Privacy Notice

As the operator of the FFOSSO platform consisting of the FFOSSO APP, which is stored on your end user device, cloud services and our website www.ffosso.com, we are the responsible controller for the personal data of the user (“you”) of our platform within the meaning of the applicable data protection law, in particular the General Data Protection Regulation (“GDPR”).
As part of our duty to provide information (Art. 13 f. GDPR), we will inform you below about which data is processed when you use the FFOSSO APP and/or visit our website and on what legal basis this is done. You will also receive information about your rights vis-à-vis us and the competent supervisory authority.

1. Information on the controller
OT Distribution GmbH & Co. KG
Am Untergrün 6
79232 March
Germany
Email: support@ffosso.com

2. Data Protection Officer
We have appointed a company data protection officer:
Tobias Escher
Am Untergrün 6
79232 March
Germany
dataprotection@orchestraltools.com

3. Informational use of our website
When you access our website merely to visit it, so-called log files are processed by being automatically recorded by our system.
The following log files are processed automatically:

IP address of the requesting computer
Type of Internet browser used
Version of the Internet browser used
Operating system and, for Apple products, its version
Pages accessed
Date and time of the visit
Time zone difference to Greenwich Mean Time (GMT)
Access status/HTTP status code
Amount of data transferred
Success or error of the loading process
USER ID if a customer account exists

The log files contain your IP address and possibly other personal data. It is therefore generally possible to identify you.
However, we only store your data temporarily and, in particular, not together with other personal data. The data will be deleted as soon as you leave the website. The temporary processing and storage of the above-mentioned data is necessary to provide our website and to ensure the security of our information technology systems. These purposes also justify our legitimate interest in processing the data on the legal basis of Art. 6 para. 1 sentence 1 lit. f GDPR.

4. Provision of our website and other cloud computing services

a. Hosting and cloud computing services

Our website is operated on the servers of the provider Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg (“AWS”), with server location in Germany. This means that the data we collect when you visit and use this website is stored by our hosting provider.
The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. f GDPR, as it is in our legitimate interest to use the services of a professional provider for the secure and efficient provision of our website. We have concluded a data processing agreement with Amazon Web Services.
We further use various cloud computing services provided by AWS, with server location in Germany, to operate and maintain our FFOSSO platform.
AWS services are used for:

secure hosting and operation of our databases and backend systems,
storage of user-generated content and media,
management of APIs and application logic,
monitoring, error detection, and system optimization,
network and DNS management.

The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. b and f GDPR. The use of third-party cloud computing services is necessary for the fulfilment of the contract. Furthermore, it corresponds to our legitimate interest in not operating cloud services ourselves and the interest in providing our website as error-free and secure as possible (Art. 6 para. 1 lit. f GDPR).
Where AWS processes data outside the European Union (e.g., in the United States), such transfers are safeguarded by the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework and/or the Standard Contractual Clauses and additional security measures (encryption, access restriction, and pseudonymization).
You can find information on data processing by AWS here: https://aws.amazon.com/privacy/
AWS has implemented compliance measures for international data transfers. These apply to all global activities where AWS processes personal data of natural persons in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs). We have concluded a data processing agreement with Amazon Web Services. Further information can be found at: https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf

b. Cloudflare

In order to provide certain content on FFOSSO in a performant and scalable manner, we use Cloudflare R2, a service for decentralised storage and delivery of data provided by Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”). R2 enables us to deliver static content such as Instruments, Presets, Visuals and sample storage or other media files efficiently and cost-effectively via distributed servers without having to resort to traditional cloud storage solutions. This may involve the transfer of personal data – in particular the IP address – to Cloudflare servers in order to deliver the requested content.
In addition, our website is delivered via the Cloudflare network and protected by Cloudflare security services (e.g., protection against attacks and bots, rate limiting and waiting room functions). For this purpose, requests to our website are routed via Cloudflare servers, where in particular your IP address, browser information, the requested URL and the time of the request are processed. Cloudflare sets technically necessary cookies for these purposes (see Section 17).
This data is processed on the legal basis of our legitimate interest pursuant to Art. 6 (1) sentence 1 lit. f GDPR, which lies in the fast, reliable, secure and resource-saving provision of our online services. Insofar as information is stored on or read from your end device for these purposes, this is done on the basis of Section 25 (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG), as it is strictly necessary to provide our website securely. We have concluded a data processing agreement (DPA) with Cloudflare in accordance with Art. 28 GDPR, which ensures that your data is processed exclusively in accordance with our instructions and is protected by appropriate technical and organisational measures.
You can find information on the processing of your personal data by Cloudflare here: https://www.cloudflare.com/de-de/privacypolicy/#cloudflare-privacy-policy
When Cloudflare transfers personal data from the EEA, Switzerland, or the United Kingdom (UK) to the United States, they rely on their certifications under the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), and the UK Extension to the EU-U.S. DPF (https://www.dataprivacyframework.gov/list). Should these certifications lapse or become otherwise invalidated, Cloudflare relies on the standard contractual clauses, including supplementary measures as necessary for transfers to the United States. They also use standard contractual clauses for other international transfers from the EEA, Switzerland, or the United Kingdom.

c. Content Delivery Network

We use the Amazon CloudFront content delivery network (CDN) from AWS to increase the security and delivery speed of our website. A CDN is a network of globally distributed servers that is able to deliver optimized content to the website user. For this purpose, personal data may be processed in server log files by AWS. Please compare the explanations under “Hosting”.
The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. f GDPR. It corresponds to our legitimate interest in not operating a content delivery network ourselves and the interest in providing our website as error-free and secure as possible (Art. 6 para. 1 lit. f GDPR).
Your personal data will be stored by AWS for as long as it is necessary for the purposes described. You can find information on the processing of your personal data here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/data-protection-summary.html
AWS has implemented compliance measures for international data transfers. These apply to all global activities where AWS processes personal data of natural persons in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs). We have concluded a data processing agreement with Amazon Web Services. Further information can be found at: https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf

d. Headless content management system

Our website is based on a headless WordPress content management system operated by us. Website content is retrieved from our content management system via the WPGraphQL API, and media files and other assets are delivered directly from our content management system (first party). In doing so, technical access data (in particular IP address, requested URL and time of the request) is processed as described in Section 3. No data is transmitted to third parties for this purpose, apart from the hosting and delivery providers described in this Section 4.
The legal basis for the processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in the efficient, secure and technically stable provision of our website. Insofar as information is stored on or read from your end device, this is done on the basis of Section 25 (2) TDDDG, as it is strictly necessary to provide our website.

5. Customer account / Customer registration
You have the option of creating a customer account through our website or in the FFOSSO APP using your personal data. If you decide to create a customer account, you must provide us with the following information:

First and last name
Email address
Password

Your data is used to create and manage your customer account, authenticate you, provide the associated functions, display and administer your orders, subscriptions, Purchased Content and licence entitlements, associate products and registered devices with the named user, and provide account-related support. The legal basis for the storage of your customer account data is Art. 6 para. 1 sentence 1 lit. b and f GDPR.
We store the data you have provided to us as part of your login/registration for as long as your customer account remains active and the data is required to provide the account and contractual functions. If you make changes to your details, the old details will be deleted and only the updated data will be saved. In addition, we only store your data in order to comply with our legal obligations (e.g. tax obligations) (Art. 6 para. 1 sentence 1 lit. c GDPR). In this case, we block your data to the extent that it is only processed for the necessary purposes.
In addition to the data you provide to us, we may also store the time (date and time) of the transmission of your data to us, as well as your IP address. The processing of this data is in our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR) in order to ensure the security of our systems and to counteract misuse. This additional data will be deleted as soon as it is no longer required, at the latest when the contract with you has been completed.
You can request deletion of your customer account at any time in your FFOSSO profile. Deletion ends access to account-based and online functions. Transaction, invoice, contractual, licence, download, consent and security records may remain stored after account deletion where and for as long as this is necessary to comply with statutory retention obligations, establish, exercise or defend legal claims, prevent misuse, or document the rights granted and the proper performance of the contract. Such retained data is restricted to the relevant purposes.
In connection with the operation of our user accounts, we use the services of CAOS Ltd., with head office in Lerchenfeldstrasse 3, 9014 St. Gallen, Switzerland (“ZITADEL”) as an identity and access management platform to handle user registration, authentication, authorization, and account administration. In doing so, we process personal data such as your name, email address, login credentials, roles and permissions, as well as usage and activity data. An overview of the personal data processed can be found in the data processing agreement linked below.
The processing of personal data via ZITADEL serves the following purposes:

Creation and management of user accounts, including secure login and access control.
Authentication and authorization of users within the FFOSSO platform, including Free Content, subscriptions and Perpetual Purchases.
Ensuring operational security, auditability of access (audit trails), and compliance with legal obligations.
Communication related to account usage (e.g. password resets, notifications).

The legal basis of the data processing is Art. 6 para. 1 sentence 1 lit. b and f GDPR. Our legitimate interest is maintaining a secure and functional user management system.
Information on how ZITADEL processes your data can be found here: https://zitadel.com/docs/legal/policies/privacy-policy
We have concluded a data processing agreement with ZITADEL and affiliated companies. You can find it here: https://zitadel.com/docs/legal/data-processing-agreement
ZITADEL complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. ZITADEL has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. ZITADEL has also certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view ZITADEL’s certification, please visit https://www.dataprivacyframework.gov/

6. Order placement, checkout, subscription and Perpetual Purchase management
When you place an order on our website, we need the following data to fulfill the contract with you:

First name, last name, and your address for your invoice
Email address to send you the order confirmation and to provide you with contract documents immediately after the order
Where applicable, company name and your VAT identification number
Your payment information to process the payment of your order
The selected product or Collection, whether the order is a subscription or a Perpetual Purchase, the price, currency, applicable tax treatment, discounts and billing interval where applicable
The named user associated with the account and product entitlement
The date, time, IP address and version of the contractual documents and declarations accepted or submitted during checkout, including declarations concerning early performance and withdrawal
Order, payment, fulfilment, download and licence status data to the extent generated by the checkout and FFOSSO platform

We also process the data required to fulfil and document the contract, manage recurring payments or a one-time Perpetual Purchase, handle a withdrawal, refund, termination or chargeback, and establish, exercise or defend legal claims. We also store your aforementioned data in order to be able to display your order history on our website.
For checkout, order, subscription, Perpetual Purchase and billing management, we use the services of our data processor Chargebee Inc., 340 S. Lemon Avenue, Suite #1537, Walnut, California 91789, USA (“Chargebee”). We have concluded an agreement with Chargebee with regard to the processing of your data in accordance with Art. 28 GDPR. You can find the data processing agreement with Chargebee here: https://www.chargebee.com/privacy/dpa/
You can find further information about Chargebee’s data processing and data protection here: https://www.chargebee.com/privacy/
The legal basis for the processing of the data is Art. 6 para. 1 sentence 1 lit. b and f GDPR. The data will be stored for as long as it is necessary to process and document your order, provide the subscription or Purchased Content, administer payment and fulfilment, and handle support and contractual claims. It is in our legitimate interests to enable you to track your current and previous orders. Beyond this, we only store your data in order to comply with our legal obligations (e.g. tax obligations pursuant to Section 147 AO and Section 257 HGB) (Art. 6 para. 1 sentence 1 lit. c GDPR). In this case, we block your data to the extent that it is only processed for the necessary purposes.
The Chargebee scripts and cookies on our website are only loaded after you have given your consent in the “Functional” category of our consent management platform (Section 25 (1) TDDDG and Art. 6 para. 1 sentence 1 lit. a GDPR). You can revoke your consent at any time in the privacy settings on our website under “Manage consent”.
In addition to the aforementioned data, we store the time (date and time) of the transmission of your data to us, as well as your IP address. The processing of this data is in our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR) in order to ensure the security of our systems and to counteract misuse. This additional data will be deleted as soon as it is no longer required, at the latest when the contract with you has been completed.
Note on data transfers to third countries:
Chargebee Inc. is based in the USA. Personal data may therefore be processed in the USA and in other countries outside the EU/EEA in which Chargebee or its sub-processors operate. The USA is a third country within the meaning of the GDPR. Transfers to Chargebee are based on the EU Standard Contractual Clauses pursuant to Art. 46 para. 2 lit. c GDPR, which are incorporated into our data processing agreement with Chargebee, together with supplementary technical and organisational measures. Insofar as Chargebee Inc. is certified under the EU-U.S. Data Privacy Framework, transfers to the USA are additionally covered by the adequacy decision of the European Commission (Art. 45 GDPR), see https://www.dataprivacyframework.gov/list.

7. Payment processing
We use the payment service provider Stripe for billing and payment processing. Stripe is an international financial services provider with various business units. According to the company, the following Stripe entities are responsible depending on your location (together “Stripe”):

EEA: Stripe Payments Europe, Limited (contracting party for data processing), Stripe Technology Europe, Limited (certain authorised payment services) and Stripe Technology Company Limited (all other activities), each One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland
Switzerland and the United Kingdom: Stripe Payments UK, Ltd., 7th Floor, The Bower Warehouse, 211 Old Street, London EC1V 9NR, United Kingdom (authorised payment services), together with Stripe Payments Europe, Limited and Stripe Technology Company Limited (address see above)
North, Central and South America: Stripe, LLC, 354 Oyster Point Boulevard, South San Francisco, California 94080, USA

Due to the implementation of Stripe, cookies are set on our website. Stripe scripts and cookies on our website are only loaded after you have given your consent in the “Functional” category of our consent management platform (Section 25 (1) TDDDG and Art. 6 para. 1 sentence 1 lit. a GDPR). You can find information on this in our cookie information (Section 17) and Stripe’s cookie policy: https://stripe.com/legal/cookies-policy
According to its own information, Stripe processes the following end customer data in particular in connection with billing and payment processing:

Email address
(Billing and delivery) address
Information on the respective payment method (e.g., credit card details, account information)
Order date
Ordered service
Any other information you enter when paying via Stripe

According to its own information, Stripe uses the collected data primarily for payment processing and the associated services (e.g., issuing and sending invoices, fraud prevention), but also for other purposes if necessary. Stripe transmits the data to various recipients, including recipients who are not based within the EU. Stripe bases this data processing and transfer on various legal bases, which you can find in Stripe’s privacy policy (https://stripe.com/privacy) and the further data privacy information in the Stripe Privacy Center (https://stripe.com/privacy-center/legal#stripe-legal-bases-tables). Stripe, LLC is certified under the EU-U.S. Data Privacy Framework, see https://www.dataprivacyframework.gov/list.

As a small company, we can only provide billing and payment processing for our international customer base with the help of the automation services of a global financial services provider such as Stripe. The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. In this respect, our legitimate interests lie in offering an efficient and secure payment method while at the same time developing international customers and securing payments in international business transactions. In addition, the data processing in connection with the payment of your order is carried out in accordance with Art. 6 para. 1 lit. b GDPR for the execution of the contracts concluded with you. A contract for commissioned data processing has been concluded with Stripe in accordance with Art. 28 GDPR. You can find the agreement here: https://stripe.com/de/legal/dpa
When using the following payment methods, data is also transmitted to the respective provider of your payment method:
PayPal: If you pay at Stripe with PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg), PayPal will receive your payment data for payment processing and PayPal may carry out a credit check. You can find information on this at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=en_DE
Credit card: If you pay with your credit card on our website, your credit card provider will receive the information that you have placed an order with us. Your credit card provider may carry out a credit check. You can find more information on this on the respective website of your credit card provider.

8. Contact form and email
You can contact us electronically via the contact form on our website or by email, e.g., to provide us with feedback, to send us inquiries about the services we offer or to ask us general questions. If you use this option, you transmit the following data to us:

Name
Subject
Email address
Description of the request

The legal basis for the processing of your data for the purpose of processing your contact is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You can withdraw your consent at any time. In addition, the legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. f GDPR. It is our legitimate interest to process your data transmitted to us in order to contact you. The data will be stored until it is no longer required to achieve the purpose of the conversation with you and your contact request has been fully clarified.
If your contact is aimed at concluding a contract with us, the additional legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. b GDPR.
The data will be stored for as long as it is necessary for the performance of the contract or pre-contractual measures or until you withdraw your consent. Beyond this, we only store your data in order to comply with legal obligations (e.g., tax obligations) (Art. 6 para. 1 sentence 1 lit. c GDPR).
In addition to the data you provide to us, we store the time (date and time) of the transmission of your data to us, as well as your IP address. The processing of this data is in our legitimate interest (Art. 6 para. 1 sentence 1 lit. f GDPR) in order to ensure the security of our systems and to counteract misuse. This data, which we also collect when you contact us, is deleted as soon as it is no longer required, at the latest when your contact request has been fully clarified.
You can inform us at any time that you would like us to delete the data provided during the conversation. In this case, to the extent permitted, all personal data from the conversation will be deleted and it will not be possible to continue the conversation.

9. Contact us by phone or post
You have the option of contacting us by telephone or post. Your personal data transmitted in this way will be stored by us. The data is processed exclusively in order to process your contact appropriately, whereby this corresponds to our legitimate interest. The legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. f GDPR. The data will be stored until it is no longer required to achieve the purpose of the conversation with you and your contact request has been fully clarified.
If your contact is aimed at concluding a contract with us, the additional legal basis for the processing of your personal data is Art. 6 para. 1 sentence 1 lit. b GDPR. This data is stored for as long as it is required for the performance of the contract or pre-contractual measures. In addition, we only store your data in order to comply with legal obligations (e.g. tax obligations) (Art. 6 para. 1 sentence 1 lit. c GDPR).
You can inform us at any time that you would like us to delete the data provided during the conversation. In this case, to the extent permitted, all personal data from the conversation will be deleted and it will not be possible to continue the conversation.

10. Newsletter

a. Newsletter subscription

In our FFOSSO App and on our website, we offer you the opportunity to subscribe to our newsletter free of charge. In addition to your declaration of consent, we only need your email address.
The legal basis for sending the newsletter and the associated processing of further voluntary information is Art. 6 para. 1 sentence 1 lit. a GDPR. By sending the newsletter registration, you consent to the processing of your data by us.
As part of your newsletter registration, we also store the date and time of the transmission of your data to us, as well as your IP address. The processing of this data corresponds to our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR in order to ensure the security of our systems and to counteract misuse.
Your data will be processed exclusively in connection with the sending of newsletters. The purpose of processing your email address is to enable us to send you the newsletter. Other data during the registration process is used either to address you personally or to ensure the security of our services and prevent misuse of the email address used.
Your data will only be stored for as long as is necessary to achieve the purpose. Your email address will therefore be stored for the duration of your active newsletter subscription if you have given your consent. The data that we also collect automatically during your registration (IP address, date and time) will be deleted at the latest when you cancel your newsletter subscription. Data stored by us for other purposes remains unaffected by this.

b. Newsletter tracking

Due to a tracking pixel implemented in our newsletters, which are based on your explicit consent, we can track whether the newsletter has been opened. We can also track whether links contained in the newsletter have been clicked on. This is done by briefly redirecting the recipient via the server of our newsletter service provider after clicking on a link and then forwarding them to the destination address. The IP address, browser, date and time of retrieval and opening of the newsletter and the click behavior on links contained in the newsletter are recorded and statistically evaluated. This function is helpful for us to understand whether our newsletter is opened and which topics are of particular interest.
Your user behaviour will only be evaluated if you have consented to the newsletter being sent and the associated personalized data evaluation. By creating a personal user profile, we would like to tailor our advertising to your interests and optimize our offers on our website for you. The legal basis for data processing is your consent in accordance with Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6 (1) sentence 1 lit. a GDPR.
We receive aggregated statistics that our service provider (see below) creates automatically. As a rule, we therefore only have an overview of the percentage of recipients who have opened the newsletter or which content was particularly well received.

c. Newsletter marketing under Section 7 (3) UWG (German Unfair Competition Act)

If you provide your email address when using our services, by registering for free, purchasing a subscription or purchasing a Perpetual Collection, we may use it to send you our newsletter. This is done exclusively for the purpose of direct advertising for our own or similar goods or services.
The legal basis for sending newsletters in connection with the sale of goods or services is Section 7 (3) UWG (German Unfair Competition Act). If we send you a newsletter following an order on our website, we will store your email address for the purpose of advertising our own or similar goods or services until you unsubscribe from the newsletter. Newsletters sent on this legal basis do not contain tracking pixels.

d. Newsletter service provider

To send the newsletters, we use the email dispatch tool of CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany (“CleverReach”). This means that the aforementioned information (email address, date and time of your newsletter registration and newsletter confirmation, IP address, other information that you voluntarily provide to us) is stored on CleverReach’s servers. CleverReach’s servers are located exclusively in the EU.
The processing of your data by CleverReach is based on a data processing agreement in accordance with Art. 28 GDPR, which we have concluded with CleverReach.

e. Right to object / right to withdraw / unsubscribe from newsletter

You can unsubscribe, object or withdraw the consent to receive our newsletter at any time. Unfortunately, it is not possible to withdraw your consent to newsletter tracking separately. If you wish to object to newsletter tracking, you must therefore also unsubscribe from the newsletter. You will find the link to do this at the end of each newsletter. By doing so, you withdraw your consent with effect for the future or object to any further use of your data for the purpose of sending the newsletter and tracking. The withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

11. Links to our profile pages in the social networks

On our website, we use small icons and possibly other links that refer to our website on the third-party platforms (social networks) listed below. These are hyperlinks, so no data is automatically transmitted by you, but only when you click on the icons or the corresponding link and a new window opens in your browser with the website of the third-party provider.

a. Facebook page

We operate a so-called Facebook page (formerly “Facebook Fanpage”) on the social media platform Facebook (Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4, Ireland (“Meta”)), which we link to on our website via the Facebook icon. As long as you do not click on the link, Meta will not receive any data from you. If you click on the link, for example to view our company profile on Facebook or to “like” our Facebook page, Meta will receive data from you (which data Meta receives also depends on whether you are logged in to Meta with your user profile while clicking on the page or not). Meta also uses so-called cookies, which are stored on your device when you visit our Facebook page even if you do not have your own Facebook profile or are not logged into it during your visit to our Facebook page. These cookies allow Meta to create user profiles based on your preferences and interests and to show you customized advertising (inside and outside Facebook). Cookies remain on your device until you delete them. You can find more information about the cookies used on Facebook at https://www.facebook.com/policies/cookies/
According to its own information, Meta uses this data for a wide variety of purposes and transmits it worldwide, both internally to other Meta companies and to a wide variety of external partners. Meta bases this data processing on various legal bases, details of which can be found in Meta’s Data Policy. The data policy can be found at the following link: https://www.facebook.com/policy.php
While Meta uses this data under its own responsibility for various purposes, we can only see aggregated data on our company Facebook page, i.e. statistics (e.g. user growth, user demographics, use of individual functionalities), which no longer have any personal reference. This data, which is called “page insights”, is created using so-called “events” logged by Meta. An “event” can be, for example, the fact that someone has marked a certain post with a “Like”. As the website operator, we do not have access to the personal data that is processed in the context of events, but only to the summarized page insights. Events that are used to create Page Insights do not store any IP addresses, cookie IDs or any other identifiers that are assigned to people or their devices, apart from a Facebook user ID for people logged in to Facebook. You can find more information about Page Insights at the following link: https://www.facebook.com/legal/terms/information_about_page_insights_data
In accordance with the provisions of the GDPR, we are jointly responsible with Meta for data processing on our Facebook page (Art. 26 GDPR). Accordingly, we have concluded an agreement with Meta provided by Meta in which this joint responsibility is regulated. You can find the agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum
This means that Meta is primarily responsible for the aggregated Insight Data. In addition, Meta will comply with all obligations under the GDPR with regard to the processing of Insight Data (including Art. 12, 13 GDPR, Art. 15-21 GDPR and Art. 32-34 GDPR). If you send us a request regarding our Facebook page, we will inform Meta promptly. Meta will respond to the request in accordance with our agreement.
Our legitimate interests in the processing of personal data lie in the use and linking of different communication channels, marketing via high-reach social media platforms and the analysis and evaluation of the success of our communication and marketing efforts. The legal basis for the processing is Art. 6 para. 1 sentence 1 lit. f GDPR. If you consent to data processing (in particular to the setting of cookies), the processing is also carried out on the basis of Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) or Art. 6 (1) sentence 1 lit. a GDPR. You can withdraw your consent in accordance with the aforementioned legal bases at any time.
If you use our Facebook page to contact us (e.g., by creating your own posts, responding to one of our posts or sending us private messages), we process the data you provide exclusively to process your contact. The legal basis for the processing of your personal data is therefore Art. 6 para. 1 sentence 1 lit. f GDPR. It is our legitimate interest to process your data transmitted to us in order to contact you. The data will be stored until it is no longer required to achieve the purpose of the conversation with you and your contact request has been fully clarified. You can inform us at any time that we should delete the data provided in the course of the conversation. In this case, to the extent permitted, all personal data from the conversation will be deleted and it will not be possible to continue the conversation.
Note on data transfers to the USA:
However, Meta Platforms Ireland Limited is a subsidiary of the US group Meta, which means that your personal data may also be transferred to Meta’s US group companies (Meta Platforms, Inc.) and Meta servers located in the USA. The USA is a third country within the meaning of the GDPR, for which an adequacy decision of the EU Commission (the so-called “EU-US Data Privacy Framework” or “EU-US DPF”) exists. Meta Platforms Inc. is certified as a US company under the EU-US DPF, see https://www.dataprivacyframework.gov/list.

b. Instagram

We operate a company profile on the social media portal Instagram. The operator of Instagram is Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4, Ireland, whereby the platforms Facebook and Instagram share the technical infrastructure according to Meta’s own information. In the following, the term “Instagram” is used for the social media portal and the term “Meta” for the operator of this portal.
On our website, we link to our company profile on Instagram using the Instagram icon. As long as you do not click on the link, Meta will not receive any data from you. If you click on the link, for example to view or subscribe to our company profile on Instagram, Meta will receive data from you (which data Meta receives also depends on whether you are logged in to Instagram with your user profile while clicking on the page or not). In addition, Meta uses so-called cookies, which are stored on your device when you visit our corporate website even if you do not have your own Instagram profile or are not logged into it during your visit to our corporate website. These cookies allow Meta to create user profiles based on your preferences and interests and to show you customized advertising (inside and outside Instagram). Cookies remain on your device until you delete them. You can find more information about the cookies used by Meta at https://privacycenter.instagram.com/policies/cookies/
According to its own information, Meta uses this data for a wide variety of purposes and transmits it worldwide, both internally to other Meta companies and to various external partners. Meta bases this data processing on various legal bases, which you can find in detail in Instagram’s privacy policy and Facebook’s data policy. Instagram’s privacy policy can be found at the following link: https://privacycenter.instagram.com/policy
While Meta uses this data under its own responsibility for various purposes, we can only see aggregated data on our company website, i.e. statistics (e.g. user growth, user demographics, use of individual functionalities), which no longer have any personal reference. These are called “Instagram Insights”. You can find more information about Instagram Insights on the corresponding information page of Meta, which refers to all Meta products (and thus also to Instagram). You can access this information page at the following link: https://www.facebook.com/legal/terms/information_about_page_insights_data
In accordance with the provisions of the GDPR, we are jointly responsible with Meta for data processing on our Instagram company profile (Art. 26 GDPR). Accordingly, we have concluded an agreement with Meta provided by Meta in which this joint responsibility is regulated. You can find the agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum
This means that Meta is primarily responsible for the aggregated Insight Data. In addition, Meta will comply with all obligations under the GDPR with regard to the processing of Insight Data (including Art. 12, 13 GDPR, Art. 15-21 GDPR and Art. 32-34 GDPR). If you send us a request regarding our Instagram company profile, we will inform Meta promptly. Meta will respond to the request in accordance with our agreement.
Our legitimate interests in the processing of personal data lie in the use and linking of different communication channels, marketing via high-reach social media platforms and the analysis and evaluation of the success of our communication and marketing efforts. The legal basis for processing is Art. 6 para. 1 sentence 1 lit. f GDPR. If you consent to data processing (in particular to the setting of cookies), the processing is also carried out on the basis of Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) or Art. 6 (1) sentence 1 lit. a GDPR. You can revoke your consent in accordance with the aforementioned legal bases at any time in the privacy settings on our website under “Manage consent”.
If you use our Instagram page to contact us (e.g. by creating your own posts, responding to one of our posts or sending us private messages), we process the data you provide exclusively to process your contact. The legal basis for the processing of your personal data is therefore Art. 6 para. 1 sentence 1 lit. f GDPR. It is our legitimate interest to process your data transmitted to us in order to contact you. The data will be stored until it is no longer required to achieve the purpose of the conversation with you and your contact request has been fully clarified. You can inform us at any time that we should delete the data provided in the course of the conversation. In this case, to the extent permitted, all personal data from the conversation will be deleted and it will not be possible to continue the conversation.
Note on data transfers to the USA:
However, Meta Platforms Ireland Limited is a subsidiary of the US group Meta, which means that your personal data may also be transferred to Meta’s US group companies (Meta Platforms, Inc.) and Meta servers located in the USA. The USA is a third country within the meaning of the GDPR, for which an adequacy decision of the EU Commission (the so-called “EU-US Data Privacy Framework” or “EU-US DPF”) exists. Meta Platforms Inc. is certified as a US company under the EU-US DPF, see https://www.dataprivacyframework.gov/list.

c. LinkedIn

We operate a company page on the social media portal LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”)), which we link to on our website via the LinkedIn icon.
As long as you do not click on the link, LinkedIn will not receive any data from you. If you click on the link, for example to view our company page on LinkedIn, LinkedIn will receive data from you (which data LinkedIn receives also depends on whether you are logged in to LinkedIn with your user profile while you click on the page or not). LinkedIn also uses so-called cookies, which are stored on your device when you visit our company page, even if you do not have your own LinkedIn profile or are not logged into it during your visit to our company page. These cookies allow LinkedIn to provide its own services, determine the performance of the services and display relevant ads (including job ads) inside and outside LinkedIn. Cookies remain on your device until you delete them. You can find more information about the cookies used by LinkedIn at https://www.linkedin.com/legal/cookie-policy
According to its own information, LinkedIn uses this data for a wide variety of purposes and transmits it to a wide variety of recipients, including recipients who are not based in the EU. LinkedIn bases this data processing on various legal bases, which you can find in LinkedIn’s privacy policy. The privacy policy can be found at the following link: https://linkedin.com/legal/privacy-policy
While LinkedIn uses this data under its own responsibility for various purposes, we can only see aggregated data on our LinkedIn company page, i.e., statistics that no longer have any personal reference. These are called “page analytics”. You can find more information on “Page Analytics” on the corresponding LinkedIn information page at https://www.linkedin.com/help/linkedin/answer/a547077/linkedin-page-analytics-overview?lang=en
In addition, if you decide to become a follower when you visit our LinkedIn company page, we will also receive your name and your position in the company according to the information in your LinkedIn user profile, as well as the date on which you became our follower: https://www.linkedin.com/help/linkedin/answer/4499/linkedin-page-analytics-overview?lang=en
In accordance with the provisions of the GDPR, we are jointly responsible with LinkedIn for data processing on our LinkedIn company page (Art. 26 GDPR). Accordingly, we have concluded an agreement with LinkedIn provided by LinkedIn in which this joint responsibility is regulated. You can find the agreement at the following link: https://legal.linkedin.com/pages-joint-controller-addendum
This means that LinkedIn is primarily responsible for the aggregated Insight data. In addition, LinkedIn will fulfill all obligations under the GDPR with regard to the processing of Insight data (including Art. 12-22 GDPR and Art. 32-34 GDPR). If you send us a request regarding our LinkedIn company page, we will inform LinkedIn promptly. LinkedIn will respond to the request in accordance with our agreement.
Our legitimate interests in the processing of personal data lie in the use and linking of different communication channels, marketing via high-reach social media platforms and the analysis and evaluation of the success of our communication and marketing efforts. The legal basis for the processing is Art. 6 para. 1 sentence 1 lit. f GDPR. If you consent to data processing (in particular to the setting of cookies), the processing is also carried out on the basis of Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) or Art. 6 (1) sentence 1 lit. a GDPR. You can revoke your consent in accordance with the aforementioned legal bases at any time.
If you use our LinkedIn profile to contact us (e.g. by creating your own posts, responding to one of our posts or sending us private messages), we will only process the data you provide in order to process your contact. The legal basis for the processing of your personal data is therefore Art. 6 para. 1 sentence 1 lit. f GDPR. It is our legitimate interest to process your data transmitted to us in order to contact you. The data will be stored until it is no longer required to achieve the purpose of the conversation with you and your contact request has been fully clarified. You can inform us at any time (see Section 1 above) that we should delete the data provided in the course of the conversation. In this case, to the extent permitted, all personal data from the conversation will be deleted and it will not be possible to continue the conversation.
Note on data transfers to the USA:
LinkedIn Ireland Unlimited Company processes data inside and outside the USA, so your personal data may also be transferred to US LinkedIn group companies (LinkedIn Corporation) and LinkedIn servers located in the USA. The USA is a third country within the meaning of the GDPR, for which an adequacy decision of the EU Commission (the so-called “EU-US Data Privacy Framework” or “EU-US DPF”) exists. LinkedIn Corporation is certified as a US company under the EU-US DPF, see https://www.dataprivacyframework.gov/list. LinkedIn also relies on so-called standard contractual clauses. Further information can be found here: https://www.linkedin.com/help/linkedin/answer/a1343190/

d. YouTube

We operate a company profile on the video sharing platform YouTube. The operator of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In the following, the term “YouTube” is used for the video sharing platform and the term “Google” for the operator of the platform.
On our website, we link to our company profile on YouTube using the YouTube icon. As long as you do not click on the link, Google will not receive any data from you. If you click on the link, for example to view or subscribe to our company profile on YouTube, Google will receive data from you (which data Google receives also depends on whether you are logged in to YouTube with your user profile while you click on the page or not). Google also uses so-called cookies, which are stored on your device when you visit our company profile, even if you do not have your own YouTube profile or are not logged into it during your visit to our company profile. These cookies allow Google, among other things, to collect and analyse data on target group interactions and website statistics (inside and outside YouTube). Cookies remain on your device until you delete them. You can find more information about the cookies used by Google at https://policies.google.com/technologies/cookies?hl=en&utm_source=ucb
According to its own information, Google uses this data for a wide variety of purposes and transmits it worldwide, both internally to affiliated companies and to companies, organizations or persons outside Google. Google bases this data processing on various legal bases, which you can find in detail in Google’s privacy policy. You can find Google’s privacy policy at the following link: https://policies.google.com/privacy?hl=en
While Google uses this data under its own responsibility for various purposes, we can only see aggregated data on our company profile, i.e., statistics (e.g., playbacks, playback times and types of access sources), which no longer have any personal reference. This performance data is analyzed using the “YouTube Analytics” tool. You can find more information about the performance data on the corresponding information page of Google under the following link: https://support.google.com/youtube/answer/9002587?hl=en&sjid=407169541051816916-EU
Our legitimate interests in the processing of personal data lie in the use and linking of different communication channels, marketing via high-reach social media platforms and the analysis and evaluation of the success of our communication and marketing efforts. The legal basis for processing is Art. 6 para. 1 sentence 1 lit. f GDPR. If you consent to data processing (in particular to the setting of cookies), the processing is also carried out on the basis of Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) or Art. 6 (1) sentence 1 lit. a GDPR.
If you use our YouTube profile to contact us (e.g., by creating your own posts, responding to one of our posts, or sending us private messages), we will only process the data you provide in order to process your contact. The legal basis for the processing of your personal data is therefore Art. 6 para. 1 sentence 1 lit. f GDPR. It is our legitimate interest to process your data transmitted to us in order to contact you. The data will be stored until it is no longer required to achieve the purpose of the conversation with you and your contact request has been fully clarified. You can inform us at any time that we should delete the data provided in the course of the conversation. In this case, to the extent permitted, all personal data from the conversation will be deleted and it will not be possible to continue the conversation.
Note on data transfers to the USA:
However, Google Ireland Ltd. is a subsidiary of the US group Google, which means that your personal data may also be transferred to US Google group companies (in particular Google LLC) and Google servers located in the USA. The USA is a third country within the meaning of the GDPR for which the EU Commission has issued an adequacy decision (the so-called “EU-US Data Privacy Framework” or “EU-US DPF”). Google LLC is certified as a US company under the EU-US DPF, see https://www.dataprivacyframework.gov/list.

e. SoundCloud

We operate a profile page on the SoundCloud platform (SoundCloud Global Limited & Co. KG, Rheinsberger Str. 76/77, 10115 Berlin, Germany (“SoundCloud”)), which we link to on our website via the SoundCloud icon. As long as you do not click on the link, SoundCloud will not receive any data from you. If you click on the link to view our profile on SoundCloud, SoundCloud will receive data from you (which data SoundCloud receives also depends on whether you are logged in to SoundCloud with your user profile while clicking on the page or not). In addition, SoundCloud uses so-called cookies, which are stored on your device when you visit our SoundCloud page even if you do not have your own SoundCloud profile or are not logged into it during your visit to our SoundCloud page. Cookies remain on your device until you delete them. You can find more information about the cookies used on SoundCloud at https://soundcloud.com/pages/cookies
According to its own information, SoundCloud uses this data for a wide variety of purposes and transmits it worldwide, both internally to other companies in the SoundCloud Group and to various external partners. SoundCloud bases this data processing on various legal bases, which you can find in detail in SoundCloud’s data policy. The data policy can be found at the following link: https://soundcloud.com/pages/privacy
While SoundCloud uses this data under its own responsibility for various purposes, we can view various statistical data (such as plays, “likes”, reposts of tracks, comments and shares) on our SoundCloud profile on the jointly responsible SoundCloud Fan Insights service. Further information on the processing of this usage data can be found at https://soundcloud.com/pages/fan-insights and in the privacy policy https://soundcloud.com/pages/privacy
In accordance with the provisions of the GDPR, we are jointly responsible with SoundCloud for data processing on our SoundCloud profile (Art. 26 GDPR). Accordingly, we have concluded an agreement with SoundCloud provided by SoundCloud in which this joint responsibility is regulated. You can find the agreement at the following link: https://soundcloud.com/pages/fan-insights-joint-controller-addendum
This means that SoundCloud is primarily responsible for the Fan Insight data. In addition, SoundCloud will comply with all obligations under the GDPR with regard to the processing of Insight data (including Art. 12, 13 GDPR, Art. 15-22 GDPR and Art. 32-34 GDPR). If you send us a request regarding our SoundCloud page, we will inform SoundCloud promptly. SoundCloud will respond to the request in accordance with our agreement.
Our legitimate interests in the processing of personal data lie in the use and linking of various communication channels, marketing via high-reach social media platforms and the analysis and evaluation of the success of our communication and marketing efforts. The legal basis for the processing is Art. 6 para. 1 sentence 1 lit. f GDPR. If you consent to data processing (in particular to the setting of cookies), the processing is also carried out on the basis of Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) or Art. 6 (1) sentence 1 lit. a GDPR. You can withdraw your consent in accordance with the aforementioned legal bases at any time.
If you use our SoundCloud page to contact us (e.g., by creating your own posts, responding to one of our posts, or sending us private messages), we process the data you provide exclusively to process your contact. The legal basis for the processing of your personal data is therefore Art. 6 para. 1 sentence 1 lit. f GDPR. It is our legitimate interest to process your data transmitted to us in order to contact you. The data will be stored until it is no longer required to achieve the purpose of the conversation with you and your contact request has been fully clarified. You can inform us at any time that we should delete the data provided in the course of the conversation. In this case, to the extent permitted, all personal data from the conversation will be deleted and it will not be possible to continue the conversation.
Note on international data transfers:
According to its own information, SoundCloud is a globally active company, which means that data may be transferred outside the European Economic Area. SoundCloud relies on so-called standard contractual clauses or other legal mechanisms. Further information on this can be found in SoundCloud’s privacy policy: https://soundcloud.com/pages/privacy

12. Integration of third-party services

a. Integration of YouTube videos on our website

We integrate videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in our website for the purpose of making our website appealing. In the following, the term “YouTube” is used for the video portal, the term “Google” for the operator of this portal.
When integrating YouTube videos, we use the extended data protection mode, in which, according to the provider, information about you is only shared with Google if you activate the video by clicking on the play button of the video.
If you activate the video, Google may use cookies to collect information for analysis and advertising purposes and to improve user-friendliness. According to Google, the data is processed pseudonymously. However, especially if you are logged into your Google or YouTube account, the data may be linked directly to these accounts.
According to its own information, Google uses this data for a wide variety of purposes and transmits it to a wide variety of recipients, including recipients who are not based within the EU. Google bases this data processing on various legal bases. You can find an overview of this in Google’s privacy policy, which you can access at the following link: https://policies.google.com/privacy?hl=en
In addition, so-called Google Fonts (fonts provided by Google) may be loaded when the video is played.
We have embedded YouTube videos on our website in such a way that they are only loaded once you have given your consent in the “Functional” category. The legal basis for the integration of the YouTube service on our website and the associated processing of your data is therefore your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.
If YouTube sets cookies when you actively click on and play a YouTube video on our site, we process your data on the basis of your consent (Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6 (1) sentence 1 lit. a GDPR). You can revoke your consent in accordance with the aforementioned legal bases at any time in the privacy settings on our website under “Manage consent”. You can find information on YouTube cookies at https://policies.google.com/technologies/cookies?hl=en
Note on data transfers to the USA:
However, Google Ireland Ltd. is a subsidiary of the US group Google, which means that your personal data may also be transferred to US Google group companies (in particular Google LLC) and Google servers located in the USA. The USA is a third country within the meaning of the GDPR for which the EU Commission has issued an adequacy decision (the so-called “EU-US Data Privacy Framework” or “EU-US DPF”). Google LLC is certified as a US company under the EU-US DPF, see https://www.dataprivacyframework.gov/list.

b. Marker.io

On our website we use Marker.io, a feedback tool offered by Marker.io SRL, Avenue Louise 231, 1050 Brussels, Belgium (“Marker.io”), to collect website feedback and technical information about errors. When using the feedback widget, the following data may be processed: IP address, browser details, operating system, timestamp, visited URL, technical diagnostic data (e.g., console logs), and any screenshots or information voluntarily submitted by the user.
Data may be transferred to servers outside the EU/EEA. Such transfers are carried out in accordance with the GDPR’s requirements for international data processing. Where Marker.io transfers personal data to a country not deemed to provide an adequate level of protection, such transfer shall be governed by the European Commission’s Standard Contractual Clauses (SCCs), incorporated herein by reference.
We have concluded a data processing agreement with Marker.io. Information about the data processing by Marker.io can be found here: https://marker.io/dpa and https://marker.io/privacy
Marker.io is only loaded after you have given your consent in the “Functional” category. The legal basis for the processing, including the setting of cookies by Marker.io when you use the feedback widget, is therefore your consent (Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6 (1) sentence 1 lit. a GDPR). Our interest lies in improving website functionality and resolving technical issues. You can revoke your consent in accordance with the aforementioned legal bases at any time in the privacy settings on our website under “Manage consent”.

c. Google Fonts and Adobe Fonts

To display fonts uniformly, we use Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), and Adobe Fonts, a service of Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland (“Adobe”). When the fonts are loaded, your browser establishes a connection to the servers of Google or Adobe. In particular, your IP address, browser and device information, the URL of the page visited and the time of the request are transmitted. Adobe may also process information on the fonts used for licensing and billing purposes.
The fonts are only loaded after you have given your consent in the “Functional” category; otherwise, a standard font is used. The legal basis is your consent (Section 25 (1) TDDDG and Art. 6 (1) sentence 1 lit. a GDPR). You can revoke your consent at any time in the privacy settings on our website under “Manage consent”.
You can find further information in Google’s privacy policy (https://policies.google.com/privacy?hl=en) and Adobe’s privacy policy (https://www.adobe.com/privacy/policy.html).
Note on data transfers to the USA:
Personal data may be transferred to Google LLC and Adobe Inc. in the USA. The USA is a third country within the meaning of the GDPR for which the EU Commission has issued an adequacy decision (“EU-US Data Privacy Framework” or “EU-US DPF”). Google LLC and Adobe Inc. are certified under the EU-US DPF, see https://www.dataprivacyframework.gov/list. In addition, Adobe relies on the EU Standard Contractual Clauses for transfers to other third countries.

d. Google Hosted Libraries (Google AJAX) and gstatic.com

We use Google Hosted Libraries (“Google AJAX”), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to load JavaScript libraries required for certain functions of our website from Google servers. Google AJAX is only loaded after you have given your consent in the “Functional” category. The legal basis is your consent (Section 25 (1) TDDDG and Art. 6 (1) sentence 1 lit. a GDPR).
In addition, static content (e.g., scripts, stylesheets and images) required for the display and functioning of our website and of integrated Google services is delivered via the Google domain gstatic.com. When this content is loaded, your IP address, browser information, the URL of the page visited and the time of the request are transmitted to Google. We classify gstatic.com as essential. The legal basis is Art. 6 (1) sentence 1 lit. f GDPR; our legitimate interest lies in the technically stable and efficient provision of our website. Insofar as information is stored on or read from your end device, this is done on the basis of Section 25 (2) TDDDG.
You can find further information in Google’s privacy policy: https://policies.google.com/privacy?hl=en
Note on data transfers to the USA:
Google Ireland Ltd. is a subsidiary of the US group Google, which means that your personal data may also be transferred to US Google group companies (in particular Google LLC) and Google servers located in the USA. The USA is a third country within the meaning of the GDPR for which the EU Commission has issued an adequacy decision (“EU-US Data Privacy Framework” or “EU-US DPF”). Google LLC is certified as a US company under the EU-US DPF, see https://www.dataprivacyframework.gov/list.

e. Google reCAPTCHA

To protect forms on our website against spam, bots and misuse, we use Google reCAPTCHA, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). reCAPTCHA checks whether an entry is made by a human or by an automated program. For this purpose, reCAPTCHA analyses the behaviour of the website visitor on the basis of various characteristics, in particular IP address, browser and device information, time spent on the website, mouse movements and cookies set by Google.
reCAPTCHA is only loaded after you have given your consent in the “Functional” category. Without this consent, forms protected by reCAPTCHA may not be usable; in this case you can contact us by email. The legal basis is your consent (Section 25 (1) TDDDG and Art. 6 (1) sentence 1 lit. a GDPR). You can revoke your consent at any time in the privacy settings on our website under “Manage consent”.
You can find further information in Google’s privacy policy (https://policies.google.com/privacy?hl=en) and Google’s terms of service (https://policies.google.com/terms?hl=en).
Note on data transfers to the USA:
Google Ireland Ltd. is a subsidiary of the US group Google, which means that your personal data may also be transferred to US Google group companies (in particular Google LLC) and Google servers located in the USA. The USA is a third country within the meaning of the GDPR for which the EU Commission has issued an adequacy decision (“EU-US Data Privacy Framework” or “EU-US DPF”). Google LLC is certified as a US company under the EU-US DPF, see https://www.dataprivacyframework.gov/list.

f. Help Scout

On our website, we use a support and help widget of Help Scout PBC, 68 Harrison Ave #605, PMB 78505, Boston, MA 02111, USA (“Help Scout”). The widget allows you to search our help articles and to contact our support. When you use the widget, the data you enter (e.g., name, email address, message and any attachments) and technical data (e.g., IP address, browser information, URL of the page visited and time of the request) are processed in order to answer your request. Help Scout processes this data on our behalf; we have concluded a data processing agreement with Help Scout in accordance with Art. 28 GDPR.
The widget is only loaded after you have given your consent in the “Functional” category. The legal basis is your consent (Section 25 (1) TDDDG and Art. 6 (1) sentence 1 lit. a GDPR). If your request is aimed at the conclusion or performance of a contract, the additional legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR. You can revoke your consent at any time in the privacy settings on our website under “Manage consent”. The retention of support requests is governed by Section 8.
You can find further information in Help Scout’s privacy policy: https://www.helpscout.com/company/legal/privacy/
Note on data transfers to the USA:
Help Scout PBC has self-certified under the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. DPF, see https://www.dataprivacyframework.gov/list. For other transfers, in particular from Switzerland, the EU Standard Contractual Clauses apply.

13. Use of tracking technologies

a. User tracking for product and service improvement

In our FFOSSO software player, we use a tracking tool designed in-house to improve our products and services. We use largely anonymous device identification numbers (randomly assigned UUIDs) for this purpose. We can only establish a personal reference using these UUIDs in exceptional cases, e.g. if a specific instrument was downloaded from only one device on a specific date or if only one device was used in a specific country within a month.
We process the following data based on the UUIDs:

Metrics: Total users, Active Users, New (active Users), Most downloaded instruments / loaded instruments, Average active days, New User retention rate, Average downloads per User, Average instruments loaded per User, Instrument builders
Events: UI opened, Instrument downloaded, Instrument loaded, Instrument created, Device added to grid, Instrument saved

The legal basis for the processing of your personal data is therefore Art. 6 para. 1 sentence 1 lit. f GDPR. It is our legitimate interest to process your data transmitted to us in order to improve our products and services. The data will be stored until it is no longer required to achieve the purpose. You can inform us at any time that we should delete the data collected. In this case, to the extent permitted, this personal data will be deleted. You can object to the further processing of your data within the FFOSSO application on the profile page, that you can reach from the main sidebar menu.

We use analysis software from Mixpanel, Inc., One Front Street, Floor 28, San Francisco, CA 94111, USA (“Mixpanel”) to analyse and statistically evaluate the above-mentioned user data. We make the collected data available to our data processor Mixpanel for statistical evaluation. Mixpanel acts as a processor and we have concluded a contract with Mixpanel for order processing in accordance with Art. 28 GDPR. This agreement is available here: https://mixpanel.com/legal/dpa/
The implementation of these technologies within our website and our application follows a strict privacy-by-design approach, under which we do not transmit any personal or personally identifiable information to Mixpanel – this information is therefore irreversibly anonymous for Mixpanel due to the lack of additional information required for identification. Information about the data processing by Mixpanel can be found here: https://mixpanel.com/legal/privacy-policy/
Note on data transfers to the USA:
Mixpanel Inc. processes data also inside and outside the USA, so your personal data may also be transferred to servers located in the USA. The USA is a third country within the meaning of the GDPR, for which an adequacy decision of the EU Commission (the so-called “EU-US Data Privacy Framework” or “EU-US DPF”) exists. Mixpanel is certified as a US company under the EU-US DPF, see https://www.dataprivacyframework.gov/list. Mixpanel also relies on so-called standard contractual clauses. Further information can be found in the privacy statement linked above.

b. Meta Pixel (Facebook Pixel) and Meta Conversions API

On our website, we use the analytics and advertising tools Meta Pixel (also listed as “Facebook Pixel” in our consent management platform) and the Meta Conversions API (CAPI) from Meta Platforms Inc. or Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland (“Meta”).

The Meta Pixel works with a JavaScript code snippet that is executed when someone opens a page or performs a certain action. Unlike the Meta Pixel, which operates in your browser, the Meta Conversions API transmits certain event data directly from our server to Meta. We use these technologies to analyze the effectiveness of our advertising, measure conversions, and optimize our marketing campaigns. We cannot identify individual users via our Facebook Business profile or address them specifically with advertising, but only user groups.

We use the Meta Pixel and the Meta Conversions API in such a way that the Meta Pixel is only activated and event data is only transmitted to Meta via the Meta Pixel and the Meta Conversions API after you have provided your consent in the “Marketing” category. The legal basis for the activation of the Meta Pixel, the transmission of event data via the Meta Pixel and the Meta Conversions API, the setting of cookies where applicable, and the subsequent processing of your personal data is your consent (Section 25 (1) TDDDG, where applicable, and Art. 6 (1) sentence 1 lit. a GDPR). You can revoke your consent at any time via the data protection settings on our website under “Manage consent”.

The Meta Pixel and the Meta Conversions API may be used together. In this case, Meta may compare browser-based and server-side events to improve the reliability and accuracy of conversion measurement and attribution. Duplicate events are identified using event identifiers where applicable.

The Meta Pixel and the Meta Conversions API may process and transmit the following data to Meta:

HTTP header information – including information typically contained in HTTP headers, such as your IP address, browser information (including the user-agent), page URL, referrer URL, and other information relating to your interaction with our website.
Pixel- and event-specific data – including the Pixel ID, event identifiers, the Facebook cookie (where applicable), and information necessary to associate browser-based and server-side events.
Click data for buttons – all buttons that visitors to the website have clicked on, the labels of these buttons, and all pages that were accessed as a result of these button clicks.
Optional values – we may optionally set custom data events to send additional information about the visit. Examples of custom data events include conversion value and page type.
Form field names – including website field names such as “email”, “address”, or “quantity”, for the purchase of a product or service. We do not intentionally transmit the contents of these form fields unless this is expressly configured and permitted.
Server-side identifiers – where applicable, technical identifiers and event information generated by our server to improve the reliability and accuracy of conversion measurement.

In particular, when using the Meta Conversions API, we transmit your IP address and browser user-agent to Meta as part of the event data. Meta uses this information to improve event matching, measure conversions, prevent fraud, and optimize the delivery and performance of advertising. Meta may use the transmitted technical information to associate server-side events with browser events and to improve the accuracy of conversion attribution.

With the Meta Pixel and the Meta Conversions API, we want to ensure that visitors to our website who fulfill certain characteristics (interest in certain products, gender, certain age, live in a certain city, etc.) are shown advertisements on Facebook. Meta calls the grouping of users based on certain characteristics “Custom Audiences”. The advertising on Facebook should be shown to potentially interested parties and not to those who are unlikely to be interested in our product. Our Custom Audience therefore consists of the “Website Custom Audiences” function, i.e., Meta may associate visitors to our website with user accounts across Meta services so that we can create Custom Audiences for advertisements on Meta platforms. This is called “retargeting.”

The Meta Pixel and the Meta Conversions API also help to statistically track the effectiveness of advertisements. Meta refers to this as “conversion measurement.” These technologies tell us whether people in the target group have visited our website, searched for a specific product on our website, viewed a specific product or product category, initiated a purchase, or completed a purchase. They also tell us whether people were directed to our website from a paid search engine result and whether people are interested in special offers. We can only see this information in aggregated statistical form—we do not use Meta’s services to identify individual visitors. We receive aggregated reports and statistics from Meta and cannot identify individual users through our Meta Business account.

In addition, our Custom Audience may also consist of “Engagement Custom Audiences” (custom audiences by interaction) in relation to user interactions on Instagram or Facebook. “Engagement” means, for example, that a person has clicked on a video on our Facebook page, followed our Instagram profile, or left a comment there. With Engagement Custom Audiences, we can show ads to these people.

While Engagement Custom Audiences are based on actions within Meta technologies, Website Custom Audiences are based on actions that take place on our website and are recorded by the Meta Pixel and the Meta Conversions API. Data is therefore only collected via these technologies in the latter case.

We also use the “Lookalike Audience” function. This allows us to reach new people who are likely to be interested in our company because they are similar to our existing customers.

In your Facebook profile, you can choose whether you want to receive personalized advertising. You can withdraw your consent—via our consent management tool—to the collection by the Meta Pixel and the Meta Conversions API and the use of your data for advertisements on Facebook and Instagram and across Meta technologies (as part of a Custom Audience). Please note that server-side data transmission via the Meta Conversions API is technically independent of browser cookies but is only carried out where the required consent has been obtained.

The Facebook Data Policy can be found here: https://www.facebook.com/policy.php. Further information from Meta about the Meta Pixel, the Meta Conversions API, and the cookies used can be found here:

We have entered into the contractual terms provided by Meta governing the processing of personal data, including, where applicable, Meta’s Data Processing Terms and Controller Addendum. You can find out more at:

Data retention and user rights

We do not determine the retention period for personal data processed by Meta. Under the GDPR, you have the right to access, rectify, or erase your data, as well as the right to object to processing. To learn more about how Meta processes data or to exercise your rights, please review Meta’s Privacy Policy.

Note on data transfers to the USA:

The Meta Pixel and the Meta Conversions API are used on the basis of a contract that we have concluded with Meta Platforms Ireland. However, Meta Platforms Ireland is a subsidiary of the US group Meta Platforms Inc., which means that your personal data may also be transferred to US Meta group companies (in particular Meta Platforms Inc.) and Meta servers located in the USA. The USA is a third country within the meaning of the GDPR, for which an adequacy decision of the EU Commission (the so-called “EU-US Data Privacy Framework” or “EU-US DPF”) exists. Meta Platforms Inc. is certified under the EU-US DPF; see https://www.dataprivacyframework.gov/list.

c. Google Analytics 4

The analytics service Google Analytics 4 is implemented on our website, which is offered for users from the European Economic Area, Switzerland and Liechtenstein by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and for all other users by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter: “Google Analytics 4”). You can find Google’s privacy policy at the following link: https://policies.google.com/privacy?hl=en. You can find information on cookies here: https://policies.google.com/technologies/cookies?hl=en
We have concluded a data processing agreement with Google Ireland Limited in accordance with Art. 28 GDPR.
Google Analytics 4 can record the following information, among others:

Type of internet browser used
Version of the internet browser
The operating system you are using
Selected language
Data on the requesting end device
Referrer (previously visited website)
Your IP address (according to Google, the IP address is only used temporarily to determine a rough location of the requesting end device (city level) and then deleted)
(Rough) location data, i.e. city (including its longitude and latitude), continent, country, region and subcontinent of the requesting end device
Date and time of the server request
The duration of the session
Click and scroll behavior including media playback, internal searches, content sharing
Webshop interactions, such as product views and orders

Google Analytics 4 only uses the IP address to derive location data. According to Google, IP addresses are otherwise not logged or stored.
We are only shown statistics via Google Analytics 4, which we use to optimize our website and offers. We have also configured Google Analytics 4 so that Google is not allowed to use the data for its own analysis of online trends or to improve its own products and services.
Before we use Google Analytics 4 to analyse your website visit, we obtain your consent in the “Marketing” category to the processing of your personal data (Art. 6 para. 1 sentence 1 lit. a GDPR) and to the setting of the necessary cookies (Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG)). Further information on the cookies used can be found in our cookie information (Section 17).
The legal basis for the processing of your personal data and the setting of cookies in the context of Google Analytics 4 is therefore your consent in accordance with Section 25 (1) TDDDG and Art. 6 (1) sentence 1 lit. a GDPR. You can revoke your consent at any time via the data protection settings on our website under “Manage consent”. You can also prevent the collection of your personal data by Google Analytics 4 and the processing of this data by Google by downloading and installing the browser add-on available at the following link (https://tools.google.com/dlpage/gaoptout?hl=de) to deactivate Google Analytics. You can also make data protection settings for Google under the following link: https://safety.google/privacy/privacy-controls/
Finally, you can also prevent the storage of Google cookies yourself by making the appropriate settings in your browser settings.
Note on data transfers to the USA:
The use of Google Analytics 4 is based on a contract that we have concluded with Google Ireland Ltd. However, Google Ireland Ltd. is a subsidiary of the US Google Group, which means that your personal data may also be transferred to US Google Group companies (in particular Google LLC) and Google servers located in the USA. The USA is a third country within the meaning of the GDPR for which the EU Commission has issued an adequacy decision (the so-called “EU-US Data Privacy Framework” or “EU-US DPF”). Google LLC is certified as a US company under the EU-US DPF, see https://www.dataprivacyframework.gov/list.

d. Google Tag Manager

We use the Google Tag Manager tag management system on our website (hereinafter: “Google Tag Manager”), which is offered for users from the European Economic Area, Switzerland and Liechtenstein by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland and for all other users by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. You can find Google’s privacy policy at the following link: https://policies.google.com/privacy?hl=en. You can find information on cookies here: https://policies.google.com/technologies/cookies?hl=en

We have concluded a data processing agreement with Google in accordance with Art. 28 GDPR.
Google Tag Manager is a tag management platform that allows us to load additional tools using a so-called “tag.” According to Google, in order to monitor the stability, performance and installation quality of the system and to obtain data for diagnosis, Google Tag Manager can be used to collect certain aggregated data for tag triggering. According to Google’s own information at https://support.google.com/tagmanager/answer/9323295, this data does not contain any IP addresses or measurement IDs that are linked to a specific person. With the exception of the data in standard HTTP request logs, which are all deleted within 14 days of receipt, and the diagnostic data described above, Google Tag Manager does not collect, store or share any information about visitors to our website. This also applies to the URLs of visited pages.
If the tools loaded by Google Tag Manager collect data for their part, Google Tag Manager does not access this data. Tools that require consent are only triggered via Google Tag Manager in accordance with your consent settings. If deactivation has been carried out at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.

Legal basis: Google Tag Manager is classified as essential in our consent management platform. It is used to store cookies, but only processes technical information and therefore does not require consent under the TDDDG. The legal basis for the use of Google Tag Manager is therefore Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the uniform and proper integration of cookies across different end devices.
Note on data transfers to the USA:
The use of Google Tag Manager is based on a contract that we have concluded with Google Ireland Ltd. However, Google Ireland Ltd. is a subsidiary of the US Google Group, which means that your personal data may also be transferred to US Google Group companies (in particular Google LLC) and Google servers located in the USA. The USA is a third country within the meaning of the GDPR for which the EU Commission has issued an adequacy decision (the so-called “EU-US Data Privacy Framework” or “EU-US DPF”). Google LLC is certified as a US company under the EU-US DPF, see https://www.dataprivacyframework.gov/list.

e. Google Ads, Conversion Linker, DoubleClick and Google Syndication

On our website, we use Google Ads and related advertising services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”):

Google Ads conversion tracking – to measure whether users who have clicked on one of our ads perform certain actions on our website (e.g., registration or purchase).
Conversion Linker – to store ad click information in first-party cookies so that conversions can be attributed to the corresponding ad.
DoubleClick – to deliver ads in the Google advertising network, to show ads to visitors of our website on other websites (remarketing) and to measure the performance of these ads.
Google Syndication – to deliver and measure ads in the Google advertising network via the domain googlesyndication.com.

For these purposes, Google may process in particular your IP address, cookie identifiers, browser and device information, the URL of the page visited and the referrer, ad click information (e.g., click ID), the time of the visit and conversion events. We only receive aggregated statistics and cannot identify individual users.
These services are only activated after you have given your consent in the “Marketing” category. The legal basis is your consent (Section 25 (1) TDDDG and Art. 6 (1) sentence 1 lit. a GDPR). You can revoke your consent at any time in the privacy settings on our website under “Manage consent”.
You can find further information in Google’s privacy policy (https://policies.google.com/privacy?hl=en) and on advertising at Google (https://policies.google.com/technologies/ads?hl=en). You can manage personalised advertising by Google at https://adssettings.google.com.
Note on data transfers to the USA:
Google Ireland Ltd. is a subsidiary of the US group Google, which means that your personal data may also be transferred to US Google group companies (in particular Google LLC) and Google servers located in the USA. The USA is a third country within the meaning of the GDPR for which the EU Commission has issued an adequacy decision (“EU-US Data Privacy Framework” or “EU-US DPF”). Google LLC is certified as a US company under the EU-US DPF, see https://www.dataprivacyframework.gov/list.

f. Reddit Pixel

On our website, we use the Reddit Pixel of Reddit, Inc., 548 Market St. #16093, San Francisco, CA 94104, USA (“Reddit”). The Reddit Pixel enables us to measure the effectiveness of our advertising on Reddit (conversion measurement) and to show ads on Reddit to visitors of our website (retargeting). For this purpose, Reddit may process in particular your IP address, browser and device information, the URL of the page visited, the referrer, events such as page views, registrations or purchases, and cookie identifiers.
The Reddit services are only activated after you have given your consent (“Reddit” in the “Functional” category and “Reddit Advertising” in the “Marketing” category). The legal basis is your consent (Section 25 (1) TDDDG and Art. 6 (1) sentence 1 lit. a GDPR). You can revoke your consent at any time in the privacy settings on our website under “Manage consent”.
You can find further information in Reddit’s privacy policy: https://www.reddit.com/policies/privacy-policy
Note on data transfers to the USA:
The USA is a third country within the meaning of the GDPR for which the EU Commission has issued an adequacy decision (“EU-US Data Privacy Framework” or “EU-US DPF”). Reddit, Inc. is certified under the EU-US DPF, see https://www.dataprivacyframework.gov/list.

g. Facebook Social Plugins

On our website, we integrate social plugins of Meta Platforms Ireland Limited (“Meta”), e.g., “Like” or “Share” buttons or embedded content. The plugins are only loaded after you have given your consent in the “Marketing” category. When they are loaded, your browser establishes a direct connection to Meta’s servers. Meta receives in particular the information that you have visited our website, your IP address and browser information and, if you are logged into your Facebook account, can assign the visit to your account.
We are jointly responsible with Meta for the collection and transmission of this data to Meta (Art. 26 GDPR); Meta is solely responsible for the subsequent processing. The legal basis is your consent (Section 25 (1) TDDDG and Art. 6 (1) sentence 1 lit. a GDPR). You can revoke your consent at any time in the privacy settings on our website under “Manage consent”. You can find the Meta Controller Addendum at https://www.facebook.com/legal/controller_addendum and Meta’s privacy policy at https://www.facebook.com/policy.php.
Note on data transfers to the USA:
Personal data may also be transferred to Meta Platforms, Inc. in the USA. The USA is a third country within the meaning of the GDPR for which the EU Commission has issued an adequacy decision (“EU-US Data Privacy Framework” or “EU-US DPF”). Meta Platforms, Inc. is certified under the EU-US DPF, see https://www.dataprivacyframework.gov/list.

14. Consent management tool Usercentrics

To obtain and document the consent of our visitors to the cookies and services we use on our website, we use the cookie consent tool of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany (“Usercentrics”).
The legal basis for the use of Usercentrics is Art. 6 para. 1 sentence 1 lit. c and f GDPR, as the legally secure obtaining of consent is legally required and it is in our legitimate interest to use the services of a professional service provider to manage and document the cookie settings of our visitors.
Information on data processing by Usercentrics can be found here: https://usercentrics.com/privacy-policy/. We have concluded a data processing agreement with Usercentrics. Further information can be found at: https://usercentrics.com/wp-content/uploads/2023/10/Usercentrics_DPA_September-2023.pdf

15. Data processing in connection with downloads, licence entitlements and use of Content

When you request, download, activate or use Content in FFOSSO, we process, to the extent generated by the platform, your USER ID, the account and entitlement type (Free Content, Subscription Content or Purchased Content), the relevant product, Collection or Content identifier and name, the date and status of download and fulfilment events, and identifiers or status information relating to registered devices and local authorisations. We may also process records of entitlement restoration, account re-association, support actions and relevant security or misuse events.

We process this data to provide and administer the Content, verify the named-user and device scope, document that a Perpetual Purchase has been made available and that the first complete download has occurred, maintain the association between the account and purchased licence, provide support, prevent unauthorised use and establish, exercise or defend contractual or legal claims. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR and, for security, misuse prevention and legal-claim purposes, Art. 6 para. 1 sentence 1 lit. f GDPR. Where storage is required by law, Art. 6 para. 1 sentence 1 lit. c GDPR also applies.

Operational records are stored only for as long as required for the relevant functions. Transaction, licence, download, fulfilment and consent records may be retained for the duration of the contractual relationship and thereafter for applicable statutory retention and limitation periods, insofar as necessary to document the grant and scope of rights, contractual performance and legal claims. Deletion of the customer account does not automatically result in deletion of records that must or may lawfully be retained for these purposes. Data stored with AWS is subject to Section 4.a.

16. Your rights
If we process your data, you are a “data subject” within the meaning of the GDPR. You have the following rights: right of access, right to rectification, right to restriction of processing, right to erasure, right to information (our notification obligation) and right to data portability. You also have the right to object, the right to withdraw consent and the right to lodge a complaint with the supervisory authority.
Below you will find some details on the individual rights:

a. Right of access
You have the right to request confirmation from us as to whether we are processing your personal data. If we process your personal data, you have the right to obtain information in particular about the processing purposes, categories of personal data, recipients or categories of recipients and, if applicable, the storage period.

b. Right of rectification
You have the right to correct and/or complete the data that we have stored about you if this data is incorrect or incomplete. We will make the correction or completion without delay.

c. Right to restriction of processing
Under certain circumstances, you have the right to request that we restrict the processing of your personal data. An example of this is if you dispute the accuracy of your personal data and we need to verify the accuracy for a certain period of time. Your data will only be processed to a limited extent for the duration of the check. Another example of restriction is if we no longer need your data, but you need it for a legal dispute.

d. Right to erasure
In certain situations, you have the right to request that we delete your personal data immediately. This is the case, for example, if we no longer need your personal data for the purposes for which we collected it or if we have processed your data unlawfully. Another example would be if we process your data on the basis of your consent, you withdraw your consent and we do not process the data on any other legal basis. However, your right to erasure does not always apply. For example, we may process your personal data in order to comply with a legal obligation or because we need it for a legal dispute.

e. Notification obligation
If you have exercised your right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom we have disclosed your personal data of the rectification, erasure or restriction of processing of your data, unless this proves impossible or involves a disproportionate effort.

f. Right to data portability
Under certain conditions, you have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format and the right to have this data transmitted to another controller. This is the case if we process the data either on the basis of your consent or on the basis of a contract with you and that we process the data using automated procedures.
You have the right to obtain that we transfer your personal data directly to another controller, insofar as this is technically feasible and the freedoms and rights of other persons are not affected by this.

g. Right of objection
You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (e) or (f) of Article 6 (1) GDPR. This also applies to profiling based on these provisions.
After an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.
If we process your personal data for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such marketing. This also applies to profiling insofar as it is associated with direct advertising. If you object to the processing of your personal data for direct marketing purposes, we will no longer process it for these purposes.

h. Right of withdrawal
In accordance with Art. 7 (3) GDPR, you have the right to withdraw your consent at any time. Withdrawal of consent does not retroactively invalidate the lawfulness of the processing.

i. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority, without prejudice to any other administrative or judicial remedy. In particular, you may exercise your right to lodge a complaint in the Member State of your place of residence, your place of work or the place of the alleged infringement if you believe that the processing of your personal data infringes the GDPR.
The competent supervisory authority for Baden-Württemberg is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstr. 20, 70173 Stuttgart, phone +49 711 6155410, fax +49 711 61554115, email poststelle@lfdi.bwl.de.
You can find an overview of the respective state data protection officers and their contact details under the following link:
https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

17. Cookie information

We use cookies on our website. Cookies are text files that are sent to your browser by our web server when you visit our website and are stored on your computer for later retrieval. Cookies are then sent to the server of our website with every server request or page view. A cookie can therefore identify your Internet browser when you visit the website again. Some of the functions that we have integrated into our website also use web storage objects. These work in a similar way to cookies, but are temporarily stored in your browser and are generally not transmitted to the server.

There are session cookies, which are deleted when the browser is closed, and there are persistent cookies, which are stored on the hard disk until their preset expiration date is reached or until they are actively removed by you. Web storage objects are divided into local storage objects, which never expire, and session storage objects, which are deleted when the browser is closed.

A distinction is made between first party cookies (only visible from the domain you are currently visiting) and third party cookies (visible across domains and regularly set by third parties).

a. Categories

The cookies, web storage objects and services used on our website are divided into the following categories in our consent management platform:

Essential: These technologies are required to activate the core functionality of our service. They are absolutely necessary to move around the website, use basic functions and ensure the security of the website; they do not collect information about you for marketing purposes. The legal basis for setting essential cookies and web storage objects is Section 25 (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG); the subsequent processing of personal data is based on Art. 6 para. 1 sentence 1 lit. f GDPR.

Functional: These technologies provide additional functions and content on our website (e.g., fonts, videos, checkout and payment functions, support and feedback tools) and enable us to analyse usage behaviour in order to measure and improve performance. These technologies are only used with your consent. The legal basis is Section 25 (1) TDDDG and Art. 6 para. 1 sentence 1 lit. a GDPR.

Marketing: These technologies are used by advertisers to serve ads that are relevant to your interests and to measure the effectiveness of advertising. These technologies are only used with your consent. The legal basis is Section 25 (1) TDDDG and Art. 6 para. 1 sentence 1 lit. a GDPR.

Please note the following: You can ensure yourself that no cookies and similar technologies are stored on your computer at all, or that the storage of only certain cookies is permitted. You can select this in your Internet browser settings. You can also view and delete the stored cookies there. If you block all cookies, it is possible that not all functions of our website will be available to you.

b. Right of revocation / removal

As stated at the beginning of this section, you can enable or restrict the transmission of cookies and similar technologies by changing the settings in your internet browser. You can delete cookies and web storage objects that have already been saved by your internet browser at any time. If cookies and web storage objects are restricted or deactivated for our website, it is possible that not all functionalities can be used. You can revoke your consent at any time in the privacy settings on our website under “Manage consent”.

c. Overview of the services used on our website

We use the following services on our website. Details of the individual cookies and web storage objects set by each service, including their names and storage duration, can be viewed at any time in the privacy settings on our website under “Manage consent” in the “Services” tab.

Essential

Service	Provider	Purpose	Details
Cloudflare	Cloudflare, Inc., USA	Content delivery, protection against attacks and bots, rate limiting and load management	Section 4.b
Google Tag Manager	Google Ireland Limited, Ireland	Management and loading of tags in accordance with your consent settings	Section 13.d
Headless WordPress – Medien & Assets (First-Party)	OT Distribution GmbH & Co. KG	Delivery of media files and assets of our website from our own content management system	Section 4.d
Usercentrics Consent Management Platform	Usercentrics GmbH, Germany	Obtaining, storing and documenting your consent decisions	Section 14
WPGraphQL API (Headless CMS)	OT Distribution GmbH & Co. KG	Retrieval of website content from our content management system	Section 4.d
gstatic.com	Google Ireland Limited, Ireland	Delivery of static content required for the display and functioning of our website	Section 12.d

Functional

Service	Provider	Purpose	Details
Adobe Fonts	Adobe Systems Software Ireland Limited, Ireland	Loading of fonts	Section 12.c
Chargebee	Chargebee Inc., USA	Checkout, order, subscription and billing management	Section 6
GTM	Google Ireland Limited, Ireland	Tag management	Section 13.d
Google AJAX	Google Ireland Limited, Ireland	Loading of JavaScript libraries (Google Hosted Libraries)	Section 12.d
Google Fonts	Google Ireland Limited, Ireland	Loading of fonts	Section 12.c
Helpscout	Help Scout PBC, USA	Support and help widget	Section 12.f
Marker.io	Marker.io SRL, Belgium	Website feedback and error reporting	Section 12.b
Reddit	Reddit, Inc., USA	Integration of Reddit services	Section 13.f
Stripe	Stripe (see Section 7)	Payment processing and fraud prevention	Section 7
YouTube Video	Google Ireland Limited, Ireland	Display of embedded videos	Section 12.a
reCAPTCHA	Google Ireland Limited, Ireland	Protection of forms against spam and misuse	Section 12.e

Marketing

Service	Provider	Purpose	Details
Conversion Linker	Google Ireland Limited, Ireland	Storage of ad click information for conversion measurement	Section 13.e
DoubleClick Ad	Google Ireland Limited, Ireland	Ad delivery, remarketing and ad measurement	Section 13.e
Facebook Pixel	Meta Platforms Ireland Limited, Ireland	Conversion measurement and Custom Audiences	Section 13.b
Facebook Social Plugins	Meta Platforms Ireland Limited, Ireland	Integration of social plugins and Facebook content	Section 13.g
Google Ads	Google Ireland Limited, Ireland	Conversion tracking and remarketing	Section 13.e
Google Analytics	Google Ireland Limited, Ireland	Web analytics	Section 13.c
Google Analytics 4	Google Ireland Limited, Ireland	Web analytics	Section 13.c
Google Syndication	Google Ireland Limited, Ireland	Delivery and measurement of ads in the Google advertising network	Section 13.e
Meta Pixel	Meta Platforms Ireland Limited, Ireland	Conversion measurement, Custom Audiences and retargeting	Section 13.b
Reddit Advertising	Reddit, Inc., USA	Conversion measurement and retargeting on Reddit	Section 13.f

18. Status of this privacy notice
Status: 7 October 2026