Privacy Policy

This English version of our privacy policy is provided for convenience. The German version is legally binding and is available on request.

Preamble

With the following privacy policy we would like to inform you about the types of your personal data (hereinafter also referred to as “data”) that we process, for what purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”).

The terms used are not gender-specific.

Last updated: 21 October 2026

Table of contents

• Preamble
• Controller
• Overview of processing operations
• Relevant legal bases
• Security measures
• International data transfers
• General information on data retention and deletion
• Rights of data subjects
• Business services
• Business processes and procedures
• Providers and services used in the course of business
• Provision of the online offering and web hosting
• Contact and enquiry management
• Artificial intelligence (AI)
• Video conferences, online meetings, webinars and screen sharing
• Cloud services
• Presence on social networks (social media)
• Plug-ins and embedded functions and content
• Changes and updates

Controller

Persons authorised to represent the company: Dr Jan Schaefer and Joachim Löw

Email address: info@buerbank.com

VAT identification number: DE452494676

Legal notice: buerbank.com/legal-notice.html

Overview of processing operations

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of data processed

• Inventory data.
• Payment data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Meta, communication and procedural data.
• Image and/or video recordings.
• Audio recordings.
• Log data.

Categories of data subjects

• Service recipients and clients.
• Prospective clients.
• Communication partners.
• Users.
• Business and contractual partners.
• Participants.
• Persons depicted.
• Third parties.

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations.
• Communication.
• Security measures.
• Office and organisational procedures.
• Organisational and administrative procedures.
• Feedback.
• Marketing.
• Provision of our online offering and user-friendliness.
• Information technology infrastructure.
• Financial and payment management.
• Public relations.
• Sales promotion.
• Business processes and operational procedures.
• Artificial intelligence (AI).

Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection rules may apply in your or our country of residence or domicile. Should more specific legal bases be relevant in individual cases, we will inform you of these in the privacy policy.

• Consent (Art. 6(1) sentence 1 point (a) GDPR): The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 point (b) GDPR): Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6(1) sentence 1 point (c) GDPR): Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

National data protection rules in Germany: In addition to the data protection rules of the GDPR, national data protection rules apply in Germany. These include in particular the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). The BDSG contains in particular special rules on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated individual decision-making, including profiling. Furthermore, the data protection laws of the individual federal states may apply.

Relevant legal bases under the Swiss Data Protection Act: We process your personal data in accordance with the Swiss Federal Act on Data Protection (“Swiss FADP”). Personal data must be processed lawfully, in good faith and proportionately (Art. 6(1) and (2) FADP). It may only be collected for a specific purpose that is recognisable to the data subject and processed only in a manner compatible with that purpose (Art. 6(3) FADP). Unlike the GDPR, the Swiss FADP does not, as a rule, make the lawfulness of processing by private controllers dependent on the selection of a specific legal basis from a statutory catalogue. There is therefore generally no obligation to state such a legal basis for each processing operation in the privacy policy.

Note on the applicability of the GDPR and the Swiss FADP: This privacy policy serves to provide information under both the Swiss FADP and the General Data Protection Regulation (GDPR). For this reason, please note that the terminology of the GDPR is used because of its broader territorial application and comprehensibility. In particular, instead of the terms used in the Swiss FADP, “processing” of “personal data”, “overriding interest” and “sensitive personal data”, the GDPR terms “processing” of “personal data”, “legitimate interest” and “special categories of data” are used. However, the legal meaning of the terms continues to be determined under the Swiss FADP where the Swiss FADP applies.

Security measures

In accordance with the legal requirements and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access to, input of, disclosure of, availability of and separation of the data. We have also established procedures to ensure that the rights of data subjects are respected, that data is deleted and that we respond to threats to the data. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

Securing online connections through TLS/SSL encryption technology (HTTPS): To protect the data of users transmitted via our online services against unauthorised access, we rely on TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby protecting the data from unauthorised access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is signalled by the display of HTTPS in the URL. This serves as an indicator to users that their data is being transmitted securely and in encrypted form.

International data transfers

Data processing in third countries: If we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in the context of using third-party services or disclosing or transferring data to other persons, bodies or companies (which is recognisable from the postal address of the respective provider or where the privacy policy expressly refers to the transfer of data to third countries), this is always done in accordance with the legal requirements.

For data transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of the EU Commission of 10 July 2023. In addition, we have concluded standard contractual clauses with the respective providers, which comply with the requirements of the EU Commission and establish contractual obligations to protect your data.

This two-fold safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the standard contractual clauses serve as additional security. Should changes occur within the framework of the DPF, the standard contractual clauses will take effect as a reliable fallback option. In this way, we ensure that your data remains adequately protected even in the event of political or legal changes.

For the individual service providers, we inform you whether they are certified under the DPF and whether standard contractual clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/.

For data transfers to other third countries, corresponding security measures apply, in particular standard contractual clauses, explicit consent or legally required transfers. Information on third-country transfers and applicable adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.

Disclosure of personal data abroad: In accordance with the Swiss FADP, we disclose personal data abroad only if adequate protection of the data subjects is guaranteed (Art. 16 Swiss FADP). Where the Federal Council has not determined adequate protection (list: https://www.bj.admin.ch/de/schweizerische-anerkennung-von-staaten-die-einen-angemessenen-datenschutz-gewaehrleisten), we take alternative security measures.

For data transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of Switzerland of 15 September 2024. In addition, we have concluded standard data protection clauses with the respective providers, which have been approved by the Federal Data Protection and Information Commissioner (FDPIC) and establish contractual obligations to protect your data.

This two-fold safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the standard data protection clauses serve as additional security. Should changes occur within the framework of the DPF, the standard data protection clauses will take effect as a reliable fallback option. In this way, we ensure that your data remains adequately protected even in the event of political or legal changes.

For the individual service providers, we inform you whether they are certified under the DPF and whether standard data protection clauses are in place. The list of certified companies and further information on the DPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/.

For data transfers to other third countries, corresponding security measures apply, including international treaties, specific guarantees, standard data protection clauses approved by the FDPIC, or binding corporate rules recognised in advance by the FDPIC or a competent data protection authority of another country.

General information on data retention and deletion

We delete the personal data we process in accordance with the statutory provisions as soon as the underlying consent is withdrawn or no further legal basis for the processing exists. This applies to cases in which the original purpose of processing no longer applies or the data is no longer required. Exceptions to this rule exist where legal obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing operations.

Where several retention periods or deletion deadlines apply to a piece of data, the longest period is always decisive. Data that is no longer retained for its originally intended purpose but due to legal requirements or other reasons is processed exclusively for the reasons justifying its retention.

Retention and deletion of data: The following general periods apply to retention and archiving under German law:

• 10 years: retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets and the work instructions and other organisational documents required for their understanding (Section 147(1) no. 1 in conjunction with (3) of the German Fiscal Code (AO), Section 257(1) no. 1 in conjunction with (4) of the German Commercial Code (HGB)).
• 8 years: accounting documents, such as invoices and expense receipts (Section 147(1) nos. 4 and 4a in conjunction with (3) sentence 1 AO, Section 14b(1) of the German VAT Act (UStG) and Section 257(1) no. 4 in conjunction with (4) HGB).
• 6 years: other business documents: commercial or business letters received, reproductions of commercial or business letters sent, other documents insofar as they are relevant for taxation, e.g. hourly wage slips, operating cost sheets, calculation documents, price labelling, but also payroll documents insofar as they are not already accounting documents, and till receipts (Section 147(1) nos. 2, 3, 5 in conjunction with (3) AO, Section 257(1) nos. 2 and 3 in conjunction with (4) HGB).
• 3 years: data required to take account of potential warranty and compensation claims or similar contractual claims and rights, and to process related enquiries, based on previous business experience and customary industry practice, is stored for the duration of the regular statutory limitation period of three years (Sections 195, 199 of the German Civil Code (BGB)).

Retention and deletion of data: The following general periods apply to retention and archiving under Swiss law:

• 10 years: retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting documents and invoices, and all necessary work instructions and other organisational documents (Art. 958f of the Swiss Code of Obligations (CO)).
• 10 years: data necessary to take account of potential compensation claims or similar contractual claims and rights, and to process related enquiries, based on previous business experience and customary industry practice, is stored for the period of the statutory limitation period of ten years, unless a shorter period of five years is relevant, which applies in certain cases (Art. 127, 130 CO). After five years, claims for rent, lease and capital interest and other periodic payments, for the supply of foodstuffs, for board and for innkeepers’ debts, as well as for craft work, retail sale of goods, medical care, professional services of lawyers, legal agents, attorneys and notaries, and from the employment relationship of employees become time-barred (Art. 128 CO).

Commencement of the period at the end of the year: If a period does not expressly begin on a specific date and is at least one year, it automatically starts at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in the context of which data is stored, the event triggering the period is the date on which the termination or other ending of the legal relationship takes effect.

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

• Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1) point (e) or (f) GDPR; this also applies to profiling based on those provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw consent you have given at any time.
• Right of access: You have the right to obtain confirmation as to whether data concerning you is being processed and to access that data, as well as further information and a copy of the data in accordance with the legal requirements.
• Right to rectification: In accordance with the legal requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
• Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, to request the restriction of processing of the data in accordance with the legal requirements.
• Right to data portability: You have the right to receive the data concerning you which you have provided to us in a structured, commonly used and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
• Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of personal data concerning you infringes the GDPR. The complaint may in particular be lodged with a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

Rights of data subjects under the Swiss FADP:

As a data subject, you have the following rights in accordance with the provisions of the Swiss FADP:

• Right of access: You have the right to obtain confirmation as to whether personal data concerning you is being processed and to receive the information necessary for you to assert your rights under this Act and to ensure transparent data processing.
• Right to data release or transfer: You have the right to request the release of your personal data that you have disclosed to us in a commonly used electronic format.
• Right to rectification: You have the right to request the rectification of inaccurate personal data concerning you.
• Right to object, erasure and destruction: You have the right to object to the processing of your data and to request that personal data concerning you be erased or destroyed.

Business services

We process personal data of our contractual and business partners, such as customers, clients, prospective clients, suppliers and other cooperation partners (collectively “contractual partners”), for the initiation, performance and settlement of contractual relationships and comparable legal relationships. This also includes pre-contractual measures taken at the request of the contractual partner and communication in connection with the respective contractual relationship.

The processing serves in particular to fulfil our primary and ancillary contractual obligations. This includes the provision of the agreed services, any update and information obligations, the handling of warranty claims and other performance issues, the processing of withdrawals, the termination of continuing obligations, reversals, refunds and the handling of other contract-related declarations and enquiries. Both one-off contracts and ongoing contractual relationships are covered.

In particular, we process master data such as name, address and, where applicable, company, contact data such as email address and telephone number, contract and service data such as the subject matter of the contract, contract term, order or transaction number, usage and performance data, payment and billing data, and communication content and history. Where necessary, we also process data disclosed or transmitted to us in the course of carrying out an engagement.

In addition, we process the data to safeguard our rights and to fulfil legal obligations. This includes in particular retention obligations under commercial and tax law, documentation obligations and, where applicable, evidence and accountability obligations. Processing also takes place on the basis of our legitimate interests in proper business management, internal administration, risk management and IT security, as well as in protecting our business operations and our contractual partners against misuse and threats to data, secrets and other legal interests. This may also include the involvement of external service providers such as IT and telecommunications providers, transport and logistics companies, payment service providers, banks, tax and legal advisers or other agents, insofar as this is necessary for the performance of the contract or to fulfil legal obligations.

Personal data is disclosed to third parties only insofar as this is necessary for the performance of the contract, for pre-contractual measures, to safeguard legitimate interests or to fulfil legal obligations. We provide separate information in this privacy policy about any processing beyond this, in particular for marketing purposes.

We inform contractual partners which data is required in the individual case when collecting the data, for example in online forms by appropriate labelling or in personal contact.

The data is deleted as soon as it is no longer required for the aforementioned purposes and no statutory retention obligations prevent this. Statutory retention periods, in particular under commercial and tax law, may require longer storage. Data transmitted in the context of a specific engagement is deleted after completion of the engagement and expiry of any retention periods, unless further legal or contractual obligations to store the data exist.

The legal basis for the processing is Art. 6(1) point (b) GDPR for the implementation of pre-contractual measures and the performance of the respective contractual relationship, and Art. 6(1) point (c) GDPR for the fulfilment of legal obligations. Insofar as the processing is based on legitimate interests, it is carried out on the basis of Art. 6(1) point (f) GDPR. Where processing is based on Art. 6(1) point (f) GDPR, it serves our legitimate interests in a proper and efficient business organisation, the internal administration and documentation of business transactions, the enforcement and defence of legal claims, ensuring IT and data security, preventing misuse and fraud, and the economic management and development of our business operations. These interests consist in particular in ensuring secure and legally compliant business operations and in safeguarding our ability to act as a business.

• Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); contract data (e.g. subject matter of the contract, term, customer category).
• Data subjects: Service recipients and clients; prospective clients; business and contractual partners.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; communication; office and organisational procedures; organisational and administrative procedures; business processes and operational procedures.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data retention and deletion”.
• Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 point (b) GDPR); legal obligation (Art. 6(1) sentence 1 point (c) GDPR); legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).

Further information on processing operations, procedures and services:

• Business consulting: We process the data of our customers, clients, prospective clients and other principals or contractual partners (uniformly referred to as “clients”) in order to provide them with our contractual or pre-contractual services, in particular consulting services. The data processed, the nature, scope, purpose and necessity of its processing are determined by the underlying contractual and business relationship. Insofar as this is necessary for the performance of our contract or required by law, or if the client has given consent, we disclose or transfer the client’s data, in compliance with professional regulations, to third parties or agents, such as authorities, courts or providers of IT, office or comparable services. Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 point (b) GDPR).

Business processes and procedures

Personal data of service recipients and clients, including customers, clients or, in special cases, mandators, patients or business partners and other third parties, is processed in the context of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates business operations in areas such as customer management, sales, payment transactions, accounting and project management.

The data collected serves to fulfil contractual obligations and to make operational processes efficient. This includes the handling of business transactions, the management of customer relationships, the optimisation of sales strategies and ensuring internal accounting and financial processes. In addition, the data supports the safeguarding of the controller’s rights and promotes administrative tasks and the organisation of the company.

Personal data may be passed on to third parties insofar as this is necessary to fulfil the stated purposes or legal obligations. After expiry of statutory retention periods or when the purpose of processing no longer applies, the data is deleted. This also includes data that must be stored for longer due to tax law and statutory documentation obligations.

• Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or pictorial messages and contributions and the information relating to them, such as details of authorship or time of creation); contract data (e.g. subject matter of the contract, term, customer category); log data (e.g. log files concerning logins or the retrieval of data or access times); usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved).
• Data subjects: Service recipients and clients; prospective clients; communication partners; business and contractual partners; third parties; users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; office and organisational procedures; business processes and operational procedures; communication; marketing; sales promotion; public relations; financial and payment management; information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)).
• Retention and deletion: Deletion in accordance with the information in the section “General information on data retention and deletion”.
• Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 point (b) GDPR); legitimate interests (Art. 6(1) sentence 1 point (f) GDPR); legal obligation (Art. 6(1) sentence 1 point (c) GDPR).

Further information on processing operations, procedures and services:

• Contact management and contact maintenance: Procedures required in the context of organising, maintaining and securing contact information (e.g. setting up and maintaining a central contact database, regular updates of contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, performing backups and restores of contact data, training staff in the effective use of contact management software, regular review of communication history and adjustment of contact strategies). Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 point (b) GDPR), legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).
• General payment transactions: Procedures required for carrying out payment transactions, monitoring bank accounts and controlling payment flows (e.g. preparing and checking transfers, processing direct debits, checking bank statements, monitoring incoming and outgoing payments, managing returned direct debits, account reconciliation, cash management). Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 point (b) GDPR), legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).
• Accounting, accounts payable, accounts receivable: Procedures required for recording, processing and controlling business transactions in the area of accounts payable and accounts receivable (e.g. preparing and checking incoming and outgoing invoices, monitoring and managing open items, carrying out payment transactions, handling reminders, account reconciliation in the context of receivables and payables, accounts payable and accounts receivable). Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 point (b) GDPR), legal obligation (Art. 6(1) sentence 1 point (c) GDPR), legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).
• Financial accounting and taxes: Procedures required for recording, managing and controlling financially relevant business transactions and for calculating, reporting and paying taxes (e.g. account assignment and posting of business transactions, preparation of quarterly and annual financial statements, carrying out payment transactions, handling reminders, account reconciliation, tax advice, preparation and filing of tax returns, handling of tax matters). Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1) sentence 1 point (b) GDPR), legal obligation (Art. 6(1) sentence 1 point (c) GDPR), legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).
• Marketing, advertising and sales promotion: Procedures required in the context of marketing, advertising and sales promotion (e.g. market analysis and target group definition, development of marketing strategies, planning and implementation of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade fair participation, customer loyalty programmes, sales promotion measures, performance measurement and optimisation of marketing activities, budget management and cost control). Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).
• Public relations: Procedures required in the context of public relations (e.g. development and implementation of communication strategies, planning and implementation of PR campaigns, preparation and distribution of press releases, maintaining media contacts, monitoring and analysis of media coverage, organisation of press conferences and public events, crisis communication, creation of content for social media and corporate websites, management of corporate branding). Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).

Providers and services used in the course of business

In the course of our business activities, we use additional services, platforms, interfaces or plug-ins from third-party providers (“services”) in compliance with the legal requirements. Their use is based on our interests in the proper, lawful and economical management of our business operations and our internal organisation.

• Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or pictorial messages and contributions and the information relating to them, such as details of authorship or time of creation); contract data (e.g. subject matter of the contract, term, customer category).
• Data subjects: Service recipients and clients; prospective clients; business and contractual partners.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; office and organisational procedures; business processes and operational procedures.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data retention and deletion”.
• Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).

Further information on processing operations, procedures and services:

• Asana: Project management: organisation and administration of teams, groups, workflows, projects and processes. Service provider: Asana, Inc., 1550 Bryant Street, Suite 200, San Francisco, CA 94103, USA. Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR). Website: https://asana.com. Privacy policy: https://asana.com/terms#privacy-policy. Data processing agreement: https://asana.com/terms#data-processing. Basis for third-country transfers: EU/EEA: Data Privacy Framework (DPF), standard contractual clauses (https://asana.com/terms#data-processing); Switzerland: Data Privacy Framework (DPF), standard contractual clauses (https://asana.com/terms#data-processing).

Provision of the online offering and web hosting

We process users’ data in order to be able to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

• Types of data processed: Usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved); log data (e.g. log files concerning logins or the retrieval of data or access times).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)); security measures.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data retention and deletion”.
• Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).

Further information on processing operations, procedures and services:

• Provision of the online offering on rented storage space: To provide our online offering, we use storage space, computing capacity and software that we rent or otherwise obtain from a corresponding server provider (also known as a “web host”). Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).
• Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files”. Server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. Server log files may be used, on the one hand, for security purposes, e.g. to avoid server overload (in particular in the event of abusive attacks, so-called DDoS attacks), and, on the other hand, to ensure server utilisation and stability. Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further retention is required for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.
• DomainFactory: Services in the field of providing information technology infrastructure and related services (e.g. storage space and/or computing capacity). Service provider: Domainfactory GmbH, c/o WeWork, Neuturmstrasse 5, 80331 Munich, Germany. Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR). Website: https://www.df.eu. Privacy policy: https://www.df.eu/de/datenschutz/. Data processing agreement: https://www.df.eu/de/support/formulare/.

Contact and enquiry management

When you contact us (e.g. by post, email, telephone or via social media) and in the context of existing user and business relationships, the details of the enquiring persons are processed insofar as this is necessary to respond to the contact enquiries and any requested measures.

• Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or pictorial messages and contributions and the information relating to them, such as details of authorship or time of creation).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Communication; organisational and administrative procedures; feedback; provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data retention and deletion”.
• Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).

Artificial intelligence (AI)

We use artificial intelligence (AI), in the course of which personal data is processed. The specific purposes and our interest in the use of AI are set out below. By AI we mean, in accordance with the term “AI system” under Article 3(1) of the AI Act, a machine-based system that is designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

Our AI systems are used in strict compliance with the legal requirements. These include both specific regulations for artificial intelligence and data protection requirements. In particular, we observe the principles of lawfulness, transparency, fairness, human oversight, purpose limitation, data minimisation and integrity and confidentiality. We ensure that the processing of personal data always takes place on a legal basis. This may be either the consent of the data subjects or a statutory permission.

When using external AI systems, we select their providers (hereinafter “AI providers”) carefully. In accordance with our legal obligations, we ensure that the AI providers comply with the applicable provisions. We likewise observe the obligations incumbent on us when using or operating the AI services obtained. The processing of personal data by us and the AI providers takes place exclusively on the basis of consent or statutory authorisation. We attach particular importance to transparency, fairness and the preservation of human control over AI-supported decision-making processes.

To protect the data processed, we implement appropriate and robust technical and organisational measures. These ensure the integrity and confidentiality of the data processed and minimise potential risks. Through regular reviews of the AI providers and their services, we ensure ongoing compliance with current legal and ethical standards.

• Types of data processed: Content data (e.g. textual or pictorial messages and contributions and the information relating to them, such as details of authorship or time of creation); usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
• Data subjects: Users (e.g. website visitors, users of online services); third parties.
• Purposes of processing and legitimate interests: Artificial intelligence (AI).
• Retention and deletion: Deletion in accordance with the information in the section “General information on data retention and deletion”.
• Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).

Further information on processing operations, procedures and services:

• ChatGPT: AI-based service designed to understand and generate natural language and related inputs and data, to analyse information and to make predictions (“AI”, i.e. “artificial intelligence”, is to be understood in the applicable legal sense of the term). Service provider: OpenAI Ireland Ltd, 117-126 Sheriff Street Upper, D01 YC43 Dublin 1, Ireland. Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR). Website: https://openai.com/chatgpt/overview/. Privacy policy: https://openai.com/policies/privacy-policy/. Opt-out: https://privacy.openai.com/policies?modal=select-subject.
• DeepL: Translation of texts into various languages and provision of synonyms and contextual examples. Support in correcting and improving texts in various languages. Service provider: DeepL SE, Maarweg 165, 50825 Cologne, Germany. Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR). Website: https://www.deepl.com. Privacy policy: https://www.deepl.com/privacy. Data processing agreement: Provided by the service provider.
• Claude (Anthropic): AI-supported service designed to understand and generate natural language and related inputs, to analyse information and to make predictions (“AI”, i.e. “artificial intelligence”, is to be understood in the applicable legal sense of the term). The provision of the AI services includes the processing (including collection, storage, organisation and structuring) of personal data in the context of a natural-language-based machine learning process; the implementation of measures to review and maintain the quality of the services; the identification and correction of errors that may impair the intended functionality; and support in ensuring the security and integrity of the AI services. Service provider: Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR). Website: https://www.anthropic.com/. Privacy policy: https://www.anthropic.com/legal/privacy. Data processing agreement: https://www.anthropic.com/legal/data-processing-addendum. Basis for third-country transfers: EU/EEA: standard contractual clauses (https://www.anthropic.com/legal/data-processing-addendum); Switzerland: standard contractual clauses (https://www.anthropic.com/legal/data-processing-addendum).

Video conferences, online meetings, webinars and screen sharing

We use platforms and applications from other providers (hereinafter referred to as “conference platforms”) for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as “conferences”). When selecting the conference platforms and their services, we observe the legal requirements.

Data processed by conference platforms: In the context of participation in a conference, the conference platforms process the personal data of participants listed below. The scope of the processing depends, on the one hand, on which data is required in the context of a specific conference (e.g. provision of access data or real names) and which optional information is provided by the participants. In addition to processing for the purpose of conducting the conference, participants’ data may also be processed by the conference platforms for security purposes or service optimisation. The data processed includes personal details (first name, surname), contact information (email address, telephone number), access data (access codes or passwords), profile pictures, information on professional position/function, the IP address of the internet connection, information on participants’ devices, their operating system, browser and its technical and language settings, information on the content of communication processes, i.e. entries in chats and audio and video data, as well as the use of other available functions (e.g. polls). The content of communications is encrypted to the extent technically provided by the conference providers. If participants are registered as users with the conference platforms, further data may be processed in accordance with the agreement with the respective conference provider.

Logging and recordings: If text entries, participation results (e.g. from polls) and video or audio recordings are logged, this will be communicated transparently to participants in advance and, where necessary, their consent will be requested.

Data protection measures of participants: Please refer to the privacy notices of the conference platforms for details of the processing of your data by them and select the security and data protection settings that are optimal for you within the settings of the conference platforms. Please also ensure data and privacy protection in the background of your recording for the duration of a video conference (e.g. by informing housemates, locking doors and, where technically possible, using the function to blur the background). Links to conference rooms and access data must not be passed on to unauthorised third parties.

Notes on legal bases: Where, in addition to the conference platforms, we also process users’ data and ask users for their consent to the use of the conference platforms or certain functions (e.g. consent to the recording of conferences), the legal basis for the processing is this consent. Furthermore, our processing may be necessary to fulfil our contractual obligations (e.g. in participant lists, in the case of processing of meeting results, etc.). Otherwise, users’ data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

• Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or pictorial messages and contributions and the information relating to them, such as details of authorship or time of creation); usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); image and/or video recordings (e.g. photographs or video recordings of a person); audio recordings; log data (e.g. log files concerning logins or the retrieval of data or access times); contract data (e.g. subject matter of the contract, term, customer category); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved).
• Data subjects: Communication partners; users (e.g. website visitors, users of online services); persons depicted; service recipients and clients; prospective clients; participants.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; communication; office and organisational procedures; provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data retention and deletion”.
• Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).

Further information on processing operations, procedures and services:

• Microsoft Teams: Used for conducting online events and conferences and for communication with internal and external participants. Voice transmission, direct messages, group communication and collaboration functions are used; name, business contact details, work profile, participation and content (audio/video, voice, chat, files, voice transcription) are processed for the purposes of and in the interest of efficiency and productivity gains, cost efficiency, flexibility, mobility, improved communication, IT security, use of a central platform and Microsoft’s business operations. Audio signals are generally not stored unless recording is activated. Meeting and conference recordings are stored for 90 days by default unless a different period is specified. Chat and file content is stored in accordance with the policies determined by the administrator or user; no automatic deletion is preset. Channels must be renewed every 180 days, otherwise content is deleted. In addition, system-generated log, diagnostic and metadata are processed and diagnostic data is collected for product stability, security and improvement. Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR). Website: https://www.microsoft.com/microsoft-teams/. Privacy policy: https://www.microsoft.com/privacy/privacystatement. Basis for third-country transfers: EU/EEA: Data Privacy Framework (DPF), standard contractual clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA); Switzerland: Data Privacy Framework (DPF), standard contractual clauses (same link).
• Zoom: Video conferences, online meetings, webinars, screen sharing, optional recording of sessions, chat function, integration with calendars and other apps. Service provider: Zoom Video Communications, Inc., 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA. Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR). Website: https://www.zoom.com. Privacy policy: https://www.zoom.com/en/trust/privacy/privacy-statement/. Data processing agreement: https://media.zoom.com/download/assets/zoom-global-dpa.pdf/dd327ebea27e11efb613d6ba63ed4cee. Basis for third-country transfers: EU/EEA: Data Privacy Framework (DPF), standard contractual clauses (same link); Switzerland: Data Privacy Framework (DPF), standard contractual clauses (same link).

Cloud services

We use software services accessible via the internet and executed on the servers of their providers (so-called “cloud services”, also referred to as “software as a service”) for the storage and management of content (e.g. document storage and management, exchange of documents, content and information with specific recipients or publication of content and information).

In this context, personal data may be processed and stored on the providers’ servers insofar as this data forms part of communication processes with us or is otherwise processed by us as set out in this privacy policy. This data may include in particular master data and contact data of users, data on transactions, contracts, other processes and their content. The providers of the cloud services also process usage data and metadata, which they use for security purposes and service optimisation.

Insofar as we use the cloud services to provide forms or other documents and content for other users or publicly accessible websites, the providers may store cookies on users’ devices for the purposes of web analysis or to remember user settings (e.g. in the case of media controls).

• Types of data processed: Inventory data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or pictorial messages and contributions and the information relating to them, such as details of authorship or time of creation); usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
• Data subjects: Prospective clients; communication partners; business and contractual partners.
• Purposes of processing and legitimate interests: Office and organisational procedures; information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)).
• Retention and deletion: Deletion in accordance with the information in the section “General information on data retention and deletion”.
• Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).

Further information on processing operations, procedures and services:

• Microsoft 365 and Microsoft cloud services: Provision of applications, protection of data and IT systems and use of system-generated log, diagnostic and metadata for the performance of the contract by Microsoft. Contact data (name, email address), content data (files, comments, profiles), software set-up and inventory data, device connectivity and configuration data, work interactions (badge swipe) and log and metadata are processed. The processing takes place for the purposes of efficiency and productivity gains, cost efficiency, flexibility, mobility, improved communication, integration of Microsoft services, IT security and Microsoft’s business operations. The retention of data is governed by the respective documents and corporate policies; for Defender (protection of data and IT systems) up to 12 months, for print management 10 days. In addition, diagnostic data is collected for product stability and improvement. Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR). Website: https://www.microsoft.com. Privacy policy: https://privacy.microsoft.com/privacystatement; security information: https://www.microsoft.com/trustcenter. Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third-country transfers: EU/EEA: Data Privacy Framework (DPF), standard contractual clauses (same link); Switzerland: Data Privacy Framework (DPF), standard contractual clauses (same link).

Presence on social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We would like to point out that user data may be processed outside the European Union. This may result in risks for users because, for example, it could make it more difficult to enforce users’ rights.

Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created on the basis of users’ usage behaviour and the resulting interests. These profiles may in turn be used, for example, to place advertisements inside and outside the networks that presumably correspond to users’ interests. For this purpose, cookies are generally stored on users’ computers, in which usage behaviour and users’ interests are stored. In addition, data may be stored in the usage profiles regardless of the devices used by the users (in particular if the users are members of the respective platforms and are logged in there).

For a detailed description of the respective forms of processing and the options to object (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the providers have access to the users’ data and can take appropriate measures and provide information directly. If you nevertheless need help, you can contact us.

• Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or pictorial messages and contributions and the information relating to them, such as details of authorship or time of creation); usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Communication; feedback; public relations.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data retention and deletion”.
• Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).

Further information on processing operations, procedures and services:

• LinkedIn: Social network. Together with LinkedIn Ireland Unlimited Company, we are jointly responsible for the collection (but not the further processing) of data from visitors, which is used to create the “Page Insights” (statistics) of our LinkedIn profiles. This data includes information about the types of content users view or interact with and the actions they take. It also includes details about the devices used, such as IP addresses, operating system, browser type, language settings and cookie data, as well as information from user profiles, such as job function, country, industry, seniority, company size and employment status. Privacy information on the processing of user data by LinkedIn can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy. We have concluded a special agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum”, https://legal.linkedin.com/pages-joint-controller-addendum), which in particular regulates the security measures LinkedIn must observe and in which LinkedIn has agreed to fulfil the rights of data subjects (i.e. users can, for example, direct requests for access or erasure directly to LinkedIn). The rights of users (in particular the right of access, erasure, objection and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint responsibility is limited to the collection and transmission of data to LinkedIn Ireland Unlimited Company, a company based in the EU. The further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, in particular with regard to the transfer of data to the parent company LinkedIn Corporation in the USA. Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland. Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR). Website: https://www.linkedin.com. Privacy policy: https://www.linkedin.com/legal/privacy-policy. Basis for third-country transfers: EU/EEA: Data Privacy Framework (DPF), standard contractual clauses (https://www.linkedin.com/legal/privacy-policy); Switzerland: Data Privacy Framework (DPF), standard contractual clauses (https://www.linkedin.com/legal/privacy-policy). Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Plug-ins and embedded functions and content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may be, for example, graphics, videos or maps (hereinafter uniformly referred to as “content”).

Integration always requires that the third-party providers of this content process the IP address of users, as without the IP address they would not be able to send the content to their browser. The IP address is therefore necessary for the display of this content or these functions. We endeavour to use only such content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offering, and may also be combined with such information from other sources.

Notes on legal bases: Where we ask users for their consent to the use of third-party providers, the legal basis for data processing is that permission. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.

• Types of data processed: Usage data (e.g. page views and dwell time, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, persons involved).
• Data subjects: Users (e.g. website visitors, users of online services).
• Purposes of processing and legitimate interests: Provision of our online offering and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section “General information on data retention and deletion”.
• Legal bases: Consent (Art. 6(1) sentence 1 point (a) GDPR); legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).

Further information on processing operations, procedures and services:

• Google Fonts (hosted on our own server): Provision of font files for the purpose of a user-friendly presentation of our online offering. Service provider: The Google Fonts are hosted on our own server; no data is transmitted to Google. Legal bases: Legitimate interests (Art. 6(1) sentence 1 point (f) GDPR).

Changes and updates

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an action on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organisations in this privacy policy, please note that the addresses may change over time and we ask you to check the information before making contact.