Privacy policy

1. Data protection at a glance

General information

The following information provides a brief overview of what happens to your personal data when you visit this website. Personal data is any data that can identify you personally. For detailed information on data protection, please refer to our privacy policy below.

Data collection on this website

Who is responsible for collecting data on this website?

Data on this website is processed by the website operator. You can find the operator’s contact details in the “Information about the controller” section of this privacy policy.

How do we collect your data?

Some of your data is collected when you provide it to us. This may, for example, be data you enter in a contact form.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This is primarily technical data, such as your internet browser, operating system or the time you access the page. This data is collected automatically as soon as you access this website.

What do we use your data for?

Some data is collected to ensure that the website functions without errors. Other data may be used to analyse your user behaviour. If contracts can be concluded or initiated through the website, the data submitted is also processed for contractual offers, orders or other order enquiries.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request correction or deletion of this data. If you have consented to data processing, you may withdraw your consent at any time with effect for the future. You also have the right, under certain circumstances, to request restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You may contact us at any time about these rights or any other questions concerning data protection.

Analytics tools and third-party tools

When you visit this website, your browsing behaviour may be evaluated statistically. This is mainly done using analytics programs.

You will find detailed information about these analytics programs in the following privacy policy.

2. Hosting

We host the content of our website with the following provider:

IONOS

The provider is IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (hereinafter IONOS). When you visit our website, IONOS records various log files, including your IP addresses. For details, please refer to IONOS’s privacy policy: https://www.ionos.de/terms-gtc/terms-privacy(opens in new tab).

We use IONOS on the basis of Article 6(1)(f) GDPR. We have a legitimate interest in presenting the website as reliably as possible. Where corresponding consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Processing on our behalf

We have concluded a data processing agreement for use of the above service. This is an agreement required under data protection law that ensures that the provider processes our website visitors’ personal data only in accordance with our instructions and in compliance with the GDPR.

3. General information and mandatory disclosures

Data protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection provisions and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that transmitting data over the internet, for example when communicating by email, can involve security vulnerabilities. It is not possible to protect data completely against access by third parties.

Information about the controller

The controller responsible for data processing on this website is:

W.S. Werkstoff Service GmbH
Katernberger Straße, 107
45327 Essen

Telephone: +49 201 316844-0
Email: [info@werkstoff-service.de](mailto:info@werkstoff-service.de)

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data, such as names, email addresses or similar information.

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for processing it no longer applies. If you make a valid request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing your personal data, such as retention periods under tax or commercial law. In the latter case, deletion takes place once those grounds no longer apply.

General information about the legal bases for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Article 6(1)(a) GDPR or Article 9(2)(a) GDPR where special categories of data under Article 9(1) GDPR are processed. Where you have expressly consented to the transfer of personal data to third countries, data processing also takes place on the basis of Article 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your device, for example through device fingerprinting, data processing additionally takes place on the basis of Section 25(1) TDDDG. Consent may be withdrawn at any time. If your data is necessary for performance of a contract or for steps taken prior to entering into a contract, we process it on the basis of Article 6(1)(b) GDPR. We also process your data on the basis of Article 6(1)(c) GDPR where this is necessary to comply with a legal obligation. Data may also be processed on the basis of our legitimate interest under Article 6(1)(f) GDPR. The following sections of this privacy policy explain the legal bases applicable in each case.

Data protection officer

We have appointed a data protection officer.

W.S. Werkstoff Service GmbH
Katernberger Str. 107
45327 Essen

Telephone: +49 201 316844-0
Email: [datenschutz@werkstoff-service.de](mailto:datenschutz@werkstoff-service.de)

Information about transfers to third countries that do not provide a secure level of data protection and to US companies that are not DPF-certified

Among other things, we use tools from companies based in third countries that do not provide a secure level of data protection, as well as US tools whose providers are not certified under the EU–US Data Privacy Framework (DPF). If these tools are active, your personal data may be transferred to and processed in those countries. Please note that a level of data protection comparable to that in the EU cannot be guaranteed in third countries that do not provide a secure level of data protection.

Please note that, as a safe third country, the USA generally provides a level of data protection comparable to that in the EU. Accordingly, transfers of data to the USA are permitted if the recipient is certified under the EU–US Data Privacy Framework (DPF) or has appropriate additional safeguards. Information about transfers to third countries, including the recipients of the data, can be found in this privacy policy.

Recipients of personal data

In the course of our business activities, we work with various external bodies. In some cases, this also requires personal data to be transferred to them. We disclose personal data to external bodies only where this is necessary to perform a contract, where we are legally obliged to do so (e.g. disclosure to tax authorities), where we have a legitimate interest in disclosure under Article 6(1)(f) GDPR, or where another legal basis permits disclosure. When using processors, we disclose our customers’ personal data only on the basis of a valid data processing agreement. Where processing is carried out jointly, a joint processing agreement is concluded.

Withdrawal of your consent to data processing

Many data processing operations are possible only with your express consent. You may withdraw consent you have already given at any time. Withdrawal does not affect the lawfulness of data processing carried out before consent was withdrawn.

Right to object to data collection in specific cases and to direct marketing (Article 21 GDPR)

IF DATA IS PROCESSED ON THE BASIS OF ARTICLE 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE APPLICABLE LEGAL BASIS FOR PROCESSING IS SET OUT IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS (OBJECTION UNDER ARTICLE 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION UNDER ARTICLE 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of a breach of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged infringement. This right exists without prejudice to other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract provided to you or to a third party in a commonly used, machine-readable format. Where you request direct transfer of the data to another controller, this will take place only insofar as it is technically feasible.

Access, rectification and erasure

Within the scope of applicable statutory provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients and the purpose of processing, and, where applicable, a right to rectification or erasure of this data. You may contact us at any time about this or any other questions concerning personal data.

Right to restriction of processing

You have the right to request restriction of the processing of your personal data. You may contact us at any time to do so. This right applies in the following cases:

• If you dispute the accuracy of your personal data stored by us, we generally need time to verify it. During this verification period, you have the right to request restriction of the processing of your personal data.
• If your personal data has been or is being processed unlawfully, you may request restriction of processing instead of erasure.
• If we no longer need your personal data but you need it to exercise, defend or establish legal claims, you have the right to request restriction of processing instead of erasure.
• If you have objected under Article 21(1) GDPR, your interests must be weighed against ours. Until it has been determined whose interests prevail, you have the right to request restriction of the processing of your personal data.

If you have restricted the processing of your personal data, that data may, apart from being stored, be processed only with your consent, to establish, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the website operator, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the change in the browser’s address bar from “http://” to “https://” and the padlock symbol in the browser bar.

When SSL or TLS encryption is enabled, the data you send to us cannot be read by third parties.

4. Data collection on this website

Cookies

Our website uses cookies. Cookies are small data packages and do not harm your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically when your visit ends. Persistent cookies remain on your device until you delete them yourself or your web browser deletes them automatically.

Cookies may originate from us (first-party cookies) or from third-party companies (third-party cookies). Third-party cookies enable certain services provided by third-party companies to be integrated into websites, such as cookies used to process payment services.

Cookies have various functions. Many cookies are technically necessary because certain website functions would not work without them, such as the shopping basket function or the display of videos. Other cookies may be used to evaluate user behaviour or for advertising purposes.

Cookies required to carry out electronic communications, provide certain functions you request (e.g. the shopping basket function), or optimise the website (e.g. cookies used to measure website audiences) are stored on the basis of Article 6(1)(f) GDPR unless another legal basis is specified. The website operator has a legitimate interest in storing these necessary cookies to provide its services in a technically error-free and optimised manner. If consent to the storage of cookies and comparable recognition technologies has been requested, processing takes place exclusively on the basis of that consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG); consent may be withdrawn at any time.

You can configure your browser to notify you when cookies are set and allow them only in individual cases, to refuse cookies in specific cases or generally, and to delete cookies automatically when you close the browser. Disabling cookies may limit the functionality of this website.

If further cookies and services are used on this website, information about them is provided in this privacy policy.

Consent with Borlabs Cookie

Our website uses Borlabs Cookie consent technology to obtain your consent to the storage of certain cookies in your browser or the use of certain technologies and to document that consent in compliance with data protection requirements. The provider of this technology is Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, Germany (hereinafter Borlabs).

When you access our website, a Borlabs cookie is stored in your browser, recording the consents you have given or your withdrawal of those consents. This data is not passed on to the provider of Borlabs Cookie.

The collected data is stored until you ask us to delete it, delete the Borlabs cookie yourself, or the purpose of storing it no longer applies. Mandatory statutory retention periods remain unaffected. Details of data processing by Borlabs Cookie can be found at https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/(opens in new tab).

Borlabs Cookie consent technology is used to obtain the legally required consents for the use of cookies. The legal basis is Article 6(1)(c) GDPR.

Server log files

The website provider automatically collects and stores information in server log files that your browser automatically transmits to us. This information includes:

• Browser type and version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not combined with other data sources.

This data is collected on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring that its website is displayed without technical errors and in optimising it; recording server log files is necessary for this purpose.

Contact form

If you send us enquiries using the contact form, the details you enter, including the contact details you provide, will be stored by us to process your enquiry and in case of follow-up questions. We do not pass on this data without your consent.

This data is processed on the basis of Article 6(1)(b) GDPR if your enquiry relates to performance of a contract or is necessary for steps taken prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), where requested; consent may be withdrawn at any time.

Data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose of storing it no longer applies, for example once your enquiry has been fully processed. Mandatory statutory provisions, particularly retention periods, remain unaffected.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, your enquiry, including all personal data arising from it (name, enquiry), will be stored and processed by us to handle your request. We do not pass on this data without your consent.

This data is processed on the basis of Article 6(1)(b) GDPR if your enquiry relates to performance of a contract or is necessary for steps taken prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), where requested; consent may be withdrawn at any time.

Data you send to us in contact enquiries remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose of storing it no longer applies, for example once your request has been fully processed. Mandatory statutory provisions, particularly statutory retention periods, remain unaffected.

5. Analytics tools and advertising

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or statistics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies or carry out independent analyses. It serves only to manage and deploy the tools integrated through it. However, Google Tag Manager records your IP address, which may also be transferred to Google’s parent company in the United States.

Google Tag Manager is used on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in quickly and easily integrating and managing various tools on its website. Where corresponding consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

The company is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF-certified company undertakes to comply with these standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780(opens in new tab).

Google Analytics

This website uses functions of the Google Analytics web analytics service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. The operator receives various usage data, such as page views, length of visits, operating systems used and users’ origins. This data is assigned to the user’s respective device. It is not assigned to a user ID.

Google Analytics also allows us to record, among other things, your mouse movements, scrolling and clicks. Google Analytics further uses various modelling approaches to supplement the collected datasets and uses machine learning technologies to analyse data.

Google Analytics uses technologies that enable users to be recognised for the purpose of analysing user behaviour, such as cookies or device fingerprinting. Information collected by Google about use of this website is generally transmitted to a Google server in the USA and stored there.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

The transfer of data to the USA is based on the European Commission’s standard contractual clauses. Details can be found here: https://business.safety.google/adscontrollerterms/sccs/(opens in new tab).

The company is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF-certified company undertakes to comply with these standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780(opens in new tab).

IP anonymisation

Google Analytics IP anonymisation is enabled. As a result, Google truncates your IP address within Member States of the European Union or other contracting states to the Agreement on the European Economic Area before transferring it to the USA. Only in exceptional cases is the full IP address transferred to a Google server in the USA and truncated there. On behalf of the operator of this website, Google uses this information to evaluate your use of the website, compile reports on website activity and provide the website operator with other services relating to website and internet use. The IP address transmitted by your browser as part of Google Analytics is not combined with other Google data.

Browser plug-in

You can prevent Google from collecting and processing your data by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de(opens in new tab).

Further information on how Google Analytics handles user data is available in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de(opens in new tab).

Processing on our behalf

We have concluded a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Google Analytics e-commerce measurement

This website uses the e-commerce measurement function of Google Analytics. E-commerce measurement enables the website operator to analyse visitors’ purchasing behaviour to improve its online marketing campaigns. Information such as orders placed, average order values, shipping costs and the time between viewing and purchasing a product is collected. Google may combine this data under a transaction ID assigned to the respective user or their device.

Google Ads

The website operator uses Google Ads, an online advertising program provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads allows us to display advertisements in Google’s search engine or on third-party websites when users enter certain search terms in Google (keyword targeting). Targeted advertisements may also be displayed on the basis of user data held by Google, such as location data and interests (audience targeting). As the website operator, we can evaluate this data quantitatively, for example by analysing which search terms led to our advertisements being displayed and how many advertisements resulted in clicks.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

The transfer of data to the USA is based on the European Commission’s standard contractual clauses. Details can be found here: https://policies.google.com/privacy/frameworks(opens in new tab) and https://business.safety.google/controllerterms/(opens in new tab).

The company is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF-certified company undertakes to comply with these standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780(opens in new tab).

Google conversion tracking

This website uses Google conversion tracking. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google conversion tracking enables Google and us to determine whether users have carried out certain actions. For example, we can evaluate how often particular buttons on our website are clicked and which products are viewed or purchased most frequently. This information is used to compile conversion statistics. We learn the total number of users who have clicked on our advertisements and which actions they have carried out. We do not receive information that allows us to identify users personally. Google itself uses cookies or comparable recognition technologies for identification.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

Further information about Google conversion tracking can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=de(opens in new tab).

The company is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF-certified company undertakes to comply with these standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780(opens in new tab).

Meta Pixel (formerly Facebook Pixel)

This website uses Meta’s visitor action pixel to measure conversions. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Dublin, D04 X2K5, Ireland. According to Meta, the data collected is also transferred to the USA and other third countries.

This allows the behaviour of website visitors to be tracked after they are redirected to the provider’s website by clicking a Meta advertisement. The effectiveness of Meta advertisements can thereby be evaluated for statistical and market research purposes, and future advertising activities can be optimised.

The data collected is anonymous to us as the operator of this website; we cannot draw conclusions about users’ identities. However, the data is stored and processed by Meta, making it possible to link it to the respective Facebook or Instagram user profile and allowing Meta to use it for its own advertising purposes in accordance with Meta’s data policy (https://de-de.facebook.com/about/privacy/(opens in new tab)). This allows Meta to display advertisements on Facebook or Instagram and other advertising channels. As the website operator, we have no influence over this use of the data.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent may be withdrawn at any time.

Insofar as personal data is collected on our website and passed to Meta using the tool described here, we and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Dublin, D04 X2K5, Ireland are jointly responsible for this processing (Article 26 GDPR). Joint responsibility is limited exclusively to collecting the data and transferring it to Meta. Meta’s subsequent processing after the transfer is not part of this joint responsibility. Our joint obligations have been set out in an agreement on joint processing. The wording of this agreement can be found at: https://www.facebook.com/legal/controller_addendum(opens in new tab). Under this agreement, we are responsible for providing data protection information when using the Meta tool and for implementing it on our website in a manner that complies with data protection requirements. Meta is responsible for the data security of Meta products. You may exercise your rights as a data subject, such as requests for access, concerning data processed by Facebook or Instagram directly with Meta. If you exercise these rights with us, we are obliged to forward them to Meta.

The transfer of data to the USA is based on the European Commission’s standard contractual clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum(opens in new tab) and https://de-de.facebook.com/help/566994660333381(opens in new tab).

Further information on protecting your privacy can be found in Meta’s privacy information: https://de-de.facebook.com/about/privacy/(opens in new tab).

You can also disable the “Custom Audiences” remarketing function in the advertising settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen(opens in new tab) . You must be logged in to Facebook to do so.

If you do not have a Facebook or Instagram account, you can disable Meta’s interest-based advertising on the European Interactive Digital Advertising Alliance website: http://www.youronlinechoices.com/de/praferenzmanagement/(opens in new tab).

The company is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF-certified company undertakes to comply with these standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/4452(opens in new tab).

6. Newsletter

Newsletter data

If you wish to receive the newsletter offered on this website, we require your email address and information that allows us to verify that you are the owner of that address and consent to receiving the newsletter. No further data is collected, or it is collected only voluntarily. We use the newsletter service providers described below to manage our newsletters.

Rapidmail

This website uses Rapidmail to send newsletters. The provider is rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg i.Br., Germany.

Rapidmail is a service that can be used, among other things, to organise and analyse the sending of newsletters. The data you enter for the purpose of subscribing to the newsletter is stored on Rapidmail's servers in Germany.

Data analysis by Rapidmail

For analysis purposes, emails sent with Rapidmail contain a so-called “tracking pixel”, which connects to Rapidmail's servers when the email is opened. This makes it possible to determine whether a newsletter message has been opened.

We can also use Rapidmail to determine whether links in the newsletter message have been clicked and, if so, which ones. All links in the email are so-called tracking links, which can be used to count your clicks. If you do not want Rapidmail to analyse your data, you must unsubscribe from the newsletter. We provide a corresponding link in every newsletter message for this purpose.

For more information about Rapidmail's analysis functions, please visit the following link: https://www.rapidmail.de/hilfe/kategorie/statistiken(opens in new tab).

Legal basis

Data processing is based on your consent (Article 6(1)(a) GDPR). You may withdraw this consent at any time. Withdrawal does not affect the lawfulness of data processing operations already carried out.

Storage period

The data you provide to us for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter, and will be deleted from the newsletter mailing list after you unsubscribe. Data stored by us for other purposes remains unaffected.

After you have unsubscribed from the newsletter mailing list, your email address may be stored by us or the newsletter service provider in a blacklist if this is necessary to prevent future mailings. The data in the blacklist is used solely for this purpose and is not combined with other data. This serves both your interests and our interest in complying with the statutory requirements for sending newsletters (legitimate interest within the meaning of Article 6(1)(f) GDPR). Storage in the blacklist is not subject to a time limit. You may object to this storage if your interests outweigh our legitimate interest.

For further details, please refer to Rapidmail's data security information at: https://www.rapidmail.de/datensicherheit(opens in new tab).

Processing on our behalf

We have concluded a data processing agreement for use of the above service. This is an agreement required under data protection law that ensures that the provider processes our website visitors’ personal data only in accordance with our instructions and in compliance with the GDPR.

7. Plugins and tools

YouTube with enhanced privacy

This website embeds videos from the YouTube website. The website is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit a page on this website that has YouTube embedded in it, a connection to YouTube's servers is established. The YouTube server is informed of which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to associate your browsing behaviour directly with your personal profile. You can prevent this by logging out of your YouTube account.

We use YouTube in privacy-enhanced mode. According to YouTube, videos played in privacy-enhanced mode are not used to personalise browsing on YouTube. Advertisements displayed in privacy-enhanced mode are also not personalised. No cookies are set in privacy-enhanced mode. Instead, however, so-called local storage elements are stored in the user's browser. Like cookies, these may contain personal data and can be used to recognise users. Details about privacy-enhanced mode can be found here: https://support.google.com/youtube/answer/171780(opens in new tab).
Activating a YouTube video may trigger further data processing operations over which we have no control.

YouTube is used in the interest of presenting our online services in an appealing manner. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR. Where the corresponding consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

Further information about data protection at YouTube can be found in its privacy policy at: https://policies.google.com/privacy?hl=de(opens in new tab).

The company is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every DPF-certified company undertakes to comply with these standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780(opens in new tab).

Google Fonts (local hosting)

This site uses so-called Google Fonts, provided by Google, to display fonts consistently. The Google Fonts are installed locally. No connection is made to Google's servers.

Further information about Google Fonts can be found at https://developers.google.com/fonts/faq(opens in new tab) and in Google's privacy policy: https://policies.google.com/privacy?hl=de(opens in new tab).

Cloudflare Turnstile

We use Cloudflare Turnstile on this website. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter “Cloudflare”).

Cloudflare Turnstile checks whether data entered on our website, for example in contact forms or other forms, is entered by a human or an automated program. This allows us, in particular, to protect our website against abusive automated access and spam.

For this purpose, Turnstile processes various technical information and signals from the device and browser used. These may include, in particular, the IP address, information about the browser and operating system used, the User-Agent header, TLS information, the so-called sitekey and information about the website accessed. Cloudflare uses this information to distinguish human visitors from automated access. According to Cloudflare, Turnstile does not read, store or transmit content that you enter in forms protected by Turnstile.

Processing is based on Article 6(1)(f) GDPR. We have a legitimate interest in protecting our website, and in particular our forms, against abusive automated use, bots and spam. Insofar as information is stored on your device or read from your device when Turnstile is used, and this is strictly necessary to provide the website function expressly requested, this is based on Section 25(2), no. 2 TDDDG.

Cloudflare processes certain data as a processor when providing Turnstile. In addition, Cloudflare may process certain technical signals under its own responsibility in order to improve the detection of bots and abusive access.

The transfer of data to the USA cannot be ruled out. Cloudflare is certified under the EU–US Data Privacy Framework (DPF). Data may therefore be transferred to the USA on the basis of the European Commission's adequacy decision. Cloudflare also states that it uses the European Commission's standard contractual clauses for international data transfers.

Further information about Cloudflare Turnstile and data protection can be found at: https://www.cloudflare.com/de-de/turnstile-privacy-policy/(opens in new tab) and https://www.cloudflare.com/de-de/privacypolicy/(opens in new tab).

Wordfence

We have integrated Wordfence into this website. The provider is Defiant Inc., Defiant, Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA (hereinafter “Wordfence”).

Wordfence protects our website against unwanted access and malicious cyberattacks. For this purpose, our website establishes a permanent connection to Wordfence's servers so that Wordfence can compare access to our website against its databases and block it where necessary.

Wordfence is used on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in protecting its website against cyberattacks as effectively as possible. Where the corresponding consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

The transfer of data to the USA is based on the European Commission's standard contractual clauses. Details can be found here: https://www.wordfence.com/help/general-data-protection-regulation/(opens in new tab).

8. eCommerce and payment providers

Processing customer and contract data

We collect, process and use personal customer and contract data to establish, define and amend our contractual relationships. We collect, process and use personal data relating to the use of this website (usage data) only insofar as this is necessary to enable the user to use the service or to bill for it. The legal basis for this is Article 6(1)(b) GDPR.

The customer data collected will be deleted once the order has been completed or the business relationship has ended and any applicable statutory retention periods have expired. Statutory retention periods remain unaffected.

Data transfer when entering into contracts for services and digital content

We transmit personal data to third parties only where this is necessary for the performance of a contract, for example to the credit institution commissioned to process payments.

No further transmission of data takes place, unless you have expressly consented to the transmission. Your data will not be disclosed to third parties without your express consent, for example for advertising purposes.

The basis for data processing is Article 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or for steps taken prior to entering into a contract.

9. Our own services

Handling applicant data

We offer you the opportunity to apply for a job with us (e.g. by email, post or via an online application form). Below, we explain the scope, purpose and use of the personal data collected from you during the application process. We assure you that your data will be collected, processed and used in accordance with applicable data protection law and all other statutory provisions, and that your data will be treated as strictly confidential.

Scope and purpose of data collection

If you send us an application, we process the personal data associated with it (e.g. contact and communication details, application documents, notes taken during interviews, etc.) insofar as this is necessary to decide whether to establish an employment relationship. The legal basis for this is Section 26 BDSG under German law (steps towards establishing an employment relationship), Article 6(1)(b) GDPR (general steps prior to entering into a contract) and – if you have given your consent – Article 6(1)(a) GDPR. Consent may be withdrawn at any time. Within our company, your personal data will be disclosed only to people involved in processing your application.

If your application is successful, the data you have submitted will be stored in our data processing systems on the basis of Section 26 BDSG and Article 6(1)(b) GDPR for the purpose of carrying out the employment relationship.

As part of the application process, we may also carry out an internet search about you. This primarily includes Google Search, LinkedIn and Xing. The legal basis for this type of processing is our legitimate interest in obtaining an overall impression of publicly available information about you pursuant to Article 6(1)(f) GDPR.

Data retention period

If we are unable to offer you a position, if you decline a job offer or if you withdraw your application, we reserve the right to retain the data you have provided for up to 6 months after the application process has ended (rejection or withdrawal of the application) on the basis of our legitimate interests (Article 6(1)(f) GDPR). The data will then be deleted and the physical application documents destroyed. Retention serves, in particular, as evidence in the event of a legal dispute. If it is apparent that the data will be needed after the 6-month period has expired (e.g. due to a threatened or pending legal dispute), it will not be deleted until the purpose of further retention no longer applies.

Data may also be retained for longer if you have given the corresponding consent (Article 6(1)(a) GDPR) or if statutory retention obligations prevent deletion.