Privacy policy

A

This privacy policy explains the nature, scope and purpose of the processing of personal data within our online offering and the websites, features and content associated with it (together referred to as the “online offering” or “website”). The privacy policy applies regardless of the domains, systems, platforms and devices (e.g. desktop or mobile) used to access the online offering.

B

Terms such as “personal data” or “processing” refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).

C

Personal data of users processed in connection with this online offering may include: master data (names, addresses), contact data (email, phone numbers, fax), usage data (interests, pages visited, access times), and meta/communication data (device IDs, IP addresses).

D

The term “user” covers all categories of data subjects affected by the processing. This includes: customers, prospects, users, website visitors, and recipients of marketing measures. Terms such as “user” are used in a gender-neutral sense.

E

We process users’ personal data only in compliance with applicable data protection law. This means user data is processed only where a legal basis exists—in particular where processing is necessary for the performance of our contractual services (e.g. processing orders) and online services or is required by law, where users have given consent, or on the basis of our legitimate interests (i.e. interest in analysing, optimising and operating our online offering securely within the meaning of Article 6(1)(f) GDPR), in particular for reach measurement, creating profiles for advertising and marketing purposes, collecting access data, and using third-party services. If a user has not yet reached the age of sixteen, consent to data processing must be given by the holder of parental responsibility or with their consent.

F

We note that the legal basis for consent is Article 6(1)(a) and Article 7 GDPR, and for minors Article 8 GDPR; the legal basis for processing for the performance of our services and contractual measures is Article 6(1)(b) GDPR; for processing to comply with legal obligations Article 6(1)(c) GDPR; and for processing based on our legitimate interests Article 6(1)(f) GDPR.

A

Under Article 15 GDPR, to obtain confirmation as to whether we process your personal data and, where that is the case, access to that data. In particular, you may obtain information about the purposes of processing, the categories of personal data, the categories of recipients to whom your data have been or will be disclosed, the envisaged retention period, the existence of the right to rectification, erasure, restriction of processing or objection, the right to lodge a complaint, the source of your data where not collected from us, and the existence of automated decision-making including profiling and meaningful information about the logic involved.

B

Under Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data or completion of incomplete personal data stored by us.

C

Under Article 17 GDPR, to obtain the erasure of personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

D

Under Article 18 GDPR, to obtain restriction of processing where you contest the accuracy of the data, processing is unlawful but you oppose erasure and we no longer need the data but you require them for legal claims, or you have objected to processing under Article 21 GDPR.

E

Under Article 20 GDPR, to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format or to have it transmitted to another controller.

F

Under Article 7(3) GDPR, to withdraw your consent at any time. This means we may no longer continue processing based on that consent in the future.

G

Under Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority of your habitual residence, place of work or our registered office.

Where your personal data are processed on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object to processing under Article 21 GDPR on grounds relating to your particular situation or where the objection relates to direct marketing. In the latter case you have a general right to object which we will honour without you having to specify a particular situation.

A

We implement organisational, contractual and technical security measures in line with the state of the art to ensure compliance with data protection laws and to protect the data we process against accidental or unlawful manipulation, loss, destruction or access by unauthorised persons.

B

Security measures include in particular encrypted transmission of data between your browser and our server.

A

Data are disclosed to third parties only within the limits of the law. We pass users’ data to third parties only where this is required for contractual purposes under Article 6(1)(b) GDPR, for example, or on the basis of legitimate interests under Article 6(1)(f) GDPR for the economic and efficient operation of our business.

B

Where we use subprocessors to provide our services, we take appropriate legal precautions and technical and organisational measures to ensure the protection of personal data in accordance with applicable law.

C

Where this privacy policy refers to content, tools or other means provided by other providers (together “third-party providers”) whose registered office is in a third country, data may be transferred to the country in which those providers are established. Third countries are countries in which the GDPR does not apply directly—generally countries outside the EU or European Economic Area. Data are transferred to third countries only where an adequate level of data protection, user consent or another legal permission exists.

A

We process inventory data (e.g. names, addresses and contact details of users), contract data (e.g. services used, contact persons, payment information) for the performance of our contractual obligations and services under Article 6(1)(b) GDPR.

B

When users register, log in again or use our online services, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests and those of users in protection against misuse and other unauthorised use. These data are not generally disclosed to third parties unless required to pursue our claims or where we are legally obliged to do so under Article 6(1)(c) GDPR.

A

When you contact us (via contact form or email), your details are processed to handle and complete your request under Article 6(1)(b) GDPR or, where you have given voluntary consent, under Article 6(1)(a) GDPR. Personal data collected via our contact form and data you send by email are erased once they are no longer needed for the purpose for which they were collected.

B

Users’ details are stored in our customer relationship management (“CRM”) system HubSpot. See the “HubSpot” section for details.

A

On the basis of our legitimate interests within the meaning of Article 6(1)(f) GDPR, we collect data about each access to the server on which this service is hosted (so-called server log files). Access data include the name of the retrieved page, file, date and time of retrieval, amount of data transferred, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.

B

Log file information is stored for security reasons (e.g. to clarify misuse or fraud) for a maximum of 14 days and then deleted. Data that must be retained longer for evidentiary purposes are exempt from deletion until the respective incident has been finally resolved.

A

Cookies are information transmitted from our web server or third-party servers to users’ web browsers and stored there for later retrieval. Cookies may be small files or other types of information storage.

B

We use “session cookies”, which are stored only for the duration of the current visit to our online presence (e.g. to enable login state or shopping cart functionality). A session cookie stores a randomly generated unique identifier, a session ID. The cookie also indicates its origin and retention period. These cookies cannot store other data. Session cookies are deleted when you end use of our online offering, e.g. by logging out or closing the browser.

C

Use of cookies for pseudonymous reach measurement is explained in this privacy policy.

D

On your first visit we ask for your consent via a cookie banner. Services in the “Statistics & marketing” category (Google Tag Manager, Google Analytics, Microsoft Clarity, OpenAI Ads Pixel, SalesViewer and HubSpot tracking) are only loaded once you choose “Accept all”. Without this consent, embedded YouTube videos are only loaded when you click the respective video. We store your choice in the cookie “ih_consent” for 180 days; the legal basis for this technically necessary cookie is Section 25(2) no. 2 TDDDG. When we add new services to this category, we ask for your consent again. You can change or withdraw your choice at any time via “Change selection” under “Cookie settings” at the top of this page.

E

If you do not wish cookies to be stored on your device, please disable the relevant option in your browser settings. Stored cookies can be deleted in the browser settings. Disabling cookies may limit the functionality of this online offering.

F

You may opt out of cookies used for reach measurement and advertising via the Network Advertising Initiative opt-out page and the US or European sites listed below.

A

If you consent to the “Statistics & marketing” category in our cookie banner, we use services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”): Google Tag Manager, which we use to manage analytics and marketing tags on our website, the web analytics service Google Analytics 4 and, where we run ads with Google, Google Ads conversion tracking. The legal basis is your consent under Article 6(1)(a) GDPR. Without your consent, these services are not loaded.

B

Google Analytics evaluates pseudonymously how our website is used, e.g. which pages are viewed, how long a visit lasts, which source brought you to us (including AI search services such as ChatGPT or Perplexity) and whether you submit a contact form or click a booking link. Google Ads conversion tracking lets us measure whether a visit or an enquiry resulted from one of our ads. Google sets cookies for this (e.g. “_ga”, stored for up to two years). Google Analytics 4 does not store IP addresses.

C

Data may be transferred to servers of Google LLC in the USA. Google LLC is certified under the EU–US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision under Article 45 GDPR.

D

You may withdraw your consent at any time via our cookie banner or reset it to “Necessary only”. You can also prevent collection by Google Analytics with Google’s browser add-on:

E

Further information on Google’s data processing and on settings and opt-out options is available on Google’s websites:

A

If you consent to the “Statistics & marketing” category in our cookie banner, we use Microsoft Clarity, an analytics and session-recording service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”). The legal basis is your consent under Article 6(1)(a) GDPR. Without your consent, Clarity is not loaded.

B

Clarity allows us to analyse user behaviour on our website (e.g. heatmaps, scroll depth and anonymised session recordings). In particular, device and browser information, interactions on the page and pseudonymous identifiers may be processed and transmitted to Microsoft servers (including in the USA). Microsoft may set cookies or similar technologies.

C

You may withdraw your consent at any time via our cookie banner or reset it to “Necessary only”. Further information on Microsoft Clarity’s data processing is available in Microsoft’s privacy statement:

A

If you consent to the “Statistics & marketing” category in our cookie banner, we use OpenAI’s Measurement Pixel, a service provided by OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (“OpenAI”). The legal basis is your consent under Article 6(1)(a) GDPR. Without your consent, the pixel is not loaded.

B

The pixel lets us measure whether visits and enquiries on our website result from our ads in ChatGPT (conversion measurement). In particular, the pages you view, the fact that a contact enquiry was submitted or a booking link was clicked (without the content of your enquiry), device and browser information and pseudonymous identifiers are transmitted to OpenAI servers. For this, OpenAI sets the cookies “__oppref” (stored for 30 days, identifier of an ad click) and “__obref” (stored for 365 days, browser identifier). A transfer to third countries, in particular the USA, cannot be ruled out; OpenAI relies on appropriate safeguards such as the EU Standard Contractual Clauses.

C

You may withdraw your consent at any time via our cookie banner or reset it to “Necessary only”; the pixel then stops sending data and deletes its cookies. Further information on OpenAI’s data processing is available in OpenAI’s privacy policy:

A

If you consent to the “Statistics & marketing” category in our cookie banner, we use the technology of SalesViewer® GmbH, Universitätsstraße 60, 44789 Bochum, Germany (“SalesViewer”). The legal basis is your consent under Article 6(1)(a) GDPR. Without your consent, SalesViewer is not loaded.

B

SalesViewer evaluates the IP address of a visit to recognise whether it comes from a company, and shows us the company name and the pages viewed. This tells us which companies are interested in our services. According to SalesViewer, the data are hashed and pseudonymised and are not used to identify individual persons.

C

You may withdraw your consent at any time via our cookie banner or reset it to “Necessary only”. Further information is available in SalesViewer’s privacy policy:

A

For our contact, newsletter and download forms and for handling enquiries, we use HubSpot, software provided by HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland, a subsidiary of HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA (“HubSpot”). Our data are stored in HubSpot’s data centre in the EU. HubSpot processes the data on our behalf (Article 28 GDPR).

B

When you submit a form, we transmit your details (e.g. name, email address, company and message) to HubSpot. The legal basis for enquiries is Article 6(1)(b) GDPR; for the newsletter it is your consent under Article 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time via the link in every email. Together with the form, we transmit the details on the origin of your visit described in the section “Storage of campaign parameters” and, if present, the HubSpot cookie “hubspotutk”.

C

If you consent to the “Statistics & marketing” category in our cookie banner, we also load HubSpot’s tracking code (Article 6(1)(a) GDPR). It sets cookies (e.g. “hubspotutk” and “__hstc”) and records which pages you view, so that we can link a later enquiry to your previous visit.

D

A transfer to HubSpot, Inc. in the USA cannot be ruled out. HubSpot, Inc. is certified under the EU–US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition. You may withdraw your consent to tracking at any time via our cookie banner. Further information is available in HubSpot’s privacy policy:

A

If you reach our website via an ad or a campaign link, the address often contains identifiers such as “gclid”, “gbraid” or “wbraid” (Google Ads), “msclkid” (Microsoft Advertising), “fbclid” (Meta) or UTM parameters (e.g. “utm_source”, “utm_campaign”). We store these parameters, together with the first page you visited and the referring website, in your browser’s local storage (“localStorage”, entry “ih_attribution”) for up to 90 days. The data stay in your browser as long as you do not submit a form.

B

Only when you submit a contact, newsletter or download form do we transmit these details to HubSpot together with your enquiry. This shows us which campaign led to an enquiry, and lets us report this back to the respective advertising platform so that we can optimise our advertising for actual enquiries rather than mere clicks. The legal basis is our legitimate interest in measuring the success of our advertising (Article 6(1)(f) GDPR).

C

You can remove the entry at any time by clearing the website data in your browser. You may also object to the processing under Article 21 GDPR, e.g. by email to us.

A

On our “POS packaging” page you can upload a logo and have it assessed by an AI. Your browser downscales the image and sends it to our server. From there we transmit it to Langdock GmbH, Greifswalder Str. 212, 10405 Berlin, Germany (“Langdock”), which evaluates it on our behalf (Article 28 GDPR) via its EU endpoint using an AI language model (currently Claude by Anthropic) and returns the assessment to us.

B

The image is processed only for the duration of the assessment and is neither stored nor logged by us. To prevent misuse, we limit the number of assessments per IP address. For this, the IP address is held only in our server’s working memory, is not stored permanently and is discarded at the latest when the server next restarts. The legal basis is carrying out the assessment you requested (Article 6(1)(b) GDPR) and our legitimate interest in protecting the service against misuse (Article 6(1)(f) GDPR).

C

Please upload logos only and no images in which people can be recognised.

A

Within our online offering, on the basis of our legitimate interests (i.e. interest in analysing, optimising and operating our online offering within the meaning of Article 6(1)(f) GDPR), we use content or service offerings from third-party providers to embed their content and services, such as videos (together “content”). This always requires that the third-party providers of this content can see users’ IP addresses, because they could not send the content to the user’s browser without the IP address. The IP address is therefore required to display this content.

We endeavour to use only content whose providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on this website. Pseudonymous information may also be stored in cookies on users’ devices and may include technical information about the browser and operating system, referring websites, visit time and further information on use of our online offering, and may be combined with such information from other sources.

B

The overview below lists third-party providers and their content with links to their privacy policies, which contain further information on data processing and, in part, opt-out options already mentioned here:

Fonts: the fonts used on our website are hosted locally on our server. No connection to servers of Google or other font providers is made when you visit our website.

Videos from the YouTube platform of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We embed videos in privacy-enhanced mode (“youtube-nocookie.com”). Without your consent to the “Statistics & marketing” category, a video is only loaded when you click it; only then is a connection to YouTube made and YouTube may set cookies. The legal basis is your consent (Article 6(1)(a) GDPR).

Links to Google Maps (e.g. for location details) only open Google Maps in a new window after you click them; Google Maps is not embedded on our website itself.

A

Data stored by us are deleted as soon as they are no longer required for their purpose and no statutory retention obligations prevent deletion. If data are not deleted because they are required for other lawful purposes, processing is restricted—the data are blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

B

By law, retention is for six years under Section 257(1) of the German Commercial Code (HGB) (commercial books, inventories, opening balances, annual accounts, commercial correspondence, accounting records, etc.) and for ten years under Section 147(1) of the German Fiscal Code (AO) (books, records, management reports, accounting records, commercial and business letters, tax-relevant documents, etc.).

A

We may amend this privacy policy to reflect changes in the legal situation or to the service and data processing. This applies only to statements on data processing. Where user consent is required or provisions of the privacy policy form part of the contractual relationship with users, changes will be made only with users’ consent.

B

Users are asked to inform themselves regularly about the content of this privacy policy.