Loading...
Tinjau ketentuan dan kebijakan yang mengatur penggunaan Octant oleh Anda. Pelajari tentang hak-hak Anda, komitmen kami, dan bagaimana kami melindungi informasi Anda.
With the following privacy policy we would like to inform you which types of your personal data (hereinafter also abbreviated as "data") we process for which purposes and in which scope. The privacy statement applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online services").
The terms used are not gender-specific.
Last Update: 12. November 2025
The following table summarises the types of data processed, the purposes for which they are processed and the concerned data subjects.
Relevant legal bases according to the GDPR: In the following, you will find an overview of the legal basis of the GDPR on which we base the processing of personal data. Please note that in addition to the provisions of the GDPR, national data protection provisions of your or our country of residence or domicile may apply. If, in addition, more specific legal bases are applicable in individual cases, we will inform you of these in the data protection declaration.
Relevant legal basis according to the Swiss Data Protection Act: If you are located in Switzerland, we process your data based on the Federal Act on Data Protection (referred to as "Swiss DPA"). Unlike the GDPR, for instance, the Swiss DPA does not generally require that a legal basis for processing personal data be stated and that the processing of personal data is conducted in good faith, lawfully and proportionately (Art. 6 para. 1 and 2 of the Swiss DPA). Furthermore, we only collect personal data for a specific purpose recognizable to the data subject and process it only in a manner compatible with this purpose (Art. 6 para. 3 of the Swiss DPA).
Reference to the applicability of the GDPR and the Swiss DPA: These privacy policy serves both to provide information pursuant to the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). For this reason, we ask you to note that due to the broader spatial application and comprehensibility, the terms used in the GDPR are applied. In particular, instead of the terms used in the Swiss FADP such as "processing" of "personal data", "predominant interest", and "particularly sensitive personal data", the terms used in the GDPR, namely "processing" of "personal data", as well as "legitimate interest" and "special categories of data" are used. However, the legal meaning of these terms will continue to be determined according to the Swiss FADP within its scope of application.
Applicability of data protection regulations in the country of office: In the country where the controller is based, national data protection regulations apply in addition to the General Data Protection Regulation (GDPR).
We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk.
The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input, transmission, securing and separation of the data. In addition, we have established procedures to ensure that data subjects' rights are respected, that data is erased, and that we are prepared to respond to data threats rapidly. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and service providers, in accordance with the principle of privacy by design and privacy by default.
Securing online connections through TLS/SSL encryption technology (HTTPS): To protect the data of users transmitted via our online services from unauthorized access, we employ TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information that is transferred between the website or app and the user's browser (or between two servers), thereby safeguarding the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions conform to the highest security standards. When a website is secured with an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is being securely and encryptedly transmitted.
In the course of processing personal data, it may happen that this data is transmitted to or disclosed to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include service providers tasked with IT duties or providers of services and content that are integrated into a website. In such cases, we observe the legal requirements and particularly conclude relevant contracts or agreements that serve to protect your data with the recipients of your data.
Data Processing in Third Countries: If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in the context of using third-party services or the disclosure or transfer of data to other individuals, entities, or companies (which becomes apparent either from the postal address of the respective provider or when explicitly mentioned in the privacy policy regarding data transfer to third countries), this is always done in accordance with legal requirements.
For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which has been recognized as a secure legal framework by the EU Commission's adequacy decision of July 10, 2023. Additionally, we have concluded Standard Contractual Clauses with the respective providers, which comply with the EU Commission's requirements and establish contractual obligations to protect your data.
This dual safeguard ensures comprehensive protection of your data: The DPF serves as the primary level of protection, while the Standard Contractual Clauses act as an additional security measure. Should any changes occur within the DPF framework, the Standard Contractual Clauses will serve as a reliable fallback option. This ensures that your data remains adequately protected even in the event of political or legal changes.
For individual service providers, we will inform you whether they are certified under the DPF and if Standard Contractual Clauses are in place. The list of certified companies and further information about the DPF can be found on the U.S. Department of Commerce's website at https://www.dataprivacyframework.gov/
For data transfers to other third countries, appropriate safeguards apply, particularly Standard Contractual Clauses, explicit consent, or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en
We will inform you which of our service providers are certified under the Data Privacy Framework as part of our data protection notices.
We delete personal data that we process in accordance with legal regulations as soon as the underlying consents are revoked or no further legal bases for processing exist. This applies to cases where the original purpose of processing is no longer applicable or the data is no longer needed. Exceptions to this rule exist if statutory obligations or special interests require a longer retention or archiving of the data.
In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or protection of the rights of other natural or legal persons, must be archived accordingly.
Our privacy notices contain additional information on the retention and deletion of data specifically applicable to certain processing processes.
In cases where multiple retention periods or deletion deadlines for a date are specified, the longest period always prevails.
Data that is no longer stored for its originally intended purpose but due to legal requirements or other reasons are processed exclusively for the reasons justifying their retention.
Data Retention and Deletion: The following general retention and archiving periods apply under Swiss law:
10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balances, accounting vouchers and invoices, as well as all necessary working instructions and other organizational documents (Article 958f of the Swiss Code of Obligations (OR)).
10 years - Data necessary to consider potential claims for damages or similar contractual claims and rights, as well as for the processing of related inquiries based on previous business experiences and usual industry practices, will be stored for the statutory limitation period of ten years, unless a shorter period of five years is applicable, which is relevant in certain cases (Articles 127, 130 OR). Claims for rent, lease, and interest on capital, as well as other periodic services, for the delivery of food, for board and lodging, for innkeeper debts, as well as for craftsmanship, small-scale sales of goods, medical care, professional services by lawyers, legal agents, procurators, and notaries, and from the employment relationship of employees, expire after five years (Article 128 OR).
Start of the period at the end of the year: If a period does not expressly start on a specific date and lasts at least one year, it automatically begins at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in the context of which data is stored, the event triggering the deadline is the time at which the termination or other termination of the legal relationship takes effect.
Rights of the Data Subjects under the GDPR: As data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:
Right to Object: You have the right, on grounds arising from your particular situation, to object at any time to the processing of your personal data which is based on letter (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data concerning you for the purpose of such marketing, which includes profiling to the extent that it is related to such direct marketing.
Right of withdrawal for consents: You have the right to revoke consents at any time.
Right of access: You have the right to request confirmation as to whether the data in question will be processed and to be informed of this data and to receive further information and a copy of the data in accordance with the provisions of the law.
Right to rectification: You have the right, in accordance with the law, to request the completion of the data concerning you or the rectification of the incorrect data concerning you.
Right to Erasure and Right to Restriction of Processing: In accordance with the statutory provisions, you have the right to demand that the relevant data be erased immediately or, alternatively, to demand that the processing of the data be restricted in accordance with the statutory provisions.
Right to data portability: You have the right to receive data concerning you which you have provided to us in a structured, common and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
Complaint to the supervisory authority: In accordance with the law and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State where you habitually reside, the supervisory authority of your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.
Rights of the data subjects under the Swiss DPA:
As the data subject, you have the following rights in accordance with the provisions of the Swiss DPA:
Right to information: You have the right to request confirmation as to whether personal data concerning you are being processed, and to receive the information necessary for you to assert your rights under the Swiss DPA and to ensure transparent data processing.
Right to data release or transfer: You have the right to request the release of your personal data, which you have provided to us, in a common electronic format, as well as its transfer to another data controller, provided this does not require disproportionate effort.
Right to rectification: You have the right to request the rectification of inaccurate personal data concerning you.
Right to object, deletion, and destruction: You have the right to object to the processing of your data, as well as to request that personal data concerning you be deleted or destroyed.
We process data of our contractual and business partners, e.g. customers and interested parties (collectively referred to as "contractual partners") within the context of contractual and comparable legal relationships as well as associated actions and communication with the contractual partners or pre-contractually, e.g. to answer inquiries.
We process this data in order to fulfill our contractual obligations. These include, in particular, the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other service disruptions. In addition, we process the data to protect our rights and for the purpose of administrative tasks associated with these obligations and company organization. Furthermore, we process the data on the basis of our legitimate interests in proper and economical business management as well as security measures to protect our contractual partners and our business operations from misuse, endangerment of their data, secrets, information and rights (e.g. for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of applicable law, we only disclose the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners will be informed about further forms of processing, e.g. for marketing purposes, within the scope of this privacy policy.
Which data are necessary for the aforementioned purposes, we inform the contracting partners before or in the context of the data collection, e.g. in online forms by special marking (e.g. colors), and/or symbols (e.g. asterisks or the like), or personally.
We delete the data after expiry of statutory warranty and comparable obligations, i.e. in principle after expiry of 4 years, unless the data is stored in a customer account or must be kept for legal reasons of archiving. The statutory retention period for documents relevant under tax law as well as for commercial books, inventories, opening balance sheets, annual financial statements, the instructions required to understand these documents and other organizational documents and accounting records is ten years and for received commercial and business letters and reproductions of sent commercial and business letters six years. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance sheet, the annual financial statements or the management report was prepared, the commercial or business letter was received or sent, or the accounting document was created, furthermore the record was made or the other documents were created.
Processed data types: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Payment Data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or phone numbers). Contract data (e.g. contract object, duration, customer category).
Data subjects: Service recipients and clients; Prospective customers. Business and contractual partners.
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; Communication; Office and organisational procedures; Organisational and Administrative Procedures. Business processes and management procedures.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR); Compliance with a legal obligation (Article 6 (1) (c) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Personal data of service recipients and clients - including customers, clients, or in specific cases, mandates, patients, or business partners as well as other third parties - are processed within the framework of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relations. This data processing supports and facilitates business processes in areas such as customer management, sales, payment transactions, accounting, and project management.
The collected data is used to fulfil contractual obligations and make business processes efficient. This includes the execution of business transactions, the management of customer relationships, the optimisation of sales strategies, and ensuring internal invoicing and financial processes. Additionally, the data supports the protection of the rights of the controller and promotes administrative tasks as well as the organisation of the company.
Personal data may be transferred to third parties if necessary for fulfilling the mentioned purposes or legal obligations. After legal retention periods expire or when the purpose of processing no longer applies, the data will be deleted. This also includes data that must be stored for longer periods due to tax law and legal obligations to provide evidence.
Processed data types: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Payment Data (e.g. bank details, invoices, payment history); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such as details of authorship or the time of creation.); Contract data (e.g. contract object, duration, customer category); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties). Log data (e.g. log files concerning logins or data retrieval or access times.).
Data subjects: Service recipients and clients; Prospective customers; Communication partner (Recipients of e-mails, letters, etc.); Business and contractual partners; Customers; Third parties; Users (e.g. website visitors, users of online services). Employees (e.g. employees, job applicants, temporary workers, and other personnel.).
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; Office and organisational procedures; Business processes and management procedures; Security measures; Provision of our online services and usability; Communication; Marketing; Sales promotion; Public relations; Financial and Payment Management. Information technology infrastructure (Operation and provision of information systems and technical devices, such as computers, servers, etc.)).
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR). Compliance with a legal obligation (Article 6 (1) (c) GDPR).
Further information on processing methods, procedures and services used:
Customer Management and Customer Relationship Management (CRM): Processes required in the context of customer management and Customer Relationship Management (CRM) include customer acquisition in compliance with data protection regulations, measures to promote customer retention and loyalty, effective customer communication, complaint management and customer service with consideration of data protection, data management and analysis to support the customer relationship, management of CRM systems, secure account management, customer segmentation and targeting; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Contact management and contact maintenance: Processes required in the context of organizing, maintaining, and securing contact information (e.g., setting up and maintaining a central contact database, regular updates of contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, conducting backups and restorations of contact data, training employees in effective use of contact management software, regular review of communication history and adjustment of contact strategies); Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Customer Account: Customers can create an account within our online offer (e.g. customer or user account, "customer account" for short). If the registration of a customer account is required, customers will be informed of this as well as of the details required for registration. The customer accounts are not public and cannot be indexed by search engines. In the course of registration and subsequent registration and use of the customer account, we store the IP addresses of the contractual partners along with the access times, in order to be able to prove the registration and prevent any misuse of the customer account. If the customer account has been terminated, the customer account data will be deleted after the termination date, unless it is retained for purposes other than provision in the customer account or must be retained for legal reasons (e.g. internal storage of customer data, order transactions or invoices). It is the customers' responsibility to back up their data when terminating the customer Account; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
General Payment Transactions: Procedures required for carrying out payment transactions, monitoring bank accounts, and controlling payment flows (e.g., creation and verification of transfers, processing of direct debit transactions, checking of account statements, monitoring of incoming and outgoing payments, management of chargebacks, account reconciliation, cash management); Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Accounting, accounts payable, accounts receivable: Procedures required for the collection, processing, and control of business transactions in the area of accounts payable and receivable accounting (e.g., creation and verification of incoming and outgoing invoices, monitoring and management of outstanding items, execution of payment transactions, handling of dunning processes, account reconciliation within the scope of receivables and payables, accounts payable accounting, and accounts receivable accounting); Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Compliance with a legal obligation (Article 6 (1) (c) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Financial Accounting and Taxes: Procedures required for the collection, management, and control of finance-related business transactions as well as for the calculation, reporting, and payment of taxes (e.g., accounting and posting of business transactions, preparation of quarterly and annual financial statements, execution of payment transactions, handling of dunning processes, account reconciliation, tax consulting, preparation and submission of tax returns, management of tax affairs); Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR), Compliance with a legal obligation (Article 6 (1) (c) GDPR), Legitimate Interests (Article 6 (1) (f) GDPR).
Marketing, advertising, and sales promotion: Processes required in the context of marketing, advertising, and sales promotion (e.g., market analysis and audience targeting, development of marketing strategies, planning and execution of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade show participation, customer loyalty programs, sales promotion measures, performance measurement and optimisation of marketing activities, budget management and cost control); Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Public Relations: Processes required in the context of public relations and public relations activities (e.g., development and implementation of communication strategies, planning and execution of PR campaigns, creation and distribution of press releases, maintenance of media contacts, monitoring and analysis of media response, organisation of press conferences and public events, crisis communication, creation of content for social media and corporate websites, management of corporate branding); Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
We process user data in order to be able to provide them with our online services. For this purpose, we process the IP address of the user, which is necessary to transmit the content and functions of our online services to the user's browser or terminal device.
Processed data types: Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties); Log data (e.g. log files concerning logins or data retrieval or access times.); Content data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such as details of authorship or the time of creation.); Contact data (e.g. postal and email addresses or phone numbers). Inventory data (For example, the full name, residential address, contact information, customer number, etc.).
Data subjects: Users (e.g. website visitors, users of online services); Business and contractual partners; Prospective customers. Communication partner (Recipients of e-mails, letters, etc.).
Purposes of processing: Provision of our online services and usability; Information technology infrastructure (Operation and provision of information systems and technical devices, such as computers, servers, etc.)); Security measures; Communication; Office and organisational procedures; Organisational and Administrative Procedures; Direct marketing (e.g. by e-mail or postal). Content Delivery Network (CDN).
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Provision of online offer on rented hosting space: For the provision of our online services, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also referred to as a "web hoster"); Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Collection of Access Data and Log Files: Access to our online service is logged in the form of so-called "server log files". Server log files may include the address and name of the accessed web pages and files, date and time of access, transferred data volumes, notification of successful retrieval, browser type along with version, the user's operating system, referrer URL (the previously visited page), and typically IP addresses and the requesting provider. The server log files can be used for security purposes, e.g., to prevent server overload (especially in the case of abusive attacks, known as DDoS attacks), and to ensure server load management and stability; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR). Retention period: Log file information is stored for a maximum period of 30 days and then deleted or anonymized. Data, the further storage of which is necessary for evidence purposes, are excluded from deletion until the respective incident has been finally clarified.
E-mail Sending and Hosting: The web hosting services we use also include sending, receiving and storing e-mails. For these purposes, the addresses of the recipients and senders, as well as other information relating to the sending of e-mails (e.g. the providers involved) and the contents of the respective e-mails are processed. The above data may also be processed for SPAM detection purposes. Please note that e-mails on the Internet are generally not sent in encrypted form. As a rule, e-mails are encrypted during transport, but not on the servers from which they are sent and received (unless a so-called end-to-end encryption method is used). We can therefore accept no responsibility for the transmission path of e-mails between the sender and reception on our server; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Content-Delivery-Network: We use a so-called "Content Delivery Network" (CDN). A CDN is a service with whose help contents of our online services, in particular large media files, such as graphics or scripts, can be delivered faster and more securely with the help of regionally distributed servers connected via the Internet; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
GitHub: Platform for version control of software projects. Developers are enabled to upload their code to repositories and track changes, as well as use tools for project management in software development; Service provider: GitHub B.V., Netherlands, https://support.github.com/contact/privacy; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://github.com. Privacy Policy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement.
Proton Calendar: Creation and management of calendar entries, synchronisation between devices, reminder functions, sending and receiving invitations to other individuals, encryption of calendar data; Service provider: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://proton.me/calendar; Privacy Policy: https://proton.me/legal/privacy. Data Processing Agreement: Provided by the service provider.
Proton Drive: Secure storage and management of files, encryption of user data, sharing files with other individuals, access to files across various devices; Service provider: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://proton.me/drive; Privacy Policy: https://proton.me/legal/privacy. Data Processing Agreement: Provided by the service provider.
Proton Mail: Email sending and receiving, storage of contacts in the address book, filter rules for sorting incoming emails, spam and virus protection, cloud storage for attachments and other content; Service provider: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://proton.me/mail; Privacy Policy: https://proton.me/legal/privacy. Data Processing Agreement: Provided by the service provider.
Mailgun: E-mail dispatch and automation services; Service provider: Sinch Incorporated, 7000 Central Parkway, Suite 1480, 30328 Atlanta, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.mailgun.com; Privacy Policy: https://www.mailgun.com/legal/privacy-policy/; Data Processing Agreement: https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-protection-agreement/ Provided by the service provider. Basis for third-country transfers: EEA - Standard Contractual Clauses (https://sinch.com/de/legal/terms-and-conditions/other-sinch-terms-conditions/data-protection-agreement/), Switzerland - Standard Contractual Clauses (https://sinch.com/de/legal/terms-and-conditions/other-sinch-terms-conditions/data-protection-agreement/).
Google Cloud Services: Cloud infrastructure services and cloud-based application software; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://cloud.google.com/; Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement: https://cloud.google.com/terms/data-processing-addendum; Basis for third-country transfers: EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause). Further Information: https://cloud.google.com/privacy.
Cloudflare: Content-Delivery-Network (CDN) - service with whose help contents of our online services, in particular large media files, such as graphics or scripts, can be delivered faster and more securely with the help of regionally distributed servers connected via the Internet; Service provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.cloudflare.com; Privacy Policy: https://www.cloudflare.com/privacypolicy/; Data Processing Agreement: https://www.cloudflare.com/cloudflare-customer-dpa/. Basis for third-country transfers: EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.cloudflare.com/cloudflare-customer-scc/), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.cloudflare.com/cloudflare-customer-scc/).
We process the data of the users of our application to the extent necessary to provide the users with the application and its functionalities, to monitor its security and to develop it further. Furthermore, we may contact users in compliance with the statutory provisions if communication is necessary for the purposes of administration or use of the application. In addition, we refer to the data protection information in this privacy policy with regard to the processing of user data.
Legal basis: The processing of data necessary for the provision of the functionalities of the application serves to fulfil contractual obligations. This also applies if the provision of the functions requires user authorisation (e.g. release of device functions). If the processing of data is not necessary for the provision of the functionalities of the application, but serves the security of the application or our business interests (e.g. collection of data for the purpose of optimising the application or security purposes), it is carried out on the basis of our legitimate interests. If users are expressly requested to give their consent to the processing of their data, the data covered by the consent is processed on the basis of the consent.
Processed data types: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties); Payment Data (e.g. bank details, invoices, payment history); Contract data (e.g. contract object, duration, customer category). Content data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such as details of authorship or the time of creation.).
Data subjects: Users (e.g. website visitors, users of online services); Business and contractual partners. Service recipients and clients.
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; Security measures; Provision of our online services and usability; Information technology infrastructure (Operation and provision of information systems and technical devices, such as computers, servers, etc.)); Web Analytics (e.g. access statistics, recognition of returning visitors). Remarketing.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR). Consent (Article 6 (1) (a) GDPR).
Further information on processing methods, procedures and services used:
Commercial use: We process the data of the users of our application, registered and any test users (hereinafter uniformly referred to as "users") in order to provide them with our contractual services and on the basis of legitimate interests to ensure the security of our application and to develop it further. The required details are identified as such within the scope of the conclusion of a contract for the use of the application, the conclusion of an order, an order or a comparable contract and may include the details required for the provision of services and any invoicing as well as contact information in order to be able to hold any consultations; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR).
Storage of an own unique identifier: In order to provide the application and ensure its functionality, we use a pseudonymous identifier. The identifier is a mathematical value (i.e. no clear data such as names are used) that is assigned to a device and/or the installation of the application installed on it. This identifier is generated during the installation of the application, remains stored between the start of the application and its updates and is deleted when users remove the application from the device.
GitHub: Platform for version control of software projects. Developers are enabled to upload their code to repositories and track changes, as well as use tools for project management in software development; Service provider: GitHub B.V., Netherlands, https://support.github.com/contact/privacy; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://github.com. Privacy Policy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement.
Sentry: Monitoring system stability and identifying code errors - Information about the device or error time are collected pseudonymously and are deleted afterwards; Service provider: Functional Software Inc., Sentry, 132 Hawthorne Street, San Francisco, California 94107, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://sentry.io; Security measures: IP Masking (Pseudonymization of the IP address); Privacy Policy: https://sentry.io/privacy; Data Processing Agreement: https://sentry.io/legal/dpa/. Basis for third-country transfers: EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://sentry.io/legal/dpa/), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://sentry.io/legal/dpa/).
Matomo: Matomo is software that is used for the purposes of web analysis and reach measurement. As part of the use of Matomo, cookies are generated and stored on the user's terminal device. User data collected through the use of Matomo is processed only by us and is not shared with third parties. The cookies are stored for a maximum period of 13 months: https://matomo.org/faq/general/faq_146/; Legal Basis: Consent (Article 6 (1) (a) GDPR). Retention period: The cookies have a maximum storage period of 13 months.
Pagerduty: Info from sentry, blockchain, kubernetes clusters.
Google Cloud Services: Cloud infrastructure services and cloud-based application software; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://cloud.google.com/; Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement: https://cloud.google.com/terms/data-processing-addendum; Basis for third-country transfers: EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause). Further Information: https://cloud.google.com/privacy.
Users can create a user account. Within the scope of registration, the required mandatory information is communicated to the users and processed for the purposes of providing the user account on the basis of contractual fulfilment of obligations. The processed data includes in particular the login information (name, password and an e-mail address).
Within the scope of using our registration and login functions as well as the use of the user account, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests, as well as the user's protection against misuse and other unauthorized use. This data will not be passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so.
Users may be informed by e-mail of information relevant to their user account, such as technical changes.
Processed data types: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such as details of authorship or the time of creation.); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features). Log data (e.g. log files concerning logins or data retrieval or access times.).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; Security measures; Organisational and Administrative Procedures. Provision of our online services and usability.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion". Deletion after termination.
Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Registration with pseudonyms: Users may use pseudonyms as user names instead of real names; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR).
Users' profiles are public: Users' profiles are publicly visible and accessible.
Deletion of data after termination: If users have terminated their user account, their data relating to the user account will be deleted, subject to any legal permission, obligation or consent of the users; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR).
No obligation to retain data: It is the responsibility of the users to secure their data before the end of the contract in the event of termination. We are entitled to irretrievably delete all user data stored during the term of the contract; Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR).
Single Sign-On" or "Single Sign-On Authentication or Logon" are procedures that allow users to log in to our online services using a user account with a provider of Single Sign-On services (e.g. a social network). The prerequisite for Single Sign-On Authentication is that users are registered with the respective Single Sign-On provider and enter the required access data in the online form provided for this purpose, or are already logged in with the Single Sign-On provider and confirm the Single Sign-On login via the button.
Authentication takes place directly with the respective single sign-on provider. Within the scope of such authentication, we receive a user ID with the information that the user is logged in with the respective single sign-on provider under this user ID and an ID that cannot be used for other purposes (so-called "user handle"). Whether we receive further data depends solely on the single sign-on procedure used, the data releases selected as part of authentication and also which data users have released in the privacy or other settings of the user account with the single sign-on provider. Depending on the single sign-on provider and the user's choice, there can be different data, usually the e-mail address and the user name. The password entered by the single sign-on provider as part of the single sign-on procedure is neither visible to us nor is it stored by us.
Users are requested to note that their data stored with us can be automatically compared with their user account with the single sign-on provider, but this is not always possible or actual. If, for example, the e-mail addresses of users change, users must change these manually in their user account with us.
We can use single sign-on authentication, provided that it has been agreed with users in the context of pre-fulfillment or fulfilment of the contract, in the context of consent processing and otherwise use it on the basis of our legitimate interests and the interests of users in an effective and secure authentication system.
Should users decide to no longer want to use the link of their user account with the Single Sign-On provider for the Single Sign-On procedure, they must remove this link within their user account with the Single Sign-On provider. If users wish to delete their data from us, they must cancel their registration with us.
Processed data types: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or phone numbers); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features). Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties).
Data subjects: Users (e.g. website visitors, users of online services). Communication partner (Recipients of e-mails, letters, etc.).
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; Security measures; Authentication processes; Provision of our online services and usability; Communication. Direct marketing (e.g. by e-mail or postal).
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion". Deletion after termination.
Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Telegram: A cloud-based messaging service that enables the sending and receiving of text messages, voice messages, images, videos, files, and voice calls. Telegram stores chats, media, and contacts encrypted on servers to allow cross-platform access. Individual chats can optionally be protected by end-to-end encryption; Service provider: Representative in the European Union: European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://telegram.org/. Privacy Policy: https://telegram.org/privacy.
LinkedIn: Social network - We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not the further processing) of visitor data, which is used to create "Page Insights" (statistics) for our LinkedIn profiles. This data includes information about the types of content users view or interact with, as well as the actions they take. It also includes details about the devices used, such as IP addresses, operating systems, browser types, language settings, and cookie data, as well as profile details of users, such as job function, country, industry, seniority, company size, and employment status. Privacy information regarding the processing of user data by LinkedIn can be found in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy
We have entered into a special agreement with LinkedIn Ireland ("Page Insights Joint Controller Addendum," https://legal.linkedin.com/pages-joint-controller-addendum), which specifically regulates the security measures LinkedIn must comply with and in which LinkedIn has agreed to fulfill the rights of data subjects. Further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy. Basis for third-country transfers: EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa). Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
X Single-Sign-On: Authentication services for user logins, provision of single sign-on functionalities, management of identity information and application integrations; Service provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://x.com; Privacy Policy: https://x.com/privacy, (Settings: https://x.com/personalization); Data Processing Agreement: https://privacy.x.com/en/for-our-partners/global-dpa. Basis for third-country transfers: EEA - Standard Contractual Clauses (https://privacy.x.com/en/for-our-partners/global-dpa), Switzerland - Standard Contractual Clauses (https://privacy.x.com/en/for-our-partners/global-dpa).
Discord: Chat, audio and video broadcasting, instant messaging, and community management; Service provider: Discord, Inc., 444 De Haro St, Suite 200, San Francisco, California 94107, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://discordapp.com/; Privacy Policy: https://discordapp.com/privacy. Basis for third-country transfers: EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).
We use blogs or comparable means of online communication and publication (hereinafter "publication medium"). Readers' data will only be processed for the purposes of the publication medium to the extent necessary for its presentation and communication between authors and readers or for security reasons. For the rest, we refer to the information on the processing of visitors to our publication medium within the scope of this privacy policy.
Processed data types: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such as details of authorship or the time of creation.); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features). Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: Feedback (e.g. collecting feedback via online form); Provision of our online services and usability; Security measures; Organisational and Administrative Procedures. Information technology infrastructure (Operation and provision of information systems and technical devices, such as computers, servers, etc.)).
Retention and deletion: Deletion in accordance with the information provided in the section "General General Information on Data Retention and Deletion".
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Comment subscriptions: When users leave comments or other contributions, their IP addresses may be stored based on our legitimate interests. This is done for our safety, if someone leaves illegal contents (insults, forbidden political propaganda, etc.) in comments and contributions. In this case, we ourselves can be prosecuted for the comment or contribution and are therefore interested in the author's identity. Furthermore, we reserve the right to process user data for the purpose of spam detection on the basis of our legitimate interests. On the same legal basis, in the case of surveys, we reserve the right to store the IP addresses of users for the duration of the surveys and to use cookies in order to avoid multiple votes. The personal information provided in the course of comments and contributions, any contact and website information as well as the content information will be stored permanently by us until the user objects; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
X: Social network; Service provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://x.com. Privacy Policy: https://x.com/privacy.
Ghost: Hosting and software for the creation, provision and operation of websites, blogs and other online services; Service provider: Ghost Foundation Ltd, 160 Robinson Road, #14-04 SBF Center, Singapore, 068914; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://ghost.org/; Privacy Policy: https://ghost.org/privacy; Data Processing Agreement: https://ghost.org/dpa/. Basis for third-country transfers: EEA - Standard Contractual Clauses (Provided by the service provider), Switzerland - Standard Contractual Clauses (Provided by the service provider).
We use messenger services for communication purposes and therefore ask you to observe the following information regarding the functionality of the messenger services, encryption, use of the metadata of the communication and your objection options.
You can also contact us by alternative means, e.g. telephone or e-mail. Please use the contact options provided to you or use the contact options provided within our online services.
In the case of encryption of content (i.e. the content of your message and attachments), we point out that the communication content (i.e. the content of the message and attachments) is encrypted end-to-end. This means that the content of the messages is not visible, not even by the messenger service providers themselves. You should always use a current version of the messenger service with activated encryption, so that the encryption of the message contents is guaranteed.
However, we would like to point out to our communication partners that although messenger service providers do not see the content, they can find out that and when communication partners communicate with us and process technical information on the communication partner's device used and, depending on the settings of their device, also location information (so-called metadata).
Information on Legal basis: If we ask communication partners for permission before communicating with them via messenger services, the legal basis of our processing of their data is their consent. Otherwise, if we do not request consent and you contact us, for example, voluntarily, we use messenger services in our dealings with our contractual partners and as part of the contract initiation process as a contractual measure and in the case of other interested parties and communication partners on the basis of our legitimate interests in fast and efficient communication and meeting the needs of our communication partners for communication via messenger services. We would also like to point out that we do not transmit the contact data provided to us to the messenger service providers for the first time without your consent.
Withdrawal, objection and deletion: You can withdraw your consent or object to communication with us via messenger services at any time. In the case of communication via messenger services, we delete the messages in accordance with our general data retention policy (i.e. as described above after the end of contractual relationships, archiving requirements, etc.) and otherwise as soon as we can assume that we have answered any information provided by the communication partners, if no reference to a previous conversation is to be expected and there are no legal obligations to store the messages to prevent their deletion.
Reservation of reference to other means of communication: For your security, we kindly ask for your understanding that we may not respond to enquiries via messenger for specific reasons. This applies in situations where contract details require heightened confidentiality or a response via messenger does not meet formal requirements. In such cases, we recommend using more appropriate communication channels.
Processed data types: Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such as details of authorship or the time of creation.); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties); Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Contract data (e.g. contract object, duration, customer category); Images and/or video recordings; Audio recordings.
Data subjects: Communication partner (Recipients of e-mails, letters, etc.); Service recipients and clients; Prospective customers; Users (e.g. website visitors, users of online services). Business and contractual partners.
Purposes of processing: Communication; Direct marketing; Provision of our online services and usability; Web Analytics; Targeting; Marketing; Profiles with user-related information; Office and organisational procedures.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal Basis: Consent (Article 6 (1) (a) GDPR); Performance of a contract and prior requests (Article 6 (1) (b) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Signal: Signal Messenger with end-to-end encryption; Service provider: Privacy Signal Messenger, LLC 650 Castro Street, Suite 120-223 Mountain View, CA 94041, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://signal.org/. Privacy Policy: https://signal.org/legal/.
Telegram: A cloud-based messaging service for text messages, voice messages, images, videos, files and calls; Service provider: Representative in the EU: EDPO, Avenue Huart Hamoir 71, 1030 Brussels, Belgium; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://telegram.org/. Privacy Policy: https://telegram.org/privacy.
Gather: Virtual spaces for online collaboration and communication; Service provider: Gather Presence, Inc., 2261 Market St. #4095, San Francisco, CA 94114, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.gather.town; Privacy Policy: https://www.gather.town/privacy-policy; Data Processing Agreement: https://www.gather.town/dpa.
Zoom: Video conferences, meetings, webinars and recordings; Service provider: Zoom Video Communications, Inc., 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://zoom.us; Privacy Policy: https://explore.zoom.us/en/privacy/; Data Processing Agreement: https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf.
Discord: Chat, audio/video broadcasting and community management; Service provider: Discord, Inc., 444 De Haro St, Suite 200, San Francisco, CA 94107, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://discordapp.com/; Privacy Policy: https://discordapp.com/privacy.
StreamYard: Live streaming, recording, interviews, and viewer comment integration; Service provider: StreamYard, Inc., 2810 N. Church St, DE 19802 Wilmington, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://streamyard.com; Privacy Policy: https://support.streamyard.com/hc/en-us/articles/15401585037204.
X: Social network; Service provider: X Internet Unlimited Company, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://x.com; Privacy Policy: https://x.com/privacy.
Notion: Project management and collaboration; Service provider: Notion Labs, Inc., 548 Market St #74567, San Francisco, CA 94104-5401, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.notion.com/de/product; Privacy Policy: https://www.notion.so/notion/Privacy-Policy-3468d120cf614d4c9014c09f6adc9091; Data Processing Agreement: Provided by service provider.
We use platforms and applications of other providers (hereinafter referred to as "Conference Platforms") for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as "Conference"). When using the Conference Platforms and their services, we comply with the legal requirements.
Data processed by Conference Platforms: In the course of participation in a Conference, the Data of the participants listed below are processed. The scope of the processing depends, on the one hand, on which data is requested in the context of a specific Conference (e.g., provision of access data or clear names) and which optional information is provided by the participants. In addition to processing for the purpose of conducting the conference, participants' Data may also be processed by the Conference Platforms for security purposes or service optimization. The processed data includes personal information (first name, last name), contact information (e-mail address, telephone number), access data (access codes or passwords), profile pictures, information on professional position/function, the IP address of the internet access, information on the participants' end devices, their operating system, the browser and its technical and linguistic settings, information on the content-related communication processes, i.e. entries in chats and audio and video data, as well as the use of other available functions (e.g. surveys). The content of communications is encrypted to the extent technically provided by the conference providers. If participants are registered as users with the Conference Platforms, then further data may be processed in accordance with the agreement with the respective Conference Provider.
Logging and recording: If text entries, participation results (e.g. from surveys) as well as video or audio recordings are recorded, this will be transparently communicated to the participants in advance and they will be asked - if necessary - for their consent.
Data protection measures of the participants: Please refer to the data privacy information of the Conference Platforms for details on the processing of your data and select the optimum security and data privacy settings for you within the framework of the settings of the conference platforms. Furthermore, please ensure data and privacy protection in the background of your recording for the duration of a Conference (e.g., by notifying roommates, locking doors, and using the background masking function, if technically possible). Links to the conference rooms as well as access data, should not be passed on to unauthorized third parties.
Notes on legal bases: Insofar as, in addition to the Conference Platforms, we also process users' data and ask users for their consent to use contents from the Conferences or certain functions (e.g. consent to a recording of Conferences), the legal basis of the processing is this consent. Furthermore, our processing may be necessary for the fulfillment of our contractual obligations (e.g. in participant lists, in the case of reprocessing of Conference results, etc.). Otherwise, user data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.
Processed data types: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such as details of authorship or the time of creation.); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features); Images and/or video recordings; Audio recordings; Log data (e.g. log files concerning logins or data retrieval or access times.); Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties).
Data subjects: Communication partner (Recipients of e-mails, letters, etc.); Users (e.g. website visitors, users of online services). Persons depicted.
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; Communication; Office and organisational procedures; Web Analytics; Targeting; Marketing; Profiles with user-related information; Provision of our online services and usability.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Discord: Chat, audio and video broadcasting, instant messaging, and community management; Service provider: Discord, Inc., 444 De Haro St, Suite 200, San Francisco, California 94107, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://discordapp.com/; Privacy Policy: https://discordapp.com/privacy. Basis for third-country transfers: EEA - Data Privacy Framework (DPF), Switzerland - Data Privacy Framework (DPF).
Google Hangouts / Meet: Conference and communication software; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://hangouts.google.com/; Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement: https://cloud.google.com/terms/data-processing-addendum. Basis for third-country transfers: DPF and Standard Contractual Clauses.
Zoom: Video conferences, meetings, webinars, screen sharing, recordings and chat; Service provider: Zoom Video Communications, Inc., 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://zoom.us; Privacy Policy: https://explore.zoom.us/en/privacy/; Data Processing Agreement: https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf. Basis for third-country transfers: DPF and Standard Contractual Clauses.
StreamYard: Live streaming, recordings, video interviews, audience interactions; Service provider: StreamYard, Inc., 2810 N. Church St, DE 19802 Wilmington, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://streamyard.com; Privacy Policy: https://support.streamyard.com/hc/en-us/articles/15401585037204.
X: Social network; Service provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://x.com; Privacy Policy: https://x.com/privacy.
We use Internet-accessible software services (so-called "cloud services", also referred to as "Software as a Service") provided on the servers of its providers for the storage and management of content (e.g. document storage and management, exchange of documents, content and information with certain recipients or publication of content and information).
Within this framework, personal data may be processed and stored on the provider's servers insofar as this data is part of communication processes with us or is otherwise processed by us in accordance with this privacy policy. This data may include in particular master data and contact data of data subjects, data on processes, contracts, other proceedings and their contents. Cloud service providers also process usage data and metadata that they use for security and service optimization purposes.
If we use cloud services to provide documents and content to other users or publicly accessible websites, forms, etc., providers may store cookies on users' devices for web analysis or to remember user settings (e.g. in the case of media control).
Processed data types: Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such as details of authorship or the time of creation.); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties). Contract data (e.g. contract object, duration, customer category).
Data subjects: Prospective customers; Communication partner (Recipients of e-mails, letters, etc.); Business and contractual partners; Users (e.g. website visitors, users of online services). Service recipients and clients.
Purposes of processing: Office and organisational procedures; Information technology infrastructure (Operation and provision of information systems and technical devices, such as computers, servers, etc.)); Communication; Provision of our online services and usability; Organisational and Administrative Procedures; Provision of contractual services and fulfillment of contractual obligations. Security measures.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Proton Calendar: Creation and management of calendar entries, synchronisation between devices, reminder functions, sending and receiving invitations to other individuals, encryption of calendar data; Service provider: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://proton.me/calendar; Privacy Policy: https://proton.me/legal/privacy. Data Processing Agreement: Provided by the service provider.
Proton Drive: Secure storage and management of files, encryption of user data, sharing files with other individuals, access to files across various devices; Service provider: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://proton.me/drive; Privacy Policy: https://proton.me/legal/privacy. Data Processing Agreement: Provided by the service provider.
Proton Mail: Email sending and receiving, storage of contacts in the address book, filter rules for sorting incoming emails, spam and virus protection, cloud storage for attachments and other content; Service provider: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://proton.me/mail; Privacy Policy: https://proton.me/legal/privacy. Data Processing Agreement: Provided by the service provider.
Tresorit: Cloud storage, cloud infrastructure services and cloud-based application software; Service provider: Tresorit AG, Franklinstrasse 27, 8050 Zurich, Switzerland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://tresorit.com/de; Privacy Policy: https://tresorit.com/legal/privacy-policy. Data Processing Agreement: Provided by the service provider.
Google Cloud Storage: Cloud storage, cloud infrastructure services and cloud-based application software; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://cloud.google.com/; Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement: https://cloud.google.com/terms/data-processing-addendum; Basis for third-country transfers: EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause). Further Information: https://cloud.google.com/privacy.
Google Cloud Services: Cloud infrastructure services and cloud-based application software; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://cloud.google.com/; Privacy Policy: https://policies.google.com/privacy; Data Processing Agreement: https://cloud.google.com/terms/data-processing-addendum; Basis for third-country transfers: EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/eu-model-contract-clause). Further Information: https://cloud.google.com/privacy.
Notion: Project management - organization and administration of teams, groups, workflows, projects and processes; Service provider: Notion Labs, Inc., 548 Market St #74567, San Francisco, CA 94104-5401, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.notion.com/de/product; Privacy Policy: https://www.notion.so/notion/Privacy-Policy-3468d120cf614d4c9014c09f6adc9091; Data Processing Agreement: Provided by the service provider. Basis for third-country transfers: EEA - Standard Contractual Clauses (Provided by the service provider), Switzerland - Standard Contractual Clauses (Provided by the service provider).
Linear: Management of software development projects, task tracking, issue resolution and product roadmapping, collaboration; Service provider: Linear Orbit, Inc., 440 N Barranca Ave #4242, Covina, CA 91723, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://linear.app/; Privacy Policy: https://linear.app/privacy. Data Processing Agreement: https://linear.app/dpa.
Sentry: Monitoring system stability and identifying code errors - Information about the device or error time are collected pseudonymously and are deleted afterwards; Service provider: Functional Software Inc., Sentry, 132 Hawthorne Street, San Francisco, California 94107, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://sentry.io; Security measures: IP Masking (Pseudonymization of the IP address); Privacy Policy: https://sentry.io/privacy; Data Processing Agreement: https://sentry.io/legal/dpa/. Basis for third-country transfers: EEA - Data Privacy Framework (DPF), Standard Contractual Clauses (https://sentry.io/legal/dpa/), Switzerland - Data Privacy Framework (DPF), Standard Contractual Clauses (https://sentry.io/legal/dpa/).
We process personal data for the purposes of promotional communication, which may be carried out via various channels, such as e-mail, telephone, post or fax, in accordance with the legal requirements.
The recipients have the right to withdraw their consent at any time or to object to the advertising communication at any time.
After revocation or objection, we store the data required to prove the past authorization to contact or send up to three years from the end of the year of revocation or objection on the basis of our legitimate interests. The processing of this data is limited to the purpose of a possible defense against claims. Based on the legitimate interest to permanently observe the revocation, respectively objection of the users, we further store the data necessary to avoid a renewed contact (e.g. depending on the communication channel, the e-mail address, telephone number, name).
Processed data types: Inventory data (e.g. full name, residential address, contact information, customer number); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or pictorial messages and contributions, including authorship details and creation timestamps).
Data subjects: Communication partners (recipients of e-mails, letters, etc.).
Purposes of processing: Direct marketing (e.g. by e-mail or postal); Marketing; Sales promotion.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal Basis: Consent (Article 6 (1) (a) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).
We process personal data of participants in competitions, contents, raffles, prize-draws or sweepstakes (hereinafter referred to as "competitions") only in compliance with the relevant data protection regulations and if the processing is contractually necessary for the provision, execution and handling of the competition, the participants have consented to the processing, or the processing serves our legitimate interests (e.g. security of the competition or protection against misuse, such as logging IP addresses when entries are submitted).
In the event that entries are published as part of the competitions (e.g. through voting, presentation of competition entries, winner announcements, or reporting), we inform participants that their names may also be published. Participants can object to this at any time.
If competitions take place within an online platform or social network (e.g. Facebook or Instagram, hereinafter referred to as "online platform"), the usage and data protection provisions of the respective online platform also apply. In these cases, we remain responsible for the information participants share as part of the competition and must be contacted regarding competition-related matters.
The data of the participants will be deleted as soon as the competition has ended and the data is no longer required to inform winners or address competition-related inquiries. Generally, participant data will be deleted no later than 6 months after the end of the competition. Winners' data may be retained longer, for example, to handle prize-related questions or fulfill prize obligations. The retention period depends on the nature of the prize and may extend up to three years for items or services (e.g. warranty processing). Additionally, participant data may be stored longer if used for reporting on the competition in online or offline media.
If data is collected for other purposes as part of the competition, its processing and storage duration follow the privacy terms applicable to that specific purpose (e.g. newsletter sign-ups during a competition).
Processed data types: Inventory data (e.g. full name, residential address, contact information, customer number); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or pictorial messages and contributions, including authorship details and timestamps).
Data subjects: Participants in sweepstakes and competitions.
Purposes of processing: Conducting sweepstakes and contests.
Retention and deletion: Deletion in accordance with the section "General Information on Data Retention and Deletion".
Legal Basis: Performance of a contract and prior requests (Article 6 (1) (b) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).
We conduct surveys and interviews to gather information for the survey purpose communicated in each case. The surveys and questionnaires ("surveys") we conduct are evaluated anonymously. Personal data is only processed insofar as it is necessary for the provision and technical execution of the survey (e.g., processing the IP address to display the survey in the user's browser or enabling survey resumption using a cookie).
Processed data types: Inventory data (e.g. full name, residential address, contact information, customer number); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or pictorial messages and contributions, including authorship details and timestamps); Usage data (e.g. page views, duration of visit, click paths, device types, operating systems, interactions with content and features).
Data subjects: Participants.
Purposes of processing: Feedback (e.g. collecting feedback via online forms); Polls and Questionnaires (e.g. surveys with input fields or multiple-choice questions).
Retention and deletion: Deletion in accordance with the section "General Information on Data Retention and Deletion".
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Web analytics (also referred to as "reach measurement") is used to evaluate the visitor flows of our online services and may include pseudonymous values related to visitor behavior, interests, or demographic information such as age or gender. Through reach analysis, we can, for example, identify when our online services or their functions and content are most frequently used or likely to encourage repeat visits. It also enables us to determine which areas need optimization.
In addition to web analytics, we may also use testing procedures to test and optimize different versions of our online services or their components.
Unless otherwise specified below, profiles (i.e., data combined from a usage process) may be created for these purposes, and information can be stored in and later retrieved from a browser or device. The data collected includes, in particular, visited websites and elements used on them, as well as technical information such as the browser used, the computer system, and information about usage times. If users have given consent to the collection of their location data to us or to the providers of the services we use, the processing of location data is also possible.
Additionally, users' IP addresses are stored. However, we use an IP masking process (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear user data (such as email addresses or names) is stored as part of web analytics, A/B testing, or optimization. Instead, pseudonyms are used. This means that neither we nor the providers of the software used know the actual identity of the users, only the information stored in their profiles for the respective procedures.
Legal basis information: If we ask users for their consent to use third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed based on our legitimate interests (i.e., our interest in efficient, economic, and user-friendly services). In this context, we would also like to point out the information on the use of cookies in this privacy policy.
Processed data types: Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties); Contact data (e.g. postal and email addresses or phone numbers); Content data (e.g. textual or pictorial messages and contributions, including authorship details and timestamps).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: Web Analytics; Profiles with user-related information; Remarketing; Targeting; Affiliate Tracking; Polls and Questionnaires; Marketing.
Retention and deletion: In accordance with the section "General Information on Data Retention and Deletion". Cookies and similar identifiers may be stored for up to 2 years unless otherwise stated.
Security measures: IP Masking.
Legal Basis: Consent (Article 6 (1) (a) GDPR); Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
Matomo: Matomo is software used for web analysis and reach measurement. Cookies created through Matomo are stored on the user's device. User data collected with Matomo is processed exclusively by us and never shared with third parties. Cookies may be stored for up to 13 months: https://matomo.org/faq/general/faq_146/; Legal Basis: Consent (Article 6 (1) (a) GDPR).
X (Twitter) Website Universal Tag & Conversion Tracking: Code loaded during a page visit to track user behavior, measure conversions, optimize ads, and build target audiences; Service provider: X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland; Legal Basis: Consent (Article 6 (1) (a) GDPR); Website: https://blog.x.com/en_us/a/2016/website-conversion-tracking-and-remarketing-made-easier-and-more-flexible; Privacy Policy: https://x.com/en/privacy; Data Processing Agreement: https://privacy.x.com/en/for-our-partners/global-dpa; Basis for third-country transfers: Standard Contractual Clauses.
YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Privacy Policy: https://policies.google.com/privacy; Third-country transfers: Data Privacy Framework (DPF); Opt-Out: https://myadcenter.google.com/personalizationoff
Within our online services, we integrate functional and content elements that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These may, for example, be graphics, videos or city maps (hereinafter uniformly referred to as "Content").
The integration always presupposes that the third-party providers of this content process the IP address of the user, since they could not send the content to their browser without the IP address. The IP address is therefore required for the presentation of these contents or functions. We strive to use only those contents, whose respective offerers use the IP address only for the distribution of the contents.
Third parties may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may include technical information about the browser and operating system, referring websites, visit times and other information about the use of our website, as well as may be linked to such information from other sources.
Processed data types: Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features). Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: Provision of our online services and usability; Web Analytics (e.g. access statistics, recognition of returning visitors); Targeting (e.g. profiling based on interests and behaviour, use of cookies); Affiliate Tracking; Marketing.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion". Storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years.).
Legal Basis: Consent (Article 6 (1) (a) GDPR). Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
We use services, platforms and software from other providers (hereinafter referred to as "third-party providers") for the purposes of organizing, administering, planning and providing our services. When selecting third-party providers and their services, we comply with the legal requirements.
Within this context, personal data may be processed and stored on the servers of third-party providers. This may include various data that we process in accordance with this privacy policy. This data may include in particular master data and contact data of users, data on processes, contracts, other processes and their contents.
If users are referred to the third-party providers or their software or platforms in the context of communication, business or other relationships with us, the third-party provider processing may process usage data and metadata that can be processed by them for security purposes, service optimisation or marketing purposes. We therefore ask you to read the data protection notices of the respective third party providers.
Processed data types: Content data (e.g. textual or pictorial messages and contributions, as well as information pertaining to them, such as details of authorship or the time of creation.); Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features); Meta, communication and process data (e.g. IP addresses, timestamps, identification numbers, involved parties); Contract data (e.g. contract object, duration, customer category); Contact data (e.g. postal and email addresses or phone numbers); Inventory data (For example, the full name, residential address, contact information, customer number, etc.); Images and/ or video recordings (e.g. photographs or video recordings of a person). Audio recordings.
Data subjects: Communication partner (Recipients of e-mails, letters, etc.); Users (e.g. website visitors, users of online services); Business and contractual partners; Prospective customers. Service recipients and clients.
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; Office and organisational procedures; Communication; Provision of our online services and usability; Information technology infrastructure (Operation and provision of information systems and technical devices, such as computers, servers, etc.)); Organisational and Administrative Procedures.
Retention and deletion: Deletion in accordance with the information provided in the section "General Information on Data Retention and Deletion".
Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR).
Further information on processing methods, procedures and services used:
calendly: Online scheduling and calendar management; Service provider: Calendly LLC., 271 17th St NW, Ste 1000, Atlanta, Georgia, 30363, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://calendly.com; Privacy Policy: https://calendly.com/pages/privacy; Data Processing Agreement: https://calendly.com/dpa; Basis for third-country transfers: EEA - Standard Contractual Clauses, Switzerland - Standard Contractual Clauses.
DocuSign: Electronic signature of documents, sending documents for signature, tracking status, storage of signed documents; Service provider: DocuSign, Inc., 221 Main Street Suite 1000, San Francisco, CA 94105, USA; Legal Basis: Legitimate Interests (Article 6 (1) (f) GDPR); Website: https://www.docusign.com; Privacy Policy: https://www.docusign.com/company/privacy-policy; Data Processing Agreement: https://www.docusign.com/legal/terms-and-conditions/data-protection-attachment; Basis for third-country transfers: Standard Contractual Clauses; Further Information: Binding Corporate Rules: https://www.docusign.com/trust/privacy/binding-corporate-rules.
Linear: Management of software development projects, task tracking, issue resolution, product roadmapping, collaboration; Service provider: Linear Orbit, Inc., Covina, CA 91723, USA; Legal Basis: Legitimate Interests; Website: https://linear.app; Privacy Policy: https://linear.app/privacy; Data Processing Agreement: https://linear.app/dpa.
Notion: Project management and administration of teams, workflows, projects and processes; Service provider: Notion Labs, Inc., San Francisco, CA, USA; Legal Basis: Legitimate Interests; Website: https://www.notion.com/de/product; Privacy Policy: https://www.notion.so/notion/Privacy-Policy-3468d120cf614d4c9014c09f6adc9091; Data Processing Agreement: Provided by the service provider.
Gather: Virtual collaboration spaces, video and text communication; Service provider: Gather Presence, Inc., San Francisco, CA, USA; Legal Basis: Legitimate Interests; Website: https://www.gather.town; Privacy Policy: https://www.gather.town/privacy-policy; Data Processing Agreement: https://www.gather.town/dpa.
Proton Drive: Secure file storage and encryption; Service provider: Proton AG, Switzerland; Legal Basis: Legitimate Interests; Website: https://proton.me/drive; Privacy Policy: https://proton.me/legal/privacy.
Proton Calendar: Calendar management with encryption; Service provider: Proton AG, Switzerland; Legal Basis: Legitimate Interests; Website: https://proton.me/calendar; Privacy Policy: https://proton.me/legal/privacy.
Proton Mail: Encrypted email services; Service provider: Proton AG, Switzerland; Legal Basis: Legitimate Interests; Website: https://proton.me/mail; Privacy Policy: https://proton.me/legal/privacy.
We kindly ask you to inform yourself regularly about the contents of our data protection declaration. We will adjust the privacy policy as changes in our data processing practices make this necessary. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.
If we provide addresses and contact information of companies and organizations in this privacy policy, we ask you to note that addresses may change over time and to verify the information before contacting us.
In this section, you will find an overview of the terminology used in this privacy policy. Where the terminology is legally defined, their legal definitions apply. The following explanations, however, are primarily intended to aid understanding.
Affiliate Tracking: Custom Audiences refers to the process of determining target groups for advertising purposes, e.g. the display of advertisements. For example, a user's interest in certain products or topics on the Internet may be used to conclude that the user is interested in advertisements for similar products or the online store in which the user viewed the products. "Lookalike Audiences" is the term used to describe content that is viewed as suitable by users whose profiles or interests presumably correspond to the users for whom the profiles were created. For the purposes of creating custom audiences and lookalike audiences, cookies and web beacons are typically used.
Contact data: Contact details are essential information that enables communication with individuals or organizations. They include, among others, phone numbers, postal addresses, and email addresses, as well as means of communication like social media handles and instant messaging identifiers.
Content Delivery Network (CDN): A "Content Delivery Network" (CDN) is a service with whose help contents of our online services, in particular large media files, such as graphics or scripts, can be delivered faster and more securely with the help of regionally distributed servers connected via the Internet.
Content data: Content data comprise information generated in the process of creating, editing, and publishing content of all types. This category of data may include texts, images, videos, audio files, and other multimedia content published across various platforms and media. Content data are not limited to the content itself but also include metadata providing information about the content, such as tags, descriptions, authorship details, and publication dates.
Contract data: Contract data are specific details pertaining to the formalisation of an agreement between two or more parties. They document the terms under which services or products are provided, exchanged, or sold. This category of data is essential for managing and fulfilling contractual obligations and includes both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data may encompass the start and end dates of the contract, the nature of the agreed-upon services or products, pricing arrangements, payment terms, termination rights, extension options, and special conditions or clauses. They serve as the legal foundation for the relationship between the parties and are crucial for clarifying rights and duties, enforcing claims, and resolving disputes.
Controller: "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Employees: As employees, individuals are those who are engaged in an employment relationship, whether as staff, employees, or in similar positions. Employment refers to a legal relationship between an employer and an employee, established through an employment contract or agreement. It entails the obligation of the employer to pay the employee remuneration while the employee performs their work. The employment relationship encompasses various stages, including establishment, where the employment contract is concluded, execution, where the employee carries out their work activities, and termination, when the employment relationship ends, whether through termination, mutual agreement, or otherwise. Employee data encompasses all information pertaining to these individuals within the context of their employment. This includes aspects such as personal identification details, identification numbers, salary and banking information, working hours, holiday entitlements, health data, and performance assessments.
Inventory data: Inventory data encompass essential information required for the identification and management of contractual partners, user accounts, profiles, and similar assignments. These data may include, among others, personal and demographic details such as names, contact information (addresses, phone numbers, email addresses), birth dates, and specific identifiers (user IDs). Inventory data form the foundation for any formal interaction between individuals and services, facilities, or systems, by enabling unique assignment and communication.
Log data: Protocol data, or log data, refer to information regarding events or activities that have been logged within a system or network. These data typically include details such as timestamps, IP addresses, user actions, error messages, and other specifics about the usage or operation of a system. Protocol data is often used for analyzing system issues, monitoring security, or generating performance reports.
Meta, communication and process data: Meta-, communication, and procedural data are categories that contain information about how data is processed, transmitted, and managed. Meta-data, also known as data about data, include information that describes the context, origin, and structure of other data. They can include details about file size, creation date, the author of a document, and modification histories. Communication data capture the exchange of information between users across various channels, such as email traffic, call logs, messages in social networks, and chat histories, including the involved parties, timestamps, and transmission paths. Procedural data describe the processes and operations within systems or organisations, including workflow documentations, logs of transactions and activities, and audit logs used for tracking and verifying procedures.
Payment Data: Payment data comprise all information necessary for processing payment transactions between buyers and sellers. This data is crucial for e-commerce, online banking, and any other form of financial transaction. It includes details such as credit card numbers, bank account information, payment amounts, transaction dates, verification numbers, and billing information. Payment data may also contain information on payment status, chargebacks, authorizations, and fees.
Personal Data: "personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processing: The term "processing" covers a wide range and practically every handling of data, be it collection, evaluation, storage, transmission or erasure.
Profiles with user-related information: The processing of "profiles with user-related information", or "profiles" for short, includes any kind of automated processing of personal data that consists of using these personal data to analyse, evaluate or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include different information concerning demographics, behaviour and interests, such as interaction with websites and their content, etc.) (e.g. interests in certain content or products, click behaviour on a website or location). Cookies and web beacons are often used for profiling purposes.
Remarketing: "Remarketing" or "retargeting" is the term used, for example, to indicate for advertising purposes which products a user is interested in on a website in order to remind the user of these products on other websites, e.g. in advertisements.
Targeting: "Tracking" is the term used when the behaviour of users can be traced across several websites. As a rule, behavior and interest information with regard to the websites used is stored in cookies or on the servers of the tracking technology providers (so-called profiling). This information can then be used, for example, to display advertisements to users presumably corresponding to their interests.
Usage data: Usage data refer to information that captures how users interact with digital products, services, or platforms. These data encompass a wide range of information that demonstrates how users utilise applications, which features they prefer, how long they spend on specific pages, and through what paths they navigate an application. Usage data can also include the frequency of use, timestamps of activities, IP addresses, device information, and location data. They are particularly valuable for analysing user behaviour, optimising user experiences, personalising content, and improving products or services. Furthermore, usage data play a crucial role in identifying trends, preferences, and potential problem areas within digital offerings.
Web Analytics: Web Analytics serves the evaluation of visitor traffic of online services and can determine their behavior or interests in certain information, such as content of websites. With the help of web analytics, website owners, for example, can recognize at what time visitors visit their website and what content they are interested in. This enables them, for example, to better adapt the content of their websites to the needs of their visitors. For the purposes of web analytics, pseudonymous cookies and web beacons are often used to recognize returning visitors and thus obtain more precise analyses of the use of an online service.