Pri­va­cy po­li­cy

Over­view of pro­ces­sing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Ty­pes of da­ta pro­ces­sed

• Inventory data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta/communication data.
• Applicant data.
• Test results
• Event data (Facebook).

Ca­te­go­ries of af­fec­ted per­sons

• Customers.
• Employees.
• Interested parties.
• users.
• Applicants.
• Competition and contest participants.

Pur­po­ses of the pro­ces­sing

• Provision of contractual services and customer service.
• Contact requests and communication.
• Direct marketing.
• Reach measurement.
• Office and organizational procedures.
• Remarketing.
• Conversion measurement.
• Click tracking.
• Target group formation.
• A/B testing.
• Managing and responding to inquiries.
• Application process.
• Running prize draws and competitions.
• Content delivery network (CDN).
• Feedback.
• Heatmaps.
• Surveys and questionnaires.
• Marketing.
• Profiles with user-related information.
• Target group formation.
• Provision of our online offer and user-friendliness.
• Transmission to partner companies of the FHDW with the aim of finding a suitable cooperation company for the candidate’s studies

Your personal data will only be passed on to third parties with your consent or on the basis of a legal permission. Your personal data will only be transferred to state institutions and authorities entitled to receive information within the framework of the relevant laws or if we are obliged to do so by a court decision. Our employees are obliged to maintain confidentiality and to comply with the provisions of data protection legislation. We have commissioned appropriate companies to process your personal data on our behalf for the technical implementation of the services provided. These are:

Pro­vi­si­on of the on­line of­fer and web hos­ting

In order to provide our online offering securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offering can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services as well as security services and technical maintenance services.

The data processed as part of the provision of the hosting service may include all information relating to the users of our online service that is generated during use and communication. This regularly includes the IP address, which is necessary in order to be able to deliver the content of online offers to browsers, and all entries made within our online offer or from websites.

• Processed data types: Content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online offer and user-friendliness; Content Delivery Network (CDN).
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further information on processing operations, procedures and services:

• Collection of access data and log files: We ourselves (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the web pages and files accessed, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider, to avoid overloading the servers (especially in the case of abusive attacks, so-called DDoS attacks) and to ensure the utilization of the servers and their stability; Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further retention is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
• Cloudflare: We use the “Cloudflare” service. The provider is Cloudflare Inc, 101 Townsend St., San Francisco, CA 94107, USA (hereinafter referred to as “Cloudflare”).
  Cloudflare offers a globally distributed content delivery network with DNS. The information transfer between your browser and our website is technically routed via the Cloudflare network. This enables Cloudflare to analyze the traffic between your browser and our website and to act as a filter between our servers and potentially malicious traffic from the internet. Cloudflare may also use cookies or other technologies to recognize Internet users, but these are used solely for the purpose described here.
  The use of Cloudflare is based on our legitimate interest in providing our website as error-free and secure as possible (Art. 6 para. 1 lit. f GDPR).
  Data transfer to the USA is based on the standard data protection clauses of the EU Commission. You can find details here: https://www.cloudflare.com/privacypolicy/.
  Further information on security and data protection at Cloudflare can be found here: https://www.cloudflare.com/privacypolicy/.
• Nitropack CDN: The provider is Nitropack LLC, 801 Garden
  Street 3A, Prof. Georgi Bradistilov Str.1700 Sofia, Bulgaria (hereinafter referred to as
  “Nitropack”). Nitropack provides a globally distributed content delivery
  Network with DNS ready. This involves the technical transfer of information between
  your browser and my website via the Nitropack network
  managed. A CDN is an online service with whose
  Help especially large media files (such as graphics, page content or
  scripts) through a network of regionally distributed and Internet-connected
  server are delivered. The use of the Content Delivery Network from
  Nitropack helps me to optimize the loading times of my website. The use of Nitropack is based on my legitimate
  interest in providing
  as error-free, secure and efficient as possible and improving the stability and functionality of my
  website (Art. 6 para. 1 lit. f GDPR). Further information on security and data protection
  at Nitropack can be found here:
  https://nitropack.io/page/privacy
  

Con­tact and in­qui­ry ma­nage­ment

When contacting us (e.g. by contact form, email, telephone or via social media) as well as in the context of existing user and business relationships, the data of the inquiring persons are processed insofar as this is necessary to answer the contact inquiries and any requested measures.

The response to contact inquiries and the management of contact and inquiry data in the context of contractual or pre-contractual relationships is carried out to fulfil our contractual obligations or to respond to (pre)contractual inquiries and otherwise on the basis of legitimate interests in responding to inquiries and maintaining user or business relationships.

• Processed data types: Inventory data (e.g. names, addresses); Contact data (e.g. e-mail, telephone numbers); Content data (e.g. entries in online forms).
• Affected persons: Communication partner.
• Purposes of processing: contact requests and communication; provision of contractual services and customer service.
• Legal bases: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR); Legal obligation (Art. 6 para. 1 sentence 1 lit. c. GDPR).

Further information on processing operations, procedures and services:

• Contact form: If users contact us via our contact form, e-mail or other communication channels, we process the data provided to us in this context to process the communicated request. For this purpose, we process personal data in the context of pre-contractual and contractual business relationships, insofar as this is necessary for their fulfillment and otherwise on the basis of our legitimate interests and the interests of the communication partners in responding to the concerns and our statutory retention obligations.

Vi­deo con­fe­ren­ces, on­line mee­tings, we­bi­nars and screen sharing

We use platforms and applications of other providers (hereinafter referred to as “conference platforms”) for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as “conference”). When selecting conference platforms and their services, we observe the legal requirements.

Data processed by conference platforms: In the context of participation in a conference, the conference platforms process the personal data of the participants listed below. The scope of the processing depends on the one hand on which data is required in the context of a specific conference (e.g. specification of access data or clear names) and which optional information is provided by the participants. In addition to processing for the purpose of holding the conference, the conference platforms may also process participants’ data for security purposes or service optimization. The processed data includes personal data (first name, surname), contact information (e-mail address, telephone number), access data (access codes or passwords), profile pictures, information on professional position/function, the IP address of the Internet access, information on the participants’ end devices, their operating system, the browser and its technical and language settings, information on the content of communication processes, i.e. entries in chats as well as audio and video data, as well as the use of other available functions (e.g. surveys). The content of the communications is encrypted to the extent technically provided by the conference providers. If the participants are registered as users with the conference platforms, further data may be processed in accordance with the agreement with the respective conference provider.

Logging and recordings: If text entries, participation results (e.g. from surveys) and video or audio recordings are logged, this will be communicated transparently to the participants in advance and they will be asked for their consent where necessary.

Data protection measures for participants: Please note the details of the processing of your data by the conference platforms in their data protection notices and select the optimum security and data protection settings for you in the conference platform settings. Please also ensure data and privacy protection in the background of your recording for the duration of a video conference (e.g. by informing roommates, locking doors and using the function to make the background unrecognizable, if technically possible). Links to the conference rooms and access data may not be passed on to unauthorized third parties.

Notes on legal bases: If, in addition to the conference platforms, we also process users’ data and ask users for their consent to the use of the conference platforms or certain functions (e.g. consent to the recording of conferences), the legal basis for processing is this consent. Furthermore, our processing may be necessary to fulfill our contractual obligations (e.g. in participant lists, in the case of processing the results of discussions, etc.). In addition, user data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

• Processed data types: Inventory data (e.g. names, addresses); Contact data (e.g. e-mail, telephone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
• Data subjects: Communication partners; users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of contractual services and customer service; contact requests and communication; office and organizational procedures.
• Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. GDPR); contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further information on processing operations, procedures and services:

• ClickMeeting: Conference software; Service provider: ClickMeeting, Arko?ska 6/A4, 80-387 Gdansk, Poland; Website: https://clickmeeting.com/de; Privacy Policy: https://clickmeeting.com/de/legal.
• Microsoft Teams: Messenger and conference software; Service Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Website: https://products.office.com; Privacy policy: https://privacy.microsoft.com/de-de/privacystatement, Security information: https://www.microsoft.com/de-de/trustcenter; Standard contractual clauses (guaranteeing the level of data protection for processing in third countries): https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.

Ap­p­li­ca­ti­on pro­ce­du­re

The application process requires applicants to provide us with the data necessary for their assessment and selection. The information required can be found in the job description or, in the case of online forms, in the details provided there.

In principle, the required information includes personal details such as name, address, contact details and proof of the qualifications required for the position. On request, we will be happy to provide additional information.

If provided, applicants can send us their applications using an online form. The data is transmitted to us in encrypted form in accordance with the state of the art. Applicants can also send us their applications by e-mail. Please note, however, that e-mails are generally not sent in encrypted form on the Internet. As a rule, e-mails are encrypted in transit, but not on the servers from which they are sent and received. We can therefore accept no responsibility for the transmission path of the application between the sender and receipt on our server.

For the purposes of searching for applicants, submitting applications and selecting applicants, we may use applicant management or recruitment software and platforms and services from third-party providers in compliance with legal requirements.

Applicants are welcome to contact us about how to submit their application or send it to us by post.

Processing of special categories of data: Insofar as special categories of personal data within the meaning of Art. 9 Para. 1 GDPR (e.g. health data, such as severely disabled status or ethnic origin) are requested from applicants so that the controller or the data subject can exercise their rights under employment law and social security and social protection law and comply with their obligations in this regard, their processing is carried out in accordance with Art. 9 para. 1 GDPR. 2 lit. b. GDPR, in the case of the protection of vital interests of applicants or other persons acc. Art. 9 para. 2 lit. c. GDPR or for the purposes of preventive health care or occupational medicine, for the assessment of the employee’s fitness for work, for medical diagnostics, for the provision of health or social care or treatment, or for the management of health or social care systems and services in accordance with Article 6(1)(c) GDPR. Art. 9 para. 2 lit. h. GDPR. In the case of communication of special categories of data based on voluntary consent, their processing is carried out on the basis of Art. 9 para. 2 lit. a. GDPR.

Deletion of data: The data provided by applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if the application for a job offer is not successful, the applicant’s data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. The deletion takes place, subject to a justified revocation of the applicants, at the latest after the expiry of a period of six months, so that we can answer any follow-up questions about the application and fulfill our obligations to provide evidence from the regulations on equal treatment of applicants. Invoices for any travel expense reimbursements are archived in accordance with tax regulations.

Inclusion in an applicant pool: Inclusion in an applicant pool, if offered, is based on consent. Applicants are informed that their consent to inclusion in the talent pool is voluntary, has no influence on the ongoing application process and that they can revoke their consent at any time for the future.

• Processed data types: Applicant data (e.g. personal details, postal and contact addresses, the documents belonging to the application and the information contained therein, such as cover letter, CV, certificates and other personal or qualification information provided by applicants with regard to a specific position or voluntarily).
• Persons concerned: Applicants.
• Purposes of processing: Application procedure (justification and possible subsequent implementation and possible subsequent termination of the employment relationship).
• Legal basis: Application procedure as a pre-contractual or contractual relationship (Art. 9 para. 2 lit. b GDPR).

Cloud ser­vices

We use software services accessible via the Internet and running on the servers of their providers (so-called “cloud services”, also referred to as “software as a service”) for the following purposes: document storage and management, calendar management, sending e-mails, spreadsheets and presentations, exchanging documents, content and information with specific recipients or publishing web pages, forms or other content and information as well as chats and participation in audio and video conferences.

In this context, personal data may be processed and stored on the servers of the providers, insofar as these are part of communication processes with us or are otherwise processed by us as set out in this privacy policy. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes and their content. The cloud service providers also process usage data and metadata that they use for security purposes and to optimize their services.

If we use cloud services to provide other users or publicly accessible websites with forms or other documents and content, the providers may store cookies on users’ devices for the purposes of web analysis or to remember user settings (e.g. in the case of media control).

Notes on legal bases: If we ask for consent to the use of cloud services, the legal basis for processing is consent. Furthermore, their use may be a component of our (pre-)contractual services, provided that the use of cloud services has been agreed within this framework. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient and secure administration and collaboration processes)

• Processed data types: Inventory data (e.g. names, addresses); Contact data (e.g. e-mail, telephone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
• Affected persons: Customers; employees (e.g. employees, applicants, former employees); interested parties; communication partners.
• Purposes of processing: Office and organizational procedures.
• Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. GDPR); contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further information on processing operations, procedures and services:

• Microsoft cloud services: cloud storage, cloud infrastructure services and cloud-based application software; Service Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Website: https://microsoft.com/de-de; Privacy policy: https://privacy.microsoft.com/de-de/privacystatement, safety instructions: https://www.microsoft.com/de-de/trustcenter; Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA; Standard contractual clauses (guaranteeing the level of data protection for processing in third countries): https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.

News­let­ter and elec­tro­nic no­ti­fi­ca­ti­ons

We only send newsletters, e-mails and other electronic notifications (hereinafter “newsletter”) with the consent of the recipient or with legal permission. If the contents of the newsletter are specifically described when registering for the newsletter, they are decisive for the user’s consent. Our newsletters also contain information about our services and us.

To subscribe to our newsletters, it is generally sufficient to enter your e-mail address. However, we may ask you to provide a name so that we can address you personally in the newsletter, or other information if this is necessary for the purposes of the newsletter.

Double opt-in procedure: Registration for our newsletter is always carried out in a so-called double opt-in procedure. This means that you will receive an e-mail after registration asking you to confirm your registration. This confirmation is necessary so that no one can log in with other people’s e-mail addresses. Subscriptions to the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation as well as the IP address. Changes to your data stored with the shipping service provider are also logged.

Deletion and restriction of processing: We may store the unsubscribed e-mail addresses for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. In the event of obligations to permanently observe objections, we reserve the right to store the e-mail address in a blocklist for this purpose alone.

The registration process is logged on the basis of our legitimate interests for the purpose of verifying that it has been carried out correctly. If we commission a service provider to send e-mails, this is done on the basis of our legitimate interests in an efficient and secure sending system.

Notes on legal bases: The newsletter is sent on the basis of the consent of the recipient or, if consent is not required, on the basis of our legitimate interests in direct marketing, if and to the extent that this is permitted by law, e.g. in the case of advertising to existing customers. If we commission a service provider to send e-mails, this is done on the basis of our legitimate interests in efficient and secure dispatch. The registration process is recorded on the basis of our legitimate interests to demonstrate that it has been carried out in accordance with the law.

Contents:

Information about us, our services, promotions and offers.

• Processed data types: Inventory data (e.g. names, addresses); Contact data (e.g. e-mail, telephone numbers); Meta/communication data (e.g. device information, IP addresses); Usage data (e.g. websites visited, interest in content, access times).
• Affected persons: Communication partner.
• Purposes of processing: Direct marketing (e.g. by e-mail or post).
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).
• Option to object (opt-out): You can cancel the receipt of our newsletter at any time, i.e. revoke your consent or object to further receipt. You will find a link to unsubscribe from the newsletter either at the end of each newsletter or you can use one of the contact options listed above, preferably e-mail.

Further information on processing operations, procedures and services:

• Measurement of opening and click rates: The newsletters contain a so-called “web-beacon”, i.e. a pixel-sized file that is retrieved from our server when the newsletter is opened or, if we use a dispatch service provider, from their server. As part of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, is initially collected and this information is used for the technical improvement of our newsletter based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or the access times. This analysis also includes determining whether the newsletters are opened, when they are opened and which links are clicked. This information is assigned to the individual newsletter recipients and stored in their profiles until they are deleted. The evaluations help us to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.the measurement of opening rates and click rates as well as the storage of the measurement results in the profiles of the users and their further processing are based on the consent of the users.a separate revocation of the performance measurement is unfortunately not possible, in this case the entire newsletter subscription must be canceled or must be contradicted. In this case, the stored profile information will be deleted.
• Mailchimp: E-mail dispatch and e-mail marketing platform; Service provider: Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA; Website: https://mailchimp.com; Privacy Policy: https://mailchimp.com/legal/; Data processing agreement: https://mailchimp.com/legal/; Standard Contractual Clauses (Safeguarding the level of data protection when processing data in third countries): Part of the order processing contract; Further information: Special security measures: https://mailchimp.com/help/Mailchimp-european-data-transfers/.

Ad­ver­ti­sing com­mu­ni­ca­ti­on via e-mail, post, fax or (mo­bi­le) te­le­pho­ne

We process personal data for the purposes of advertising communication, which may take place via various channels, such as e-mail, telephone, post or fax, in accordance with legal requirements.

Recipients have the right to withdraw their consent at any time or to object to advertising communication at any time.

After revocation or objection, we may store the data required to prove consent for up to three years on the basis of our legitimate interests before we delete it. The processing of this data is limited to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time.

• Processed data types: inventory data (e.g. names, addresses); contact data (e.g. e-mail, telephone numbers).
• Affected persons: Communication partner.
• Purposes of processing: Direct marketing (e.g. by e-mail or post).
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Com­pe­ti­ti­ons and con­tests

We process personal data of participants in competitions and contests only in compliance with the relevant data protection regulations, insofar as the processing is contractually required for the provision, execution and handling of the competition, the participants have consented to the processing or the processing serves our legitimate interests (e.g. in the security of the competition or the protection of our interests against misuse through the possible collection of IP addresses when submitting competition entries).

If contributions by participants are published as part of the competitions (e.g. as part of a vote or presentation of the competition entries or winners or reporting on the competition), we would like to point out that the names of the participants may also be published in this context. Participants can object to this at any time.

If the competition takes place within an online platform or a social network (e.g. Facebook or Instagram, hereinafter referred to as “online platform”), the terms of use and data protection provisions of the respective platforms also apply. In these cases, we would like to point out that we are responsible for the information provided by the participants as part of the competition and that inquiries regarding the competition should be addressed to us.

The participants’ data will be deleted as soon as the competition or contest has ended and the data is no longer required to inform the winners or because queries about the competition are to be expected. In principle, the participants’ data will be deleted no later than 6 months after the end of the competition. Winners’ data may be retained for longer, e.g. to answer queries about the prizes or to fulfill the prize payments; in this case, the retention period depends on the type of prize and is up to three years for items or services, e.g. to be able to process warranty claims. Furthermore, the participants’ data may be stored for longer, e.g. in the form of reporting on the competition in online and offline media.

If data was also collected for other purposes as part of the competition, its processing and the retention period are based on the data protection information for this use (e.g. in the case of registration for the newsletter as part of a competition).

• Processed data types: Inventory data (e.g. names, addresses); Content data (e.g. entries in online forms).
• Data subjects: Competition and contest participants.
• Purposes of the processing: Running prize draws and competitions.
• Legal bases: Contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. GDPR).

Competition: Conditions of participation for the Advent calendar

Organizer

The organizer of the competition is the Fachhochschule der Wirtschaft Nordrhein-Westfalen gGmbH (FHDW NRW gGmbH), Fürstenallee 5, 33102 Paderborn. The competition is in no way connected to Instagram and is in no way sponsored, supported or organized by Instagram. Instagram is merely the platform on which the FHDW NRW gGmbH posts the competition. The recipient of the information provided is not Instagram, but the FHDW. All questions, comments and/or complaints regarding the competition should be addressed exclusively to FHDW NRW gGmbH.

Eligibility to participate

All followers residing in Germany, Austria and Switzerland who have reached the age of fourteen are eligible to participate. Employees of FHDW NRW gGmbH are excluded from participation.

Participation

In addition, we reserve the right, at our own discretion, to exclude persons from participation if they violate the conditions of participation, act unfairly or manipulate participation. Only one competition entry per participant is permitted. The competition entries must not contain any insults, false facts, competition, trademark or copyright infringements. The participants themselves are responsible for any legal violations.

Participation deadline

All information on the entry deadline can be found in the respective competition post on Instagram. Participation is only possible within the participation period. Entries received after the closing date will not be considered.

Selection and notification of the winner

The winners will be determined after the closing date in a random draw among all participants. The winners will be announced shortly after the competition and announced via the FHDW Instagram story. The winners agree that they will be named and linked in a separate post on our Instagram page.

Profits

The prizes vary depending on the competition or raffle. The respective prize will be sent to the winners by post after the announcement. It is not possible to exchange, collect or pay out the prize in cash.

Dispatch of the prize

The winner undertakes to provide FHDW NRW gGmbH with his/her name and address via Instagram Direct Message within the aforementioned period of 28 days in order to process the shipment. Shipping is handled by us. The participant is responsible for the accuracy of the data.

Data protection
The winners’ contact details will only be stored in order to send the prize from the competition. Further information on data protection can be found in the privacy policy at https://stg-fachhochschulederwirtschaft-stg.kinsta.cloud/datenschutz/.

Legal process
This competition is subject exclusively to the laws of the Federal Republic of Germany. Legal recourse is excluded.

Liability
The FHDW NRW gGmbH is not liable for damages in connection with participation in the competition or with the acceptance and use of the prize, unless the competition provider or its vicarious agents act with intent or gross negligence. This shall not affect any claims for compensation due to injury to life, limb and health as well as material contractual obligations.

Other provisions
We expressly reserve the right to terminate the competition without prior notice and without giving reasons. This applies in particular to any reasons that would disrupt or prevent the competition from running as planned.

Should any provision of these Terms and Conditions of Participation be or become invalid in whole or in part, this shall not affect the validity of the remaining provisions of these Terms and Conditions of Participation. The invalid provision shall be replaced by the legally permissible provision that comes closest to the economic meaning and purpose expressed in the invalid provision. The same applies in the event of a loophole in these conditions of participation.

Status: November 2022

Web ana­ly­sis, mo­ni­to­ring and op­ti­miza­t­i­on

Web analysis (also referred to as “reach measurement”) is used to evaluate the flow of visitors to our online offering and may include behavior, interests or demographic information about visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, we can, for example, recognize at what time our online offer or its functions or content are most frequently used or invite reuse. We can also understand which areas need to be optimized.

In addition to web analysis, we may also use test procedures, e.g. to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles, i.e. data summarized for a usage process, can be created for these purposes and information can be stored in a browser or in an end device and read out from it. The information collected includes, in particular, websites visited and the elements used there, as well as technical information such as the browser used, the computer system used and information on usage times. If users have consented to the collection of their location data from us or from the providers of the services we use, location data may also be processed.

The IP addresses of users are also stored. However, we use an IP masking procedure (i.e. pseudonymization by shortening the IP address) to protect users. In general, no clear user data (such as e-mail addresses or names) is stored for web analysis, A/B testing and optimization, but pseudonyms. This means that we and the providers of the software used do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of Processing: Web Analytics (e.g. access statistics, recognition of returning visitors); Profiles with user-related information (Creating user profiles); Clicktracking; A/B Tests; Feedback (e.g. collecting feedback via online form); Heatmaps (Mouse movements of the users, which are combined to an overall picture); Polls and Questionnaires (e.g. surveys with input options, multiple choice questions); Marketing.
• Security measures: IP masking (pseudonymization of the IP address).
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further information on processing operations, procedures and services:

• Google Analytics: Web analysis, reach measurement and measurement of user flows; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms; Standard contractual clauses (guaranteeing the level of data protection for processing in third countries): https://business.safety.google/adsprocessorterms; Option to object (opt-out): Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements: https://adssettings.google.com/authenticated; further information: https://privacy.google.com/businesses/adsservices (types of processing and processed data).
• Hotjar: Software for the analysis and optimization of online offers based on feedback functions as well as pseudonymous measurements and analyses of user behavior, which may include in particular A/B tests (measurement of the popularity and user-friendliness of different content and functions), measurement of click paths and interaction with content and functions of the online offer; Service provider: Hotjar Ltd, 3 Lyons Range, 20 Bisazza Street, Sliema SLM 1640, Malta ; Website: https://www.hotjar.com; Privacy Policy: https://www.hotjar.com/legal/policies/privacy. Cookie policy: https://www.hotjar.com/legal/policies/cookie-information; Deletion of data: The cookies that Hotjar uses have different “lifespans”; some remain valid for up to 365 days, some only during the current visit; Opt-out: https://www.hotjar.com/legal/compliance/opt-out.

etra­cker

The provider of this website uses services of etracker GmbH from Hamburg, Germany(www.etracker.com) to analyze usage data. Cookies are used to statistically analyze the use of this website by its visitors and to display usage-related content or advertising. Cookies are small text files that are stored by the Internet browser on the user’s end device. etracker cookies do not contain any information that enables a user to be identified.

The data generated with etracker is processed and stored by etracker on behalf of the provider of this website exclusively in Germany and is therefore subject to the strict German and European data protection laws and standards. etracker has been independently tested, certified and awarded the ePrivacyseal data protection seal of approval.

Data processing is carried out on the legal basis of Art. 6 para. 1 lit. f (legitimate interest) of the EU General Data Protection Regulation (EU GDPR). Our legitimate interest lies in the optimization of our online offering and our website. Since the privacy of our visitors is particularly important to us, etracker anonymizes the IP address as early as possible and converts login or device identifiers into a unique key that is not assigned to a person. No other use, merging with other data or disclosure to third parties is carried out by etracker.

You can object to the data processing described above at any time, insofar as it is personal. Your objection has no negative consequences for you.

Further information on data protection at etracker can be found here.

On­line mar­ke­ting

We process personal data for online marketing purposes, which may include in particular the marketing of advertising space or the presentation of advertising and other content (collectively referred to as “content”) based on the potential interests of users and the measurement of its effectiveness.

For these purposes, so-called user profiles are created and stored in a file (so-called “cookie”) or similar procedures are used, by means of which the user data relevant for the presentation of the aforementioned content is stored. This information may include, for example, content viewed, websites visited, online networks used, but also communication partners and technical information such as the browser used, the computer system used and information on usage times and functions used. If users have consented to the collection of their location data, this can also be processed.

The IP addresses of users are also stored. However, we use available IP masking procedures (i.e. pseudonymization by shortening the IP address) to protect users. In general, no clear user data (such as e-mail addresses or names) is stored as part of the online marketing process, but pseudonyms. This means that we and the providers of the online marketing processes do not know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is generally stored in cookies or by means of similar procedures. These cookies can later generally also be read on other websites that use the same online marketing procedure and analyzed for the purpose of displaying content as well as supplemented with further data and stored on the server of the online marketing procedure provider.

As an exception, clear data can be assigned to the profiles. This is the case, for example, if the users are members of a social network whose online marketing processes we use and the network links the user profiles with the aforementioned data. Please note that users can make additional agreements with the providers, e.g. by giving their consent during registration.

We only receive access to summarized information about the success of our advertisements. However, as part of so-called conversion measurements, we can check which of our online marketing procedures have led to a so-called conversion, i.e., for example, to the conclusion of a contract with us. Conversion measurement is used solely to analyze the success of our marketing measures.

Unless otherwise stated, we ask you to assume that cookies used are stored for a period of two years.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Event data (Facebook) (“event data” is data that can be transmitted by us to Facebook via Facebook pixels (via apps or in other ways), for example, and relates to people or their actions; the data includes, for example, information about visits to websites, interactions with content, functions, app installations, product purchases, etc.).The event data is processed for the purpose of creating target groups for content and advertising information (custom audiences); event data does not include the actual content (such as comments written), no login information and no contact information (i.e. no names, email addresses and telephone numbers). Event data will be deleted by Facebook after a maximum of two years, the target groups formed from them with the deletion of our Facebook account); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: remarketing; conversion measurement (measurement of the effectiveness of marketing measures); target group formation; target group formation (determination of target groups relevant for marketing purposes or other output of content); marketing; profiles with user-related information (creation of user profiles).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a. GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).
• Possibility of objection (opt-out): We refer to the data protection notices of the respective providers and the objection options (so-called “opt-out”) specified for the providers. If no explicit opt-out option has been specified, you have the option of deactivating cookies in your browser settings. However, this may limit the functions of our online offer. We therefore recommend the following additional opt-out options, which are summarized for the respective areas:a) Europe: https://www.youronlinechoices.eu.
  b) Canada: https://www.youradchoices.ca/choices.
  c) USA: https://www.aboutads.info/choices.
  d) Cross-territory: https://optout.aboutads.info.

Further information on processing operations, procedures and services:

• Facebook pixel and target group formation (custom audiences): With the help of the Facebook pixel (or comparable functions, for the transmission of event data or contact information by means of interfaces in apps), it is possible for Facebook to determine the visitors of our online offer as a target group for the display of ads (so-called “Facebook ads”). Accordingly, we use the Facebook pixel to display the Facebook ads placed by us only to those users on Facebook and within the services of the partners cooperating with Facebook (so-called “Audience Network”). https://www.facebook.com/audiencenetwork/ ) who have also shown an interest in our online offering or who have certain characteristics (e.g. interest in certain topics or products that can be seen from the websites visited) that we transmit to Facebook (so-called “Custom Audiences”). With the help of the Facebook pixel, we also want to ensure that our Facebook ads correspond to the potential interest of users and are not annoying. With the help of the Facebook pixel, we can also track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad (so-called “conversion measurement”); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Standard contractual clauses (guarantee of data protection level for processing in third countries): The “Facebook-EU data transfer addendum” applies (https://www.facebook.com/legal/EU_data_transfer_addendum) in the case of order processing by Facebook as the basis for the processing of event data of EU citizens in the USA and the inclusion in the “Facebook Platform Terms of Use” (https://developers.facebook.com/terms) with regard to the independent processing of event data by Facebook in the context of ad placement; Further information: The “Data processing conditions” (https://www.facebook.com/legal/terms/dataprocessing/update) with regard to event data that Facebook processes on behalf of companies in order to provide reports and analyses; furthermore, the “Addendum for controllers” applies as an agreement on joint controllership (Art. 26 para. 1 sentence 3 GDPR), which is relevant in the case of Facebook’s own processing of event data for the purposes of targeting and improving and securing Facebook products.
• Google Ads and conversion measurement: We use the online marketing process “Google Ads” to place ads in the Google advertising network (e.g. in search results, in videos, on websites, etc.) so that they are displayed to users who are presumed to be interested in the ads (so-called “conversion”). We also measure the conversion of the ads. However, we only learn the anonymous total number of users who clicked on our ad and were redirected to a page with a so-called “conversion tracking tag”. However, we ourselves do not receive any information that can be used to identify users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://marketingplatform.google.com; Privacy Policy: https://policies.google.com/privacy; Further information: Types of processing and data processed: https: //privacy.google.com/businesses/adsservices; Data processing conditions for Google advertising products: Information on the services Data processing terms between controllers and standard contractual clauses for third country transfers of data: https://business.safety.google/adscontrollerterms.
• Extended conversions for Google Ads: If customers click on our Google ads and subsequently use the advertised service (so-called “conversion”), the data entered by the user, such as the e-mail address, name, home address or telephone number, can be transmitted to Google. The hash values are then compared with users’ existing Google accounts in order to better evaluate and improve user interaction with the ads (e.g. clicks or views) and thus their performance; website: https://support.google.com/google-ads/answer/9888656.

Pre­sence in so­ci­al net­works (so­ci­al me­dia)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may result in risks for users because, for example, it could make it more difficult to enforce users’ rights.

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, user profiles can be created based on user behavior and the resulting interests of users. The usage profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the user’s computer, in which the user’s usage behavior and interests are stored. Furthermore, data can also be stored in the user profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

For a detailed description of the respective forms of processing and the opt-out options, please refer to the data protection declarations and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we would also like to point out that these can be asserted most effectively with the providers. Only the providers have access to the users’ data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

• Processed data types: Contact data (e.g. e-mail, telephone numbers); Content data (e.g. entries in online forms); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Contact requests and communication; feedback (e.g. collecting feedback via online form); marketing.
• Legal basis: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further information on processing operations, procedures and services:

• Instagram: Social network; Service provider: Instagram Inc, 1601 Willow Road, Menlo Park, CA, 94025, USA; Website: https://www.instagram.com; Privacy Policy: https://instagram.com/about/legal/privacy.
• Facebook pages: Profiles within the social network Facebook – We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data of visitors to our Facebook page (so-called “fan page”). This data includes information about the types of content users view or interact with, or the actions they take (see “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by the users (e.g. B. IP addresses, operating system, browser type, language settings, cookie data; see under “Device information” in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services, known as “Page Insights”, for page operators to help them understand how people interact with their pages and the content associated with them. We have concluded a special agreement with Facebook (“Information on Page Insights”, https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular which security measures Facebook must observe and in which Facebook has agreed to fulfill the rights of data subjects (i.e. users can, for example, send information or deletion requests directly to Facebook). The rights of users (in particular to information, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Information on Page Insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Standard Contractual Clauses (Safeguarding the level of data protection when processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further information: Agreement on joint controllership: https: //www.facebook.com/legal/terms/information_about_page_insights_data.
• LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Data Processing Agreement: https://legal.linkedin.com/dpa; Standard Contractual Clauses (Safeguarding the level of data protection when processing data in third countries): https://legal.linkedin.com/dpa; Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
• Snapchat: Social network; Service provider: Snap Inc, 3000 31st Street, Santa Monica, California 90405 USA; Website: https://www.snapchat.com/; Privacy Policy: https://www.snap.com/de-DE/privacy/privacy-policy, Cookie Policy: https://www.snap.com/de-DE/cookie-policy; Standard Contractual Clauses (Safeguarding the level of data protection when processing data in third countries): https://www.snap.com/en-US/terms/standard-contractual-clauses.
• TikTok: Social network / video platform; Service provider: musical.ly Inc., 10351 Santa Monica Blvd #310, Los Angeles, CA 90025 USA; Website: https://www.tiktok.com; Privacy Policy: https://www.tiktok.com/de/privacy-policy.
• Twitter: Social network; service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, parent company: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Privacy Policy: https://twitter.com/privacy,(Settings: https://twitter.com/personalization).
• YouTube: Social network and video platform; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Privacy Policy: https://policies.google.com/privacy; Opt-Out: https://adssettings.google.com/authenticated.
• Xing: Social network; Service provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany; Website: https://www.xing.de; Privacy Policy: https://privacy.xing.com/de/datenschutzerklaerung.

Plug­ins and em­bed­ded func­tions and con­tent

We incorporate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). This may include, for example, graphics, videos or city maps (hereinafter uniformly referred to as “content”).

The integration always requires that the third-party providers of this content process the IP address of the user, as they would not be able to send the content to their browser without the IP address. The IP address is therefore required to display this content or function. We endeavor to only use content whose respective providers only use the IP address to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to analyze information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offer, as well as being linked to such information from other sources.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is consent. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.

• Processed data types: Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses); Inventory data (e.g. names, addresses); Contact data (e.g. e-mail, telephone numbers); Content data (e.g. entries in online forms).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online offer and user-friendliness; provision of contractual services and customer service.
• Legal basis: Consent (Art. 6 para. 1 p. 1 lit. a. GDPR); contract fulfillment and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b. GDPR); Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. GDPR).

Further information on processing operations, procedures and services:

• Font Awesome: Display of fonts and symbols; Service provider: Fonticons, Inc. ,6 Porter Road Apartment 3R, Cambridge, MA 02140, USA; Website: https://fontawesome.com/; Privacy Policy: https://fontawesome.com/privacy.
• Google Maps: We integrate the maps of the “Google Maps” service of the provider Google. The processed data may include, in particular, IP addresses and location data of the users, which, however, are not collected without their consent (usually in the context of the settings of their mobile devices); Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://cloud.google.com/maps-platform; Privacy policy: https://policies.google.com/privacy; possibility of objection (opt-out): Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of advertisements: https://adssettings.google.com/authenticated.
• reCAPTCHA: We integrate the “reCAPTCHA” function in order to be able to recognize whether entries (e.g. in online forms) are made by humans and not by automatically acting machines (so-called “bots”). The processed data may include IP addresses, information on operating systems, devices or browsers used, language settings, location, mouse movements, keyboard strokes, time spent on websites, previously visited websites, interactions with ReCaptcha on other websites, possibly cookies and results of manual recognition processes (e.g. answering questions asked or selecting objects in images). Data processing is carried out on the basis of our legitimate interest in protecting our online offering from abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://www.google.com/recaptcha/; Privacy policy: https://policies.google.com/privacy; possibility of objection (opt-out): Opt-Out-Plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of advertisements: https://adssettings.google.com/authenticated.
• YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website: https://www.youtube.com; Privacy Policy: https://policies.google.com/privacy; Opt-Out: Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=de; Settings for the display of advertisements: https://adssettings.google.com/authenticated.

• Google Translate
  This site uses the translation service Google Translate via an API. The provider is Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

  To use the functions of Google Translate, it is necessary to save your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this site has no influence on this data transmission.

  The use of Google Translate is in the interest of easy accessibility and accessibility of our online offers for international visitors. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR represent.

  You can find more information on the handling of user data in Google’s privacy policy: https://www.google.de/intl/de/policies/privacy/.

Amend­ment and up­dating of the pri­va­cy po­li­cy

We ask you to inform yourself regularly about the content of our privacy policy. We will adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and please check the information before contacting us.

Rights of the da­ta sub­jects

As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6 (1) GDPR. 1 lit. e or f GDPR; this also applies to profiling based on these provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw your consent at any time.
• Right of access: You have the right to obtain confirmation as to whether or not personal data concerning you is being processed and to obtain information about this data and further information and a copy of the data in accordance with the legal requirements.
• Right to rectification: In accordance with the statutory provisions, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
• Right to erasure and restriction of processing: In accordance with the statutory provisions, you have the right to demand that data concerning you be erased immediately or, alternatively, to demand that the processing of the data be restricted in accordance with the statutory provisions.
• Right to data portability: You have the right to receive the data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format in accordance with the legal requirements or to request its transmission to another controller.
• Complaint to a supervisory authority: In accordance with the statutory provisions and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State in which you are habitually resident, the supervisory authority of your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

De­fi­ni­ti­ons of terms

This section provides you with an overview of the terms used in this privacy policy. Many of the terms are taken from the law and defined above all in Art. 4 GDPR. The legal definitions are binding. The following explanations, on the other hand, are primarily intended to aid understanding. The terms are sorted alphabetically.

• A/B tests: A/B tests are used to improve the user-friendliness and performance of online offers. For example, users are shown different versions of a website or its elements, such as input forms, on which the placement of the content or the labels of the navigation elements may differ. Subsequently, the behavior of the users, e.g. longer time spent on the website or more frequent interaction with the elements, can be used to determine which of these websites or elements are more likely to meet the needs of the users.
• Content Delivery Network (CDN): A “Content Delivery Network” (CDN) is a service with the help of which the content of an online offer, in particular large media files such as graphics or program scripts, can be delivered faster and more securely with the help of regionally distributed servers connected via the Internet.
• Heatmaps: “Heatmaps” are user mouse movements that are summarized into an overall picture, which can be used, for example, to recognize which website elements are preferred and which website elements users prefer less.
• Click tracking: Click tracking makes it possible to monitor the movements of users within an entire online offering. Since the results of these tests are more accurate if user interaction can be tracked over a certain period of time (e.g. so that we can find out whether a user likes to return), cookies are usually stored on users’ computers for these test purposes.
• Conversion measurement: Conversion measurement (also known as “visit action evaluation”) is a procedure that can be used to determine the effectiveness of marketing measures. For this purpose, a cookie is usually stored on the user’s device within the websites on which the marketing measures are carried out and then retrieved again on the target website. For example, we can track whether the ads we have placed on other websites have been successful.
• Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Profiles with user-related information: The processing of “profiles with user-related information”, or “profiles” for short, includes any type of automated processing of personal data that consists of using this personal data to analyze, evaluate or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include various information relating to demographics, behavior and interests, such as interaction with websites and their content, etc.) (e.g. interests in certain content or products, click behavior on a website or location). Cookies and web beacons are often used for profiling purposes.
• Reach measurement: Reach measurement (also known as web analytics) is used to evaluate the flow of visitors to an online offer and can include the behavior or interests of visitors in certain information, such as website content. With the help of reach analysis, website owners can, for example, recognize at what time visitors visit their website and what content they are interested in. This allows them, for example, to better adapt the content of the website to the needs of their visitors. For the purposes of reach analysis, pseudonymous cookies and web beacons are often used to recognize returning visitors and thus obtain more precise analyses of the use of an online offer.
• Remarketing: The term “remarketing” or “retargeting” is used when, for example, it is noted for advertising purposes which products a user was interested in on a website in order to remind the user of these products on other websites, e.g. in advertisements.
• Controller: The “controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: “Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically every handling of data, be it collection, analysis, storage, transmission or deletion.
• Target group formation: Target group formation (or “custom audiences”) is when target groups are determined for advertising purposes, e.g. the display of advertisements. For example, based on a user’s interest in certain products or topics on the Internet, it can be concluded that this user is interested in advertisements for similar products or the online store in which they viewed the products. The term “lookalike audiences” (or similar target groups) is used when the content deemed suitable is displayed to users whose profiles or interests presumably correspond to the users for whom the profiles were created. Cookies and web beacons are generally used for the purpose of creating custom audiences and lookalike audiences.