Privacy notice

This English version is a translation provided for ease of understanding. Only the German version is binding; in the event of any discrepancy, the German version prevails.

Preamble

With the following privacy notice we would like to explain to you which types of your personal data (referred to below in short as "data") we process, for which purposes and to what extent. The privacy notice applies to all processing of personal data carried out by us, both in the provision of our services and in particular on our websites, in mobile applications and within external online presences such as our social media profiles (referred to collectively below as "online offering").

The terms used are not gender specific.

Table of contents

• Preamble
• Controller
• Overview of the processing operations
• Relevant legal bases
• Security measures
• Transfer of personal data
• International data transfers
• General information on data storage and erasure
• Rights of data subjects
• Business services
• Business processes and procedures
• Provision of the online offering and web hosting
• Use of cookies
• Handling of contacts and enquiries
• Video conferences, online meetings, webinars and screen sharing
• Newsletter and electronic notifications
• Web analytics, monitoring and optimisation
• Presences in social networks (social media)
• Plug-ins and embedded functions and content
• Amendment and updating
• Definitions of terms

Controller

IAGO GmbH, Hohe Bleichen 22, 20354 Hamburg, Germany

Authorised representatives: Niclas Lahmer

E-mail address: info@iago.de

Legal notice: https://iago.de/impressum/

Contact for data protection matters: Niclas Lahmer, Managing Director, data protection officer and data protection auditor accredited by TÜV, info@iago.de

Overview of the processing operations

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of data processed

• Master data.
• Payment data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication and procedural data.
• Image and video recordings.
• Sound recordings.
• Log data.

Categories of data subjects

• Recipients of services and clients.
• Employees.
• Interested parties.
• Communication partners.
• Users.
• Business and contractual partners.
• Persons depicted.
• Third parties.

Purposes of processing

• Provision of contractual services and performance of contractual obligations.
• Communication.
• Security measures.
• Direct marketing.
• Reach measurement.
• Office and organisational procedures.
• Organisational and administrative procedures.
• Feedback.
• Marketing.
• Profiles with user related information.
• Provision of our online offering and ease of use.
• Information technology infrastructure.
• Financial and payment management.
• Public relations.
• Sales promotion.
• Business processes and commercial procedures.

Relevant legal bases

Relevant legal bases under the GDPR: below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection requirements in your country or ours may apply. Should more specific legal bases be relevant in an individual case, we will inform you of these in the privacy notice.

• Consent (Art. 6(1)(1)(a) GDPR): the data subject has given consent to the processing of personal data relating to them for one specific purpose or several specific purposes.
• Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR): the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6(1)(1)(c) GDPR): the processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1)(1)(f) GDPR): the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

National data protection provisions in Germany: in addition to the data protection provisions of the GDPR, national data protection provisions apply in Germany. These include in particular the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act, BDSG). The BDSG contains special provisions on, in particular, the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated decision making in individual cases including profiling. In addition, the data protection acts of the individual federal states may apply.

Note on the application of the GDPR and the Swiss FADP: this privacy notice serves to provide information both under the Swiss Federal Act on Data Protection (FADP) and under the General Data Protection Regulation (GDPR). For this reason, please note that the terms of the GDPR are used because of their broader territorial application and their familiarity. In particular, instead of the terms "processing" of "personal data", "overriding interest" and "particularly sensitive personal data" used in the Swiss FADP, the terms "processing" of "personal data", "legitimate interest" and "special categories of data" used in the GDPR are used. Where the Swiss FADP applies, however, the legal meaning of the terms continues to be determined by the Swiss FADP.

Security measures

In accordance with the statutory requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing as well as the differing likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access to, input, disclosure, availability and separation of that data. We have also set up procedures that ensure the exercise of data subject rights, the erasure of data and responses to threats to the data. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in line with the principle of data protection by design and by default.

Securing online connections with TLS and SSL encryption technology (HTTPS): in order to protect the data of users transmitted through our online services against unauthorised access, we use TLS and SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user's browser (or between two servers), which protects the data against unauthorised access. TLS, as the further developed and more secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL or TLS certificate, this is signalled by HTTPS appearing in the address. This serves as an indicator to users that their data is transmitted securely and in encrypted form.

Transfer of personal data

In the course of our processing of personal data, it happens that the data is transferred to, or disclosed to, other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks, or providers of services and content that are embedded in a website. In such cases we observe the statutory requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

International data transfers

Data processing in third countries: where we transfer data to a third country (that is, outside the European Union (EU) or the European Economic Area (EEA)), or where this happens in the course of using third party services or the disclosure or transfer of data to other persons, bodies or companies (which can be recognised from the postal address of the respective provider or where the privacy notice expressly refers to the transfer of data to third countries), this is always done in accordance with the statutory requirements.

For data transfers to the USA we rely primarily on the Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of the EU Commission of 10 July 2023. In addition, we have concluded standard contractual clauses with the respective providers which comply with the requirements of the EU Commission and set out contractual obligations to protect your data.

This twofold safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the standard contractual clauses serve as additional security. Should changes arise in relation to the DPF, the standard contractual clauses take effect as a reliable fallback. In this way we ensure that your data remains adequately protected at all times, even in the event of political or legal changes.

For each service provider we inform you whether it is certified under the DPF and whether standard contractual clauses are in place. Further information on the DPF and a list of the certified companies can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English).

For data transfers to other third countries, corresponding safeguards apply, in particular standard contractual clauses, express consent or transfers required by law. Information on third country transfers and applicable adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.

General information on data storage and erasure

We erase personal data that we process in accordance with the statutory provisions as soon as the underlying consent is withdrawn or no further legal bases for the processing exist. This concerns cases in which the original purpose of the processing ceases to apply or the data is no longer needed. Exceptions to this rule exist where statutory obligations or particular interests require the data to be kept or archived for longer.

In particular, data that has to be kept for reasons of commercial or tax law, or whose storage is necessary for the pursuit of legal claims or for the protection of the rights of other natural or legal persons, must be archived accordingly.

Our privacy notice contains additional information on the retention and erasure of data that applies specifically to certain processing operations.

Where several statements are made about the retention period or erasure periods for an item of data, the longest period always applies.

Where a period does not expressly begin on a specific date and is at least one year long, it starts automatically at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in which data is stored, the triggering event is the moment at which the termination or other ending of the legal relationship takes effect.

Data that is no longer kept for the originally intended purpose but on the basis of statutory requirements or other reasons is processed by us exclusively for the reasons that justify its retention.

Further notes on processing operations, procedures and services:

• 10 years: retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets and the working instructions and other organisational documents required to understand them (section 147(1) no. 1 in conjunction with (3) of the German Fiscal Code, section 14b(1) of the German VAT Act, section 257(1) no. 1 in conjunction with (4) of the German Commercial Code).
• 8 years: accounting vouchers such as invoices and cost receipts (section 147(1) nos. 4 and 4a in conjunction with (3) sentence 1 of the German Fiscal Code and section 257(1) no. 4 in conjunction with (4) of the German Commercial Code).
• 6 years: other business documents: commercial or business letters received, copies of commercial or business letters sent, other documents insofar as they are relevant for taxation, for example hourly wage slips, cost accounting sheets, calculation documents, price markings, but also payroll documents insofar as they are not already accounting vouchers, and till rolls (section 147(1) nos. 2, 3, 5 in conjunction with (3) of the German Fiscal Code, section 257(1) nos. 2 and 3 in conjunction with (4) of the German Commercial Code).
• 3 years: data that is needed in order to take account of potential warranty and damages claims or similar contractual claims and rights, and to deal with related enquiries, is stored on the basis of past business experience and customary industry practice for the duration of the regular statutory limitation period of three years (sections 195, 199 of the German Civil Code).

Rights of data subjects

Rights of data subjects under the GDPR: as a data subject you have various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:

• Right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on those provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: you have the right to withdraw consent given at any time.
• Right of access: you have the right to request confirmation as to whether data concerning you is being processed, and to obtain access to that data as well as further information and a copy of the data in accordance with the statutory requirements.
• Right to rectification: in accordance with the statutory requirements, you have the right to request that data concerning you be completed or that inaccurate data concerning you be rectified.
• Right to erasure and restriction of processing: in accordance with the statutory requirements, you have the right to request that data concerning you be erased without delay, or alternatively, in accordance with the statutory requirements, to request a restriction of the processing of the data.
• Right to data portability: you have the right, in accordance with the statutory requirements, to receive data concerning you which you have provided to us in a structured, commonly used and machine readable format, or to request its transmission to another controller.
• Complaint to a supervisory authority: in accordance with the statutory requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the member state of your habitual residence, the supervisory authority of your place of work or of the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

Business services

We process data of our contractual and business partners, for example customers and interested parties (referred to collectively as "contractual partners"), in the context of contractual and comparable legal relationships and related measures, and with regard to communication with the contractual partners (or prior to a contract), for example in order to answer enquiries.

We use this data in order to fulfil our contractual obligations. These include in particular the obligations to provide the agreed services, any obligations to update them and remedies in the event of warranty claims and other defects in performance. In addition, we use the data to safeguard our rights and for the purposes of the administrative tasks associated with these obligations as well as the organisation of the company. We also process the data on the basis of our legitimate interests both in proper and commercially sound management and in security measures to protect our contractual partners and our business operations against misuse and against risks to their data, secrets, information and rights (for example when involving telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisers, payment service providers or tax authorities). Within the framework of applicable law, we pass on the data of contractual partners to third parties only to the extent that this is necessary for the aforementioned purposes or in order to fulfil legal obligations. Contractual partners are informed of further forms of processing, for example for marketing purposes, in this privacy notice.

We inform contractual partners which data is required for the aforementioned purposes before or in the course of collecting the data, for example in online forms, by special marking (for example colours) or symbols (for example asterisks or similar), or in person.

We erase the data after the expiry of statutory warranty and comparable obligations, that is, as a rule after four years, unless the data is stored in a customer account, for example for as long as it has to be kept for legal reasons of archiving (for tax purposes usually ten years). Data disclosed to us by the contractual partner in the course of an engagement is erased in accordance with the requirements and, as a rule, after the end of the engagement.

• Types of data processed: master data (for example full name, home address, contact details, customer number, etc.); payment data (for example bank details, invoices, payment history); contact data (for example postal and e-mail addresses or telephone numbers). Contract data (for example subject matter of the contract, term, customer category).
• Data subjects: recipients of services and clients; interested parties. Business and contractual partners.
• Purposes of processing: provision of contractual services and performance of contractual obligations; communication; office and organisational procedures; organisational and administrative procedures. Business processes and commercial procedures.
• Retention and erasure: erasure in accordance with the information in the section "General information on data storage and erasure".
• Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legal obligation (Art. 6(1)(1)(c) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further notes on processing operations, procedures and services:

• Consulting: we process the data of our clients as well as of interested parties and other principals or contractual partners (referred to uniformly as "clients") in order to be able to provide our services to them. The procedures that form part of and serve the purposes of consulting include: making contact and communicating with clients, carrying out needs and requirements analyses, planning and implementing consulting projects, documenting project progress and results, recording and managing client specific information and data, scheduling and organising appointments, providing consulting resources and materials, invoicing and payment management, follow up work on consulting projects, quality assurance and feedback processes. The data processed, the nature, scope, purpose and necessity of its processing are determined by the underlying contractual and client relationship. Where this is necessary for the performance of our contract, for the protection of vital interests or by law, or where the client has given consent, we disclose or transfer client data, observing the requirements of professional law, to third parties or agents such as authorities, subcontractors or providers of IT, office or comparable services; legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).
• Online courses and online training: we process the data of the participants of our online courses and online training (referred to uniformly as "participants") in order to be able to provide our course and training services to them. The data processed, the nature, scope, purpose and necessity of its processing are determined by the underlying contractual relationship. In principle, the data includes information on the courses and services used and, where this is part of our range of services, personal specifications and results of the participants. The forms of processing also include performance assessment and the evaluation of our services and those of the course and training leaders. In addition, depending on the equipment and structure of the respective courses or learning content, further processing operations may be implemented, such as attendance tracking to document participation, progress monitoring to measure and analyse learning progress by collecting examination and test results, and the analysis of interactions in learning platforms, such as forum posts and submitted assignments; legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).
• Registering for courses through the website: we accept registrations through the booking form on our website. The details of the company and the contact person, the names, dates of birth and e-mail addresses of the persons registered, the course chosen and its date, and the category of participant from which the price follows are processed. In addition we record the sending IP address in order to be able to recognise and prevent abusive and automated registrations. The details are first held as an enquiry and are only transferred to our records after we have checked them; legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).
• Customer portal: for corporate customers we operate a portal in which they can view the certificates of their staff, the courses booked together with the participants and, where enabled for the account, invoices, records, consulting hours and checklists. For access we process the name and e-mail address of the authorised person, a password stored only in encrypted form and, where set up, the second factor. Logins, failed login attempts and security relevant events are logged with the time and the IP address in order to be able to detect unauthorised access. The portal runs on our own infrastructure; legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).
• Verification of certificates: certificates that have been issued can be checked for authenticity on our website, either through the QR code on the certificate or by entering first name, surname and certificate number. Only the certificate number, the date of issue and the validity are displayed, no further details about the person. Every check is logged with the time and the IP address in order to detect the systematic trying out of numbers; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).
• Booking an online appointment: on the page Get to know us an introductory call can be booked directly. We process your first name and surname, your company, your e-mail address, your telephone number, the date and time chosen and the platform chosen as well as, where you provide it, what you would like to talk about. We use these details to arrange the call, to send you the confirmation with the link to the call and a calendar invitation, and to hold the call. The booking is stored in our internal system and in the calendar of the person holding the call, both on our own infrastructure. To prevent misuse we limit the number of bookings per sender; for this the IP address is only used temporarily in memory and is not stored with the booking. The call itself takes place via Zoom or Microsoft Teams; the information in the section "Video conferences, online meetings, webinars and screen sharing" applies to this. We erase your details as soon as they are no longer required and no retention obligations apply; legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).

Business processes and procedures

Personal data of recipients of services and principals, including customers, clients or, in specific cases, mandators, patients or business partners as well as other third parties, is processed in the context of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates commercial operations in areas such as customer management, sales, payment transactions, accounting and project management.

The data collected serves to fulfil contractual obligations and to organise operational processes efficiently. This includes handling business transactions, managing customer relationships, optimising sales strategies and ensuring internal invoicing and financial processes. In addition, the data supports the safeguarding of the controller's rights and assists administrative tasks and the organisation of the company.

Personal data may be passed on to third parties where this is necessary in order to fulfil the purposes mentioned or legal obligations. Once statutory retention periods have expired or the purpose of the processing ceases to apply, the data is erased. This also covers data that has to be stored for longer because of tax law and statutory record keeping obligations.

• Types of data processed: master data (for example full name, home address, contact details, customer number, etc.); payment data (for example bank details, invoices, payment history); contact data (for example postal and e-mail addresses or telephone numbers); content data (for example messages and contributions in text or image form and the information relating to them, such as details of authorship or the time of creation); contract data (for example subject matter of the contract, term, customer category); log data (for example log files concerning logins or the retrieval of data or access times); usage data (for example page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (for example IP addresses, time stamps, identification numbers, persons involved).
• Data subjects: recipients of services and clients; interested parties; communication partners; business and contractual partners; third parties; users (for example website visitors, users of online services). Employees (for example staff, applicants, temporary staff and other members of staff).
• Purposes of processing: provision of contractual services and performance of contractual obligations; office and organisational procedures; business processes and commercial procedures; communication; marketing; sales promotion; financial and payment management. Information technology infrastructure (operation and provision of information systems and technical devices such as computers, servers, etc.).
• Retention and erasure: erasure in accordance with the information in the section "General information on data storage and erasure".
• Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR). Legal obligation (Art. 6(1)(1)(c) GDPR).

Further notes on processing operations, procedures and services:

• Contact management and contact maintenance: procedures required for the organisation, maintenance and safeguarding of contact information (for example setting up and maintaining a central contact database, regular updates of contact details, monitoring data integrity, implementing data protection measures, ensuring access controls, carrying out backups and restores of contact data, training staff in the effective use of contact management software, regular review of the communication history and adjustment of contact strategies); legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).
• General payment transactions: procedures required for carrying out payment transactions, monitoring bank accounts and controlling payment flows (for example preparing and checking transfers, handling direct debits, checking account statements, monitoring incoming and outgoing payments, managing returned direct debits, reconciling accounts, cash management); legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).
• Accounting, accounts payable, accounts receivable: procedures required for recording, processing and checking business transactions in the field of accounts payable and accounts receivable (for example preparing and checking incoming and outgoing invoices, monitoring and managing open items, carrying out payment transactions, handling reminders, reconciling accounts in respect of receivables and liabilities, accounts payable and accounts receivable); legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR), legal obligation (Art. 6(1)(1)(c) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).
• Financial accounting and taxes: procedures required for recording, managing and checking financially relevant business transactions and for calculating, declaring and paying taxes (for example allocating and posting business transactions, preparing quarterly and annual financial statements, carrying out payment transactions, handling reminders, reconciling accounts, tax advice, preparing and filing tax returns, dealing with tax matters); legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR), legal obligation (Art. 6(1)(1)(c) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).
• Marketing, advertising and sales promotion: procedures required in the context of marketing, advertising and sales promotion (for example market analysis and definition of target groups, development of marketing strategies, planning and carrying out advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade fair participation, customer loyalty programmes, sales promotion measures, performance measurement and optimisation of marketing activities, budget management and cost control); legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).

Provision of the online offering and web hosting

We process the data of users in order to be able to make our online services available to them. For this purpose we process the user's IP address, which is necessary in order to transmit the content and functions of our online services to the user's browser or device.

• Types of data processed: usage data (for example page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (for example IP addresses, time stamps, identification numbers, persons involved); log data (for example log files concerning logins or the retrieval of data or access times). Content data (for example messages and contributions in text or image form and the information relating to them, such as details of authorship or the time of creation).
• Data subjects: users (for example website visitors, users of online services).
• Purposes of processing: provision of our online offering and ease of use; information technology infrastructure (operation and provision of information systems and technical devices such as computers, servers, etc.). Security measures.
• Retention and erasure: erasure in accordance with the information in the section "General information on data storage and erasure".
• Legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).

Further notes on processing operations, procedures and services:

• Provision of the online offering on our own infrastructure: we operate our online offering on our own infrastructure. Storage space, computing capacity and the software used are therefore in our hands; no external provider is involved in delivering the pages, and the server logs that arise in the process do not leave our house; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).
• Collection of access data and log files: access to our online offering is logged in the form of so called server log files. Server log files may include the address and name of the web pages and files retrieved, the date and time of retrieval, volumes of data transferred, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (the page visited previously) and, as a rule, IP addresses and the requesting provider. Server log files may be used, on the one hand, for security purposes, for example to avoid overloading the servers (in particular in the case of abusive attacks, so called DDoS attacks), and on the other hand to ensure the utilisation of the servers and their stability; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR). Erasure of data: log file information is stored for a maximum of 30 days and then erased or anonymised. Data whose further retention is necessary for evidentiary purposes is exempt from erasure until the respective incident has been finally clarified.
• Sending and storing e-mails: our operations include the sending, receipt and storage of e-mails. For these purposes the addresses of the recipients and senders as well as further information concerning the sending of e-mails (for example the providers involved) and the content of the respective e-mails are processed. The aforementioned data may also be processed for the purposes of spam detection. Please note that as a rule e-mails are not sent in encrypted form on the internet. E-mails are usually encrypted in transit, but (unless a so called end to end encryption procedure is used) not on the servers from which they are sent and received. We can therefore accept no responsibility for the transmission path of e-mails between the sender and their receipt on our server; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).
• Protection of our forms against misuse (spam protection): we protect our forms (contact, enquiries, registration for training courses, newsletter and appointment booking) with the open source software ALTCHA, which we operate on our own infrastructure. When a form is opened, our server gives your browser a small computing task, which the browser solves in the background; the solution is transmitted with the form and checked by our server. In addition, we use a check field that is invisible to people and a time check. No cookies are set, no information is stored on your device, no data is transferred to third parties and no profiles are created. Your IP address is processed only briefly in working memory in order to limit the number of requests per sender and is not stored permanently. We count rejected submissions without their content in order to assess the effectiveness of the protection; these counts are erased after 90 days; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).
• Error log of the website: in order to detect and remedy faults quickly, we log technical errors of our website on our own infrastructure: errors on the server, errors when scripts are run in your browser and requests for addresses that do not exist on our website. We store the address concerned, the error message, the time and frequency, for errors in the browser a short indication of the browser and operating system (for example "Chrome 130 on Windows") and, for addresses that do not exist, the page visited previously. Your IP address is not stored, the reports are not combined with other data and are accessible only to the members of our staff responsible. We discard reports from search engines and other automated programs. The reports are erased after 90 days; for forms whose submission failed, see "Forms that could not be submitted" in the section "Handling of contacts and enquiries"; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).

Use of cookies

The term "cookies" refers to functions that store information on users' devices and read information from them. Cookies may also be used for various purposes, for example for the functionality, security and convenience of online offerings and for producing analyses of visitor flows. We use cookies in accordance with the statutory provisions. To this end we obtain the users' consent in advance where this is required. Where consent is not necessary, we rely on our legitimate interests. This applies where the storage and reading of information is essential in order to be able to provide expressly requested content and functions. This includes, for example, the storage of settings and ensuring the functionality and security of our online offering. Consent can be withdrawn at any time. We give clear information about its scope and about which cookies are used.

Notes on the legal bases under data protection law: whether we process personal data with the aid of cookies depends on consent. Where consent has been given, it serves as the legal basis. Without consent we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage period: with regard to the storage period, a distinction is made between the following types of cookies:

• Temporary cookies (also: session cookies): temporary cookies are erased at the latest after a user has left an online offering and closed their device (for example browser or mobile application).
• Permanent cookies: permanent cookies remain stored even after the device has been closed. In this way, for example, the login status can be saved and preferred content displayed directly when the user visits a website again. Likewise, the user data collected with the aid of cookies may be used for reach measurement. Unless we give users explicit information about the type and storage period of cookies (for example when obtaining consent), they should assume that these are permanent and that the storage period may be up to two years.

General information on withdrawal and objection (opt out): users may withdraw the consent they have given at any time and may also object to the processing in accordance with the statutory requirements, including by means of the privacy settings of their browser.

• Types of data processed: meta, communication and procedural data (for example IP addresses, time stamps, identification numbers, persons involved).
• Data subjects: users (for example website visitors, users of online services).
• Legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR). Consent (Art. 6(1)(1)(a) GDPR).

Further notes on processing operations, procedures and services:

• Processing of cookie data on the basis of consent: we use a consent management solution with which the users' consent to the use of cookies, or to the procedures and providers named within the consent management solution, is obtained. This procedure serves to obtain, log, manage and withdraw consent, in particular in relation to the use of cookies and comparable technologies that are used to store, read and process information on users' devices. In the course of this procedure, users' consent is obtained for the use of cookies and the associated processing of information, including the specific processing operations and providers named in the consent management procedure. Users also have the option of managing and withdrawing their consent. The declarations of consent are stored in order to avoid asking again and to be able to demonstrate consent in accordance with the statutory requirements. Storage takes place on the server side and in a cookie (a so called opt in cookie) or by means of comparable technologies, in order to be able to attribute the consent to a specific user or their device. Unless specific information about the providers of consent management services is available, the following general information applies: the consent is stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, the details of the scope of the consent (for example the categories of cookies and service providers concerned) and information about the browser, the system and the device used; legal bases: consent (Art. 6(1)(1)(a) GDPR).
• Temporary storage of form entries: so that nothing is lost if a page is reloaded or left by mistake, your browser stores what you enter in our forms for contact, enquiries and registration for training courses in the local storage of your device. This information does not leave your device until you submit the form. It is erased once the form has been submitted successfully; a draft that is older than three days is no longer used and is removed the next time you visit. You can delete it at any time using "Start over" on the form or the settings of your browser. Consents (tick boxes) are not stored. If a submission fails, your browser also keeps a random identifier of this attempt for the duration of the session (session storage), so that the report on it is marked as dealt with once the submission succeeds after all. This storage is strictly necessary for the form function you are expressly using (section 25(2) no. 2 TDDDG); legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).

Handling of contacts and enquiries

When you contact us (for example by post, contact form, e-mail, telephone or via social media), and in the context of existing user and business relationships, the details of the enquiring persons are processed to the extent necessary in order to answer the contact enquiries and any measures requested.

• Types of data processed: master data (for example full name, home address, contact details, customer number, etc.); contact data (for example postal and e-mail addresses or telephone numbers); content data (for example messages and contributions in text or image form and the information relating to them, such as details of authorship or the time of creation); usage data (for example page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (for example IP addresses, time stamps, identification numbers, persons involved).
• Data subjects: communication partners.
• Purposes of processing: communication; organisational and administrative procedures; feedback (for example collecting feedback via an online form). Provision of our online offering and ease of use.
• Retention and erasure: erasure in accordance with the information in the section "General information on data storage and erasure".
• Legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR). Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR).

Further notes on processing operations, procedures and services:

• Contact form: when you contact us through our contact form, by e-mail or by other means of communication, we process the personal data transmitted to us in order to answer and deal with the matter concerned. As a rule this includes details such as name, contact information and, where applicable, further information that is communicated to us and is necessary for dealing with the matter appropriately. We use this data exclusively for the stated purpose of making contact and communicating; legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).
• Forms that could not be submitted: if submitting one of our forms fails, for example because of a technical fault or because an entry was rejected during the check, we store the details entered together with the error message displayed, the time and a short indication of the browser and operating system in our protected internal system. This enables us to deal with your request nevertheless and to get in touch with you. Passwords and security features are not stored. If the submission succeeds afterwards, the report is marked as dealt with. The details are erased 30 days after the last attempt; legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR), legitimate interests (Art. 6(1)(1)(f) GDPR).

Video conferences, online meetings, webinars and screen sharing

We use platforms and applications of other providers (referred to below as "conference platforms") for the purpose of holding video and audio conferences, webinars and other kinds of video and audio meetings (referred to collectively below as "conference"). When selecting the conference platforms and their services we observe the statutory requirements.

Data processed by conference platforms: in the course of participation in a conference, the conference platforms process the personal data of the participants set out below. The scope of the processing depends, on the one hand, on which data is required for a specific conference (for example provision of access data or real names) and, on the other hand, on which optional details are provided by the participants. In addition to the processing for holding the conference, the participants' data may also be processed by the conference platforms for security purposes or to optimise the service. The data processed includes personal details (first name, surname), contact information (e-mail address, telephone number), access data (access codes or passwords), profile pictures, details of professional position or function, the IP address of the internet connection, details of the participants' devices, their operating system, the browser and its technical and language settings, information on the content of the communication, that is, entries in chats as well as audio and video data, and the use of other available functions (for example polls). The content of communications is encrypted to the extent technically provided by the conference providers. If the participants are registered as users with the conference platforms, further data may be processed in accordance with the agreement with the respective conference provider.

Logging and recordings: if text entries, participation results (for example from polls) and video or audio recordings are logged, this is communicated transparently to the participants in advance and, where necessary, their consent is requested.

Data protection measures by participants: for details of the processing of your data by the conference platforms, please refer to their privacy notices and choose the security and data protection settings that are best for you within the settings of the conference platforms. For the duration of a video conference, please also ensure the protection of data and privacy in the background of your recording (for example by informing people you live with, locking doors and, where technically possible, using the function to blur the background). Links to the conference rooms and access data must not be passed on to unauthorised third parties.

Notes on legal bases: where, in addition to the conference platforms, we also process the users' data and ask users for their consent to the use of the conference platforms or of certain functions (for example agreement to the recording of conferences), the legal basis of the processing is that consent. Our processing may also be necessary in order to fulfil our contractual obligations (for example in attendance lists, when working up the results of discussions, etc.). Otherwise, the users' data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

• Types of data processed: master data (for example full name, home address, contact details, customer number, etc.); contact data (for example postal and e-mail addresses or telephone numbers); content data (for example messages and contributions in text or image form and the information relating to them, such as details of authorship or the time of creation); usage data (for example page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); image and video recordings (for example photographs or video recordings of a person); sound recordings. Log data (for example log files concerning logins or the retrieval of data or access times).
• Data subjects: communication partners; users (for example website visitors, users of online services). Persons depicted.
• Purposes of processing: provision of contractual services and performance of contractual obligations; communication. Office and organisational procedures.
• Retention and erasure: erasure in accordance with the information in the section "General information on data storage and erasure".
• Legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).

Further notes on processing operations, procedures and services:

• Microsoft Teams: audio and video conferences, chat, file sharing, integration with Office 365 applications, real time collaboration on documents, calendar functions, task management, screen sharing, optional recording; service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR); website: https://www.microsoft.com/de-de/microsoft-teams/; privacy notice: https://privacy.microsoft.com/de-de/privacystatement, security information: https://www.microsoft.com/de-de/trustcenter. Basis for third country transfers: Data Privacy Framework (DPF), standard contractual clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
• Zoom: video conferences, online meetings, webinars, screen sharing, optional recording of sessions, chat function, integration with calendars and other apps; service provider: Zoom Video Communications, Inc., 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR); website: https://zoom.us; privacy notice: https://explore.zoom.us/de/privacy/; data processing agreement: https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf. Basis for third country transfers: Data Privacy Framework (DPF), standard contractual clauses (https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf).

Newsletter and electronic notifications

We send newsletters, e-mails and other electronic notifications (referred to below as "newsletter") exclusively with the consent of the recipients or on the basis of a legal provision. Where the contents of a newsletter are described when subscribing to it, those contents are decisive for the users' consent. As a rule, providing your e-mail address is sufficient in order to subscribe to our newsletter. In order to be able to offer you a personalised service, however, we may ask for your name so that you can be addressed personally in the newsletter, or for further information where this is necessary for the purpose of the newsletter.

Double opt in: subscription to our newsletter takes place in a two step confirmation procedure. After subscribing you receive an e-mail asking you to confirm the subscription. Only then do we add you to the distribution list. This confirmation is necessary so that nobody can subscribe using someone else's e-mail address. The subscription and the confirmation are logged with the time and the IP address in order to be able to demonstrate the procedure.

Erasure and restriction of processing: we may store the e-mail addresses that have been unsubscribed for up to three years on the basis of our legitimate interests before we erase them, in order to be able to demonstrate that consent was previously given. The processing of this data is restricted to the purpose of a potential defence against claims. An individual request for erasure is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to observe objections permanently, we reserve the right to store the e-mail address solely for this purpose in a block list.

The subscription procedure is logged on the basis of our legitimate interests for the purpose of demonstrating that it was carried out properly. Where we commission a service provider to send e-mails, this is done on the basis of our legitimate interests in an efficient and secure sending system.

Contents:

Information about us, our services, campaigns and offers.

• Types of data processed: master data (for example full name, home address, contact details, customer number, etc.); contact data (for example postal and e-mail addresses or telephone numbers). Meta, communication and procedural data (for example IP addresses, time stamps, identification numbers, persons involved).
• Data subjects: communication partners.
• Purposes of processing: direct marketing (for example by e-mail or post).
• Legal bases: consent (Art. 6(1)(1)(a) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).
• Option to object (opt out): you can cancel the receipt of our newsletter at any time, that is, withdraw your consent or object to further receipt. You will find a link to cancel the newsletter either at the end of every newsletter, or you can use one of the contact options given above for this purpose, preferably e-mail.

Further notes on processing operations, procedures and services:

• Mailjet: sending of the newsletter via an e-mail service provider. On our behalf, Mailjet processes the recipients' e-mail address and, where provided, their name, as well as delivery information (e.g. whether an e-mail was delivered or opened, or whether a link in it was clicked). We only use this information in aggregated form to check and improve our mailings. Service provider: Mailjet SAS (Sinch group), 43 rue de Dunkerque, 75010 Paris, France; legal bases: consent (Art. 6 (1) (1) (a) GDPR), legitimate interests (Art. 6 (1) (1) (f) GDPR); website: https://www.mailjet.com/; privacy policy: https://www.mailjet.com/legal/privacy-policy/; data processing agreement: https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-protection-agreement/. Basis for third-country transfers: standard contractual clauses (https://sinch.com/legal/terms-and-conditions/other-sinch-terms-conditions/data-protection-agreement/), insofar as data is processed outside the EU.

Web analytics, monitoring and optimisation

Web analytics (also referred to as "reach measurement") serves to evaluate the visitor flows of our online offering and may include behaviour, interests or demographic information about the visitors, such as age or gender, as pseudonymous values. With the aid of reach analysis we can, for example, recognise at what time our online offering or its functions or content are used most frequently, or invite repeat use. It also enables us to understand which areas need optimising.

In addition to web analytics, we may also use test procedures, for example in order to test and optimise different versions of our online offering or of its components.

Unless stated otherwise below, profiles, that is, data combined for a usage process, may be created for these purposes, and information may be stored in a browser or on a device and then read from it. The information collected includes, in particular, websites visited and elements used there, as well as technical information such as the browser used, the computer system used and details of times of use. Where users have consented to the collection of their location data by us or by the providers of the services we use, the processing of location data is also possible.

In addition, the IP addresses of users are stored. However, we use an IP masking procedure (that is, pseudonymisation by shortening the IP address) to protect users. In general, no clear data of users (such as e-mail addresses or names) is stored in the course of web analytics, A/B testing and optimisation, but pseudonyms. That means that neither we nor the providers of the software used know the actual identity of the users, but only the details stored in their profiles for the purpose of the respective procedures.

Notes on legal bases: where we ask users for their consent to the use of third party providers, the legal basis of the data processing is that consent. Otherwise the user data is processed on the basis of our legitimate interests (that is, an interest in efficient, economical and user friendly services). In this context we would also like to draw your attention to the information on the use of cookies in this privacy notice.

Umami (our own reach measurement)

For reach measurement we use Umami, open source software which we operate ourselves on our own infrastructure at analytics.iago.de. No data is transferred to third parties and no data is transferred to third countries. Umami does not set cookies, does not store any information on your device and does not assign any identifier across devices or sites with which your behaviour could be tracked across several visits. Your IP address is not stored; it is processed only transiently in order to form an anonymous daily key from it, from which no conclusions about you can be drawn.

Information processed: page visited, referring page, approximate origin at country level, type of device, operating system, browser and screen size, and the time of the visit. Purpose: evaluating which content is used, in order to improve our offering. Legal basis: legitimate interests under Art. 6(1)(1)(f) GDPR. As no information is stored on your device or read from it, no consent under section 25(1) TDDDG is required; the measurement therefore deliberately does not appear in our consent banner. Erasure: the information collected is erased after twelve months.

• Types of data processed: usage data (for example page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (for example IP addresses, time stamps, identification numbers, persons involved).
• Data subjects: users (for example website visitors, users of online services).
• Purposes of processing: reach measurement (for example access statistics).
• Retention and erasure: erasure after twelve months. No cookies are set and no information is stored on the device.
• Security measures: IP masking (pseudonymisation of the IP address).
• Legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).

Presences in social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We point out that user data may be processed outside the area of the European Union in the process. This may give rise to risks for users because, for example, the enforcement of user rights could be made more difficult.

Furthermore, the data of users within social networks is as a rule processed for market research and advertising purposes. For example, usage profiles may be created on the basis of the usage behaviour and the resulting interests of the users. The latter may in turn be used, for example, to place advertisements within and outside the networks which presumably correspond to the interests of the users. For this reason, cookies are as a rule stored on the computers of users, in which the usage behaviour and the interests of the users are stored. In addition, data may also be stored in the usage profiles independently of the devices used by the users (in particular if they are members of the respective platforms and are logged in there).

For a detailed description of the respective forms of processing and of the options to object (opt out) we refer you to the privacy notices and information of the operators of the respective networks.

In the case of requests for access and the exercise of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the latter have access to the user data in each case and can take appropriate measures and provide information directly. Should you nevertheless need assistance, you can contact us.

• Types of data processed: contact data (for example postal and e-mail addresses or telephone numbers); content data (for example messages and contributions in text or image form and the information relating to them, such as details of authorship or the time of creation). Usage data (for example page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
• Data subjects: users (for example website visitors, users of online services).
• Purposes of processing: communication; feedback (for example collecting feedback via an online form). Public relations.
• Retention and erasure: erasure in accordance with the information in the section "General information on data storage and erasure".
• Legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR).

Further notes on processing operations, procedures and services:

• LinkedIn: social network. Together with LinkedIn Ireland Unlimited Company we are jointly responsible for the collection (but not the further processing) of data of visitors which is used to produce the "page insights" (statistics) of our LinkedIn profiles. This data includes information about the types of content that users view or interact with, as well as the actions they take. Details about the devices used are also recorded, such as IP addresses, operating system, browser type, language settings and cookie data, as well as information from the user profiles such as job function, country, industry, seniority, company size and employment status. Information on data protection in relation to the processing of user data by LinkedIn can be found in LinkedIn's privacy notice: https://www.linkedin.com/legal/privacy-policy. We have concluded a special agreement with LinkedIn Ireland ("Page Insights Joint Controller Addendum", https://legal.linkedin.com/pages-joint-controller-addendum) which in particular governs which security measures LinkedIn must observe and in which LinkedIn has agreed to fulfil the rights of data subjects (that is, users can, for example, address requests for access or erasure directly to LinkedIn). The rights of users (in particular the right of access, erasure, objection and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. The joint responsibility is limited to the collection of the data and its transfer to LinkedIn Ireland Unlimited Company, a company based in the EU. The further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, in particular as regards the transfer of the data to the parent company LinkedIn Corporation in the USA; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR); website: https://www.linkedin.com; privacy notice: https://www.linkedin.com/legal/privacy-policy; basis for third country transfers: Data Privacy Framework (DPF), standard contractual clauses (https://legal.linkedin.com/dpa). Option to object (opt out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Plug-ins and embedded functions and content

We embed functional and content elements in our online offering which are obtained from the servers of their respective providers (referred to below as "third party providers"). These may be, for example, graphics, videos or city maps (referred to uniformly below as "content").

Embedding always requires the third party providers of this content to process the IP address of the users, since without the IP address they could not send the content to their browser. The IP address is therefore necessary for the display of this content or these functions. We endeavour to use only such content whose respective providers use the IP address solely for the delivery of the content. Third party providers may also use so called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" allow information such as visitor traffic on the pages of this website to be evaluated. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and the operating system, referring websites, the time of the visit and further details about the use of our online offering, but may also be combined with such information from other sources.

Notes on legal bases: where we ask users for their consent to the use of third party providers, the legal basis of the data processing is that permission. Otherwise the user data is processed on the basis of our legitimate interests (that is, an interest in efficient, economical and user friendly services). In this context we would also like to draw your attention to the information on the use of cookies in this privacy notice.

• Types of data processed: usage data (for example page views and time spent, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (for example IP addresses, time stamps, identification numbers, persons involved); contact data (for example postal and e-mail addresses or telephone numbers). Content data (for example messages and contributions in text or image form and the information relating to them, such as details of authorship or the time of creation).
• Data subjects: users (for example website visitors, users of online services).
• Purposes of processing: provision of our online offering and ease of use. Profiles with user related information (creation of user profiles).
• Retention and erasure: erasure in accordance with the information in the section "General information on data storage and erasure". Storage of cookies for up to 2 years (unless stated otherwise, cookies and similar storage methods may be stored on users' devices for a period of two years).
• Legal bases: consent (Art. 6(1)(1)(a) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further notes on processing operations, procedures and services:

• Vimeo video player: integration of a video player; service provider: Vimeo Inc., Attention: Legal Department, 555 West 18th Street New York, New York 10011, USA; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR); website: https://vimeo.com; privacy notice: https://vimeo.com/privacy; data processing agreement: https://vimeo.com/enterpriseterms/dpa. Basis for third country transfers: standard contractual clauses (https://vimeo.com/enterpriseterms/dpa).
• YouTube videos: embedding of videos from the YouTube platform in extended privacy mode (youtube-nocookie.com), in which data is only transmitted to YouTube once a video is played; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR); website: https://www.youtube.com; privacy notice: https://policies.google.com/privacy; basis for third country transfers: Data Privacy Framework (DPF).
• OpenStreetMap: embedding of a map on the contact page. The map is only loaded once you have given your consent; before that, no request is sent to OpenStreetMap and your IP address stays with us. When the map is loaded, your IP address and technical details of your browser are transmitted to the provider; service provider: OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom; legal bases: consent (Art. 6(1)(1)(a) GDPR); website: https://www.openstreetmap.org; privacy notice: https://osmfoundation.org/wiki/Privacy_Policy; basis for third country transfers: adequacy decision of the EU Commission for the United Kingdom. Option to withdraw (opt out): via the Cookie settings button in the footer.

Amendment and updating

We ask you to inform yourself regularly about the content of our privacy notice. We adapt the privacy notice as soon as the changes to the data processing operations carried out by us make this necessary. We will inform you as soon as the changes require an act of participation on your part (for example consent) or any other individual notification.

Where we give addresses and contact details of companies and organisations in this privacy notice, please note that the addresses may change over time, and please check the details before making contact.

Definitions of terms

In this section you will find an overview of the terms used in this privacy notice. Where the terms are defined by law, their statutory definitions apply. The following explanations, by contrast, are intended above all to aid understanding.

• Employees: employees are persons who are in an employment relationship, whether as members of staff, salaried employees or in similar positions. An employment relationship is a legal relationship between an employer and an employee which is established by an employment contract or an agreement. It includes the employer's obligation to pay remuneration to the employee while the employee performs their work. The employment relationship comprises various phases, including its establishment, when the employment contract is concluded, its performance, when the employee carries out their work, and its termination, when the employment relationship ends, whether by notice, termination agreement or otherwise. Employee data is all information that relates to these persons and arises in the context of their employment. This covers aspects such as personal identification data, identification numbers, salary and bank details, working hours, holiday entitlements, health data and performance appraisals.
• Master data: master data comprises essential information that is necessary for the identification and administration of contractual partners, user accounts, profiles and similar records. This data may include, among other things, personal and demographic details such as names, contact information (addresses, telephone numbers, e-mail addresses), dates of birth and specific identifiers (user IDs). Master data forms the basis for any formal interaction between persons and services, institutions or systems, by making unambiguous attribution and communication possible.
• Content data: content data comprises information generated in the course of the creation, editing and publication of content of all kinds. This category of data may include texts, images, videos, audio files and other multimedia content published on various platforms and media. Content data is not limited to the actual content, but also includes metadata that provides information about the content itself, such as tags, descriptions, author information and publication dates.
• Contact data: contact data is essential information that makes communication with persons or organisations possible. It includes, among other things, telephone numbers, postal addresses and e-mail addresses, as well as means of communication such as social media handles and instant messaging identifiers.
• Meta, communication and procedural data: meta, communication and procedural data are categories containing information about the manner in which data is processed, transmitted and managed. Metadata, also known as data about data, comprises information describing the context, origin and structure of other data. It may include details of file size, the date of creation, the author of a document and the history of changes. Communication data records the exchange of information between users through various channels, such as e-mail traffic, call logs, messages in social networks and chat histories, including the persons involved, time stamps and transmission paths. Procedural data describes the processes and workflows within systems or organisations, including workflow documentation, records of transactions and activities, and audit logs used to trace and review operations.
• Usage data: usage data refers to information that records how users interact with digital products, services or platforms. This data comprises a wide range of information showing how users use applications, which functions they prefer, how long they spend on particular pages and which paths they take to navigate through an application. Usage data may also include the frequency of use, time stamps of activities, IP addresses, device information and location data. It is particularly valuable for analysing user behaviour, optimising user experiences, personalising content and improving products or services. In addition, usage data plays a decisive role in identifying trends, preferences and possible problem areas within digital offerings.
• Personal data: "personal data" means any information relating to an identified or identifiable natural person (referred to below as the "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (for example a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Profiles with user related information: the processing of "profiles with user related information", or "profiles" for short, comprises any form of automated processing of personal data consisting of the use of that personal data to analyse, evaluate or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may cover various information concerning demographics, behaviour and interests, such as interaction with websites and their content, etc.) (for example interests in certain content or products, click behaviour on a website or the location). Cookies and web beacons are frequently used for profiling purposes.
• Log data: log data is information about events or activities that have been recorded in a system or network. This data typically contains information such as time stamps, IP addresses, user actions, error messages and other details about the use or operation of a system. Log data is often used to analyse system problems, to monitor security or to produce performance reports.
• Reach measurement: reach measurement (also referred to as web analytics) serves to evaluate the visitor flows of an online offering and may cover the behaviour or the interests of visitors in certain information, such as the content of web pages. With the aid of reach analysis, operators of online offerings can, for example, recognise at what time users visit their web pages and which content they are interested in. This enables them, for example, to adapt the content of the web pages better to the needs of their visitors. Pseudonymous cookies and web beacons are frequently used for reach analysis purposes in order to recognise returning visitors and thus obtain more precise analyses of the use of an online offering.
• Controller: "controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: "processing" means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically every handling of data, whether collection, evaluation, storage, transmission or erasure.
• Contract data: contract data is specific information relating to the formalisation of an agreement between two or more parties. It documents the conditions under which services or products are provided, exchanged or sold. This category of data is essential for the administration and performance of contractual obligations and covers both the identification of the contracting parties and the specific terms and conditions of the agreement. Contract data may include the start and end dates of the contract, the type of services or products agreed, price agreements, payment terms, rights of termination, renewal options and special conditions or clauses. It serves as the legal basis for the relationship between the parties and is decisive for clarifying rights and obligations, enforcing claims and resolving disputes.
• Payment data: payment data comprises all information required to process payment transactions between buyers and sellers. This data is of decisive importance for electronic commerce, online banking and any other form of financial transaction. It includes details such as credit card numbers, bank details, payment amounts, transaction dates, verification numbers and invoice information. Payment data may also contain information about payment status, chargebacks, authorisations and fees.