, or
the reason for storing the data no longer applies. Stored cookies remain on your end device
until you delete them. Mandatory legal retention periods remain unaffected.
We have no influence on the duration of storage of your data that is stored by the operatorsof the conference tools for their own purposes. For details, please directly contact theoperators of the conference tools.

page 65 of 68

Version as of 1 October 2023

9.4.

Conference tools used

We employ the following conference tools:

9.5.

Webex

We use Webex. The provider of this service is the Webex Communications DeutschlandGmbH, Hansaallee 249 c/o Cisco Systems GmbH, 40549 Düsseldorf, Germany.
It cannot be ruled out that data processed via Webex will be transferred to third-party
countries (e.g. USA). Webex has Binding Corporate Rules (BCR) which have been approvedby the Dutch, Polish, Spanish, and other relevant European Data Protection Authorities.
These are binding corporate rules that legitimise the transfer of data within the company tothird countries outside the EU and EEA: https://www.cisco.com/c/de_de/about/trustcenter/data-protection-and-privacy-policy.html andhttps://konferenzen.telekom.de/fileadmin/Redaktion/conference/ciscowebex/Webex_Compliance_Deutsch_V1.0.pdf.
For details on data processing, please refer to Webex’s privacy policy:
https://www.cisco.com/c/de_de/about/legal/privacy-full.html.
Data processing
We have concluded a data processing agreement (DPA) with the above-mentioned provider.
This is a contract mandated by data privacy laws that guarantees that they process personal
data of our website visitors only based on our instructions and in compliance with the GDPR.

page 66 of 68

Version as of 1 October 2023

10. Custom Services

10.1.

Handling applicant data

We offer website visitors the opportunity to submit job applications to us (e.g., via e-mail,via postal services on by submitting the online job application form). Below, we will brief
you on the scope, purpose and use of the personal data collected from you in conjunction
with the application process. We assure you that the collection, processing, and use of yourdata will occur in compliance with the applicable data privacy rights and all other statutory
provisions and that your data will always be treated as strictly confidential.

10.2.

Scope and purpose of the collection of data

If you submit a job application to us, we will process any affiliated personal data (e.g.,contact and communications data, application documents, notes taken during job
interviews, etc.), if they are required to make a decision concerning the establishment or an
employment relationship. The legal grounds for the aforementioned are Art. 6(1)(b) GDPR
(General Contract Negotiations) and – provided you have given us your consent – Art.
6(1)(a) GDPR. You may revoke any consent given at any time. Within our company, yourpersonal data will only be shared with individuals who are involved in the processing of yourjob application.
If your job application should result in your recruitment, the data you have submitted will bearchived on the grounds of Art. 26 GDPR and Art. 6(1)(b) GDPR for the purpose of
implementing the employment relationship in our data processing system.

page 67 of 68

Version as of 1 October 2023

10.3.

Data Archiving Period

If we are unable to make you a job offer or you reject a job offer or withdraw yourapplication, we reserve the right to retain the data you have submitted on the basis of ourlegitimate interests (Art. 6(1)(f) GDPR) for up to six (6) months from the end of theapplication procedure (rejection or withdrawal of the application). Afterwards the data will
be deleted, and the physical application documents will be destroyed. The storage serves inparticular as evidence in the event of a legal dispute. If it is evident that the data will be
required after the expiry of the 6-month period (e.g., due to an impending or pending legal
dispute), deletion will only take place when the purpose for further storage no longer
applies.
Longer storage may also take place if you have given your agreement (Article 6(1)(a) GDPR)
or if statutory data retention requirements preclude the deletion.

10.4.

Admission to the applicant poolIf we do not make you a job offer, you may be able to join our applicant pool. In case ofadmission, all documents and information from the application will be transferred to theapplicant pool in order to contact you in case of suitable vacancies.
Admission to the applicant pool is based exclusively on your express agreement (Art. 6(1)(a)GDPR). The submission agreement is voluntary and has no relation to the ongoing
application procedure. The affected person can revoke his agreement at any time. In thiscase, the data from the applicant pool will be irrevocably deleted, provided there are no
legal reasons for storage.
The data from the applicant pool will be irrevocably deleted no later than two (2) years after
consent has been granted.

page 68 of 68