Privacy Policy

1. Information on the collection of personal data

This privacy policy describes how we collect, use and disclose your personal data when you use our website and our software. In this way, we wish to inform you about our processing operations and to comply with our legal obligations, in particular under the EU General Data Protection Regulation (GDPR).

Personal data is any data that can be related to you personally, such as your name, your e-mail address, your telephone number, your contract and payment data, and your usage behavior on this website.

The controller within the meaning of Art. 4(7) GDPR is:

Pulse Technologies GmbH
Augustenstraße 87
80798 München
Germany

Persons authorized to represent the company: Alexander Baule, Kolja Schmid

E-mail address: info@medipulse.de

Contact person for data protection matters: Kolja Schmid, reachable at info@medipulse.de.

Legal notice: www.medipulse.de/en/legal-notice

2. Overview of processing operations

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects concerned.

Types of data processed

• Master data (e.g., names, addresses).
• Contact data (e.g., e-mail addresses, telephone numbers).
• Content data (e.g., entries in online forms).
• Usage data (e.g., page views and time spent on pages, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features).
• Meta, communication and process data (e.g., IP addresses, time information, identification numbers, persons involved).
• Contract data (e.g., subject matter of the contract, term, customer category).

Categories of data subjects

• Service recipients and clients.
• Prospective customers.
• Communication partners.
• Users (e.g., website visitors, users of online services).
• Business and contractual partners.

Purposes of processing

• Provision of contractual services and fulfillment of contractual obligations.
• Communication.
• Security measures.
• Reach measurement (e.g., access statistics, recognition of returning visitors).
• Tracking (e.g., interest-/behavior-based profiling, use of cookies).
• Audience building.
• Conversion measurement (measurement of the effectiveness of marketing measures).
• Marketing.
• Direct marketing (e.g., by e-mail or by post).
• Office and organizational procedures.
• Organizational and administrative procedures.
• Profiles with user-related information.
• Provision of our online offering and user-friendliness.
• Information technology infrastructure.
• Business processes and business management procedures.

3. Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or registered office. Should, furthermore, more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6(1) sentence 1(a) GDPR) - The data subject has given consent to the processing of personal data concerning them for one specific purpose or several specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1(b) GDPR)- Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6(1) sentence 1(c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1) sentence 1(f) GDPR) - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that the interests, fundamental rights and fundamental freedoms of the data subject which require protection of personal data do not override them.

National data protection regulations in Germany

In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include in particular the Act on Protection against Misuse of Personal Data in Data Processing (German Federal Data Protection Act – BDSG). The BDSG contains in particular special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated individual decision-making, including profiling. Furthermore, the state data protection laws of the individual federal states may apply.

Note on the applicability of the GDPR and the Swiss DSG

These data protection notices serve to provide information both under the Swiss Federal Act on Data Protection (DSG) and under the General Data Protection Regulation (GDPR). For this reason, we ask you to note that, owing to their broader territorial application and comprehensibility, the terms of the GDPR are used. In particular, instead of the terms used in the Swiss DSG, "Bearbeitung" (handling) of "Personendaten" (personal data), "überwiegendes Interesse" (overriding interest) and "besonders schützenswerte Personendaten" (particularly sensitive personal data), the terms used in the GDPR, "processing" of "personal data" as well as "legitimate interest" and "special categories of data", are used. The legal meaning of the terms is, however, within the scope of application of the Swiss DSG, still determined in accordance with the Swiss DSG.

4. Your rights

Rights of data subjects under the GDPR: As a data subject, you are entitled under the GDPR to various rights, which arise in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw consent given at any time.
• Right of access: You have the right to request confirmation as to whether the data in question is being processed and to access to this data as well as to further information and a copy of the data in accordance with the statutory requirements.
• Right to rectification: In accordance with the statutory requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
• Right to erasure and restriction of processing: In accordance with the statutory requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, in accordance with the statutory requirements, to request a restriction of the processing of the data.
• Right to data portability: You have the right to receive data concerning you which you have provided to us, in accordance with the statutory requirements, in a structured, commonly used and machine-readable format, or to request its transmission to another controller.
• Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the requirements of the GDPR.
• Protection against automated decisions: In accordance with the statutory requirements, you have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

To exercise these rights, as well as for an objection or the withdrawal of consent, a message to info@medipulse.de is sufficient.

5. Data security

In accordance with the statutory requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access relating to it, input, disclosure, securing of availability and its separation. Furthermore, we have established procedures that ensure the exercise of data subject rights, the erasure of data and responses to threats to the data. Furthermore, we already take the protection of personal data into account during the development or selection of hardware, software and procedures in accordance with the principle of data protection by design and by data protection-friendly default settings.

6. Objection to or withdrawal from data processing

If you have consented to the processing of your data, you may withdraw this consent at any time. The withdrawal takes effect from the time at which you notify us of it and concerns the future processing of your data. The lawfulness of the processing up until your withdrawal remains unaffected.

Insofar as we process your personal data on the basis of a balancing of interests, you may object to this processing. We carry out a balancing of interests in particular where we rely on legitimate interests pursuant to Art. 6(1) sentence 1(f) GDPR. Please state in your objection the reasons for which you oppose the processing, so that we can carry out the balancing anew.

You may object at any time to the processing of your personal data for direct marketing purposes and the associated data analysis, without any need to give reasons (Art. 21(2) GDPR).

For an objection or a withdrawal, a message to info@medipulse.de is sufficient. For cookies and the analytics and marketing services based on them, you can also change your decision at any time via the cookie settings on this website.

7. Storage period of your personal data

We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consents are withdrawn or no further legal bases for the processing exist. This applies to cases in which the original purpose of processing ceases to apply or the data is no longer required. Exceptions to this rule exist where statutory obligations or special interests require longer retention or archiving of the data. In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for the pursuit of legal claims or for the protection of the rights of other natural or legal persons, must be archived accordingly. Our data protection notices contain additional information on the retention and deletion of data that applies specifically to certain processing operations.

Where there are several indications of the retention period or deletion periods for an item of data, the longest period always prevails. If a period does not expressly begin on a specific date and amounts to at least one year, it starts automatically at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in the course of which data is stored, the event triggering the period is the time at which the termination or other ending of the legal relationship takes effect. Data that is no longer retained for the originally intended purpose but on the basis of statutory requirements or other reasons is processed by us exclusively for the reasons that justify its retention.

Further information on processing operations, procedures and services:

Retention and deletion of data: The following general periods apply to retention and archiving under German law:

• 10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheet as well as the work instructions and other organizational documents required for their understanding, accounting vouchers and invoices (Section 147(3) in conjunction with (1) nos. 1, 4 and 4a of the German Fiscal Code (AO), Section 14b(1) of the German VAT Act (UStG), Section 257(1) nos. 1 and 4, (4) of the German Commercial Code (HGB)).
• 6 years - Other business documents: commercial or business letters received, copies of commercial or business letters sent, other documents insofar as they are relevant for taxation, e.g., hourly wage slips, operating accounting sheets, calculation documents, price markings, but also payroll documents insofar as they are not already accounting vouchers, and till receipts (Section 147(3) in conjunction with (1) nos. 2, 3, 5 AO, Section 257(1) nos. 2 and 3, (4) HGB).
• 3 years - Data required to take into account potential warranty and damages claims or similar contractual claims and rights, and to process related inquiries, based on previous business experience and customary industry practices, is stored for the duration of the regular statutory limitation period of three years (Sections 195, 199 of the German Civil Code (BGB)).

8. Data processing by third parties

In the course of our processing of personal data, it may occur that such data is transmitted to other bodies, companies, legally independent organizational units or persons, or disclosed to them. The recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are embedded in a website. In such cases, we observe the statutory requirements and in particular conclude appropriate contracts or agreements serving the protection of your data with the recipients of your data.

9. International data transfers

Data processing in third countries: If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if the processing takes place in the context of using third-party services or the disclosure or transmission of data to other persons, bodies or companies, this is done only in accordance with the statutory requirements. If the level of data protection in the third country has been recognized by means of an adequacy decision (Art. 45 GDPR), this serves as the basis for the data transfer. Otherwise, data transfers take place only if the level of data protection is otherwise ensured, in particular by Standard Contractual Clauses (SCCs) (Art. 46(2)(c) GDPR), explicit consent or in the case of a contractually or legally required transfer (Art. 49(1) GDPR). Furthermore, we inform you of the bases of the third-country transfer for the individual providers from the third country, with the adequacy decisions taking precedence as bases. Information on third-country transfers and existing adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en. Within the framework of the so-called "Data Privacy Framework" (DPF), the EU Commission has likewise recognized the level of data protection for certain companies from the USA as secure within the adequacy decision of July 10, 2023. The list of certified companies as well as further information on the DPF can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/(in English). Within the data protection notices, we inform you which of the service providers we use are certified under the Data Privacy Framework.

10. Processing of personal data when visiting our website

We process users' data in order to be able to provide our online services to them. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the users' browser or terminal device.

Types of data processed: Usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and functions); meta, communication and process data (e.g., IP addresses, time information, identification numbers, persons involved); log data (e.g., log files relating to logins or the retrieval of data or access times.). Content data (e.g., text or image messages and posts as well as the information relating to them, such as information on authorship or time of creation).

Data subjects: Users (e.g., website visitors, users of online services).

Purposes of processing: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.).). Security measures.

Legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR).

Provision of the online offering on rented storage space: For the provision of our online offering, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also referred to as a "web host");

Vercel: Hosting and delivery of this website, including the server-side functions for contact and inquiry forms as well as the calculators;Service provider: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA; Legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR); Website: https://vercel.com;Privacy policy: https://vercel.com/legal/privacy-policy;Data processing agreement: https://vercel.com/legal/dpa;Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (SCCs).

The website is separate from the MediPulse software. The software itself and the data you process in it are not hosted by Vercel, but exclusively in data centers in Frankfurt am Main. Who has which role in this respect is governed by Section 17; where the data is located and which service providers are involved is set out at www.medipulse.de/en/security.

Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files". The server log files may include the address and name of the web pages and files accessed, date and time of access, volumes of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files can be used, on the one hand, for security purposes, e.g., to avoid overloading the servers (in particular in the event of abusive attacks, so-called DDoS attacks), and, on the other hand, to ensure the utilization of the servers and their stability; legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR). Deletion of data: Log file information is stored for a maximum period of 30 days and then deleted or anonymized. Data whose further retention is necessary for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.

Location-based display of product images: On our product pages, we show an image of the MediPulse interface with sample data. To make this image appear more familiar, our hosting provider determines the approximate location of your access (city) from your IP address, and we insert this place name into the image ("Praxis München"). Only the place name is processed, and it is used only for the duration of your page view in the browser; no storage, analysis, profiling or disclosure takes place, and your IP address is not stored for this purpose. If no location can be determined or JavaScript is deactivated, the image shows the neutral name "Demo Praxis"; legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR) in a comprehensible presentation of our product.

Email sending and hosting: The web hosting services we use also include the sending, receipt and storage of emails. For these purposes, the addresses of the recipients and senders as well as further information relating to the sending of emails (e.g., the providers involved) and the contents of the respective emails are processed. The aforementioned data may also be processed for the purpose of detecting SPAM. Please note that emails on the internet are generally not sent in encrypted form. As a rule, emails are encrypted in transit, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and received. We therefore cannot assume any responsibility for the transmission path of emails between the sender and receipt on our server; legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR).

11. Further functions and offerings of our website

In addition to the purely informational use of our website, we offer functions that you can use if you are interested and which we describe in detail below. As a rule, you provide further personal data for this purpose, which we process in order to provide the respective function. The foregoing general information on your rights, data security, the storage period and disclosure to third parties applies equally to these processing operations.

12. Use of cookies

The term "cookies" refers to functions that store information on users' terminal devices and read it from them. Cookies can also be used for various purposes, for example for the functionality, security and convenience of online offerings and for the creation of analyses of visitor flows. We use cookies in accordance with the statutory provisions. To this end, we obtain the users' prior consent where necessary. Where consent is not required, we rely on our legitimate interests. This applies if the storage and reading of information is essential in order to be able to provide expressly requested content and functions. This includes, for example, the storage of settings and ensuring the functionality and security of our online offering. Consent can be withdrawn at any time. We provide clear information about its scope and which cookies are used.

Notes on legal bases under data protection law

Whether we process personal data with the help of cookies depends on consent. If consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage period

With regard to the storage period, the following types of cookies are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online offering and closed their terminal device (e.g., browser or mobile application).
• Permanent cookies: Permanent cookies remain stored even after the terminal device has been closed. For example, the login status can be saved and preferred content can be displayed directly when the user visits a website again. Likewise, the user data collected with the help of cookies can be used for reach measurement. Unless we provide users with explicit information on the type and storage period of cookies (e.g., in the context of obtaining consent), they should assume that the cookies are permanent and that the storage period can be up to two years.

General information on withdrawal and objection (opt-out)

Users can withdraw the consents they have given at any time and can also declare an objection to the processing in accordance with the statutory requirements, including by means of the privacy settings of their browser.

Types of data processed: Meta, communication and process data (e.g., IP addresses, time information, identification numbers, persons involved).

Legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR). Consent (Art. 6(1) sentence 1(a) GDPR).

Further information on processing operations, procedures and services:

Processing of cookie data on the basis of consent: We use a consent management solution by which the users' consent to the use of cookies, or to the procedures and providers named within the consent management solution, is obtained. This procedure serves to obtain, log, manage and revoke consents, in particular with regard to the use of cookies and comparable technologies used to store, read and process information on the users' terminal devices. Within the scope of this procedure, the users' consents to the use of cookies and the associated processing of information, including the specific processing operations and providers named in the consent management procedure, are obtained. Users also have the option of managing and withdrawing their consents. The declarations of consent are stored in order to avoid asking again and to be able to provide proof of consent in accordance with the statutory requirements. Storage takes place on the server side and/or in a cookie (so-called opt-in cookie) or by means of comparable technologies in order to be able to assign the consent to a specific user or their device. Unless specific information is available on the providers of consent management services, the following general information applies: The consent is stored for a period of up to two years. A pseudonymous user identifier is created, which is stored together with the time of consent, the information on the scope of consent (e.g., the relevant categories of cookies and/or service providers) and information about the browser, the system and the terminal device used; legal bases: Consent (Art. 6(1) sentence 1(a) GDPR).

Our own consent management: We request your consent to the use of cookies and comparable technologies with our own solution, without an external service provider. We store your decision (preferences, statistics and marketing, each yes or no), a random consent ID and the time in a cookie named "mp_einwilligung" on your terminal device for twelve months; it is not transmitted to our servers. You can change or withdraw your selection at any time via the "Cookie settings" link in the footer of the website; legal bases: Legal obligation (Art. 6(1) sentence 1(c) GDPR) and legitimate interests (Art. 6(1) sentence 1(f) GDPR) in storing your decision.

13. Online marketing and analytics tools

Web analytics (also referred to as "reach measurement") serves to evaluate the visitor flows of our online offering and may include behavior, interests or demographic information about the visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognize at what time our online offering or its functions or content are used most frequently, or invite users to return. It also enables us to understand which areas require optimization.

In addition to web analytics, we may also use testing procedures, for example to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e., data combined into a usage process, may be created for these purposes, and information may be stored in a browser or terminal device and then read from it. The information collected includes, in particular, websites visited and elements used there, as well as technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data vis-à-vis us or vis-à-vis the providers of the services we use, the processing of location data is also possible.

In addition, the users' IP addresses are stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. In general, no directly identifying data of the users (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimization, but rather pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purpose of the respective procedures.

Notes on legal bases: If we ask users for their consent to the use of the third-party providers, the legal basis for the data processing is consent. Otherwise, the users' data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Types of data processed: Usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and functions). Meta, communication and process data (e.g., IP addresses, time information, identification numbers, persons involved).

Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles). Provision of our online offering and user-friendliness.

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion". Storage of cookies for up to 2 years (Unless otherwise stated, cookies and similar storage methods may be stored on users' devices for a period of two years.).

Security measures: IP masking (pseudonymization of the IP address).

Google Analytics: We use Google Analytics to measure and analyze the use of our online offering on the basis of a pseudonymous user identification number. This identification number does not contain any unique data, such as names or email addresses. It serves to assign analysis information to a terminal device in order to recognize which content users have accessed within one or several usage processes, which search terms they have used, accessed again or interacted with our online offering. Likewise, the time of use and its duration are stored, as well as the sources of the users that refer to our online offering and technical aspects of their terminal devices and browsers. In this process, pseudonymous profiles of users are created with information from the use of various devices, whereby cookies may be used. Google Analytics does not log or store individual IP addresses for EU users. Analytics does, however, provide coarse geographic location data by deriving the following metadata from IP addresses: city (and the derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based counterparts). For EU traffic, the IP address data is used exclusively for this derivation of geolocation data before being deleted immediately. It is not logged, is not accessible and is not used for any further purposes. When Google Analytics collects measurement data, all IP lookups are performed on EU-based servers before the traffic is forwarded to Analytics servers for processing; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal bases: Consent (Art. 6(1) sentence 1(a) GDPR); website: https://marketingplatform.google.com/intl/de/about/analytics/; security measures: IP masking (pseudonymization of the IP address); privacy policy: https://policies.google.com/privacy; data processing agreement: https://business.safety.google/adsprocessorterms/; basis for third-country transfers: Data Privacy Framework (DPF); option to object (opt-out): opt-out plugin: https://tools.google.com/dlpage/gaoptout; settings for the display of advertisements: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/(types of processing and of the data processed).

Google Tag Manager: We use Google Tag Manager, with which the tags (i.e., small code elements) of other services can be integrated and managed. Google Tag Manager itself does not set any cookies and does not collect any personal data for its own purposes. It serves solely to manage and deliver the services integrated through it, which in turn may collect data. In the course of delivery, the users' IP address is transmitted to the provider's servers. With regard to the services integrated via Google Tag Manager and their respective legal bases, we refer to the other information in this privacy policy; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR); website: https://marketingplatform.google.com/intl/de/about/tag-manager/; privacy policy: https://policies.google.com/privacy; data processing agreement: https://business.safety.google/adsprocessorterms/; basis for third-country transfers: Data Privacy Framework (DPF).

PostHog: We use PostHog to analyze usage behavior on our online offering and to conduct A/B tests. In doing so, PostHog records page views, interactions such as clicks and scrolling behavior, as well as the steps leading up to booking an appointment, and can display these as session recordings ("Session Recordings"). Entries in form fields are masked by the service's default settings and are not recorded in plain text. Assignment takes place via a pseudonymous identifier that is stored in cookies or comparable storage technologies. The data is stored in PostHog's EU cloud in Germany (Frankfurt am Main); service provider: PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA; legal bases: Consent (Art. 6(1) sentence 1(a) GDPR); website: https://posthog.com; privacy policy: https://posthog.com/privacy; data processing agreement: https://posthog.com/dpa; option to object (opt-out): withdrawal of consent via the cookie settings on our online offering.

HubSpot: We use HubSpot as a system for managing contacts, inquiries and marketing measures (customer relationship management) and for analyzing the use of our online offering. For this purpose, HubSpot uses cookies and comparable technologies with which returning visitors are recognized by means of a pseudonymous identifier and their page views, click paths, length of visit and the source of access are evaluated. If data is transmitted to us via a form, HubSpot may combine the previously collected usage data with the contact data provided, so that the usage history is assigned to a contact. Furthermore, functions for recording form entries and for booking appointments are used. Processing for our European users takes place on servers within the European Union; service provider: HubSpot Ireland Limited, HubSpot House, One Sir John Rogerson's Quay, Dublin 2, Ireland; parent company: HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA; legal bases: Consent (Art. 6(1) sentence 1(a) GDPR) with regard to the analytics and marketing functions; performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1(b) GDPR) as well as legitimate interests (Art. 6(1) sentence 1(f) GDPR) with regard to the handling and management of inquiries; website: https://www.hubspot.de; privacy policy: https://legal.hubspot.com/de/privacy-policy; data processing agreement: https://legal.hubspot.com/dpa; basis for third-country transfers: Data Privacy Framework (DPF).

14. Online marketing

We process personal data for the purpose of online marketing, which may include, in particular, the marketing of advertising space or the display of promotional and other content (collectively referred to as “content”) based on the potential interests of users, as well as the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (the so-called “cookie”), or similar procedures are used by means of which the information about the user relevant to the display of the aforementioned content is stored. This may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information, such as the browser used, the computer system used, and information on usage times and functions used. If users have consented to the collection of their location data, this data may also be processed.

In addition, the IP addresses of users are stored. However, we use available IP masking procedures (i.e., pseudonymization by shortening the IP address) to protect users. In general, no directly identifying data of the users (such as e-mail addresses or names) is stored in the context of the online marketing procedure, but pseudonyms. This means that neither we nor the providers of the online marketing procedures know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is generally stored in the cookies or by means of similar procedures. These cookies can later generally also be read on other websites that use the same online marketing procedure, analyzed for the purpose of displaying content, supplemented with further data, and stored on the server of the online marketing procedure provider.

By way of exception, it is possible to assign directly identifying data to the profiles, primarily when the users are, for example, members of a social network whose online marketing procedure we use and the network links the user profiles with the aforementioned information. Please note that users may enter into additional agreements with the providers, for example by giving consent during registration.

As a matter of principle, we only receive access to aggregated information about the success of our advertisements. However, within the framework of so-called conversion measurements, we can check which of our online marketing procedures have led to a so-called conversion, i.e., for example, to the conclusion of a contract with us. Conversion measurement is used solely to analyze the success of our marketing measures.

Unless otherwise stated, please assume that the cookies used are stored for a period of two years.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the data processing is that permission. Otherwise, the users' data is processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Notes on withdrawal and objection: We refer to the privacy notices of the respective providers and the objection options stated for the providers (so-called “opt-out”). If no explicit opt-out option has been specified, you have, on the one hand, the option of disabling cookies in the settings of your browser. However, this may restrict functions of our online offering. We therefore additionally recommend the following opt-out options, which are offered in summary form for the respective regions:

• Europe: https://www.youronlinechoices.eu.
• Canada: https://www.youradchoices.ca/choices.
• USA: https://www.aboutads.info/choices.
• Cross-regional: https://optout.aboutads.info.

Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors); tracking (e.g., interest-/behavior-based profiling, use of cookies); audience building; marketing. Profiles with user-related information (creation of user profiles).

Meta Pixel: We use the Meta Pixel to measure the effectiveness of our advertisements within Meta's services (Facebook, Instagram) and to build target audiences for the delivery of advertising. With the help of the Meta Pixel, Meta can determine the visitors to our online offering as a target audience for the display of ads (“Custom Audiences”). Furthermore, the Meta Pixel allows us to track whether users, after clicking on an ad, have taken an action relevant to us, such as submitting an inquiry (“conversion measurement”). On the basis of the target audiences built in this way, users with comparable characteristics can also be addressed (“Lookalike Audiences”). For this purpose, a cookie is set and a pseudonymous identifier is processed; we ourselves receive only aggregated evaluations from Meta and no access to the data of individual users. With regard to the collection of the data on our online offering and its transmission to Meta, we are jointly responsible with Meta for the processing (Art. 26 GDPR); the allocation of obligations results from the agreement linked below. Meta is solely responsible for the subsequent further processing of the data; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; parent company: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA; legal bases: consent (Art. 6(1) sentence 1(a) GDPR); website: https://www.facebook.com/business/tools/meta-pixel; privacy policy: https://www.facebook.com/privacy/policy/; joint processing agreement: https://www.facebook.com/legal/controller_addendum; basis for third-country transfers: Data Privacy Framework (DPF), https://www.facebook.com/privacy/policies/data_privacy_framework/; objection option (opt-out): withdrawal of consent via the cookie settings on our online offering and ad settings at Meta: https://www.facebook.com/settings?tab=ads.

LinkedIn Insight Tag: We use the LinkedIn Insight Tag to measure the effectiveness of our advertisements on LinkedIn and to build target audiences for their delivery. The tag enables the evaluation of page views and conversions as well as the building of target audiences from the visitors to our online offering (retargeting). Furthermore, we receive aggregated evaluations, not related to individual persons, about the professional composition of our visitors (e.g., industry, company size, function). For this purpose, a cookie is set and a pseudonymous identifier is processed; service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; parent company: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA; legal bases: consent (Art. 6(1) sentence 1(a) GDPR); website: https://business.linkedin.com/marketing-solutions/insight-tag; privacy policy: https://www.linkedin.com/legal/privacy-policy; data processing agreement: https://www.linkedin.com/legal/l/dpa; basis for third-country transfers: Data Privacy Framework (DPF); objection option (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

ChatGPT Ads (OpenAI Pixel): We use OpenAI's Measurement Pixel to measure the effectiveness of our advertisements in ChatGPT. The pixel records page views and conversions on our website, in particular a booked demo and a submitted Praxis-Check or Ziffern-Check. If you come to our website via an ad in ChatGPT, the pixel stores a click identifier in a cookie so that later conversions can be attributed to the ad. In the process, device and browser information, the IP address and the pages visited are also processed. Contact data that you enter into forms may be encrypted (hashed) in your browser before transmission and sent along for attribution; OpenAI does not receive it in plain text. Service provider: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; parent company: OpenAI, L.L.C., San Francisco, USA; legal bases: consent (Art. 6(1) sentence 1(a) GDPR, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG)); website: https://developers.openai.com/ads/measurement-pixel; privacy policy: https://openai.com/policies/eu-privacy-policy/; data processing agreement: https://openai.com/policies/data-processing-addendum/; basis for third-country transfers: Standard Contractual Clauses (SCCs) of the EU Commission. You can withdraw your consent at any time via the cookie settings.

15. Conclusion of a contractual relationship

We process data of our contractual and business partners, e.g., customers and prospective customers (collectively referred to as “contractual partners”), within the framework of contractual and comparable legal relationships as well as associated measures and with regard to communication with the contractual partners (or pre-contractually), for example to answer inquiries.

We use this data to fulfill our contractual obligations. These include, in particular, the obligations to provide the agreed services, any update obligations, and remedies in the event of warranty and other service disruptions. In addition, we use the data to safeguard our rights and for the purpose of the administrative tasks associated with these obligations as well as company organization. Furthermore, we process the data on the basis of our legitimate interests both in proper and economically sound business management and in security measures to protect our contractual partners and our business operations against misuse and endangerment of their data, secrets, information and rights (e.g., for the involvement of telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of applicable law, we only disclose the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about other forms of processing, for example for marketing purposes, within the framework of this privacy policy.

We inform the contractual partners which data is required for the aforementioned purposes before or during data collection, e.g., in online forms, by special marking (e.g., colors) or symbols (e.g., asterisks or similar), or in person.

We delete the data after expiry of statutory warranty and comparable obligations, i.e., generally after four years, unless the data is stored in a customer account, e.g., as long as it must be retained for legal reasons of archiving (for example, for tax purposes, generally ten years). We delete data disclosed to us by the contractual partner within the framework of an order in accordance with the specifications and generally after the end of the order.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); payment data (e.g., bank details, invoices, payment history); contact data (e.g., postal and e-mail addresses or telephone numbers); contract data (e.g., subject matter of the contract, term, customer category); usage data (e.g., page views and length of stay, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and process data (e.g., IP addresses, time information, identification numbers, persons involved).

Data subjects: Service recipients and clients; prospective customers. Business and contractual partners.

Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; security measures; communication; office and organizational procedures; organizational and administrative procedures. Business processes and business management procedures.

Retention and deletion: Deletion in accordance with the information in the section “General information on data storage and deletion”.

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1(b) GDPR); legal obligation (Art. 6(1) sentence 1(c) GDPR). Legitimate interests (Art. 6(1) sentence 1(f) GDPR).

Online shop, order forms, e-commerce and delivery: We process the data of our customers in order to enable them to select, purchase or order the chosen products, goods and associated services, as well as their payment and delivery or performance. If necessary for the execution of an order, we use service providers, in particular postal, freight forwarding and shipping companies, to carry out the delivery or performance to our customers. For the processing of payment transactions, we use the services of banks and payment service providers. The required information is marked as such in the course of the ordering or comparable purchasing process and includes the information required for delivery or provision and billing as well as contact information in order to be able to consult if necessary; legal bases: performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1(b) GDPR).

16. Use of payment service providers

For the payment of fee-based contracts, the payment methods specified in Section 12 of our General Terms and Conditions are available. Depending on the payment method selected, we pass on the data required for processing – limited in purpose to the payment – to the respective payment service provider. We do not ourselves collect or store complete credit card data.

Stripe: We process all payment methods via Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. For this purpose, Stripe receives name, e-mail address, billing address, payment data (such as IBAN or card data) and the invoice amounts and processes them on our behalf and, for example for fraud prevention and for its own legal obligations, under its own responsibility. Stripe may transfer data to Stripe, Inc. in the USA; the basis for this is the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs) of the EU Commission. Details: stripe.com/de/privacy.

• Credit card: Stripe passes the card data on to the provider of the respective credit card; its terms of payment and use apply.
• SEPA direct debit: You grant us a SEPA direct debit mandate. Your account data and the collection order are received by Stripe, which carries out the debit on our behalf.
• PayPal: Payments via PayPal are made through PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal's privacy provisions additionally apply. For the payment method “PayPal invoice”, PayPal carries out its own credit check and decides on acceptance under its own responsibility; PayPal is itself the controller under data protection law for this purpose.
• Apple Pay: The payment is provided via Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA. Your card data is managed by Apple and is not transmitted to us in plain text. As Apple has its registered office in the USA, your data may be processed outside the European Union; Apple governs the details in its own privacy provisions.

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1(b) GDPR); fulfillment of legal obligations, in particular retention obligations under commercial and tax law (Art. 6(1) sentence 1(c) GDPR).

17. Use of the MediPulse software

For the use of our software, two roles must be distinguished, because different responsibilities are attached to them.

Your data as a customer: For the data arising during registration, login and use of the customer account as well as during the performance of the contract, we are the controller within the meaning of the GDPR. This involves processing, in particular, master and contact data of the persons authorized to sign and to use the account, access and usage data of the account, as well as contract and billing data.

The data in the application: For the data that enters the application from your practice management system (PVS) and your connected accounts, you as the medical practice are the controller; we process it exclusively on your behalf and in accordance with your instructions. The basis for this is the data processing agreement pursuant to Art. 28 GDPR. Of a patient, only a practice-internal identifier is transferred; master, contact and insurance data remain in your practice management system. Details on the technical functioning, the transferred fields and the retention periods can be found at medipulse.de/en/security.

Data subjects: Customers and their employees authorized to use the software.

Purposes of processing: Provision of contractual services; management of and response to inquiries; security measures; billing.

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1(b) GDPR). Fulfillment of a legal obligation (Art. 6(1) sentence 1(c) GDPR). Legitimate interests (Art. 6(1) sentence 1(f) GDPR).

18. Contact by e-mail

When contacting us (e.g., by post, contact form, e-mail, telephone or via social media) as well as within the framework of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to answer the contact inquiries and any requested measures.

Data subjects: Communication partners.

Purposes of processing: Communication; organizational and administrative procedures; feedback (e.g., collecting feedback via online form). Provision of our online offering and user-friendliness.

Legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR). Performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1(b) GDPR).

Contact form: When contacting us via our contact form, by e-mail or other communication channels, we process the personal data transmitted to us in order to respond to and handle the respective request. This generally includes information such as name, contact information and, where applicable, further information that is communicated to us and is necessary for appropriate handling. We use this data exclusively for the stated purpose of contact and communication; legal bases: performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1(b) GDPR), legitimate interests (Art. 6(1) sentence 1(f) GDPR).

19. Subscribing to our newsletter

We send newsletters, e-mails and other electronic notifications (hereinafter “newsletter”) exclusively with the consent of the recipients or on the basis of a statutory basis. If the contents of the newsletter are specified in the course of subscribing to it, these contents are decisive for the users’ consent. To subscribe to our newsletter, it is normally sufficient to provide your e-mail address. However, in order to be able to offer you a personalized service, we may ask you to provide your name so that we can address you personally in the newsletter, or for further information if this is necessary for the purpose of the newsletter.

Deletion and restriction of processing: We may store unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove consent that was formerly given. The processing of these data is restricted to the purpose of a potential defense against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. In the event of obligations to permanently observe objections, we reserve the right to store the e-mail address solely for this purpose in a suppression list (so-called “blocklist”).

The logging of the subscription procedure is carried out on the basis of our legitimate interests for the purpose of proving that it was conducted properly. Insofar as we commission a service provider to send e-mails, this is done on the basis of our legitimate interests in an efficient and secure sending system.

Contents: Information about us, our services, promotions and offers.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and e-mail addresses or telephone numbers); meta, communication and process data (e.g., IP addresses, time information, identification numbers, persons involved). Usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features).

Purposes of processing: Direct marketing (e.g., by e-mail or post).

Legal bases: Consent (Art. 6(1) sentence 1(a) GDPR).

Right to object (opt-out): You can cancel receipt of our newsletter at any time, i.e., withdraw your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of each newsletter, or you can otherwise use one of the contact options stated above, preferably e-mail, for this purpose.

Measurement of open and click rates: The newsletters contain a so-called “web beacon”, i.e., a pixel-sized file that is retrieved from our server when the newsletter is opened or, if we use a mailing service provider, from its server. In the course of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, is initially collected. This information is used for the technical improvement of our newsletter on the basis of the technical data or the target groups and their reading behavior on the basis of their retrieval locations (which can be determined with the help of the IP address) or the access times. This analysis also includes determining whether and when the newsletters are opened and which links are clicked. The information is assigned to the individual newsletter recipients and stored in their profiles until deletion. The analyses serve to identify the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. The measurement of open and click rates and the storage of the measurement results in the users’ profiles; legal bases: Consent (Art. 6(1) sentence 1(a) GDPR).

20. Promotional communication via e-mail, post, fax or telephone

We process personal data for the purposes of promotional communication, which may take place via various channels, such as e-mail, telephone, post or fax, in accordance with the statutory requirements.

Recipients have the right to withdraw consent given at any time or to object to promotional communication at any time.

After withdrawal or objection, we store the data required to prove the previous authorization to contact or send materials for up to three years after the end of the year of the withdrawal or objection on the basis of our legitimate interests. The processing of these data is restricted to the purpose of a possible defense against claims. On the basis of the legitimate interest in permanently observing users’ withdrawal or objection, we also store the data required to avoid renewed contact (e.g., depending on the communication channel, the e-mail address, telephone number, name).

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and e-mail addresses or telephone numbers). Content data (e.g., text or image messages and posts as well as the information relating to them, such as details of authorship or time of creation).

Purposes of processing: Direct marketing (e.g., by e-mail or post); marketing. Sales promotion.

Legal bases: Consent (Art. 6(1) sentence 1(a) GDPR). Legitimate interests (Art. 6(1) sentence 1(f) GDPR).

21. Automated decisions and profiling

We do not make any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22(1) GDPR). In particular, no automated system decides on the conclusion, content or termination of a contract with you.

The analyses that our software provides for medical practices relate to operational key figures of the practice and serve to prepare decisions that the practice itself makes. They do not make any decisions about individual persons.

If you choose the payment method “PayPal invoice”, PayPal carries out its own credit check and decides whether to accept this payment method. PayPal carries out this check under its own responsibility under data protection law; in this respect, you assert your rights against PayPal.

On this website, we use analysis and marketing services after obtaining your consent, which may create usage profiles. These profiles serve to measure reach and to target advertising; they do not lead to any decision within the meaning of Art. 22 GDPR. Details and your right to object can be found in the sections on cookies, analysis and online marketing.

22. Blogs and publication media

We use blogs or comparable means of online communication and publication (hereinafter “publication medium”). Readers’ data are processed for the purposes of the publication medium only insofar as this is necessary for its presentation and for communication between authors and readers or for security reasons. Otherwise, we refer to the information on the processing of visitors to our publication medium within the scope of this privacy policy.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and e-mail addresses or telephone numbers); content data (e.g., text or image messages and posts as well as the information relating to them, such as details of authorship or time of creation); usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features). Meta, communication and process data (e.g., IP addresses, time information, identification numbers, persons involved).

Purposes of processing: Feedback (e.g., collecting feedback via online form); provision of our online offering and user-friendliness; security measures. Organizational and administrative procedures.

Comments and posts: When users leave comments or other posts, their IP addresses may be stored on the basis of our legitimate interests. This is done for our security in case someone leaves unlawful content in comments and posts (insults, prohibited political propaganda, etc.). In this case, we ourselves may be held liable for the comment or post and are therefore interested in the identity of the author. Furthermore, we reserve the right, on the basis of our legitimate interests, to process the users’ details for the purpose of spam detection. On the same legal basis, we reserve the right, in the case of surveys, to store the users’ IP addresses for their duration and to use cookies in order to avoid multiple votes. The personal information provided in the course of comments and posts, any contact and website information as well as the content-related details are stored by us permanently until the users object; legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR).

23. Presences on social networks (social media)

We maintain online presences within social networks and, in this context, process user data in order to communicate with the users active there or to offer information about us.

We would like to point out that user data may be processed outside the area of the European Union in this context. This may result in risks for users, because, for example, the enforcement of users’ rights could be made more difficult.

Furthermore, users’ data within social networks are generally processed for market research and advertising purposes. For example, usage profiles may be created on the basis of usage behavior and the resulting interests of users. The latter may in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of users. For this reason, cookies are generally stored on the users’ computers, in which the usage behavior and interests of the users are stored. In addition, data may also be stored in the usage profiles independently of the devices used by the users (in particular if they are members of the respective platforms and are logged in there).

For a detailed description of the respective forms of processing and the options to object (opt-out), we refer to the privacy policies and information of the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the latter have access to the user data in each case and can directly take appropriate measures and provide information. Should you nevertheless require assistance, you may contact us.

Types of data processed: Contact data (e.g., postal and e-mail addresses or telephone numbers); content data (e.g., text or image messages and posts as well as the information relating to them, such as details of authorship or time of creation). Usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and features).

Purposes of processing: Communication; feedback (e.g., collecting feedback via online form). Public relations.

LinkedIn: Social network - We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not the further processing) of visitor data used to create the “Page Insights” (statistics) of our LinkedIn profiles. These data include information about the types of content that users view or interact with, as well as the actions they take. In addition, details about the devices used are recorded, such as IP addresses, operating system, browser type, language settings and cookie data, as well as information from user profiles, such as job function, country, industry, seniority level, company size and employment status. Privacy information on the processing of user data by LinkedIn can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy. We have concluded a special agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum”, https://legal.linkedin.com/pages-joint-controller-addendum), which governs, in particular, which security measures LinkedIn must observe and in which LinkedIn has agreed to fulfill the rights of data subjects (i.e., users can, for example, send requests for information or deletion directly to LinkedIn). The rights of users (in particular the right of access, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. The joint responsibility is limited to the collection and transmission of the data to LinkedIn Ireland Unlimited Company, a company based in the EU. The further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, in particular with regard to the transfer of the data to the parent company LinkedIn Corporation in the USA; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR); website: https://www.linkedin.com; privacy policy: https://www.linkedin.com/legal/privacy-policy; basis for third-country transfers: Data Privacy Framework (DPF). Option to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

24. Plug-ins and embedded functions and content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may, for example, be graphics, videos or city maps (hereinafter uniformly referred to as “content”).

Integration always requires that the third-party providers of this content process the IP address of the users, since without the IP address they would not be able to send the content to their browser. The IP address is therefore required for the display of this content or these functions. We endeavor to use only such content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. By means of the “pixel tags”, information such as visitor traffic on the pages of this website can be analyzed. The pseudonymous information may also be stored in cookies on the users’ device and may contain, among other things, technical information about the browser and the operating system, referring websites, the time of visit and other information about the use of our online offering, and may also be linked with such information from other sources.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the data processing is this permission. Otherwise, user data are processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

Purposes of processing: Provision of our online offering and user-friendliness.

Instagram posts: On the “About us” page, we embed posts from our Instagram channel. When this content is loaded, users’ data, in particular the IP address and technical information about the browser, are transmitted to Meta; Meta may set cookies and, if users are logged in to Instagram, assign the visit to their account. The content is only loaded when the corresponding section of the page comes close to the visible area; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; parent company: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA; legal bases: Legitimate interests (Art. 6(1) sentence 1(f) GDPR); website: https://www.instagram.com; privacy policy: https://privacycenter.instagram.com/policy; basis for third-country transfers: Data Privacy Framework (DPF), https://www.facebook.com/privacy/policies/data_privacy_framework/.

25. Current version of and amendments to this privacy policy

The version available on this page applies in each case. Due to the further development of our online offering, changes in statutory requirements or the use of new services, it may become necessary to amend it. We recommend that you review the content again from time to time.

If the amendment requires consent or affects a component of our contractual services, we will inform you separately.