Privacy policy

This privacy policy informs you about the type, scope and purpose of the processing of personal data (hereinafter “data”) within our online offering and the associated websites, functions and content, as well as external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”). With regard to the terms used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

The following cookies may be set when you use our website:

Technically necessary, required depending on use:

Name	Domain	Expiration	Path	Description
wordpress_logged_in_*	gameforest.de	7 Tage		Anmeldung auf der Website
wordpress_apbct_antibot	gameforest.de	Sitzung		Schutz vor Spam

For analytical and statistical purposes:

Name	Domain	Expiration	Description
_ga	gameforest.de	2 Jahre	Besucherkennung für Google Analytics
_ga_*	gameforest.de	2 Jahre	Sitzungs- und Zugriffsmessung mit Google Analytics
entry_page_path	gameforest.de	7 Tage	Erste besuchte Seite

For marketing and audience targeting in advertising:

Name	Domain	Expiration	Description
_fbp	gameforest.de	3 Monate	Meta-Werbung und Remarketing
datr	.facebook.com	2 Jahre	Browserkennung für Facebook
_gcl_au	.gameforest.de	3 Monate	Zuordnung von Google-Ads-Conversions
NID	.google.com	6 Monate	Google-Werbepräferenzen und Kennungen
APISID	.google.com	2 Jahre	Google-Profil und personalisierte Werbung

You can change your cookie and tracking settings at any time:

Controller

OM Network GmbH
Alexanderstraße 9b
70184 Stuttgart

Types of data processed:

– Inventory data (e.g., names, addresses).
– Contact data (e.g., email, phone numbers).
– Content data (e.g., text entries, photographs, videos).
– Usage data (e.g., websites visited, interest in content, access times).
– Meta/communication data (e.g., device information, IP addresses).

Categories of data subjects

Visitors and users of the online offering (hereinafter collectively referred to as “users”).

Purpose of processing

– Providing the online offering, its functions and content.
– Answering contact requests and communicating with users.
– Security measures.
– Reach measurement/marketing

Terms used

“Personal data” means all information relating to an identified or identifiable natural person (hereinafter “data subject”). A natural person is considered identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or one or more special characteristics that express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations performed with or without the aid of automated procedures in connection with personal data. The term is broad and covers practically any handling of data.

“Pseudonymisation” means the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that this additional information is kept separately and is subject to technical and organisational measures that ensure the personal data are not attributed to an identified or identifiable natural person.

“Profiling” means any form of automated processing of personal data that consists of using personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or change of location.

The “controller” is the natural or legal person, authority, institution or other body which alone or jointly with others decides on the purposes and means of processing personal data.

“Processor” means a natural or legal person, authority, institution or other body that processes personal data on behalf of the controller.

Applicable legal bases

In accordance with Art. 13 GDPR, we inform you of the legal bases for our data processing. Unless the legal basis is stated in the privacy policy, the following applies: the legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 GDPR; the legal basis for processing to fulfil our services and carry out contractual measures, including answering enquiries, is Art. 6 para. 1 lit. b GDPR; the legal basis for processing to comply with our legal obligations is Art. 6 para. 1 lit. c GDPR; and the legal basis for processing to safeguard our legitimate interests is Art. 6 para. 1 lit. f GDPR. If processing of personal data is necessary to protect the vital interests of the data subject or another natural person, Art. 6 para. 1 lit. d GDPR serves as the legal basis.

Security measures

In accordance with Art. 32 GDPR, and taking into account the state of the art, the implementation costs, the nature, scope, context and purposes of processing, and the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement suitable technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data as well as access, input, disclosure, availability and separation of the data. We have also set up procedures that ensure the exercise of data subject rights, the deletion of data and a response to threats to data. Furthermore, we take the protection of personal data into account already during the development or selection of hardware, software and procedures, in line with the principles of data protection by design and by default (Art. 25 GDPR).

Cooperation with processors and third parties

If, as part of our processing, we disclose data to other persons and companies (processors or third parties), transfer it to them, or otherwise grant them access to the data, this is done only on the basis of a legal permission (e.g. where transferring data to third parties, such as payment service providers, is necessary to perform a contract under Art. 6 para. 1 lit. b GDPR), where you have given your consent, where a legal obligation requires it, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

If we engage third parties to process data on the basis of a so-called “data processing agreement”, this is done on the basis of Art. 28 GDPR.

Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this happens when using third-party services or when data is disclosed or transferred to third parties, this is done only where it is necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation, or on the basis of our legitimate interests. Subject to statutory or contractual permissions, we process or allow the data to be processed in a third country only where the special requirements of Art. 44 et seq. GDPR are met. This means processing is carried out, for example, on the basis of special safeguards, such as an officially recognised finding that a level of data protection equivalent to that of the EU exists (e.g. for the USA through the “Privacy Shield”), or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).

Rights of data subjects

You have the right to request confirmation as to whether data concerning you is being processed, and to receive information about this data, further information and a copy of the data in accordance with Art. 15 GDPR.

You have the right under Art. 16 GDPR to request the completion of data concerning you or the correction of inaccurate data concerning you.

In accordance with Art. 17 GDPR, you have the right to request that data concerning you be deleted without delay or, alternatively, in accordance with Art. 18 GDPR, to request restriction of the processing of the data.

You have the right to request that the data concerning you, which you have provided to us, be provided to you in accordance with Article 20 GDPR and transmitted to another controller.

You also have the right under Article 77 GDPR to lodge a complaint with the competent supervisory authority.

Right of withdrawal

You have the right to withdraw consents given under Article 7(3) GDPR with effect for the future.

Right to object

You may object at any time to the future processing of data concerning you in accordance with Article 21 GDPR. The objection may in particular be made against processing for direct marketing purposes.

Cookies and right to object to direct marketing

“Cookies” are small files stored on users’ computers. Different information can be stored within cookies. A cookie primarily serves to store information about a user (or the device on which the cookie is stored) during or after their visit to an online offering. Temporary cookies, or “session cookies” or “transient cookies”, are cookies that are deleted after a user leaves an online offering and closes their browser. Such a cookie can store, for example, the contents of a shopping cart in an online shop or a login status. Cookies that remain stored even after the browser is closed are referred to as “permanent” or “persistent”. For example, the login status can be saved if users visit a site again after several days. Likewise, such a cookie can store users’ interests, which are used for reach measurement or marketing purposes. Cookies offered by providers other than the controller operating the online offering are referred to as “third-party cookies” (if they are only the controller’s own cookies, they are called “first-party cookies”).

We may use temporary and permanent cookies and explain this in our privacy policy.

If users do not want cookies to be stored on their computer, they are asked to disable the relevant option in their browser’s system settings. Stored cookies can be deleted in the browser’s system settings. Excluding cookies may lead to functional restrictions of this online offering.

A general objection to the use of cookies for online marketing purposes can be declared for most services, especially for tracking, via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. Furthermore, cookies can be stored by disabling them in your browser settings. Please note that some functions of this online offering may then not be available.

Deletion of data

Data we process will be deleted or its processing restricted in accordance with Articles 17 and 18 GDPR. Unless expressly stated in this privacy policy, data stored by us will be deleted as soon as it is no longer necessary for its purpose and no statutory retention obligations prevent deletion. Where data cannot be deleted because it is needed for other legally permitted purposes, its processing will be restricted. That is, the data will be blocked and not processed for other purposes. This applies, for example, to data that must be kept for commercial or tax law reasons.

Under statutory requirements in Germany, retention is in particular for 10 years pursuant to §§ 147(1) AO, 257(1) nos. 1 and 4, (4) HGB (books, records, management reports, accounting vouchers, commercial books, documents relevant for taxation, etc.) and for 6 years pursuant to § 257(1) nos. 2 and 3, (4) HGB (commercial letters).

Under statutory requirements in Austria, retention is in particular for 7 years pursuant to § 132(1) BAO (accounting records, receipts/invoices, accounts, vouchers, business documents, statements of income and expenses, etc.), for 22 years in connection with real estate, and for 10 years for documents relating to electronically supplied services, telecommunications, broadcasting and television services provided to non-entrepreneurs in EU member states for which the Mini One-Stop Shop (MOSS) is used.

Business-related processing

We also process
– Contract data (e.g. contract subject, term, customer category).
– Payment data (e.g. bank details, payment history)
from our customers, prospects and business partners for the purpose of providing contractual services, service and customer care, marketing, advertising and market research.

Contractual services

We process the data of our contractual partners and prospects, as well as other clients, customers, mandates, patients or contractual partners (collectively referred to as “contractual partners”) in accordance with Art. 6(1)(b) GDPR, in order to provide them with our contractual or pre-contractual services. The data processed, the type, scope and purpose, and the necessity of processing it, are determined by the underlying contractual relationship.

The data processed includes master data of our contractual partners (e.g., names and addresses), contact details (e.g., email addresses and phone numbers), contract data (e.g., services used, contract content, contractual communication, names of contact persons) and payment data (e.g., bank details, payment history).

We generally do not process special categories of personal data, except where they form part of a commissioned or contractual processing.

We process data necessary to establish and fulfill contractual services and point out the necessity of providing it where this is not evident to contractual partners. Data is only disclosed to external persons or companies if required in connection with a contract. When processing data entrusted to us in the context of an order, we act in accordance with the instructions of the clients and statutory requirements.

When using our online services, we may store the IP address and the time of the respective user action. Storage is based on our legitimate interests as well as the interests of users in protection against misuse and other unauthorized use. Such data is generally not passed on to third parties, unless this is necessary to pursue our claims under Article 6(1)(f) GDPR or there is a legal obligation to do so under Article 6(1)(c) GDPR.

Data is deleted when it is no longer necessary to fulfill contractual or statutory duties of care or to handle any warranty and comparable obligations, whereby the necessity of retaining the data is reviewed every three years; otherwise, statutory retention obligations apply.

Administration, financial accounting, office organization, contact management

We process data for administrative tasks, organization of our business, financial accounting and compliance with legal obligations, such as archiving. In doing so, we process the same data that we process in the course of providing our contractual services. The processing grounds are Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. Customers, prospects, business partners and website visitors are affected by the processing. The purpose and our interest in the processing lie in administration, financial accounting, office organization and archiving of data, i.e. tasks that serve to maintain our business activities, perform our duties and provide our services. Deletion of data relating to contractual services and contractual communication corresponds to the information given for these processing activities.

In doing so, we disclose or transmit data to tax authorities, advisors such as tax consultants or auditors, as well as other fee-collecting bodies and payment service providers.

We also store information about suppliers, organizers and other business partners based on our business interests, e.g., for future contact. This largely company-related data is generally stored permanently.

Participation in affiliate partner programs

Within our online offering, we use industry-standard tracking measures on the basis of our legitimate interests (i.e. interest in analyzing, optimizing and economically operating our online offering) pursuant to Art. 6(1)(f) GDPR, insofar as these are necessary for operating the affiliate system. Below we explain the technical background to users.

The services offered by our contract partners may also be advertised and linked on other websites (so-called affiliate links or after-buy systems, e.g. where third-party links or services are offered after a contract has been concluded). The operators of the respective websites receive a commission if users follow the affiliate links and subsequently take up the offers.

In summary, it is necessary for our online offering that we can track whether users who are interested in affiliate links and/or the offers available on our site subsequently take up the offers via the affiliate links or our online platform. To do this, the affiliate links and our offers are supplemented with certain values, which can be part of the link or set in another way, e.g. in a cookie. These values include in particular the referring website (referrer), time, an online identifier of the operator of the website on which the affiliate link was located, an online identifier of the respective offer, an online identifier of the user, as well as tracking-specific values such as advertising media ID, partner ID and categorisations.

The online identifiers of users that we use are pseudonymous values. That is, the online identifiers do not themselves contain personal data such as names or email addresses. They only help us determine whether the same user who clicked an affiliate link or showed interest in an offer through our online offering has taken up the offer, i.e. has concluded a contract with the provider, for example. However, the online identifier is personal data insofar as the partner company and also we have the online identifier together with other user data. This is the only way the partner company can tell us whether that user has taken up the offer and we can, for example, pay out the bonus.

Registration feature

Users can create a user account. During registration, the required mandatory information is provided to users and processed on the basis of Art. 6(1)(b) GDPR for the purpose of providing the user account. The data processed includes, in particular, login information (name, password and an email address). The data entered during registration will be used for the purposes of using the user account and its purpose.

Users can be informed by email about information relevant to their user account, such as technical changes. If users have terminated their user account, their data relating to the user account will be deleted, subject to any statutory retention obligations. It is the users’ responsibility to back up their data before the contract ends once termination has taken place. We are entitled to irretrievably delete all user data stored during the contract term.

When using our registration and sign-in features and the user account, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests, as well as the user’s interest in protection against misuse and other unauthorised use. These data are generally not passed on to third parties, unless this is necessary to pursue our claims or there is a statutory obligation to do so pursuant to Art. 6 para. 1 lit. c GDPR. IP addresses are anonymised or deleted after 7 days at the latest.

Comments and posts

If users leave comments or other posts, their IP addresses may be stored for 7 days on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. This is for our own security, in case someone leaves unlawful content in comments and posts (insults, banned political propaganda, etc.). In such a case, we may be held liable for the comment or post ourselves and are therefore interested in the identity of the author.

Furthermore, we reserve the right to process the users’ details for spam detection purposes, on the basis of our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR.

On the same legal basis, we reserve the right, in the case of polls, to store users’ IP addresses for the duration of the poll and to use cookies to prevent multiple voting.

The data provided in comments and posts will be stored permanently by us until the user objects.

Retrieving profile pictures from Gravatar

Within our online offering and in particular on the blog, we use the Gravatar service provided by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA.

Gravatar is a service where users can sign up and store profile pictures and their email addresses. If users leave posts or comments on other online presences (especially blogs) using the respective email address, their profile pictures can be displayed alongside the posts or comments. For this purpose, the email address provided by users is transmitted to Gravatar in encrypted form to check whether a profile is stored for it. This is the sole purpose of transmitting the email address, and it is not used for other purposes but is deleted afterwards.

Gravatar is used on the basis of our legitimate interests within the meaning of Art. 6 para. 1 lit. f) GDPR, as with the help of Gravatar we give post and comment authors the option to personalise their posts with a profile picture.

By displaying the images, Gravatar learns users’ IP addresses, as this is necessary for communication between a browser and an online service. Further information on the collection and use of data by Gravatar can be found in Automattic’s privacy notices: https://automattic.com/privacy/.

If users do not want a user picture linked to their email address on Gravatar to appear in the comments, they should use an email address for commenting that is not stored on Gravatar. We also point out that it is possible to use an anonymous email address or no email address at all, if users do not wish their own email address to be sent to Gravatar. Users can completely prevent the transmission of data by not using our comment system.

Retrieving emojis and smileys

Within our WordPress blog, graphical emojis (or smilies), i.e. small graphic files expressing emotions, are used, which are obtained from external servers. The providers of the servers collect users’ IP addresses. This is necessary so that the emoji files can be transmitted to users’ browsers. The emoji service is offered by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. Privacy notices from Automattic: https://automattic.com/privacy/. The server domains used are s.w.org and twemoji.maxcdn.com, which, to our knowledge, are so-called content delivery networks, i.e. servers that serve only to transmit the files quickly and securely, and users’ personal data is deleted after transmission.

Emojis are used on the basis of our legitimate interests, i.e. our interest in an attractive design of our online offering pursuant to Art. 6 para. 1 lit. f GDPR.

Contacting us

When you contact us (e.g. via contact form, email, telephone or social media), the user’s details are processed to handle the contact request and its completion pursuant to Art. 6(1)(b) GDPR (in the context of contractual or pre-contractual relationships) and Art. 6(1)(f) GDPR (other enquiries).. The users’ details may be stored in a customer relationship management system (“CRM system”) or comparable enquiry management system.

We delete enquiries once they are no longer required. We review the need for retention every two years; statutory archiving obligations also apply.

The following information tells you about the content of our newsletter as well as the registration, dispatch and statistical evaluation procedures and your rights of objection. By subscribing to our newsletter, you agree to receive it and to the procedures described.

Newsletter content: We send newsletters, emails and other electronic notifications containing promotional information (hereinafter “Newsletter”) only with the recipients’ consent or where legally permitted. Where the content of a newsletter is specifically described when signing up, that content is decisive for the users’ consent. Otherwise, our newsletters contain information about our services and about us.

Double opt-in and logging: Signing up for our newsletter takes place via a so-called double opt-in procedure. That is, after signing up you will receive an email asking you to confirm your registration. This confirmation is necessary so that nobody can sign up using someone else’s email address. Newsletter sign-ups are logged in order to be able to prove the sign-up process in accordance with legal requirements. This includes storing the time of sign-up and of confirmation, as well as the IP address. Changes to your data stored with the mailing service provider are also logged.

Sign-up data: To sign up for the newsletter, it is sufficient for you to provide your email address. Optionally, we ask you to provide a name so that we can address you personally in the newsletter.

The newsletter is sent and its success is measured on the basis of the recipients’ consent pursuant to Art. 6 para. 1 lit. a, Art. 7 GDPR in conjunction with § 7 para. 2 no. 3 UWG, or, where consent is not required, on the basis of our legitimate interests in direct marketing pursuant to Art. 6 para. 1 lit. f GDPR in conjunction with § 7 para. 3 UWG.

Logging of the sign-up process is based on our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR. Our interest is in using a user-friendly and secure newsletter system that serves both our business interests and meets users’ expectations, and also allows us to prove consents.

Cancellation/revocation – You can unsubscribe from our newsletter at any time, i.e. revoke your consent. You will find a link to unsubscribe at the end of every newsletter. We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove a previously given consent. Processing of this data is limited to the purpose of defending possible claims. An individual deletion request is possible at any time, provided that the former existence of a consent is confirmed at the same time.

The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from our server or, if we use a dispatch service provider, from its server when the newsletter is opened. As part of this retrieval, technical information such as browser and system information, as well as your IP address and time of retrieval, are initially collected.

This information is used to technically improve the services, based on technical data or on target groups and their reading behavior, based on the places they are accessed from (which can be determined using the IP address) or the access times. The statistical surveys also include establishing whether newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to individual newsletter recipients. However, it is neither our aim, nor that of the shipping service provider, if used, to monitor individual users. Rather, the evaluations serve us to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

Unfortunately, it is not possible to withdraw from success measurement separately. In this case, the entire newsletter subscription must be cancelled.

Hosting and email dispatch

The hosting services we use provide the following services: infrastructure and platform services, computing capacity, storage space and database services, email dispatch, security services and technical maintenance services that we use for the purpose of operating this online offering.

Here we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta and communication data from customers, prospects and visitors to this online offering, based on our legitimate interest in providing this online offering efficiently and securely pursuant to Art. 6 para. 1 lit. f GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement).

Collection of access data and log files

We, or our hosting provider, collect data about every access to the server on which this service is located (so-called server log files), based on our legitimate interests within the meaning of Art. 6(1)(f) GDPR. Access data includes the name of the retrieved web page, file, date and time of retrieval, amount of data transferred, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider.

For security reasons (e.g. to investigate misuse or fraud), log file information is stored for a maximum of 7 days and then deleted. Data whose further retention is required for evidence purposes is exempt from deletion until the relevant incident has been finally resolved.

Cloudflare content delivery network

We use a so-called “Content Delivery Network” (CDN) provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare is certified under the Privacy Shield framework and thereby provides a guarantee that it will comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnZKAA0&status=Active).

A CDN is a service that uses regionally distributed servers connected via the internet to deliver content from our online offering, especially large media files such as graphics or scripts, faster. User data is processed solely for the above purposes and to maintain the security and functionality of the CDN.

This use is based on our legitimate interests, i.e. our interest in the secure and efficient provision, analysis and optimization of our online offering pursuant to Art. 6 para. 1 lit. f GDPR.

For more information, see Cloudflare’s privacy policy: https://www.cloudflare.com/security-policy.

Google Tag Manager

Google Tag Manager is a solution that lets us manage so-called website tags through a single interface (and so, for example, integrate Google Analytics and other Google marketing services into our online offering). The Tag Manager itself (which implements the tags) does not process users’ personal data. For the processing of users’ personal data, please refer to the following information on Google services. Usage policies: https://www.google.com/intl/de/tagmanager/use-policy.html.

Google Analytics

Based on our legitimate interests (i.e. interest in analysing, optimising and operating our online offering economically within the meaning of Art. 6(1)(f) GDPR), we use Google Analytics, a web analytics service provided by Google LLC (“Google”). Google uses cookies. The information generated by the cookie about users’ use of the online offering is generally transmitted to and stored on a Google server in the USA.

Google is certified under the Privacy Shield framework and thereby provides a guarantee that it will comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

Google will use this information on our behalf to evaluate users’ use of our online offering, to compile reports on activity within this online offering and to provide us with further services related to the use of this online offering and internet use. Pseudonymous user profiles may be created from the processed data.

We only use Google Analytics with IP anonymization activated. This means that users’ IP addresses are shortened by Google within member states of the European Union or other contracting states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.

The IP address transmitted by the user’s browser is not merged with other Google data. Users can prevent the storage of cookies by adjusting their browser software settings. Users can also prevent Google from collecting the data generated by the cookie and related to their use of the online offering, and from processing that data, by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

Alternatively, you can disable Google Analytics by clicking the following link: Disable Google Analytics

For more information on how Google uses data, setting and objection options, see Google’s privacy policy (https://policies.google.com/technologies/ads) and the settings for how Google displays adverts (https://adssettings.google.com/authenticated).

Users’ personal data is deleted or anonymized after 14 months.

Audience building with Google Analytics

We use Google Analytics to show adverts placed within Google’s and its partners’ advertising services only to users who have shown an interest in our online offering or who have certain characteristics (e.g. interests in specific topics or products, determined by the websites visited) that we transmit to Google (so-called “remarketing” or “Google Analytics audiences”). We also use remarketing audiences to ensure that our adverts match users’ potential interests.

Based on our legitimate interests (i.e. interest in analysing, optimising and operating our online offering economically within the meaning of Art. 6(1)(f) GDPR), we use the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

Google is certified under the Privacy Shield agreement and therefore provides a guarantee to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

We use the AdSense service, which displays ads on our website and for which we receive payment for displaying them or for other use. For these purposes, usage data such as clicks on an ad and users’ IP addresses are processed, whereby the last two digits of the IP address are removed. Therefore, users’ data is processed pseudonymously.

We use AdSense with non-personalized ads. In this case, ads are not shown based on user profiles. Non-personalized ads are not based on previous user behavior. Targeting uses contextual information, including broad geographic targeting (e.g. at city level) based on the current location, the content of the current website or app, and current search terms. Google prevents any personalized targeting, including demographic targeting and targeting based on user lists.

Google Ads and conversion measurement

We use the online marketing method Google “AdWords” to place ads in the Google advertising network (e.g. in search results, in videos, on websites, etc.) so that they are shown to users who are presumed to be interested in the ads. This allows us to show ads for and within our online offering more precisely, so that users are only shown ads that potentially match their interests. If a user is shown ads for products they were interested in on other online offerings, this is called “remarketing”. For this purpose, when our and other websites on which the Google advertising network is active are accessed, Google immediately runs a code and so-called (re)marketing tags (invisible graphics or code, also called “web beacons”) are embedded in the website. With their help, an individual cookie, i.e. a small file, is saved on the user’s device (comparable technologies can be used instead of cookies). This file records which websites the user visited, which content they were interested in and which offers they clicked, as well as technical information about the browser and operating system, referring websites, visit time and other details about use of the online offering.

We also receive an individual “conversion cookie”. The information obtained with the help of the cookie is used by Google to create conversion statistics for us. However, we only learn the anonymous total number of users who clicked our ad and were redirected to a page tagged with a conversion tracking tag. We do not receive any information that can be used to personally identify users.

Users’ data is processed pseudonymously within the Google advertising network. That is, Google does not store or process, for example, users’ names or email addresses, but processes the relevant data on a cookie basis within pseudonymous user profiles. From Google’s perspective, ads are not managed and shown for a specifically identified person, but for the cookie holder, regardless of who that cookie holder is. This does not apply if a user has expressly allowed Google to process the data without this pseudonymization. The information collected about users is transmitted to Google and stored on Google’s servers in the USA.

Facebook pixel, Custom Audiences and Facebook conversion

Within our online offering, based on our legitimate interests in analysing, optimising and operating our online offering economically, and for these purposes, the so-called “Facebook pixel” of the social network Facebook is used. It is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA or, if you are based in the EU, by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).

Facebook is certified under the Privacy Shield framework and thereby provides a guarantee that it will comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active).

Using the Facebook pixel, Facebook is able, on the one hand, to determine visitors to our online offering as a target group for displaying advertisements (so-called “Facebook ads”). Accordingly, we use the Facebook pixel to show the Facebook ads we place only to those Facebook users who have shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products, determined based on the websites visited) that we transmit to Facebook (so-called “Custom Audiences”). With the help of the Facebook pixel, we also want to ensure that our Facebook ads match users’ potential interests and do not come across as intrusive. With the help of the Facebook pixel, we can further track the effectiveness of Facebook ads for statistical and market research purposes, by seeing whether users were redirected to our website after clicking a Facebook ad (so-called “conversion”).

Facebook processes data in accordance with Facebook’s Data Policy. Accordingly, general information on how Facebook ads are displayed can be found in Facebook’s Data Policy: https://www.facebook.com/policy. Specific information and details about the Facebook pixel and how it works can be found in Facebook’s Help Centre: https://www.facebook.com/business/help/651294705016616.

You can object to the collection by the Facebook pixel and the use of your data to display Facebook ads. To set which types of adverts you see on Facebook, visit the page set up by Facebook and follow the instructions on settings for interest-based advertising: https://www.facebook.com/settings?tab=ads. The settings apply across platforms, i.e. they are applied to all devices, such as desktop computers and mobile devices.

Facebook pixel opt-out: Disable Facebook pixel

You can also object to the use of cookies for audience measurement and advertising purposes via the opt-out page of the Network Advertising Initiative (http://optout.networkadvertising.org/), and additionally via the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).

Online presence on social media

We maintain online presences within social networks and platforms in order to communicate with customers, prospects and users active there, and to inform them about our services.

We point out that user data may be processed outside the European Union. This may pose risks for users, as it could make it harder to enforce their rights, for example. With regard to US providers certified under the Privacy Shield, we note that they undertake to comply with EU data protection standards.

Furthermore, users’ data is generally processed for market research and advertising purposes. For example, usage profiles can be created from users’ usage behavior and the resulting interests. Usage profiles may in turn be used to show advertisements inside and outside the platforms that presumably match users’ interests. For these purposes, cookies are generally stored on users’ computers, in which usage behavior and users’ interests are saved. Furthermore, data independent of the devices used by users may also be stored in the usage profiles (especially if users are members of the respective platforms and are logged in to them).

Personal data of users is processed on the basis of our legitimate interests in effectively informing users and communicating with them pursuant to Art. 6 para. 1 lit. f GDPR. If users are asked by the respective providers for consent to data processing (i.e. they declare their agreement, for example, by ticking a checkbox or confirming a button), the legal basis for processing is Art. 6 para. 1 lit. a and Art. 7 GDPR.

For a detailed description of the respective processing and opt-out options, please refer to the provider information linked below.

Also in the case of access requests and the assertion of user rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to users’ data and can take appropriate measures directly and provide information. If you still need help, you can contact us.

– Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) – Privacy policy: https://www.facebook.com/about/privacy/, Opt-out: https://www.facebook.com/settings?tab=adsand http://www.youronlinechoices.com, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.

– Google/ YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – Privacy policy: https://policies.google.com/privacy, Opt-out: https://adssettings.google.com/authenticated, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.

– Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) – Privacy policy/ Opt-out: http://instagram.com/about/legal/privacy/.

– Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA) – Privacy policy: https://twitter.com/de/privacy, Opt-out: https://twitter.com/personalization, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active.

– Pinterest (Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA) – Privacy policy/ Opt-out: https://about.pinterest.com/de/privacy-policy.

Integration of third-party services and content

Based on our legitimate interests (i.e. interest in analysing, optimising and operating our online offering economically within the meaning of Art. 6(1)(f) GDPR), we use content or service offers from third-party providers within our online offering in order to embed their content and services, such as videos or fonts (collectively referred to below as “content”).

This always requires that the third-party providers of this content perceive users’ IP address, since they could not send the content to their browser without the IP address. The IP address is therefore necessary to display this content. We endeavor to use only content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to analyze visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on users’ devices and may include, among other things, technical information about the browser and operating system, referring websites, visit time and other details on use of our online offering, and may also be linked with such information from other sources.

YouTube

We embed videos from the “YouTube” platform operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, Opt-out: https://adssettings.google.com/authenticated.

Google Fonts

We integrate the fonts (“Google Fonts”) from the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, Opt-out: https://adssettings.google.com/authenticated.

Google reCAPTCHA

We integrate the function for recognising bots, e.g. when entering data in online forms (“ReCaptcha”) from the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.com/policies/privacy/, Opt-out: https://adssettings.google.com/authenticated.

Google Maps

We integrate the maps of the service “Google Maps” from the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The processed data may include, in particular, users’ IP addresses and location data, which are not collected without their consent (usually given through the settings of their mobile devices). The data may be processed in the USA. Privacy policy: https://www.google.com/policies/privacy/, Opt-out: https://adssettings.google.com/authenticated.