Privacy policy
Introduction and overview
This privacy policy explains which personal data ESGE GmbH processes, for what purposes and what rights you have. If you have any questions, please contact us at sebastian@esge.at.
Scope
This privacy policy applies to all personal data processed by us in the company and to all personal data processed by companies we engage as processors. By personal data, we mean information within the meaning of Article 4(1) GDPR, such as a person’s name, email address and postal address. Processing personal data enables us to offer and bill for our services and products, whether online or offline. This privacy policy covers all online presences (websites and online shops) that we operate, social media presences and email communications, and mobile apps for smartphones and other devices.
In brief: this privacy policy applies to all areas in which personal data is processed in a structured manner within the company through the channels mentioned. If we enter into legal relationships with you outside these channels, we will inform you separately where appropriate.
Legal bases
In this privacy policy, we provide transparent information about the legal principles and provisions—the legal bases of the General Data Protection Regulation—that allow us to process personal data.
As regards EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can read this EU General Data Protection Regulation online on EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679.
We process your data only if at least one of the following conditions applies:
Consent (Article 6(1)(a) GDPR): you have given us your consent to process data for a particular purpose. An example would be storing the data you enter in a contact form.
Contract (Article 6(1)(b) GDPR): we process your data to fulfil a contract or pre-contractual obligations with you. For example, if we conclude a purchase contract with you, we need personal information beforehand.
Legal obligation (Article 6(1)(c) GDPR): we process your data if we are subject to a legal obligation. For example, we are legally required to retain invoices for accounting purposes. These usually contain personal data.
Legitimate interests (Article 6(1)(f) GDPR): where legitimate interests do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data to operate our website securely and cost-effectively. This processing therefore constitutes a legitimate interest.
Other conditions, such as carrying out tasks in the public interest, exercising official authority and protecting vital interests, do not generally apply to us. If such a legal basis does apply, it will be stated in the relevant section.
National laws also apply in addition to the EU Regulation. In Austria, this is the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act), abbreviated to DSG. In Germany, the Federal Data Protection Act, abbreviated to BDSG, applies. If other regional or national laws apply, we will inform you in the following sections.
Contact details of the controller
If you have any questions about data protection or the processing of personal data, the contact details of the responsible person or entity are provided below:
Sebastian Gratzer | ESGE GmbH
Reitmoos 9b
6914 Hohenweiler
Austria
Email: sebastian@esge.at
Telephone: +43 6803249676
Legal notice: https://www.esge.at/impressum/
Retention period
Our general criterion is to retain personal data only for as long as strictly necessary to provide our services and products. This means that we delete personal data as soon as the reason for processing it no longer exists. In some cases, we are legally required to retain certain data even after the original purpose has ceased to apply, for example for accounting purposes.
If you request deletion of your data or withdraw your consent to data processing, the data will be deleted as quickly as possible, provided that no obligation to retain it applies. Where we have further information, we will inform you below about the specific duration of each processing operation.
Rights under the General Data Protection Regulation
In accordance with Articles 13 and 14 GDPR, we inform you of the following rights to which you are entitled, to ensure fair and transparent processing of data.
Under Article 15 GDPR, you have the right to obtain information about whether we process your data. If we do, you have the right to receive a copy of the data and the following information: the purposes of processing; the categories or types of data processed; who receives the data and, if it is transferred to third countries, how its security can be guaranteed; how long the data is retained; the existence of rights to rectification, erasure or restriction of processing and to object to processing; your right to complain to a supervisory authority (links to these authorities are provided below); the source of the data if we did not collect it from you; and whether profiling takes place, meaning the automatic analysis of data to create a personal profile of you.
Under Article 16 GDPR, you have the right to rectification, meaning that we must correct your data if you find errors. Under Article 17 GDPR, you have the right to erasure (“right to be forgotten”), which means that you may request the deletion of your data. Under Article 18 GDPR, you have the right to restriction of processing, meaning that we may only store the data but may no longer use it. Under Article 20 GDPR, you have the right to data portability, meaning that we provide your data in a commonly used format on request. Under Article 21 GDPR, you have the right to object, which, when upheld, results in a change to processing.
If processing is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interests), you may object to it. We will then examine as quickly as possible whether we can legally comply with the objection. If data is used for direct marketing, you may object to this type of processing at any time. We may then no longer use your data for direct marketing. If data is used for profiling, you may object to this type of processing at any time. We may then no longer use your data for profiling. Under Article 22 GDPR, in certain circumstances you have the right not to be subject to a decision based solely on automated processing, such as profiling.
Under Article 77 GDPR, you have the right to lodge a complaint. This means that you may complain to the data protection authority at any time if you believe that the processing of personal data infringes the GDPR.
In brief: you have rights—please do not hesitate to contact the controller listed above. If you believe that processing of your data violates data protection law or that your data protection rights have otherwise been infringed, you may complain to the supervisory authority. In Austria, this is the Data Protection Authority, whose website is https://www.dsb.gv.at/. In Germany, each federal state has a data protection commissioner. For further information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI).
The following local data protection authority is responsible for our company:
Austrian Data Protection Authority
Head: Mag. Dr. Andrea Jelinek
Address: Barichgasse 40-42, 1030 Vienna
Telephone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/
Transfer of data to third countries
We transfer or process data in countries outside the EU (third countries) only if you consent to this processing, it is legally required or it is necessary for a contract, and in every case only insofar as it is generally permitted. In most cases, your consent is the main reason for having data processed in third countries. Processing personal data in third countries such as the USA, where many software providers offer services and have servers, may mean that personal data is processed and stored in unexpected ways.
We expressly point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. Processing by US services, such as Google Analytics, may result in data being processed and stored without anonymisation. US government authorities may also be able to access individual data. In addition, collected data may be linked to data from other services offered by the same provider if you have a corresponding user account. Where possible, we try to use server locations within the EU, if offered.
Where applicable, we provide more detailed information about transfers to third countries in the relevant sections of this privacy policy.
Security of data processing
We have implemented both technical and organisational measures to protect personal data. Where possible, we encrypt or pseudonymise personal data. Within our capabilities, this makes it as difficult as possible for third parties to infer personal information from our data. Article 25 GDPR refers to “data protection by design and by default”. This means considering security and taking appropriate measures in both software, such as forms, and hardware, such as access to a server room. Where necessary, we describe specific measures below.
TLS encryption with HTTPS
TLS, encryption and HTTPS sound technical, and they are. We use HTTPS (Hypertext Transfer Protocol Secure) to transmit data over the internet in a way that prevents eavesdropping. This means that the entire transfer of all data from your browser to our web server is secured—nobody can “listen in”.
We have therefore introduced an additional layer of security and fulfil data protection by design (Article 25(1) GDPR). By using TLS (Transport Layer Security), an encryption protocol for secure data transmission on the internet, we can ensure the protection of confidential data.
You can recognise this protection by the small padlock symbol at the top left of the browser, to the left of the web address (for example, example.com), and by the use of the HTTPS scheme instead of HTTP as part of our web address. To learn more about encryption, we recommend searching Google for “Hypertext Transfer Protocol Secure wiki” to find useful links with further information.
Communication
Communication summary
👥 Data subjects: everyone who communicates with us by telephone, email or online form
📓 Data processed: for example, telephone number, name, email address and information entered in forms. More details are provided under the relevant contact method.
🤝 Purpose: handling communications with customers, business partners and others
📅 Retention period: the duration of the business matter and the statutory requirements
⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract), Article 6(1)(f) GDPR (legitimate interests)
If you contact us by telephone, email or online form, personal data may be processed. The data is processed to handle your enquiry and the related business transaction. It is retained for the duration of the business matter and the statutory retention periods.
Data subjects
These processes affect everyone who contacts us using the communication channels we provide.
Telephone
If you call us, call data is stored in pseudonymised form on the relevant device and by the telecommunications provider used. Data such as your name and telephone number may subsequently be sent by email and stored to respond to your enquiry. The data is deleted once the business matter has been concluded and statutory provisions permit deletion.
If you communicate with us by email, data may be stored on the relevant device (computer, laptop, smartphone and so on) and is stored on the email server. The data is deleted once the business matter has been concluded and statutory provisions permit deletion.
Online forms
If you communicate with us using an online form, data is stored on our web server and may be forwarded to one of our email addresses. The data is deleted once the business matter has been concluded and statutory provisions permit deletion.
Legal bases
Processing is based on the following legal bases: Article 6(1)(a) GDPR (consent): you give us permission to store your data and continue to use it for purposes relating to the business matter. Article 6(1)(b) GDPR (contract): processing is necessary to fulfil a contract with you or a processor such as a telephone provider, or we need to process data for pre-contractual activities, such as preparing a quotation. Article 6(1)(f) GDPR (legitimate interests): we want to handle customer enquiries and business communications professionally. Certain technical facilities, such as email programs, Exchange servers and mobile network operators, are necessary to communicate efficiently.
Cookies
Cookies summary
👥 Data subjects: visitors to the website
🤝 Purpose: depends on the cookie. Further details are provided below or by the manufacturer of the software that sets the cookie.
📓 Data processed: depends on the cookie used. Further details are provided below or by the manufacturer of the software that sets the cookie.
📅 Retention period: depends on the cookie and may range from hours to years
⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(f) GDPR (legitimate interests)
What are cookies?
Our website uses HTTP cookies to store user-specific data. Below, we explain what cookies are and why they are used, to help you understand this privacy policy.
Whenever you browse the internet, you use a browser. Common browsers include Chrome, Safari, Firefox, Internet Explorer and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies. Cookies are useful helpers, and almost all websites use them. More precisely, these are HTTP cookies, as there are other types for other applications. HTTP cookies are small files stored on your computer by our website. These files are automatically placed in the cookie folder, effectively the “brain” of your browser. A cookie consists of a name and a value. One or more attributes must also be specified when defining a cookie.
Cookies store certain user data, such as your language or personal website settings. When you return to our website, your browser sends this user-related information back to it. Thanks to cookies, our website knows who you are and offers the settings you are accustomed to. In some browsers each cookie has its own file; in others, such as Firefox, all cookies are stored in a single file. The following diagram shows a possible interaction between a web browser such as Chrome and a web server: the browser requests a website and receives a cookie from the server, which the browser uses again when another page is requested.
There are first-party and third-party cookies. First-party cookies are created directly by our website, while third-party cookies are created by partner websites, such as Google Analytics. Each cookie must be assessed individually because it stores different data. Cookie expiry periods also range from a few minutes to several years. Cookies are not software programs and contain no viruses, trojans or other malicious programs. Nor can they access information on your PC.
For example, cookie data may look like this:
Name: _ga
Value: GA1.2.1326744211.152112390928-9
Purpose: distinguishing website visitors
Expiry: after 2 years
A browser should support at least these minimum capacities:
At least 4096 bytes per cookie
At least 50 cookies per domain
At least 3000 cookies in total
What types of cookies are there?
The specific cookies we use depend on the services used and are explained in the following sections of this privacy policy. Here, we briefly describe the different types of HTTP cookies.
Four types can be distinguished:
Essential cookies
These cookies are necessary to ensure basic website functions. For example, they are needed when a user puts a product in a shopping basket, continues browsing other pages and only checks out later. They prevent the shopping basket from being deleted, even if the user closes the browser window.
Functional cookies
These cookies collect information about user behaviour and whether users receive error messages. They also measure loading times and website behaviour in different browsers.
Preference cookies
These cookies improve usability. For example, they store locations entered by users, font sizes or form data.
Advertising cookies
Also called targeting cookies, these deliver individually tailored advertising to users. This can be useful, but also annoying.
Usually, when you first visit a website, you are asked which of these types of cookies you want to allow. That decision is itself stored in a cookie. If you would like to learn more and are comfortable with technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Internet Engineering Task Force (IETF) Request for Comments entitled “HTTP State Management Mechanism”.
Purpose of processing through cookies
The purpose ultimately depends on the particular cookie. More details are provided below or by the manufacturer of the software that sets it.
What data is processed?
Cookies are small helpers for a variety of tasks. It is not possible to generalise which data they store, but the following privacy policy informs you about the data processed or stored.
Cookie retention period
The retention period depends on the cookie and is specified below. Some cookies are deleted in less than an hour, while others may remain on a computer for several years. You can also influence the retention period yourself. You can manually delete all cookies through your browser at any time (see “Right to object” below). Cookies based on consent will be deleted at the latest when you withdraw consent; this does not affect the lawfulness of storage up to that point.
Right to object—how can I delete cookies?
You decide whether and how to use cookies. Regardless of the service or website they come from, you can always delete, disable or only partially allow them. For example, you can block third-party cookies but allow all others.
To see which cookies have been stored in your browser, change cookie settings or delete cookies, use your browser settings:
Chrome: delete, enable and manage cookies in Chrome
Safari: manage cookies and website data in Safari
Firefox: clear cookies to remove data stored on your computer by websites
Internet Explorer: delete and manage cookies
Microsoft Edge: delete and manage cookies
If you do not want cookies at all, you can set your browser to notify you whenever a cookie is to be set. You can then decide whether to allow each individual cookie. The procedure varies by browser. It is best to search Google for instructions using terms such as “delete cookies Chrome” or “disable cookies Chrome” if you use Chrome.
Legal basis
The so-called “Cookie Directives” have existed since 2009. They state that storing cookies requires your consent (Article 6(1)(a) GDPR). However, responses to these directives still differ widely across EU countries. In Austria, the directive was implemented in Section 96(3) of the Telecommunications Act (TKG). In Germany, the Cookie Directives were not implemented as national law. Instead, the directive was largely implemented in Section 15(3) of the Telemedia Act (TMG).
For strictly necessary cookies, even where no consent is given, legitimate interests (Article 6(1)(f) GDPR) exist and are usually economic in nature. We want to provide visitors with a pleasant user experience, for which certain cookies are often strictly necessary. Cookies that are not strictly necessary are used only with your consent. The legal basis is Article 6(1)(a) GDPR.
The following sections provide more detailed information about the use of cookies where the software used employs them.
Web hosting
Web hosting privacy summary
👥 Data subjects: visitors to the website
🤝 Purpose: professional hosting of the website and safeguarding its operation
📓 Data processed: IP address, time of access, browser and operating system used, address accessed and volume of data transferred (server log files)
📅 Retention period: depends on the provider, generally a few days
⚖️ Legal basis: Article 6(1)(f) GDPR (legitimate interests)
What is web hosting?
When you visit websites, certain information, including personal data, is automatically generated and stored. This also happens on this website. The data is processed as sparingly as possible and only with justification. By website, we mean all web pages on a domain, from the homepage to the last subpage. In this case, the domain is esge.at.
When you view a website on a computer, tablet or smartphone, you use a program called a web browser. The browser requests data from a web server. A web server is the software that delivers the website and runs in a data centre. Data technically necessary to establish the connection is processed automatically.
Why do we process personal data?
The purposes of processing are professional hosting and safeguarding the operation of the website, maintaining operational and IT security, anonymously analysing access behaviour to improve our offering and, where appropriate, pursuing claims.
What data is processed?
Even while you are visiting this website, the web server usually automatically stores data such as the complete web address (URL) of the page accessed, browser and browser version, operating system, address of the previously visited page (referrer URL), host name and IP address of the accessing device, and date and time, in so-called web server log files.
How long is data retained?
The data listed above is generally stored for a few days. It is not passed to third parties unless there is a legal obligation to do so.
Legal basis
The lawfulness of processing personal data for web hosting derives from Article 6(1)(f) GDPR (safeguarding legitimate interests). Professional hosting by a provider is necessary to present the company securely and accessibly on the internet and, where appropriate, to investigate attacks and pursue resulting claims.
Vercel privacy policy
We use Vercel to host and deliver this website. The service provider is the US company Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.
Vercel also processes your data in the USA. We point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can involve various risks to the lawfulness and security of processing.
For processing by recipients based in third countries (outside the European Union, Iceland, Liechtenstein and Norway, particularly the USA), or transfers to them, Vercel uses standard contractual clauses under Article 46(2) and (3) GDPR. Standard Contractual Clauses (SCCs) are templates provided by the European Commission and are intended to ensure that your data complies with European data protection standards even when transferred to and stored in third countries. You can find the decision and the relevant standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.
Further information on data processed through Vercel is available in its privacy policy at https://vercel.com/legal/privacy-policy.
Web analytics privacy summary
👥 Data subjects: visitors to the website
🤝 Purpose: analysing visitor information to optimise the website
📓 Data processed: access statistics containing data such as access locations, device data, duration and time of access, navigation behaviour, click behaviour and IP addresses. More details are provided for the relevant web analytics tool.
📅 Retention period: depends on the web analytics tool used
⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(f) GDPR (legitimate interests)
What is web analytics?
We use software on our website to analyse visitor behaviour, referred to as web analytics. Data is collected and stored, managed and processed by the provider of the analytics tool, also called a tracking tool. The data is used to analyse user behaviour on our website, and the analyses are made available to us as the website operator. Most tools also offer various testing options. For example, we can test which offers or content visitors prefer by showing two different offers for a limited period. After this A/B test, we know which product or content visitors find more interesting. For these tests and other analytics procedures, user profiles may be created and data stored in cookies.
Why do we use web analytics?
Our website has a clear goal: to provide the best online offering in our industry. To achieve this, we want to offer the best and most interesting content and ensure that you feel comfortable using our website. Web analytics tools let us examine visitor behaviour more closely and improve our website for you and for us. For example, we can identify visitors’ average age, where they come from, when the website receives most visits and which content or products are especially popular. This information helps us optimise the website to suit your needs, interests and wishes.
What data is processed?
The exact data stored depends on the analytics tools used. Typically, it includes the content you view, buttons or links you click, when you access a page, the browser you use, the device you use to visit the website (PC, tablet, smartphone and so on) and your computer system. If you have agreed to the collection of location data, the analytics provider may also process it.
Your IP address is also stored. Under the GDPR, IP addresses constitute personal data. However, your IP address is generally stored in pseudonymised form, meaning it is obscured and shortened. For testing, web analytics and web optimisation, direct data such as your name, age, address or email address is generally not stored. If collected, such data is stored in pseudonymised form so that you cannot be identified as an individual.
The following example shows schematically how Google Analytics works as an example of client-side web tracking using JavaScript code. How long the data is retained always depends on the provider. Some cookies store data for only a few minutes or until you leave the website; others can retain it for several years.
Duration of data processing
Where we have further information, we provide details below about the duration of processing. Generally, we process personal data only as long as strictly necessary to provide our services and products. This period may be exceeded where required by law, for example for accounting purposes.
Right to object
You have the right and ability to withdraw consent to the use of cookies or third-party providers at any time, through our cookie management tool or other opt-out functions. You can also prevent data collection through cookies by managing, disabling or deleting them in your browser.
Legal basis
The use of web analytics requires your consent, which we obtained through our cookie pop-up. Under Article 6(1)(a) GDPR (consent), this consent is the legal basis for processing personal data that may be collected by web analytics tools.
In addition to consent, we have a legitimate interest in analysing visitor behaviour to improve our offering technically and economically. Web analytics helps us identify website errors and attacks and improve cost-effectiveness. The legal basis is Article 6(1)(f) GDPR (legitimate interests). Nevertheless, we use these tools only insofar as you have given consent.
As web analytics tools use cookies, we recommend reading our general privacy information about cookies. To learn exactly which data is stored and processed, please read the privacy policies of the relevant tools. Information on specific web analytics tools, where applicable, is provided in the following sections.
Google Analytics privacy policy
Google Analytics privacy summary
👥 Data subjects: visitors to the website
🤝 Purpose: analysing visitor information to optimise the website
📓 Data processed: access statistics containing data such as access locations, device data, duration and time of access, navigation behaviour, click behaviour and IP addresses. Further details are provided below.
📅 Retention period: depends on the properties used
⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(f) GDPR (legitimate interests)
What is Google Analytics?
We use Google Analytics (GA), an analytics and tracking tool from the US company Google Inc., on our website. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for all Google services in Europe. Google Analytics collects data about your actions on our website. For example, when you click a link, the action is stored in a cookie and sent to Google Analytics. The reports we receive help us adapt our website and services to your wishes. Below, we explain the tool in more detail, particularly which data is stored and how you can prevent this.
Google Analytics analyses traffic on our website. To make it work, tracking code is incorporated into the website’s code. When you visit, this code records various actions you take. Once you leave, the data is sent to Google Analytics servers and stored there. Google processes the data and we receive reports on user behaviour. These may include:
Audience reports: these help us get to know our users and understand who is interested in our services. Advertising reports: these make it easier to analyse and improve online advertising.
Acquisition reports: these provide useful information about how to attract more people to our services. Behaviour reports: these show how you interact with our website. We can trace your route through the website and the links you click.
Conversion reports: a conversion is an action you take in response to a marketing message, such as becoming a buyer or newsletter subscriber rather than simply a visitor. These reports help us understand how you respond to our marketing, with the aim of increasing our conversion rate.
Real-time reports: these show us immediately what is happening on our website, such as how many users are reading this text.
Why do we use Google Analytics on our website?
Our goal is to offer you the best possible service. Google Analytics statistics and data help us achieve it. Statistical analysis gives us a clear picture of the website’s strengths and weaknesses. We can optimise the site so that interested people find it more easily on Google. The data also helps us understand visitors better and identify what to improve to provide the best possible service. It also helps us personalise advertising and marketing and make them more cost-effective. After all, it only makes sense to show our products and services to people who are interested in them.
What data does Google Analytics store?
Using tracking code, Google Analytics creates a random, unique ID linked to your browser cookie. This identifies you as a new user. On your next visit, you are recognised as a returning user. All collected data is stored with this user ID, making it possible to analyse pseudonymous user profiles.
To analyse our website, a property ID must be inserted into the tracking code. The data is then stored in that property. Each newly created property is a Google Analytics 4 property by default. Alternatively, a Universal Analytics property can still be created. Data retention periods vary depending on the property used.
Identifiers such as cookies and app instance IDs measure your interactions with our website. Interactions include all types of actions you take. If you also use other Google systems, such as a Google account, data generated through Google Analytics may be linked to third-party cookies. Google does not disclose Google Analytics data unless we, as the website operator, authorise it. Exceptions may apply where legally required.
Google Analytics uses the following cookies:
Name: _ga
Value: 2.1326744211.152112390928-5
Purpose: by default, analytics.js uses the _ga cookie to store the user ID. It mainly distinguishes website visitors.
Expiry: after 2 years
Name: _gid
Value: 2.1687193234.152112390928-1
Purpose: also used to distinguish website visitors
Expiry: after 24 hours
Name: _gat_gtag_UA_<property-id>
Value: 1
Purpose: used to reduce the request rate. If Google Analytics is deployed through Google Tag Manager, this cookie is named _dc_gtm_ <property-id>.
Expiry: after 1 minute
Name: AMP_TOKEN
Value: not specified
Purpose: contains a token that can retrieve a user ID from the AMP Client ID service. Other possible values indicate an opt-out, a request or an error.
Expiry: after 30 seconds to one year
Name: __utma
Value: 1564498958.1564498958.1564498958.1
Purpose: tracks behaviour on the website and measures performance. It is updated whenever information is sent to Google Analytics.
Expiry: after 2 years
Name: __utmt
Value: 1
Purpose: like _gat_gtag_UA_<property-id>, this cookie throttles the request rate.
Expiry: after 10 minutes
Name: __utmb
Value: 3.10.1564498958
Purpose: identifies new sessions. It is updated whenever new data or information is sent to Google Analytics.
Expiry: after 30 minutes
Name: __utmc
Value: 167421564
Purpose: establishes new sessions for returning visitors. This is a session cookie stored only until you close the browser.
Expiry: when the browser closes
Name: __utmz
Value: m|utmccn=(referral)|utmcmd=referral|utmcct=/
Purpose: identifies the source of traffic to our website. It stores where you came from, such as another website or an advertisement.
Expiry: after 6 months
Name: __utmv
Value: not specified
Purpose: stores custom user data. It is updated whenever information is sent to Google Analytics.
Expiry: after 2 years
Note: this list is not exhaustive, as Google changes its selection of cookies from time to time.
The following is an overview of the most important data collected through Google Analytics:
Heatmaps: Google creates heatmaps showing the areas you click, giving us information about where you navigate on our website.
Session duration: Google defines this as the time you spend on our website without leaving. A session ends automatically after 20 minutes of inactivity.
Bounce rate: a bounce occurs when you view only one page and then leave our website.
Account creation: Google Analytics collects data when you create an account or place an order on our website.
IP address: this is displayed only in shortened form, preventing unique identification.
Location: the IP address can determine your country and approximate location, a process known as IP geolocation.
Technical information: this includes your browser type, internet provider and screen resolution.
Referral source: Google Analytics and we are also interested in the website or advertisement through which you reached our site.
Other data includes contact information, any ratings, media playback (such as playing a video through our website), sharing content on social media or adding it to favourites. This list is not exhaustive and provides only a general overview of data storage by Google Analytics.
How long and where is the data stored?
Google has servers around the world. Most are in America, so your data is usually stored on US servers. You can find the locations of Google’s data centres here: https://www.google.com/about/datacenters/locations/?hl=de.
Your data is distributed across various physical storage media. This makes it quicker to retrieve and better protected against tampering. Each Google data centre has appropriate contingency programmes for your data. If hardware fails or natural disasters disable servers, the risk of service interruption at Google remains low.
The retention period depends on the properties used. With the newer Google Analytics 4 properties, the retention period for user data is fixed at 14 months. For other event data, we can choose a retention period of 2 or 14 months.
For Universal Analytics properties, the default retention period for user data is 26 months, after which it is deleted. We can, however, choose the retention period ourselves from five options:
Deletion after 14 months
Deletion after 26 months
Deletion after 38 months
Deletion after 50 months
No automatic deletion
There is also an option to delete data only if you have not returned to our website within the selected period. In that case, the retention period resets each time you revisit within the defined period. Once the period has elapsed, data is deleted once a month. This retention period applies to data linked to cookies, user identifiers and advertising IDs, such as DoubleClick domain cookies. Report results are based on aggregated data and stored independently of user data. Aggregated data combines individual records into a larger whole.
How can I delete my data or prevent its storage?
Under EU data protection law, you have the right to access, update, delete or restrict your data. The browser add-on for disabling Google Analytics JavaScript (ga.js, analytics.js, dc.js) prevents Google Analytics from using your data. You can download and install it at https://tools.google.com/dlpage/gaoptout?hl=de. Please note that this add-on disables only collection by Google Analytics. If you want to disable, delete or manage cookies generally, the “Cookies” section contains links to instructions for common browsers.
Legal basis
Google Analytics requires your consent, which we obtained through our cookie pop-up. Under Article 6(1)(a) GDPR (consent), this is the legal basis for processing personal data that may be collected by web analytics tools. In addition to consent, we have a legitimate interest in analysing visitor behaviour to improve our offering technically and economically. Google Analytics helps us identify website errors and attacks and improve cost-effectiveness. The legal basis is Article 6(1)(f) GDPR (legitimate interests). Nevertheless, we use Google Analytics only insofar as you have given consent.
Google also processes your data in the USA, among other places. We point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for transfers to the USA. This can involve risks to the lawfulness and security of processing.
For processing by recipients in third countries (outside the European Union, Iceland, Liechtenstein and Norway, particularly the USA), or transfers to them, Google uses standard contractual clauses under Article 46(2) and (3) GDPR. Standard Contractual Clauses (SCCs) are templates provided by the European Commission, intended to ensure that your data complies with European standards even when transferred to and stored in third countries such as the USA. Through these clauses, Google undertakes to maintain the European level of protection when processing your relevant data, even if it is stored, processed and managed in the USA. The clauses are based on a European Commission implementing decision. The decision and relevant clauses are available here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.
The Google Ads Data Processing Terms, which refer to the standard contractual clauses, are available at https://business.safety.google/intl/de/adsprocessorterms/.
We hope this explains the most important information about data processing by Google Analytics. To learn more about the tracking service, we recommend these links: https://marketingplatform.google.com/about/analytics/terms/de/ and https://support.google.com/analytics/answer/6004245?hl=de.
Email marketing
👥 Data subjects: newsletter subscribers
🤝 Purpose: direct advertising by email and notifications of system-related events
📓 Data processed: information entered during registration, at least the email address. More details are provided for the relevant email marketing tool.
📅 Retention period: for the duration of the subscription
⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(f) GDPR (legitimate interests)
What is email marketing?
We also use email marketing to keep you informed. If you have agreed to receive our emails or newsletters, your data is processed and stored for this purpose. Email marketing is a part of online marketing in which news or general information about a company, products or services is emailed to a group of interested people.
To participate, usually through a newsletter, you generally only need to register with your email address by completing and submitting an online form. We may also ask for your title and name so that we can address you personally.
Newsletter registration generally uses the “double opt-in” procedure. After registering on our website, you receive an email to confirm your subscription. This ensures that the email address belongs to you and that nobody has registered using someone else’s address. We, or a notification tool we use, log each registration to demonstrate that the registration process complied with the law. We generally store the registration time, confirmation time and your IP address. Changes you make to stored data are also logged.
Why do we use email marketing?
We want to stay in touch and keep you informed of important news about our company. Email marketing, often simply called a newsletter, is therefore an important part of our online marketing. If you agree, or if legally permitted, we send newsletters, system emails or other notifications by email. Below, “newsletter” primarily means regularly sent emails.
We do not want our newsletter to bother you, so we strive to provide only relevant, interesting content. You can learn about our company, services and products. As we continually improve our offering, the newsletter also informs you about news and special, attractive promotions. Where we engage a service provider offering a professional mailing tool, we do so to deliver newsletters quickly and securely. The purpose of email marketing is to inform you about new offers and further our business objectives.
What data is processed?
If you subscribe through our website, you confirm membership of an email list by email. Alongside your IP and email addresses, your title, name, address and telephone number may be stored, but only if you consent. Information marked as required is necessary to participate in the service. Providing it is voluntary, but without it you cannot use the service. Information about your device or preferred website content may also be stored. More information about data storage when visiting a website appears in the “Automatic data storage” section. We record your declaration of consent so that we can demonstrate its compliance with our laws.
Duration of data processing
If you remove your email address from our mailing or newsletter list, we may retain it for up to three years on the basis of legitimate interests to demonstrate your previous consent. We may process this data only where necessary to defend against claims.
If you confirm that you gave consent to subscribe, you may submit an individual deletion request at any time. If you permanently object to consent, we reserve the right to store your email address on a suppression list. We retain your email address for as long as you voluntarily subscribe.
Right to object
You may cancel your subscription at any time by withdrawing your consent. This usually takes only a few seconds or one or two clicks. You will normally find an unsubscribe link at the end of each email. If you cannot find it, please contact us by email and we will cancel the subscription immediately.
Legal basis
Our newsletter is sent on the basis of your consent under Article 6(1)(a) GDPR. We may send it only if you actively subscribed beforehand. Where appropriate, we may also send advertising messages if you have become a customer and have not objected to the use of your email address for direct advertising. Information about specific email marketing services and their processing of personal data, where applicable, is provided in the following sections.
Social media
👥 Data subjects: visitors to the website
🤝 Purpose: presenting and improving our services, contacting visitors and interested parties, and advertising
📓 Data processed: data such as telephone numbers, email addresses, contact information, user behaviour, device information and your IP address. Further details are provided for the relevant social media tool.
📅 Retention period: depends on the social media platforms used
⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(f) GDPR (legitimate interests)
What is social media?
In addition to our website, we are active on various social media platforms. User data may be processed so that we can use social networks to address people interested in us. Elements of a social media platform may also be embedded directly in our website. This occurs, for example, when you click a social button on our website and are taken directly to our social media presence. Social media refers to websites and apps through which registered members can create content, exchange it publicly or in certain groups, and connect with other members.
Why do we use social media?
For years, social media platforms have been places where people communicate and connect online. Our social media presences let us introduce our products and services to interested people. The social media elements embedded in our website help you access our social media content quickly and easily.
The data stored and processed through your use of a social media channel primarily serves web analytics. These analyses aim to develop more precise, personalised marketing and advertising strategies. Depending on your behaviour on a platform, the analysed data can be used to draw conclusions about your interests and create user profiles. This enables platforms to show you tailored advertisements. For this purpose, cookies are generally placed in your browser to store information about usage behaviour.
We generally assume that we remain responsible under data protection law even when using the services of a social media platform. However, the European Court of Justice has ruled that, in certain cases, the platform operator may be jointly responsible with us within the meaning of Article 26 GDPR. Where this applies, we point it out separately and work on the basis of an agreement. The essence of that agreement is then provided below under the relevant platform.
Please note that when using social media platforms or our embedded elements, your data may also be processed outside the European Union, as many channels, such as Facebook and Twitter, are US companies. This may make it harder for you to assert or enforce rights concerning your personal data.
What data is processed?
The exact data stored and processed depends on the platform provider. Usually, it includes telephone numbers, email addresses, information entered in contact forms, user data such as which buttons you click, whom you like or follow, which pages you visit and when, device information and your IP address. Most of this data is stored in cookies. Especially if you have a profile on the channel you visit and are logged in, data may be linked to your profile.
All data collected through a social media platform is also stored on the provider’s servers. Only the providers therefore have access to it and can give you the appropriate information or make changes. To know exactly which data is stored and processed and how to object, read the provider’s privacy policy carefully. We also recommend contacting the provider directly if you have questions about storage or processing or wish to exercise your rights.
Duration of data processing
Where further information is available, we provide it below. For example, Facebook stores data until it is no longer needed for its own purposes. However, customer data matched against its own user data is deleted within two days. Generally, we process personal data only as long as strictly necessary to provide our services and products. This period may be exceeded where legally required, for example for accounting purposes.
Right to object
You may withdraw consent to the use of cookies or third parties, such as embedded social media elements, at any time. You can do this through our cookie management tool or other opt-out functions. You can also prevent collection through cookies by managing, disabling or deleting them in your browser.
As social media tools may use cookies, we recommend reading our general privacy information about cookies. To learn exactly which data is stored and processed, read the privacy policies of the relevant tools.
Legal basis
If you have consented to your data being processed and stored through embedded social media elements, that consent is the legal basis under Article 6(1)(a) GDPR. Where consent exists, your data is also generally stored and processed on the basis of our legitimate interest under Article 6(1)(f) GDPR in fast, effective communication with you or other customers and business partners. Nevertheless, we use the tools only insofar as you have given consent. Most platforms also place cookies in your browser to store data. We therefore recommend reading our cookie privacy information and the relevant provider’s privacy policy or cookie policy.
Information about specific social media platforms, where applicable, is provided in the following sections.
Cookie Consent Management Platform
👥 Data subjects: website visitors
🤝 Purpose: obtaining and managing consent to certain cookies and thus the use of certain tools
📓 Data processed: data for managing cookie settings, such as IP address, time and type of consent, and individual consents. Further details are provided for the relevant tool.
📅 Retention period: depends on the tool; periods of several years should be expected
⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(f) GDPR (legitimate interests)
What is a Cookie Consent Management Platform?
We use Consent Management Platform (CMP) software on our website to make it easier for us and you to handle scripts and cookies correctly and securely. The software automatically creates a cookie pop-up, scans and checks all scripts and cookies, provides the cookie consent required under data protection law and helps us and you keep track of cookies. Most cookie consent management tools identify and categorise all existing cookies. As a visitor, you then decide which scripts and cookies to allow or reject. The following diagram illustrates the relationship between browser, web server and CMP.
Why do we use a cookie management tool?
Our aim is to provide the greatest possible transparency in data protection, which is also a legal obligation. We want to inform you as fully as possible about all tools and cookies that may store and process your data. You also have the right to decide which cookies to accept. To provide this right, we first need to know exactly which cookies are on our website. A cookie management tool regularly scans the website for all cookies, enabling us to identify them and provide GDPR-compliant information. You can then accept or reject them through the consent system.
What data is processed?
Our cookie management tool lets you manage each cookie yourself and gives you full control over the storage and processing of your data. Your declaration of consent is stored so that we do not have to ask again on every visit and can demonstrate your consent if legally required. It is stored either in an opt-in cookie or on a server. Retention varies by provider. This data, such as a pseudonymous user ID, consent time, details of cookie categories or tools, browser and device information, is usually stored for up to two years.
Duration of data processing
Where further information is available, we provide details below. Generally, we process personal data only as long as strictly necessary to provide our services and products. Data stored in cookies is retained for varying periods. Some cookies are deleted as soon as you leave the website, while others may remain in your browser for several years. The exact duration depends on the tool used; generally, you should expect a retention period of several years. The individual providers’ privacy policies usually provide precise details.
Right to object
You can withdraw your consent to cookies at any time through our cookie management tool or other opt-out functions. You can also prevent cookie-based collection by managing, disabling or deleting cookies in your browser. Information on specific cookie management tools, where applicable, is provided in the following sections.
Legal basis
If you consent to cookies, personal data is processed and stored through them. Where we may use cookies based on your consent under Article 6(1)(a) GDPR, this is also the legal basis for using the cookies and processing your data. Cookie Consent Management Platform software is used to manage and enable consent. It lets us operate the website efficiently in compliance with the law, constituting a legitimate interest under Article 6(1)(f) GDPR.
Audio & video
👥 Data subjects: visitors to the website
🤝 Purpose: improving our services
📓 Data processed: contact information, user behaviour, device information and your IP address may be stored. Further details are provided in the relevant privacy sections below.
📅 Retention period: data is generally retained as long as needed for the service’s purpose
⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(f) GDPR (legitimate interests)
What are audio and video elements?
We have embedded audio or video elements so that you can watch videos or listen to music or podcasts directly on our website. The content is supplied by service providers and retrieved from their servers. These are embedded functional elements from platforms such as YouTube, Vimeo or Spotify. These services are generally free, although paid content may also be published. The embedded elements allow you to listen to or watch the content on our website. When you use them, your personal data may be transmitted to, processed and stored by the providers.
Why do we use audio and video elements?
We want to offer the best possible website experience and recognise that content is no longer communicated only through text and static images. Instead of simply linking to a video, we provide audio and video formats directly on our website that are entertaining, informative or ideally both. This expands our service and makes interesting content easier to access. We therefore offer video and/or audio content alongside text and images.
What data is stored by audio and video elements?
When you access a page containing, for example, an embedded video, your server connects to the service provider’s server. Your data is transmitted to the third party and stored there. Some data is collected and stored regardless of whether you have an account with the provider. This generally includes your IP address, browser type, operating system and other general information about your device. Most providers also collect information about your web activity, such as session duration, bounce rate, buttons clicked and the website through which you use the service. This information is usually stored through cookies or pixel tags, also called web beacons. Pseudonymised data is generally stored in browser cookies. The provider’s privacy policy explains exactly which data is stored and processed.
Duration of data processing
The exact period for which data is stored on third-party servers is described below in the relevant tool’s privacy information or in the provider’s privacy policy. In principle, personal data is processed only as long as strictly necessary to provide our services or products. This generally also applies to third parties. You can usually expect some data to remain on their servers for several years. Cookie retention periods in particular vary: some cookies are deleted when you leave the website, while others may remain in your browser for several years.
Right to object
You may withdraw consent to cookies or third-party providers at any time through our cookie management tool or other opt-out functions. You can also prevent cookie-based collection by managing, disabling or deleting cookies in your browser. Withdrawal does not affect the lawfulness of prior processing.
Because embedded audio and video functions generally use cookies, please also read our general cookie privacy information. The relevant third parties’ privacy policies provide more details about the handling and storage of your data.
Legal basis
If you have consented to your data being processed and stored through embedded audio and video elements, this is the legal basis under Article 6(1)(a) GDPR. Your data is also generally stored and processed on the basis of our legitimate interest under Article 6(1)(f) GDPR in fast, effective communication with you or other customers and business partners. Nevertheless, we use embedded audio and video elements only insofar as you have given consent.
YouTube privacy policy
👥 Data subjects: visitors to the website
🤝 Purpose: improving our services
📓 Data processed: contact information, user behaviour, device information and your IP address may be stored. More details are provided below.
📅 Retention period: data is generally retained as long as needed for the service’s purpose
⚖️ Legal bases: Article 6(1)(a) GDPR (consent), Article 6(1)(f) GDPR (legitimate interests)
What is YouTube?
We have embedded YouTube videos on our website to present interesting videos directly on our pages. YouTube is a video portal that has been a Google subsidiary since 2006. It is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you access a page with an embedded YouTube video, your browser automatically connects to YouTube or Google servers. Depending on the settings, various data is transmitted. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for all processing in Europe.
Below, we explain which data is processed, why we embed YouTube videos and how you can manage or delete your data. On YouTube, users can watch, rate, comment on and upload videos free of charge. Over recent years, YouTube has become one of the most important social media channels worldwide. To display videos on our website, YouTube provides a code snippet that we have embedded.
Why do we use YouTube videos?
YouTube is the video platform with the most visitors and the best content. We strive to offer the best possible user experience, and interesting videos are part of that. Our embedded videos provide useful content alongside our text and images. Embedded videos also make our website easier to find through Google Search. If we run advertisements through Google Ads, the collected data also lets Google show them only to people interested in our offers.
What data does YouTube store?
As soon as you visit one of our pages containing a YouTube video, YouTube sets at least one cookie storing your IP address and our URL. If you are logged into your YouTube account, YouTube can usually use cookies to link your interactions with our website to your profile. These include session duration, bounce rate, approximate location and technical information such as browser type, screen resolution and internet provider. Other data may include contact information, ratings, sharing content on social media and adding items to your YouTube favourites.
If you are not logged into a Google or YouTube account, Google stores data with a unique identifier linked to your device, browser or app. This preserves settings such as your preferred language. However, many interactions cannot be stored because fewer cookies are set.
The following list shows cookies set in a browser test, both without a logged-in YouTube account and with one. It is not exhaustive, as user data always depends on interactions with YouTube.
Name: YSC
Value: b9-CV6ojI5Y112390928-1
Purpose: records a unique ID to store statistics about the video watched
Expiry: at the end of the session
Name: PREF
Value: f1=50000000
Purpose: also records your unique ID. PREF gives Google statistics on how you use YouTube videos on our website.
Expiry: after 8 months
Name: GPS
Value: 1
Purpose: records your unique ID on mobile devices to track GPS location
Expiry: after 30 minutes
Name: VISITOR_INFO1_LIVE
Value: 95Chz8bagyU
Purpose: estimates user bandwidth on our pages containing YouTube videos
Expiry: after 8 months
Additional cookies set when you are logged into your YouTube account:
Name: APISID
Value: zILlvClZSkqGsSwI/AU1aZI6HY7112390928-
Purpose: creates a profile of your interests for personalised advertising
Expiry: after 2 years
Name: CONSENT
Value: YES+AT.de+20150628-20-0
Purpose: stores a user’s consent status for different Google services. CONSENT also supports security by verifying users and protecting their data against unauthorised attacks.
Expiry: after 19 years
Name: HSID
Value: AcRwpgUik9Dveht0I
Purpose: creates a profile of your interests to help display personalised advertising
Expiry: after 2 years
Name: LOGIN_INFO
Value: AFmmF2swRQIhALl6aL…
Purpose: stores information about your login details
Expiry: after 2 years
Name: SAPISID
Value: 7oaPxoG-pZsJuuF5/AnUdDUIsJ9iJz2vdM
Purpose: uniquely identifies your browser and device to create a profile of your interests
Expiry: after 2 years
Name: SID
Value: oQfNKjAsI112390928-
Purpose: stores your Google account ID and most recent login time in digitally signed and encrypted form
Expiry: after 2 years
Name: SIDCC
Value: AN0-TYuqub2JOcDTyL
Purpose: stores information about how you use the website and which advertisements you may have seen before visiting our site
Expiry: after 3 months
How long and where is the data stored?
Data received and processed by YouTube is stored on Google servers. Most are in America. Their locations are listed at https://www.google.com/about/datacenters/locations/?hl=de. Your data is distributed across servers to make it faster to retrieve and better protected against tampering.
Google retains collected data for different periods. Some data can be deleted at any time, some is deleted automatically after a limited period, and some is retained for longer. Certain data stored in your Google account, such as items from “My Activity”, photos, documents and products, remains until you delete it. Even without a Google account, you can delete some data linked to your device, browser or app.
How can I delete my data or prevent storage?
You can generally delete data manually in your Google account. The automatic deletion function for location and activity data introduced in 2019 stores information for either 3 or 18 months, depending on your choice, and then deletes it.
Whether or not you have a Google account, you can configure your browser to delete or disable Google cookies. The procedure varies by browser. The “Cookies” section contains links to instructions for common browsers. If you do not want cookies at all, you can set your browser to notify you whenever a cookie is to be set, allowing you to decide on each one.
Legal basis
If you have consented to your data being processed and stored through embedded YouTube elements, this is the legal basis under Article 6(1)(a) GDPR. Your data is also generally stored and processed on the basis of our legitimate interest under Article 6(1)(f) GDPR in fast, effective communication with you or other customers and business partners. Nevertheless, we use embedded YouTube elements only insofar as you have given consent. YouTube also places cookies in your browser to store data. We therefore recommend reading our cookie privacy information and the provider’s privacy policy or cookie policy.
YouTube also processes data in the USA, among other places. We point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for transfers to the USA. This can involve risks to the lawfulness and security of processing. For processing by recipients in third countries (outside the European Union, Iceland, Liechtenstein and Norway, particularly the USA), or transfers to them, YouTube uses European Commission-approved standard contractual clauses under Article 46(2) and (3) GDPR. These require YouTube to maintain EU data protection standards when processing relevant data outside the EU. They are based on a European Commission implementing decision. The decision and clauses are available here, among other places: https://germany.representation.ec.europa.eu/index_de.
As YouTube is a Google subsidiary, they share a privacy policy. For more information about how your data is handled, we recommend https://policies.google.com/privacy?hl=de.
Explanation of terms used
We strive to make this privacy policy as clear and understandable as possible. This is not always easy, particularly with technical and legal subjects. It often makes sense to use legal terms, such as personal data, or technical expressions, such as cookies and IP addresses. We would like to explain them. Below is an alphabetical list of important terms that may not yet have been explained sufficiently. Where definitions come from the GDPR, we include the GDPR text and, where appropriate, our own explanation.
Consent
Definition under Article 4 GDPR
For the purposes of this Regulation:
“consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
Explanation: on websites, consent is generally given through a cookie consent tool. You are probably familiar with this: when you first visit a website, a banner usually asks whether you agree to data processing. You can often adjust individual settings and decide which processing to allow. If you do not consent, your personal data may not be processed. Consent can, of course, also be given in writing rather than through a tool.
Personal data
Definition under Article 4 GDPR
For the purposes of this Regulation:
“personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Explanation: personal data is all data that can identify you as an individual. This generally includes your name, address, email address, postal address, telephone number, date of birth, identification numbers such as social security number, tax identification number, identity card number or student number, and banking information such as account numbers, credit information and account balances.
According to the European Court of Justice (ECJ), your IP address also constitutes personal data. IT specialists can use it to establish at least the approximate location of your device and, subsequently, identify you as the connection holder. Storing an IP address therefore also requires a legal basis under the GDPR.
There are also “special categories” of personal data requiring particular protection. These include racial and ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data such as information obtained from blood or saliva samples, biometric data (information about psychological, physical or behavioural characteristics that can identify a person), health data, and data concerning sexual orientation or sex life.
Profiling
Definition under Article 4 GDPR
For the purposes of this Regulation:
“profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
Explanation: profiling brings together different information about a person to learn more about them. Online, it is often used for advertising or credit checks. Web or advertising analytics programs collect information about your behaviour and interests on a website. This creates a specific user profile that can be used to target advertising to a particular audience.
Closing remarks
If you have questions about data protection, please contact sebastian@esge.at.
All texts are protected by copyright.
Source: created with the Privacy Policy Generator by AdSimple.
ESGE newsletter
If you subscribe to the ESGE newsletter, we process your email address and consent to send information about brand management, projects and related offers approximately four times a year. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw it at any time using the unsubscribe link in each edition or by emailing sebastian@esge.at. Withdrawal does not affect the lawfulness of prior processing.
We use Brevo to manage subscriptions and send the newsletter. When you submit the form, its data is transferred to Brevo. Brevo processes data on our behalf for delivery and may also process data independently for platform security. See Brevo’s privacy policy for details. We use your address for the newsletter until you unsubscribe. Consent records and necessary suppression records may be retained afterwards to document consent and prevent further mailings.