German Privacy Policy

1. General information

1.1 Purpose and responsibility

1. This Privacy Policy informs you about the nature, scope and purpose of processing personal data in relation to our online offering and its linked websites, functions and content (hereinafter referred to as "online offering" or "website"). Details on these processing activities are provided under Section 2.

2. Details on data processing in our buildings (e.g. office space and meeting/conference rooms) are described in Section 3.

3. Details on data processing for the purpose of carrying out our business processes are described in Section 4.

4. Fora The Office Group (Germany) GmbH (Friedrichstraße 189, D-10117 Berlin) - hereinafter referred to as "we" or "us" is responsible under data protection law.

5. Our data protection officer can be reached on the email address: [email protected]

The term "user" covers all customers and visitors of the online offering.

1.2 Legal bases

We collect and process personal data based on the following legal bases:

a. "Consent in accordance with Article 6 Paragraph 1 lit. a General Data Protection Regulation (GDPR). Consent is any voluntary, informed and unambiguous statement of consent, for a specific case, in the form of a declaration or other clear affirmative action, with which the person concerned indicates that you agree with the processing of personal data concerning you.

b. Necessity to fulfil the contract or carry out preparatory measures in accordance with Article 6 Paragraph 1 lit. b GDPR, namely the data are required so that we can fulfil contractual obligations to you or we need the data to prepare a contract with you.

c. Processing to fulfil a legal obligation in accordance with Article 6 Paragraph 1 lit c GDPR, namely that e.g. processing of data is required by law or other regulations.

d. Processing is required to pursue legitimate interests in accordance with Article 6 Paragraph 1 lit. f GDPR, namely that processing is required to pursue legitimate interests on our part or on the part of third parties, unless the interests or basic rights and freedoms on your side, which require protection of personal data, prevail.

1.3 Data subject rights

You are entitled to the following rights with regard to data processing by us:

a. Right to appeal with the supervisory authority in accordance with Article 13 Paragraph 2 Letter d) GDPR as well as Article 14 Paragraph 2 Letter e) GDPR

b. Right to information in accordance with Article 15 GDPR

c. Right to reporting in accordance with Article 16 GDPR

d. Right to deletion ("Right to be forgotten") in accordance with Article 17 GDPR

e. Right to restriction on processing in accordance with Article 18 GDPR

f. Right to data portability in accordance with Article 20 GDPR

g. Right to revocation in accordance with Article 21 GDPR

Note: Users can object to the processing of their personal data in accordance with statutory requirements at any time with effect for the future. Consent can be revoked in particular to object against processing for the purposes of direct mail advertising.

Without prejudice to any other administrative or judicial appeal, you have the right to complain to a supervisory authority, in particular in the member state of your residence, your workplace or the place of the alleged breach, if you believe that the processing of the data concerning you infringes the GDPR.

1.4 Data deletion and storage period

The data subject's personal data will be deleted or blocked as soon as the storage purpose no longer applies. Data may be stored beyond this if this is necessary for the data controller to comply with European or national statutory requirements under EU directives, laws or other regulations. Data will only be blocked or deleted once a storage period required by the standards mentioned ends, unless it is still required to be stored for the conclusion or fulfilment of a contract.

1.5 Security of processing

1. We have implemented the appropriate technical and organisational security measures to the best available technology. The data that we process will be protected against accidental or intentional tampering, loss, destruction as well as unauthorised access.

2. The security measures include, in particular, the encrypted transfer of data between your browser and our server.

1.6 Data transmission to third parties, subcontractors and third-party providers

1. Data is only transmitted to third parties to the extent permitted by law. We will only then forward user data to third parties if this is required e.g. for accounting purposes or other purposes, if the transmission is required to fulfil contractual obligations to the users.

2. If we use subcontractors for our online offering, we have made suitable contractual arrangements and taken corresponding technical and organisational measures with respect to these companies.

3. If we use content, tools or other means of other companies (hereinafter collectively referred to as "third parties") and whose registered office is situated in a third country, it can be assumed that a data transfer is made in the home states of the third-party providers. Personal data will only be transmitted by us to third countries when there is an adequate level of data protection, user consent, or other legal authorisation.

2. Processing as part of our online offering

2.1 Collection of information for the use of the online offering

1. When using the online offering, information is automatically transmitted from the user's browser to us; including the name of the retrieved website, file, retrieval date and time, transferred data volume, notification of successful retrieval, browser type and version, the user's operating system, Referral URL (the previously visited page), IP address and the requesting provider.

2. This information is processed based on legitimate interests in accordance with Article 6 Paragraph (1) lit. f GDPR (e.g. optimisation of the online offering) as well as ensuring the security of processing in accordance with Article 5 Paragraph (1) lit. f GDPR (e.g. for the defence and analysis of cyber attacks).

3. The information is automatically deleted no later than 30 days after the connection is ended, i.e. use of the online offering, provided that there are no other retention periods preventing this.

4. The collection and storage of data in log files is obligatory for the provision of the online offering. Users are not entitled to the options of erasure, objection or correction.

2.2 Information on Google Services

1. On our website, we use various services of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

More information on the individual, specific services of Google that we use on this website can be found later in our Privacy Policy.

2. With the integration of Google Services, Google may collect information (including personal data) and process this. Therefore, it cannot be ruled out that Google will transmit the information to a server in a third country.

Transmission to the US depends on which capacity data personal data is transmitted. Therefore as data controller we can transmit data to Google in the US for further use.

There is currently no adequacy decision in accordance with Art. 45 GDPR. However, transmission can be based on standard contractual clauses. Google is required to comply with the standard contractual clauses (SCC) for the transmission of personal data to third countries).

More information on the standard contractual clauses is available at

https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractuals-clauses-scc_de as well as https://policies.google.com/privacy/frameworks?hl=de

3. We ourselves cannot influence which data Google actually collects and processes. However, Google states that the following information (including personal data) can be processed:

• Log data (in particular the IP address)

• Location-based information

• Unique application number

• Cookies and similar technologies

For information on the types of cookies used by Google, refer to https://policies.google.com/technologies/types.

4. If you are signed into your Google account, Google can add the processed information depending on your account settings and treat it as personal data.

5. Google states the following in this regard:

"When you’re not signed in to a Google Account, we store the information we collect with unique identifiers tied to the browser, application, or device you’re using. This helps us do things like maintain your language preferences across browsing sessions. When you’re signed in, we also collect information that we store with your Google Account, which we treat as personal information." (https://privacy.google.com/take-control.html)

6. You can prevent this data from being added directly by signing out of your Google account or by activating the appropriate settings in your Google account. In addition, you can change your cookie settings (e.g. delete, block cookies etc.).

7. More information is available in Google's data privacy information, which can be downloaded here: https://www.google.com/policies/privacy

8. For information on Google's privacy settings, refer to https://privacy.google.com/take-control.html

2.3 Google Analytics

1. On the basis of your consent for analysis, optimisation and economic operation of our online offering in accordance with Art. 6 Para. 1 lit. a GDPR Google Analytics, we use a web analysis service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) - hereinafter referred to as "Google“). Google uses cookies and other technologies. The information generated by the web analysis service about the use of the online offering by the user is transferred to a Google server in the US and processed there.

2. Google will act for us in the context of order processing in accordance with Article 28 GDPR. We have concluded a privacy agreement with Google which contains EU standard data protection clauses.

3. Furthermore, we have entered into a joint responsibility agreement with Google for the use of Google measurement services in accordance with Article 26 GDPR (cf. https://support.google.com/analytics/answer/9012600). We have agreed with Google in this context to be responsible for the fulfilment of information obligations and for safeguarding the data subject's rights in accordance with Chapter 3 GDPR as well as the security of processing and reporting and notification obligations. (Article 32 to 34 GDPR). Google will use the information to assess the use of our online offering by the users, to compile reports on the activities within this online offering and to provide other services associated with the use of this online offering and the internet use. Pseudonymised user profiles may be created from the data which is processed in this way.

4. We use Google Analytics to only display advertisements made by Google and its affiliate advertising services to users who have shown an interest in our online offering or who have certain characteristics (e.g. interests in specific themes or products that are determined based on websites visited), which we transmit to Google (Remarketing Audiences or Google Analytics Audiences). By using Remarketing Audiences, we also want to ensure that our advertisements correspond to the potential interest of users and not be perceived as a nuisance.

5. We use Google Analytics with activated IP anonymisation.

6. Google Analytics stores cookies in your web browser for a period of two years from your last visit. These cookies contain a randomly generated user ID that can be used to identify you on future website visits. Users can prevent the storage of cookies by setting their browser software accordingly; users can also prevent Google's collection of data generated by the cookie and related to the use of the online offering as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link: https://tools.google.com/¬dlpage/gaoptout?hl=de.

7. The recorded data are stored together with the randomly generated user ID which allows the evaluation of pseudonymous user profiles. These user-related data will be automatically deleted after 26 months. Other data will be saved in aggregated form for an indefinite period.

8. Other information on data use by Google, settings and revocation options can be found on the Google websites:

https://policies.google.com/technologies/partner-sites?hl=de ("Use of data by Google when using our partners' websites or apps")

https://policies.google.com/¬technologies/ads ("Data use for advertising purposes")

https://adssettings.google.com/¬authenticated ("Manage information that Google uses to show advertising").

2.4 Google Tag Manager

1. We use Google Tag Manager on our website. Google Tag Manager is a service of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

2. With Google Tag Manager we can integrate various codes and services into our website in an ordered and simplified manner. Google Tag Manager implements tags or "triggers" the integrated tags. When trigging a tag, Google may process information (including personal data) and process this. Therefore, it cannot be ruled out that Google will transmit the information to a server in a third country.

3. For information on the standard contractual clauses and transmission to the US by us to Google and other relevant data for data processing by Google when using Google Services, refer to Section 2.4 "Information on Google Services" in this Privacy Policy.

4. Google Tag Manager processes the following personal data in particular:

• Online identifiers (including cookie identifiers)

• IP address

5. In addition, you will find more detailed information about Google Tag Manager on the websites https://www.google.de/tagmanager/use-policy.html

as well as

https://www.google.com/intl/de/policies/privacy/index.html (Section "Data that we receive based on your use of our services")

6. Furthermore, we have concluded a data processing agreement with Google for the use of the Google Tag Manager (Art. 28 GDPR). Google processes the data on our behalf, in order to trigger the stored tags and display the services on our website. Google can pass this information on to third parties if this is legally required or if third parties are entrusted with processing this data on behalf of Google.

7. If you have disabled individual tracking services (e.g. by having an opt-out cookie created), every relevant tracking tag integrated through the Google Tag Manager remains disabled.

8. Integrating the Google Tag Manager makes a clear, simplified integration of various services possible. In addition, integrating the Google Tag Manager optimises the loading times of the various services

9. The legal basis for the processing of personal data described herein regarding the analysis process is your express consent in accordance with Art. 6 Para. 1 lit. a GDPR.

10. The legal basis of processing of data, which is processed within the scope of your consent, is our legitimate interest according to Art. 6 Para. 1 lit. f GDPR. We have a legitimate interest in being able to prove that you have granted us your consent (Art. 7. Para. 1 GDPR).

2.5 Facebook Pixel (Facebook Custom Audience)

1. We use Tracking Pixel of Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Facebook Inc. 1601, Willow Road Menlo Park, CA 94025, USA. We use Facebook Pixel to track the success of our own Facebook advertising campaigns and optimise the distribution of Facebook advertising campaigns to interested target audiences.

2. After clicking on a Facebook advertisement or visiting our website, a cookie is stored on your end device by means of a pixel on our website. The cookie processes data on whether you reached our website via a Facebook advertisement and makes it possible to analyse the behaviour of the user through to the purchase. This allows us to track the success rate of our Facebook advertising campaigns. Additionally, the pixel processes data indicating that you have visited our website and allows the advertising on Facebook to be adapted to your interests.

3. Via the Facebook Pixel integrated on our website, a direct connection to the Facebook servers will be established when visiting our website. The information generated through the cookie via your use of this website (including your IP address) will be transmitted to Facebook in the US.

4. For data transmissions to the US there is no adequacy decision of the EU Commission. Facebook ensures an adequate level of data protection with the EU standard contractual clauses. A copy of the contractual clauses can be downloaded here:https://www.facebook.com/legal/EU_data_transfer_addendum

5. The collected data are anonymous and cannot be traced back to the user. If you have signed up for Facebook, Facebook can assign the recorded information to your account. Even if you do not have a Facebook account or are not logged in when visiting our website, it is possible for Facebook to process and store your IP address and other identification data.

6. The legal basis for data processing is your consent in accordance with Art. 6 Para. 1 a GDPR

7. You can revoke your consent for the data processing by Facebook Pixel for our web domain at any time with effect for the future, by adjusting your preferences in our cookie settings. In addition, you can prevent the setting of cookies by adjusting the corresponding settings in your Facebook account at https://www.facebook.com/settings?tab=ads.

2.6 Consent management

1. Our website uses OneTrust cookie consent technologies to obtain your consent to store specific cookies in your browser and document these compliant with data protection laws. The provider of this technology is OneTrust, represented in two headquarters in the US and England: Atlanta, GA, USA (Co-Headquarters), 1200 Abernathy Rd NE, Building 600, Atlanta, GA 30328 United States, +1 (844) 847-7154 and London, England (Co-Headquarters), Dixon House, 1 Lloyd’s Avenue, London, EC3N 3DQ, +44 (800) 011-9778. When you enter our website, a OneTrust cookie will be stored in your browser, in which the consents granted by you or the revocation of these consents will be stored.

2. The collected data will be stored, until you ask us to delete this or you delete the OneTrust cookie yourselves or the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected. Details for data processing of OneTrust cookies can be found in the OneTrust Data Privacy Policy at https://www.onetrust.com/privacy/

3. The use of OneTrust cookie consent technology is for the purpose of obtaining legally required consent for the use of cookies. The legal basis for this is Art. 6 para. 1 sentence 1 lit. c GDPR.

4. We have entered into an order processing contract with One Trust. This is an agreement mandated by data protection laws, which guarantees that One Trust processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

2.7 DoubleClick

1. DoubleClick by Google is a service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

2. DoubleClick by Google uses cookies to present relevant advertisements to you. For this, a pseudonym identification number (ID) is assigned to your browser to check which advertisements were shown in your browser and which advertisements were viewed (clicked on). The cookies contain no personal data. The use of DoubleClick cookies allows Google and its partner website to place advertisements online based on previous visits to our or other websites. The information generated by cookies will be transferred by Google to a server in the US and stored there. Under no circumstances will Google match your data with other data collected by Google.

3. The legal basis is your consent in accordance with Art. 6 Para. 1 lit. a GDPR. You hereby agree to the processing of data collected about you by Google in the manner in which the data are processed and with the purpose stated above.

4. You can prevent the storage of cookies with the corresponding setting in your browser software. In addition, you can prevent Google's collecion of data related to your use on the websites and generated by cookies as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link under "Disable DoubleClick extension".

5. More information on DoubleClick by Google and data privacy is available here: https://policies.google.com/technologies/ads?hl=de

2.8 YouTube

1. On our web pages, we use videos from the video portal "YouTube" of the company Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google") to achieve a seamless integration of videos as well as an appealing design of our website. The legal basis for the data processing is your consent according to Art. 6 Para. 1 lit. a GDPR.

2. For this, we use the option of "enhanced data protection mode" provided by Google.

3. When you visit a page that has an embedded video, a connection to the Google servers will be established and therefore content displayed through a notification to your browser on the website.

4. According to Google, in "enhanced data protection mode" your data – particularly which of our web pages you have visited as well as device-specific information including IP address – will only then be transmitted to the YouTube server in the US when you view the video. By clicking on the video you consent to this transmission.

5. When you are logged into Google at the same time, this information will be assigned to your YouTube member account. You can prevent this by signing out of your member account before visiting our website.

6. Information is to some extent sent to the parent company Google Inc. headquartered in the US, to other Google companies and to external partners of Google, who may be located outside the European Union. Google uses standard contractual clauses approved by the European Commission for this purpose and relies on the adequacy decisions issued by the European Commission regarding certain countries.

7. For more information on data privacy in connection with YouTube, refer to the Google Privacy Policy.

8. The domain googlevideo.com ("Google Video") and ggpht.com ("Google Photos") is accessed when the video portal is used. Your consent is also the legal basis. This also applies to Google's advertising network "DoubleClick"; see Section 2.8 "DoubleClick".

2.9 Google Remarketing or "Similar Audiences"

1. This website uses the Remarketing or "Similar Audiences" function of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States ("Google").

2. You can be targeted with advertising by enabling personalised and interest-based advertisements when you visit other websites in the "Google Display Network". "Google Remarketing" or the function "Similar Audiences" uses "cookies", i.e. text files that are stored on your computer and enable an analysis of the websites you are using. These text files collect data about your website visits as well as anonymised data on website use. Personal data is not stored. If you visit another website in the "Google Display Network", advertisements may be displayed to you that are highly likely to reflect product and information content that you previously viewed.

3. Your consent is the legal basis for processing according to Art. 6 Para. 1 lit. a GDPR.

4. You can prevent "Google Remarketing" or the "Similar Audiences" function by adjusting the settings in your browser software to prevent the storage of cookies. However, please note that in this case not all functions of this website may be able work to their full extent. In addition, you can prevent Google's collection of data generated by the cookie and related to your website use as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link under "Disable DoubleClick extension": https://www.google.com/settings/ads/plugin?hl=de. You can also disable the use of cookies by third-party providers, by accessing the opt-out page of the Network Advertising Initiative at http://www.networkadvertising.org/choices and following the opt-out instructions there.

5. Google's Privacy Policy on Remarketing with further information can be found here: http://www.google.com/privacy/ads/.

2.10 Google AdWords Conversion Tracking

1. This website uses the Google AdWords Conversion Tracking function of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States ("Google").

2. Google AdWords Conversion Tracking uses cookies, which are text files that are stored on your computer and make it possible to analyse your website usage when you have clicked on a Google advertisement. The cookies are valid for 90 days maximum. Personal data is not stored. So long as the cookie is valid, Google and we (the website operator) can identify that you have clicked on an advertisement and landed on a particular web page (e.g. order confirmation page, newsletter subscription). These cookies cannot be tracked across multiple websites from various AdWords participants. Conversion statistics are created in Google AdWords by the cookie. These statistics record the number of users that have clicked on our advertisement. It also counts how many users landed on a target page provided with a conversion tag. The statistics however contain no data which can be used to identify you.

3. You can prevent the storage of cookies on your hard drive by selecting "Accept no cookies" in your browser settings (In MS Internet Explorer under "Extras > Internet Options > Data Privacy > Setting"; in Firefox under "Extras > Settings > Data Privacy > Cookies"); however please note that you may not be able to use all the functions of this website to the full extent.

4. Your consent constitutes the legal basis for the processing according to Art. 6 Para. 1 lit. 1 GDPR. By using this website you declare that you agree with the processing of the data that Google collects about you in the manner described above and for the purpose mentioned above.

5 More information on how Google uses conversion data as well as Google's Privacy Policy can be found at https://support.google.com/adwords/answer/93148?ctx=tltp, http://www.google.de/policies/privacy/

2.11 Links to other websites

1. While using some of our services, you will be automatically forwarded to other websites.

2. Please note that this Privacy Policy is not valid there. The privacy polices of the linked websites may deviate from this considerably.

3. Processing in our buildings

This section will describe the processing of personal data by us in the buildings; this includes e.g. office spaces and meeting/conference rooms rented from us.

3.1 Video surveillance

Below you will find our privacy note within the meaning of Article 12 to 14 GDPR on the processing of personal data for our video surveillance.

1. Video recordings are processed based on Article 6 Paragraph (1) lit. f GDPR; the so-called legitimate interest, for the following purposes:

a. Protection of domestic authority

b. Prevention and investigation of criminal offences (in particular theft, attacks, fraud, damage and vandalism)

2. Our legitimate interests are:

a. Protection of property and assets

b. Protection of customers, visitors and employees

3. Any further use or sharing of video recordings only takes place if this is required as part of criminal prosecution. The recipients in this case are law enforcement authorities.

4. We use external service providers for the maintenance of the video surveillance system, whereby access to the video surveillance system or the stored video recordings cannot be ruled out.

5. Video recordings are deleted 3 days after being recorded. There will only be a longer storage period if this is required for the enforcement of legal claims or the prosecution of criminal offences in specific individual cases.

6. Data is only transmitted to third parties (e.g. the police) when this is required for the investigation of criminal offences.

4. Processing for the purpose of performance of business processes

4.1 Contact form and contacting by email

1. When contacting us (using the online form or email) the data provided by the user will be processed exclusively for processing and carrying out the request.

2. Any other use of the data will only take place with the user's consent.

3. The data provided by the user will be stored in our Customer Relationship Management System (CRM System). The legal retention periods for business letters apply.

4.2 Applicant management

1. When you use the online application form on our website, we collect the data that you enter. These are contact data (title, first name, surname, email address), data on potential employment with us (salary expectations, notice period, earliest start date), data from your message, CV, cover letter and references that you have provided us with. Mandatory information is marked as such. We process this application data exclusively for the purpose of the recruitment process. The legal basis for the data processing is Section 26 Para. 1 Sentence 1 BDSG (German Federal Data Protection Act), as far as the data processing is required for the recruitment decision. These data are marked in our online application form as mandatory information. If you also transmit data to us, which are not absolutely necessary for the application, the processing of this voluntary data is based on your consent; the legal basis is then Article 6 Para. 1 lit. a GDPR in connection with Section 26 Para. 2 BDSG (if particular categories of personal data are affected within the meaning of Art.9 Para. 1 GDPR). Please note that after transmitting your application, modifications to your applicant data and documents can still only be carried out by us. Even if you modify your data in the applicant profile, we will continue to work with the data that you transmitted to us and will not make any comparison between the applicant data and your data in the applicant profile.

2. We collect and process data as part of the recruiting process by using the application management software "Prescreen" of the provider (New Work SE, Strandkai 1, 20457 Hamburg, Germany) – hereinafter referred to as "Prescreen". Prescreen acts for us as processor within the meaning of Art. 4 Number 8 GDPR. After entering your data in the online application form on our website and sending the form, the entered data will be transferred using TLS encryption and stored in the Prescreen database. Prescreen stores the data exclusively on ISO-certified servers in Germany. If you send us an unsolicited application directly by email, the encryption depends on your email server provider. We will only allow access to your data to those people and agents who prepare the recruitment decision for us (human resources department, relevant decision-makers in individual cases) or who are involved in the recruitment by law (e.g. works council). In addition, only the administrators have access to the data to maintain the system and ensure data security. We treat your data as strictly confidential and only pass it on to external third parties if required by law (Art. 6 Para. 1 lit. c GDPR) or you have given your separate consent (Art. 6 Para. 1 lit. a GDPR).

3. Storage period

During the recruiting process, your data will be stored at Prescreen and possibly also by us. The data will be deleted once its knowledge it no longer required for the recruiting process. This means your data and your personal application profile will be deleted at Prescreen six months after completion of the recruiting process (i.e. after the position has been filled or after completion of the application process) and – where available – by us.

Data will not be deleted if you have separately agreed to further storage (Art. 6 Para. 1 lit. a GDPR): applicants who cannot be recruited directly at the time of the application, but have an interesting profile, we ask by email whether we may store your data after completion of the application process for another 12 months.

If after going through the recruiting process, we enter into an employment contract with you, the data will be transferred and processed there for the purpose of performance of the employment relationship in the personnel management system.

4.3 Direct marketing

1. With the following notes, we inform you about the content of our newsletter as well as about the subscription, delivery and statistical evaluation process and your right to object. By signing up to our newsletter you consent to receive this and the outlined procedures.

2. Double opt-in and logging

As part of the subscription to our newsletter the so-called double opt-out process will be carried out, meaning after signing up you will receive an email in which you are asked to confirm your registration. This confirmation is necessary so that nobody can register with unfamiliar email addresses. The newsletter subscriptions will be stored to comply with legal requirements regarding documentation. This includes the storage of the time of registration and the confirmation and IP address.

3. Mailing provider

The mailing of the newsletter will be carried out with the Marketing Cloud of salesforce.com Germany GmbH (Erika-Mann-Str. 31-37, 80636 Munich) - hereinafter "Mailing provider." The privacy policy of the mailing provider can be viewed here: https://www.salesforce.com/de/company/privacy/.

The mailing provider can use this data by its own account in pseudonymous form - meaning without assignment to a user - for the optimisation or improvement of its own services, e.g. for technical optimisation of the mailing and the display of the newsletter or for statistical purposes to determine which country the recipient is from. However, the mailing service does not use the data of our newsletter recipients to write to them directly or forward to third parties.

4. Registration details

In order to subscribe to the newsletter, you have to provide your email address, title, first name and surname.

5. Statistical surveys and evaluations

The newsletters contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved when opening the newsletter from the server of the mailing provider. As part of this retrieval, initially, technical information such as about the browser and your system, as well as your IP address and the time of the retrieval is collected. This information is used to technically improve the services based on the technical data or the target groups and their reading behaviour based on the retrieval site (which can be determined by the IP address) or access times.

Statistical surveys include also determining whether the newsletters are opened when it is opened and which links are clicked. This information can be assigned to the individual newsletter recipients for technical reasons. However, it is neither our intention nor that of the mailing service provider to monitor the individual users. The evaluations serve to identify the reading habits of our users and tailor our content to them or send other content according to the interests of our users.

6. Legal bases

The use of the mailing service provider, carrying out statistical surveys and analyses as well as logging the registration process are conducted based on our legitimate interests according to Art. 6 (1) (f) GDPR. We have an interest in using a user-friendly and secure newsletter system that serves our business interests and meets the expectations of our users.

7. Cancellation/Opt-out

You can opt out of receiving our newsletter at any time, by withdrawing your consent. A link to unsubscribe from the newsletter is provided at the end of every newsletter. If the users have unsubscribed from receiving the newsletter, the personal data processed for the mailing will be deleted.

4.4 Advertising to existing customers

1. If you have a contractual relationship with us, we will be able to inform you about similar services from time to time by email, telephone, SMS or letter, if you have not opted out of this.

2. Legal basis for the data process is Art. 6 Para. 1 lit. f GDPR. Our legitimate interest is in direct advertising (Recital 47 GDPR). You can object to the use of your email address, telephone number and postal address for advertising purposes at any time or additional costs with effect for the future.

5 Cookie Policy

5.1 General information

1. Cookies are information transferred by our web server or third-party web servers to the user's web browser and stored there for later retrieval. Cookies can be small files or any other forms of information storage.

2. If the user does not want cookies to be stored on their computer, they will be asked to disable the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. Disabling of cookies may restrict the functionality of this online offering.

5.2 Cookies overview, opt-out

1. A current overview of the cookies used on this website can be seen in the Consent Management Platform "OneTrust" (see Paragraph 2.6 "Consent Management".

2. There you will also be able to manage your individual consents or preferences.

6. Changes to the Privacy Policy

1. We reserve the right to change this Privacy Policy in order to adapt to changed legal situations or changes in data processing.

2. If user consents are required or components of the Privacy Policy contain provisions of the contractual relationship with the users, the changes will only be made with the user's consent.

3. The users will be asked regularly to remain up to date with the content of this Privacy Policy.