Data Protection

Logging and creation of log files 

When you access our website, a range of technical data is logged. This general data and information is stored in the server’s log files. The browser type and version, the operating system used, the referrer URL, the hostname of the accessing computer, the time of the server request and the IP address are recorded in a log file. The processing of personal data is carried out for the purpose of providing the website, as well as for troubleshooting and investigating cases of misuse or fraud, on the basis of a legitimate interest pursuant to Article 6(1), first sentence, point (f) of the GDPR. The log files are deleted after 7 days. 

 

Use of cookies 

We use cookies on our website. Cookies enable us to optimise the information and services on our website to suit the user’s needs. Cookies allow us to recognise users of our website. The purpose of this recognition is to make it easier for users to use our website. You can find the settings for the cookies used in the cookie banner, which can be accessed at any time via the icon at the bottom of the page. 

 

Cookies are used on our website in connection with the following services: 

 

Google Analytics, Google Ireland Limited – web analytics 

On the basis of your consent pursuant to Article 6(1), first sentence, point (a) of the GDPR, and with regard to the setting of cookies pursuant to Section 25(1) of the TTDSG in conjunction with Article 4(11), Article 7 of the GDPR, we use Google Analytics – a web analytics service provided by Google Ireland Limited (“Google”) – via Google Tag Manager. To this end, a data processing agreement has been concluded with Google in accordance with Article 28 of the GDPR. Furthermore, in the event of data being transferred to the parent company, Google LLC – based in the USA – an adequacy decision exists in accordance with Article 45(1) of the GDPR in conjunction with Google LLC’s certification under the EU-US Data Privacy Framework. Your declaration of consent expressly covers the possible global transfer and processing of data by other group companies of Google LLC. In this regard, we would like to expressly draw your attention to any risks involved, such as the difficulty in enforcing data subjects’ rights under data protection law. For the use of Google Analytics, cookies are stored for up to 14 months. 

The cookies set by Google Analytics are used to process usage data (e.g. web pages visited, access times) and communication data (e.g. IP addresses, device information) are processed on our behalf in order to analyse the use of our online service, compile reports on activities within our online service and provide other services related to the use of our online service. This may also involve the creation of pseudonymised user profiles. 

Google Analytics is used exclusively with IP anonymisation enabled. All personal data processed is deleted or fully anonymised after 14 months. For further information on Google’s use of data, as well as options for settings and opting out, please refer to Google’s Privacy Policy and the settings for the display of Google adverts. 

 

Zoho CRM, Zoho Corporation GmbH – Customer communication  

On the basis of your consent in accordance with Article 6(1), first sentence, point (a) of the GDPR, and with regard to the setting of cookies in accordance with Section 25(1) of the TTDSG in conjunction with Article 4(11), Article 7 of the GDPR, we use Zoho CRM from Zoho Corporation GmbH (“Zoho”) for the purposes of customer communication and for managing contacts and enquiries. In this context, we process your contact details (e.g. email address, telephone numbers), content data (e.g. information provided in contact forms) and usage-related information (e.g. IP addresses, web pages visited, access times). With regard to personal data transmitted via forms, please also refer to the section ‘Contact form’. 

For the use of Zoho CRM, a data processing agreement has been concluded with Zoho in accordance with Article 28 of the GDPR. Furthermore, in the event of data transfers to affiliated group companies based in third countries with regard to data protection, appropriate safeguards for the protection of data subjects within the meaning of Article 46(1) of the GDPR are in place through the conclusion of standard data protection clauses in accordance with Article 46(2)(c) of the GDPR, appropriate safeguards are in place to protect data subjects within the meaning of Article 46(1) of the GDPR. Your declaration of consent expressly covers the possible worldwide transfer and processing of data by Zoho’s affiliated group companies. In this regard, we would like to expressly draw your attention to any potential risks, such as the extensive access rights of investigative authorities and the difficulty in enforcing data subjects’ rights under data protection law. When using Zoho CRM, the cookies used are stored for the duration of the session.

Please refer to Zoho’s Privacy Policy for details of the purpose and scope of data processing by Zoho, as well as your rights in this regard and the settings available to protect your privacy.

 

Furthermore, only strictly necessary cookies are used on our website in accordance with Section 25(2)(2) of the TTDSG. The subsequent processing of your personal data is carried out on the basis of our overriding legitimate interest in accordance with Article 6(1), first sentence, point (f) of the GDPR. Our legitimate interest in this regard is to ensure that the website is provided in a manner that complies with data protection regulations (storage of preferences in the cookie banner, retention period: 1 year) as well as the unrestricted technical functionality of the website (identification of logged-in users, retention period: session).

To provide the consent management system, we use, on the basis of our overriding legitimate interest in ensuring the website is provided in compliance with data protection regulations in accordance with Article 6(1), first sentence, point (f) GDPR, we use the service provided by Cookiebot, a service of Usercentrics A/S. In this context, the following data is processed: the IP address (including geolocation), an individual user ID, language settings, and the nature and timing of the consent given. A data processing agreement has been concluded with Usercentrics A/S regarding the use of Cookiebot, in accordance with Article 28 of the GDPR.

 

Contact form 

Our website features a contact form which can be used to contact us electronically. It is also possible to contact us by email using the contact details provided in the legal notice. When you contact us, we process the personal data you provide – in particular your name, email address and the nature of your enquiry – in order to resolve your matter. The processing of the personal data listed is carried out on the basis of a legitimate interest in responding satisfactorily to enquiries and requests in accordance with Article 6(1), first sentence, point (f) of the GDPR; or, in the case of enquiries regarding quotations and contractual matters, on the basis of the contract or pre-contractual measures in accordance with Article 6(1), first sentence, point (b) of the GDPR. 

The personal data you provide will be treated confidentially by us; it will be used exclusively to process your enquiry and will not be passed on to third parties, unless this is necessary in individual cases due to the nature of your enquiry. Personal data will be deleted once your enquiry has been fully resolved or following an objection on your part. The retention periods set out here apply only insofar as no statutory retention periods preclude deletion. 

 

Links to other websites 

Our website contains links to other websites, known as external links. We have no control over whether the operators of other websites comply with data protection regulations. Please note that by clicking on a link to another website, you will be subject to different data protection provisions. We have no influence over the data processing carried out on those sites. External links are identified as such in accordance with Section 19(3) of the TTDSG. 

 

Use of service providers to operate the website 

To operate the website, we use service providers who process personal data on behalf of the controller or through whom access to personal data cannot be ruled out. We have entered into data processing agreements with all of these service providers in accordance with Article 28 of the GDPR. In addition to the service providers already mentioned, these include digitalwert – Agentur für digitale Wertschöpfung GmbH (website management).

We also host the content of our website with the following provider: Host Europe.

The provider is Host Europe GmbH, Hansestraße 111, 51149 Cologne (hereinafter “Host Europe”). When you visit our website, Host Europe collects various log files, including your IP addresses.

For details, please refer to Host Europe’s privacy policy: https://www.hosteurope.de/AGB/Datenschutzerklaerung/.

The use of Host Europe is based on Article 6(1)(f) of the GDPR. We have a legitimate interest in ensuring that our website is displayed as reliably as possible. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., for device fingerprinting) within the meaning of the TTDSG. Consent may be revoked at any time.

 

Newsletter

 

Newsletter data

If you wish to subscribe to the newsletter offered on the website, we require your email address as well as information that enables us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter. No further data is collected, or only on a voluntary basis. We use newsletter service providers, as described below, to manage the newsletter.

 

Rapidmail

This website uses Rapidmail to send newsletters. The provider is rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg im Breisgau, Germany.

Rapidmail is a service that can be used, amongst other things, to organise and analyse the sending of newsletters. The data you enter for the purpose of subscribing to the newsletter is stored on Rapidmail’s servers in Germany.

 

Data analysis by Rapidmail

For analysis purposes, emails sent via Rapidmail contain a so-called ‘tracking pixel’, which connects to Rapidmail’s servers when the email is opened. This allows us to determine whether a newsletter message has been opened.

Furthermore, with the help of Rapidmail, we can determine whether any links in the newsletter message have been clicked and, if so, which ones. All links in the email are so-called tracking links, which allow your clicks to be counted. If you do not wish your data to be analysed by Rapidmail, you must unsubscribe from the newsletter. We provide a link for this purpose in every newsletter.

For more details on Rapidmail’s analytics features, please see the following link: https://de.rapidmail.wiki/kategorien/statistiken/.

 

Legal basis

Data processing is carried out on the basis of your consent (Article 6(1)(a) of the GDPR). You may withdraw this consent at any time. The lawfulness of any data processing operations that have already taken place remains unaffected by the withdrawal.

 

Retention period

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter, and will be deleted from the newsletter distribution list once you have unsubscribed. Data stored by us for other purposes remains unaffected by this.

After you unsubscribe from the newsletter distribution list, your email address may be stored on a blacklist by us or the newsletter service provider, where necessary, to prevent future mailings. The data from the blacklist is used solely for this purpose and is not merged with any other data. This serves both your interests and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Article 6(1)(f) of the GDPR). There is no time limit on storage on the blacklist. You may object to this storage provided that your interests override our legitimate interest.

For further details, please refer to Rapidmail’s data security information at: https://www.rapidmail.de/datensicherheit.

 

Data subjects’ rights and contacting the Data Protection Officer 

Data subjects may at any time request information about the personal data concerning them and, where applicable, request the rectification or erasure of such data, or the restriction of processing, or object to processing. Furthermore, you have a right to data portability. Furthermore, where data processing is carried out on the basis of consent, this consent may be withdrawn at any time with effect for the future. To exercise your rights, please contact us at info[at]marketing.dresden.de or our external data protection officer at zentrale[at]dids.de (further contact details are available at www.dids.de). Furthermore, in accordance with Article 77 of the GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you suspect that the processing of personal data is unlawful.