Privacy Policy

1. Definitions

In our Privacy Policy, we use special terms from various data protection laws. We want our statement to be easy to understand and therefore explain these terms in advance.

The following definitions shall be interpreted or expanded, as appropriate, based on the case law of the General Court of the European Union (EGC), the European Court of Justice (ECJ), the Swiss Federal Supreme Court (SFSC), the Supreme Court of the United Kingdom (UKSC) or on national data protection laws or national case law of a state or federal state, including but not limited to California, including case law, also under common law, if this is necessary for the application of the law in individual cases.

We use the following terms, among others, in this Privacy Policy:

2. Name and address of the Controller

The Controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and the European Economic Area, British data protection laws, Swiss data protection laws (DSG, DSV), Californian data protection law (CCPA/CPRA), Chinese data protection law (PIPL), as well as international laws and provisions with a data protection nature is:

Docs4D GmbH

Am Trimmelter Hof 66

54296 Trier

Phone.: +49 651 170 845 14

eMail: info@docs4d.com

Website: www.docs4d.com

3. Name and contact details of the data protection officer

Herr Dr. Steffen Kathe

Güterstraße 58

54295 Trier

Deutschland

Phone.: +4965169990050

eMail: info@datenschutzbeauftragter-trier.de

4. Contact possibility via the website and other data transfers and your Consent

Our website contains information that enables quick electronic contact with our organisation as well as direct communication with us, which also includes a general address of the so-called electronic mail (email address) and possibly a telephone number. If a Data Subject contacts us by email, via a contact form, via an input form or in any other way, the Personal Data transmitted by the Data Subject will be stored automatically. This Personal Data transmitted to us on a voluntary basis by a Data Subject is processed for the purposes of usage or contacting the Data Subject.

We obtain your Consent for the transmission, storage and Processing of your contact data and inquiries and for contacting you in accordance with Art. 6 (1) (a) GDPR and Art. 49 (1) (1) (a) GDPR as follows:

By transmitting your Personal Data, you voluntarily consent to the Processing of the Personal Data you have entered or transmitted for the purposes of processing the inquiry and contacting you. By transmitting your data to us, you also voluntarily give your explicit Consent in accordance with Art. 49 (1) (1) (a) GDPR to data transfers to third countries to and by the companies named in this Privacy Policy and for the purposes stated, in particular for such transfers to third countries for which there is or is not an adequacy decision by the EU/EEA and to companies or other bodies that are not subject to an existing adequacy decision on the basis of self-certification or other accession criteria and in which or for which there are significant risks and no suitable guarantees for the protection of your Personal Data (e.g., due to Section 702 FISA, Executive Order EO12333 and the CloudAct in the USA). When you gave your voluntary and explicit Consent, you were aware that there may not be an adequate level of data protection in third countries and that your data subject rights may not be enforceable. You can withdraw your Consent under data protection law at any time with effect for the future. The withdrawal of Consent does not affect the lawfulness of Processing based on Consent before its withdrawal. With a single action (entry and transmission), you give several Consents. These are Consents under EU/EEA data protection law as well as those under the CCPA/CPRA, ePrivacy and telemedia law, and other international legislation, which are required, among other things, as a legal basis for any planned further Processing of your Personal Data. With your action, you also confirm that you have read and taken note of this Privacy Policy.

5. Routine deletion and restriction of Personal Data

We process and store Personal Data for the period required to achieve the purpose of processing or if this has been provided for by the European legislator or another legislator in laws or regulations to which we are subject, or if a legal basis for the Processing exists.

If the purpose of processing no longer applies or if a storage period prescribed by the European legislator or another competent legislator expires, or if the legal basis for the Processing no longer applies, the Personal Data will be routinely restricted or deleted in accordance with the statutory provisions.

6. Rights of the Data Subject according to GDPR

7. General purpose of Processing, categories of processed data and categories of recipients

The general purpose of processing Personal Data is the handling of all activities relating to the Controller, customers, interested parties, business partners or other contractual or pre-contractual relationships between the aforementioned groups (in the broadest sense) or legal obligations of the Controller. This general purpose applies if no more specific purposes for specific Processing are specified.

The categories of Personal Data that we process are customer data, prospective customer data, employee data (including applicant data) and supplier data. The categories of recipients of Personal Data are public bodies, external bodies, internal processing, intragroup processing and other bodies.

A list of our Processors and data recipients in third countries and, if applicable, international organizations is either published on our website or can be requested from us free of charge.

8. Legal basis for the Processing

Art. 6 (1) (a) GDPR serves as the legal basis for Processing operations for which we obtain Consent for a specific Processing purpose. If the Processing of Personal Data is necessary for the performance of a contract to which the Data Subject is party, as is the case, for example, when Processing operations are necessary for the supply of goods or to provide any other service or consideration, Processing is based on Art. 6 (1) (b) GDPR. The same applies to such Processing operations that are necessary to carry out pre-contractual measures, for example in cases of inquiries about our products or services. If we are subject to a legal obligation which requires the Processing of Personal Data, such as for the fulfillment of tax obligations, Processing is based on Art. 6 (1) (c) GDPR.

In rare cases, it may be necessary to process Personal Data to protect the vital interests of the Data Subject or another natural person. This would be the case, for example, if a visitor were injured in our organisation and their name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other Third Party. The Processing would then be based on Art. 6 (1) (d) GDPR.

If the Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller, the legal basis is Art. 6 (1) (e) GDPR.

Ultimately, Processing operations could be based on Art. 6 (1) (f) GDPR. This legal basis is used for Processing operations which are not covered by any of the abovementioned legal grounds, if Processing is necessary for the purposes of the legitimate interests pursued by our organisation or by a Third Party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of Personal Data. We are permitted to carry out such Processing operations in particular because they have been specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed, for example, if the Data Subject is a customer of the Controller (Recital 47 Sentence 2 GDPR).

9. Legitimate interests in Processing pursued by the Controller or a Third Party and direct marketing

If the Processing of Personal Data is based on Art. 6 (1) (f) GDPR and no more specific legitimate interests are stated, our legitimate interest is the performance of our business activities for the benefit of the well-being of our staff and our shareholders.

We may send you direct advertising about our own goods or services that are similar to the goods or services you have requested, commissioned or purchased. You may object to direct advertising at any time (e.g. by email). You will not incur any costs other than the transmission costs according to the basic rates. The Processing of Personal Data for direct marketing purposes is based on Art. 6 (1) (f) GDPR. The legitimate interest is direct marketing.

Our messages and newsletters may also constitute direct marketing communications within the meaning of Article 13(2) of EU Directive 2002/58 (Directive on privacy and electronic communications) and the national law resulting from the Directive, provided that we have obtained your electronic and other contact information in connection with the sale of a service or product, which includes the creation of a free user account that allows you, among other things, to access free content on our websites and publications (newsletters, etc.), provided that we advertise similar products or services through direct marketing, so that direct marketing is also permissible without consent (see ECJ, judgment of November 13, 2025, Case C 654/23). In such cases, you can refuse the use of your contact information at any time free of charge.

10. Duration for which the Personal Data is stored

The criterion for the duration of the storage of Personal Data is the respective statutory retention period. If there is no statutory retention period, the criterion is the contractual or internal retention period. After this period has expired, the corresponding data is routinely deleted if it is no longer required to fulfill or initiate a contract. This applies in particular to all Processing operations for which no more specific criteria have been defined.

11. Legal or contractual provisions for the provision of Personal Data; necessity for the conclusion of the contract; obligation of the Data Subject to provide the Personal Data; possible consequences of non-provision

We would like to inform you that the provision of Personal Data is partly required by law (e.g., tax regulations) or may also result from contractual obligations (e.g., information on the contractual partner). Sometimes it may be necessary for a contract to be concluded for a Data Subject to provide us with Personal Data that must subsequently be processed by us. For example, Data Subjects are obliged to provide us with Personal Data if our organisation concludes a contract with them. Failure to provide Personal Data would mean that the contract with the Data Subject could not be concluded. The Data Subject must contact us before providing Personal Data. We will inform the Data Subject on a case-by-case basis whether the provision of the Personal Data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the Personal Data and what the consequences would be if the Personal Data were not provided.

12. Existence of automated decision-making

As a responsible company, we do not normally use automated decision-making or Profiling. If, in exceptional cases, we carry out automated decision-making or Profiling, we will inform the Data Subject either separately or via a sub-item in our Privacy Policy (here on our website). In this case, the following applies:

Automated decision-making, including Profiling, may take place if (1) this is necessary for the conclusion or performance of a contract between the Data Subject and us, or (2) this is permissible on the basis of Union or Member State legislation to which we are subject and this legislation contains appropriate measures to safeguard the rights and freedoms and legitimate interests of the Data Subject, or (3) this takes place with the explicit Consent of the Data Subject.

In the cases referred to in Art. 22 (2) (a) and (c) GDPR, we shall implement suitable measures to safeguard the Data Subject's rights and freedoms and legitimate interests. In these cases, you have the right to obtain human intervention on the part of the Controller, to express your point of view and to contest the decision.

Meaningful information on the logic involved and the scope and intended effects of such Processing for the Data Subject will be provided in this Privacy Policy where applicable.

13. Recipients in a third country and appropriate or adequate safeguards and how to obtain a copy of them or where they are available.

According to Art. 46 (1) GDPR, the Controller or Processor may only transfer Personal Data to a third country if the Controller or Processor has provided appropriate safeguards and if enforceable rights and effective legal remedies are available to the Data Subjects. Appropriate safeguards can be provided by standard contractual clauses without the need for special approval from a supervisory authority, Art. 46 (2) (c) GDPR.

The EU standard contractual clauses or other appropriate safeguards are agreed with all recipients from third countries prior to the first transfer of Personal Data, or the transfers are based on adequacy decisions. Consequently, it is ensured that appropriate safeguards, enforceable rights and effective legal remedies are guaranteed for all Processing of Personal Data. Any Data Subject can obtain a copy of the standard contractual clauses or adequacy decisions from us. In addition, the standard contractual clauses and adequacy decisions are available in the Official Journal of the European Union.

Art. 45 (3) GDPR authorizes the European Commission to decide by means of an implementing decision that a non-EU country ensures an adequate level of protection. This means a level of protection for Personal Data that essentially corresponds to the level of protection within the EU. Adequacy decisions mean that Personal Data can flow from the EU (as well as from Norway, Liechtenstein and Iceland) to a third country without further obstacles. Similar regulations apply to the United Kingdom, Switzerland and some other countries.

In all cases where the European Commission, or a government or competent authority of another country, has decided that a third country ensures an adequate level of protection and/or a valid framework exists (e.g., EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework), all transfers by us to the members of such frameworks (e.g., self-certified entities) are based solely on the membership of that entity in the respective framework or on the respective adequacy decisions. If we or one of our group companies is a member of such a framework, all transfers to us or our group company are based exclusively on the membership of the respective company in this framework. If we or one of our group companies is located in a third country with an adequate level of protection, all transfers to us or our group company are based solely on the respective adequacy decisions.

Any Data Subject can obtain a copy of the frameworks from us. In addition, the frameworks are also available in the Official Journal of the European Union or in the published legal materials or on the websites of data protection supervisory authorities or other authorities or institutions.

14. Right to lodge a complaint with a data protection supervisory authority

As the Controller, we are obliged to inform the Data Subject of the existence of the right to lodge a complaint with a supervisory authority. The right to lodge a complaint is regulated in Art. 77 (1) GDPR. According to this provision, without prejudice to any other administrative or judicial remedy, every Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the Data Subject considers that the Processing of Personal Data relating to him or her infringes the General Data Protection Regulation. The right to lodge a complaint has been restricted by the EU legislator to the effect that it can only be exercised with a single supervisory authority (Recital 141 Sentence 1 GDPR). This provision is intended to avoid duplicate complaints in the same matter by the same Data Subject. If a Data Subject wishes to complain about us, it is therefore requested that only one supervisory authority is contacted.

15. Data protection for applications and in the application process

We collect and process Personal Data of applicants in the application process. Processing may also take place electronically. This is particularly the case if an applicant submits relevant application documents to us electronically, for example by email or via a web form on our or third-party websites.

For applicant data, the purpose of data processing is to carry out a review of the application in the application process. For this purpose, we process all data provided by you. Based on the data submitted as part of the application, we check whether you will be invited to an interview (part of the selection process). Then, in the case of generally suitable applicants, in particular during the interview, we process certain other Personal Data provided by you that is essential for our selection decision.

The legal basis for data Processing is Art. 6 (1) (b) GDPR, Art. 9 (2) (b) and (h) GDPR, Art. 88 (1) GDPR and national legislation.

If we do not conclude an employment contract with the applicant, the application documents will be deleted no later than six months after notification of the rejection decision, provided that no other legitimate interests of the Controller stand in the way of deletion. Another legitimate interest in this sense is, for example, the provision of evidence in legal proceedings.

16. Data protection provisions about the application and use of Complianz - GDPR/CCPA Cookie Consent

Complianz - GDPR/CCPA Cookie Consent is a WordPress plugin that supports compliance with data protection regulations (GDPR and CCPA) by providing a user-friendly solution for managing cookie Consents. This plugin helps website operators to obtain and document legally required Consents for data processing and cookie use from website visitors. It processes and stores information about users' Consent to cookies and their IP addresses.

The application is installed on our own IT infrastructure. We are the company operating the service.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of using Complianz - GDPR/CCPA Cookie consent is to comply with data protection laws through the use of cookie consent tools. Processing is based on Art. 6 (1) (c) GDPR, as the Processing is necessary for compliance with a legal obligation to which our organisation is subject.

The criteria for determining the duration for which the Personal Data is processed are the statutory or contractual retention periods. The use of Personal Data is required by law, as it is necessary to fulfill legal obligations in the area of data protection and Consent management. Users are required to indicate their cookie preferences or reject cookies, and this information must be stored to properly document the decision.

Further information about Complianz - GDPR/CCPA Cookie consent can be found at https://complianz.io/.

17. Data protection provisions about the application and use of Facebook Connect

We use Facebook Connect to give users the opportunity to easily register or log in to our website using their Facebook login. The service facilitates access by automating login processes and transferring profile information. In the course of use, personal data may be processed - in particular, data that users provide or are technically transmitted by Facebook. The data processed includes names, email address, profile picture, language settings, Facebook ID, IP address, browser data and device data as well as the time stamp of the login.

Processing is automated via Meta's systems. As soon as users log in with Facebook, Facebook provides us with an authenticated connection and confirms their identity and the shared profile information. The data transfer is encrypted. Meta uses this information for authentication, to improve user security and to analyze login behavior. We only receive the data that has been requested as authorization.

The company that operates the service and therefore the recipient of personal data is: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. For data subjects in the EU and EEA, Meta Platforms Ireland Ltd, Merrion Road, Dublin D04 X2K5, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Meta Platforms Technologies UK Ltd, 10 Brock Street, Regent's Place, London, NW1 3FG, United Kingdom.

Purposes for which personal data are to be processed and the legal basis for the processing: The purpose of the processing is to optimize the registration process. Processing is based on Art. 6 (1) (f) GDPR, whereby the legitimate interest lies in the efficient registration within our systems and websites.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the personal data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with personal data. However, if you do not provide it, you may not be able to use our services or those of the company that operates the service.

Further information and the applicable data protection provisions can be found at https://facebook.com.

18. Data protection provisions about the application and use of JavaScript and JavaScript frameworks

On our website, we use JavaScript or JavaScript frameworks as a client-side programming language or JS framework for the dynamic display of content and for interaction in the browser. Among other things, JavaScript enables the display of pop-ups, the loading of dynamic content, the tracking of user behavior, the sending of forms, and communication with third-party providers via APIs. JavaScript is not a standalone software product with an external operating company, but rather a scripting language integrated by default into web browsers by default that is executed on our websites.

The JavaScript-based source code is hosted on our own IT infrastructure and executed by the web browser. We are the company that operates the service.

In addition, we may use various open-source JavaScript libraries or frameworks in our web development, such as Vue JS, Angular JS, or similar projects. These serve to structurally and modularly expand the functionality of our website, in particular for client-side validation, optimization of user guidance, reduction of loading times, and asynchronous data processing. Where technically possible, we host these components locally on our own IT infrastructure so that no data is transferred to third parties. In certain cases, however, individual components may be integrated via external sources such as content delivery networks (CDNs). This may result in connections being established with third-party servers, in which case the IP address, technical metadata, or usage parameters in particular may be processed.

Purposes for which personal data is to be processed and the legal basis for the processing: The purpose of the processing is to enable interactive functions, dynamic content, easier development, client-side validation, and improved user guidance. Processing is based on Art. 6 (1) (f) GDPR. The legitimate interest lies in simplifying development and providing a functional and user-friendly website.

The criteria for determining the duration for which personal data is processed are based on the respective purpose of the interaction, in particular the duration of the respective session or the storage of client-side information (e.g., in connection with cookies or local storage). The provision of personal data is necessary for the use of interactive website functions.

19. Data protection provisions about the application and use of HubSpot

HubSpot, Inc. provides a comprehensive inbound marketing, sales and customer service platform that helps businesses attract visitors, convert leads, acquire and retain customers. HubSpot software includes a wide range of tools and features, including content management, social media marketing, email marketing, lead management, analytics, CRM and customer support. This integrated solution enables companies to optimize their marketing and sales processes and create a better customer experience.

When using HubSpot, Personal Data such as names, email addresses, telephone numbers, company information, interaction data (e.g., website visits, email openings, clicks) and in certain cases, payment information is processed. This data helps companies to better understand their customers and potential customers and to plan and implement targeted marketing, sales and service activities.

The company that operates the service and thus the recipient of personal data is: HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA. For data subjects in the EU and EEA, HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: HubSpot UK, 199 Bishopsgate, London EC2M 3T, United Kingdom.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is the use and optimization of the marketing, sales and service platform. Processing is based on Art. 6 (1) (b) GDPR for the performance of a contract to which the Data Subject is party and Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in improving business processes, increasing customer satisfaction and supporting our growth.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of HubSpot may be retrieved under https://legal.hubspot.com.

20. Data protection provisions about the application and use of WordPress.com

WordPress.com is a platform that offers blogging and website creation services. WordPress.com allows users to create and manage their own websites or blogs without any technical knowledge. WordPress.com offers a variety of plugins that allow users to customize the design and functionality of their websites.

When using WordPress.com, Personal Data such as names, email addresses, payment information (for premium services), as well as usage data such as website visits and interactions with the platform are processed. This information is required to provide the services offered, manage user accounts, provide support and ensure the security of the platform.

The company that operates the service and thus the recipient of personal data is: Automattic, Inc., 60 29th Street 343, San Francisco, CA 94110, USA. For data subjects in the EU and EEA, Automattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of data processing is the use of blogging and website creation services. Processing is based on the performance of a contract pursuant to Art. 6 (1) (b) GDPR, to which the Data Subject is a party, and on legitimate interests pursuant to Art. 6 (1) (f) GDPR, such as the use of an efficient platform, the improvement of our services and ensuring platform security.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of WordPress.com can be found at https://automattic.com.

21. Data protection provisions about the application and use of Google Fonts

Google Fonts is a free service from Google LLC that provides web developers with a wide range of fonts to improve the design and aesthetics of websites. By integrating Google Fonts, web developers can ensure that texts on their websites are displayed consistently and as intended on different devices and browsers. Google Fonts is provided via Google servers, ensuring high availability and fast loading times.

When using Google Fonts, Personal Data such as IP addresses and browser information may be processed, as a request is sent to the Google servers when the fonts are loaded. This data is used to provide the service, optimize performance and prevent misuse.

The company that operates the service and thus the recipient of personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is to use and optimize the font service for web developers and end users. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in improving the user experience on websites by providing a variety of fonts and ensuring fast loading times.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of Google Fonts can be found at https://policies.google.com/privacy.

22. Data protection provisions about the application and use of Google Maps

Google Maps is a comprehensive mapping and navigation service provided by Google LLC that allows users to view maps, plan routes and find local businesses and services. By providing detailed geographical information, Google Maps helps people around the world to find their way around and navigate in everyday life. The service offers features such as satellite images, street views, real-time traffic conditions and the ability to rate and review places.

When using Google Maps, Personal Data such as location data, search queries and usage statistics are processed. This information is necessary to provide and use the service, offer personalized recommendations and improve the user's experience.

The company that operates the service and thus the recipient of personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is the use and optimization of the mapping and navigation service. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in the provision and use of an efficient, user-friendly and precise navigation service.

The company that operates the service is located in a third country, namely in the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of Google Maps can be found at https://policies.google.com/privacy.

23. Data protection provisions about the application and use of Google reCAPTCHA

Google reCAPTCHA is a security service provided by Google LLC that is used to distinguish human users from automated software bots. reCAPTCHA is used on websites to prevent abuse such as spam and automated data entry. reCAPTCHA uses advanced risk analysis techniques and adaptive challenges to ensure that legitimate users access website content.

When Google reCAPTCHA is used, Personal Data such as IP addresses, mouse movements, keystrokes and browser and operating system information are processed. This data is necessary to carry out a precise risk analysis and determine whether the interactions originate from a human or an automated bot.

The company that operates the service and thus the recipient of personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is to secure websites against automated misuse. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in ensuring the security of websites, protection against spam and abuse and maintaining the quality of service for legitimate users.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the statutory or contractual retention periods. The provision of Personal Data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide us with Personal Data. However, if you do not provide it, you may not be able to use the services.

Further information and the applicable data protection provisions of Google reCAPTCHA can be found at https://policies.google.com/privacy.

24. Data protection provisions about the application and use of Google Analytics

Google Analytics is a tool from Google LLC that provides operators of websites and apps with detailed statistics on traffic and user behavior. It enables the collection and analysis of data on website visits, user interactions and conversion rates, which helps operators to understand and optimize their online presence. Google Analytics uses cookies to collect information about user behavior, including page views, time spent on the site and the paths users take on the site.

When using Google Analytics, Personal Data such as IP addresses, browser information and interaction data are processed. This data helps website operators to measure the performance of their website, improve the user experience and develop targeted marketing strategies.

The company that operates the service and thus the recipient of personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is the analysis and optimization of websites, apps, and advertising. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in improving the website, increasing user-friendliness and the effectiveness of online marketing.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of Google Analytics can be found at https://policies.google.com/privacy.

25. Data protection provisions about the application and use of Feeds for YouTube

Feeds for YouTube is a WordPress plugin that allows users to seamlessly integrate content from YouTube channels, individual videos or complete galleries into their websites. The tool facilitates the display of YouTube videos directly on a WordPress page, which can increase interaction and engagement on the website. Although Feeds for YouTube does not store any Personal Data, it interacts with YouTube, a platform that processes user data.

The application is installed on our own IT infrastructure. We are the company operating the service.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of using Feeds for YouTube is to enable users to easily integrate YouTube content on their website, which can improve the attractiveness and interactivity of the site. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in increasing user engagement and enriching the website content with multimedia content.

The criteria for determining the duration for which the Personal Data is processed are internal, statutory, or contractual retention periods. The use of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us with Personal Data. If you do not provide it, you may not be able to use our services, functionality, or the plugin.

More information about Feeds for YouTube can be found at WordPress.org.

26. Data protection provisions about the application and use of HubSpot WordPress Plug-In

HubSpot for WordPress is a plugin that allows users to manage and integrate marketing activities, sales activities and customer service activities directly from their WordPress installation. The tool offers features such as contact management, email marketing, workflows, CRM functionalities and more. HubSpot collects a variety of Personal Data, including names, email addresses, website usage data and other relevant information needed to improve marketing and customer interaction.

The application is installed on our own IT infrastructure. We are the company operating the service.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of using HubSpot is to use a comprehensive marketing platform and sales platform that helps companies to manage their customer relationships more effectively. Processing is based on Art. 6 (1) (b) GDPR for the performance of a contract to which the Data Subject is party and on Art. 6 (1) (f) GDPR, based on the legitimate interest of HubSpot and its users to optimize marketing processes and sales processes.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship or statutory or defined retention periods. The use of Personal Data is necessary for the use of the service. Users are required to provide certain Personal Data to use our services.

Further information about HubSpot can be found on the HubSpot website: https://www.hubspot.com.

27. Data protection provisions about the application and use of Jetpack

Jetpack is a WordPress plugin that provides a variety of security, performance optimization, image and content optimization, and marketing tools for WordPress websites. Jetpack enables website owners to protect their sites against brute force attacks, create automatic content and design backups, speed up image and video loading times and get detailed analytics reports. It also supports social media automation and offers advanced SEO functionalities.

When using Jetpack, Personal Data such as IP addresses, usage data (e.g., pages visited, interaction times), browser and device information and, in certain cases, email addresses are processed. This data helps to ensure the security of the website, optimize performance, analyze user interactions and improve the user experience.

The company that operates the service and thus the recipient of personal data is: Automattic Inc., 60 29th Street 343, San Francisco, CA 94110, USA. For data subjects in the EU and EEA, Aut O'Mattic A8C Ireland Ltd., 25 Herbert Place, Dublin, D02 AY86, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is the use and optimization of the Jetpack services. Processing is based on Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in improving the security, performance and marketing efficiency of websites.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. Automattic Inc. may have concluded one of the EU Standard Contractual Clauses with us. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of Jetpack may be retrieved under https://jetpack.com.

28. Data protection provisions about the application and use of MailPoet

MailPoet is a WordPress plugin that allows users to manage and send newsletters, automated emails and post notifications directly from their WordPress dashboard. It provides a comprehensive platform for email marketing, including the creation of subscriber lists and the segmentation of these lists for targeted campaigns. MailPoet processes Personal Data such as email addresses, usernames and any other information required for email marketing.

The application is installed on our own IT infrastructure. We are the company operating the service.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of using MailPoet is to use email marketing tools for WordPress users to develop effective and personalized communication strategies. Processing is based on Art. 6 (1) (b) GDPR, as it is necessary for the performance of a contract to which the Data Subject is party or to take steps prior to entering into a contract, and on Art. 6 (1) (f) GDPR for Processing operations that serve to improve the marketing experience and optimize customer satisfaction (legitimate interests).

The criteria for determining the duration for which the Personal Data is processed are internal, statutory, or contractual retention periods. The use of Personal Data is required by contract or is necessary for the conclusion of a contract. You are obliged to provide us with Personal Data for this Processing activity if you wish to use the functions of MailPoet.

Further information about MailPoet can be found at https://www.mailpoet.com/.

29. Data protection provisions about the application and use of Facebook

Facebook is a social network that offers people the opportunity to connect, share content and communicate online. Users can create profiles, post photos and videos, exchange messages and organize themselves into groups. Facebook also offers companies and organizations a platform for advertising and interacting with their target group.

When using Facebook, Personal Data such as names, email addresses, telephone numbers, usage data, location information, and information on shared content is processed. This data is necessary to provide the platform, offer personalized content and advertising, ensure user safety, and develop new services.

The company that operates the service and thus the recipient of personal data is: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. For data subjects in the EU and EEA, Meta Platforms Ireland Ltd., Merrion Road, Dublin D04 X2K5, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Meta Platforms Technologies UK Ltd, 10 Brock Street, Regent's Place, London, NW1 3FG, United Kingdom.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is to use and improve the social network functions and network services. Processing is based on Art. 6 (1) (b) GDPR for the performance of a contract to which the Data Subject is party and Art. 6 (1) (f) GDPR, whereby our legitimate interest lies in improving the user experience, providing personalized content and advertising and ensuring the security of the network.

The company that operates the service is located in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of Facebook can be found at https://facebook.com.

30. Data protection provisions about the application and use of LinkedIn

LinkedIn is a social network for professional contacts and career development. The platform allows users to create a professional profile, network with colleagues, business partners and potential employers, share professional experiences and skills, and keep up to date with industry news. LinkedIn also provides tools for companies and recruiters to source talent, post job ads and build a brand presence.

When using LinkedIn, Personal Data such as names, email addresses, professional titles and experience, educational background, skills, interests, and platform usage data are processed. This information is necessary to provide and use the service to create networking opportunities, to present personalized content and job offers and to ensure the security of user data.

The company that operates the service and thus the recipient of the Personal Data is: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of processing is the use and optimization of network and career services. Processing is based on the Consent of the user (Art. 6 (1) (a) GDPR), the performance of a contract (Art. 6 (1) (b) GDPR) to which the Data Subject is party and on legitimate interests (Art. 6 (1) (f) GDPR), such as marketing and recruitment.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of LinkedIn Corporation can be found at https://www.linkedin.com.

31. Data protection provisions about the application and use of Vimeo

Vimeo provides a platform for sharing, viewing, and creating videos. Vimeo enables creators, video artists, and companies to share, promote and monetize high-quality content with a global audience. The platform is characterized by a user-centric approach that values quality, creative freedom, and a supportive community environment.

When using Vimeo services, Personal Data such as names, email addresses, profile information, video data, interaction data (such as views and likes) and payment information are processed. This data is required to operate the platform, manage user accounts, offer personalized recommendations, improve support, and process payments for premium services.

The company that operates the service and thus the recipient of personal data is: Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. For data subjects in the EU and EEA, EDPO (European Data Protection Office), Avenue Huart Hamoir 71, 1030 Brussels, Belgium, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: EDPO Switzerland Sàrl, Rue de Lausanne 37, 1201 Geneva, Switzerland.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of data processing is the use of the video platform. Processing is based on the performance of a contract pursuant to Art. 6 (1) (b) GDPR, to which the Data Subject is a party, and on legitimate interests pursuant to Art. 6 (1) (f) GDPR, such as the use of an efficient platform for videos, the optimization of the user experience and the use of efficient customer support.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may have concluded one of the EU Standard Contractual Clauses with us. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of Vimeo may be retrieved under https://vimeo.com.

32. Data protection provisions about the application and use of X (formerly Twitter)

X (formerly known as Twitter) is a global platform for public self-expression and real-time conversation. Users can create and share short messages, called tweets, which can include text, images, videos, and links. The platform allows users to follow breaking news, interact with others and participate in global discussions.

When using X, several types of Personal Data are processed, including usernames, email addresses, telephone numbers and location data. This information can be used for account creation, personalization of content, provision of advertising, security purposes and for analytical evaluations.

The company that operates the service and thus the recipient of personal data is: X Corp., 865 FM-1209, Building 2, Bastrop, TX 78602, USA. For data subjects in the EU and EEA, X Internet Unlimited Company, 1 Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: X Schweiz GmbH, c/o Wasag Treuhand AG, Normannenstrasse 8, 3018 Bern, Switzerland.

The Processing of Personal Data takes place, among other things, on the basis of the user's Consent (Art. 6 (1) (a) GDPR), for the performance of a contract (Art. 6 (1) (b) GDPR) to which the Data Subject is a party, or on the basis of legitimate interests (Art. 6 (1) (f) GDPR), such as the use of the platform and the improvement of communication with the public.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may have concluded one of the EU Standard Contractual Clauses with us. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of X can be found at https://twitter.com/.

33. Data protection provisions about the application and use of YouTube

YouTube is a video sharing and viewing platform used by individuals, artists, businesses, and media companies to publish a variety of content such as music videos, vlogs, educational material and much more. YouTube offers users the ability to upload, share, comment and interact with a broad community.

When using YouTube, Personal Data such as IP addresses, user interactions (e.g., videos viewed, comments), location data (if enabled for services) and information from linked Google accounts are processed. This information is required to provide personalized content and advertising, enable user interactions, keep the platform secure and improve the user experience.

The company that operates the service and thus the recipient of personal data is: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For data subjects in the EU and EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acts as contact and representative within the meaning of Art. 27 GDPR. The representative under national law in the United Kingdom is: Google UK Limited, Belgrave House, 76 Buckingham Palace Road, London SW1W 9TQ, United Kingdom. The representative under Art. 14 of the Federal Act on Data Protection (FADP) in Switzerland is: Google Switzerland GmbH, Brandschenkestrasse 110, 8002 Zurich, Switzerland.

Purposes for which the Personal Data is to be processed and the legal basis for the Processing: The purpose of data processing lies in the use of the video sharing services. Processing is based on the performance of a contract pursuant to Art. 6 (1) (b) GDPR, to which the Data Subject is a party, and on legitimate interests pursuant to Art. 6 (1) (f) GDPR, such as the use of an efficient video platform, the improvement of the user experience, the use of personalized advertising and the use of embedded videos on our website.

The company that operates the service is based in a third country, namely the USA. Transfers to third countries may be based on the conclusion of Standard Contractual Clauses or other suitable or appropriate safeguards referred to in Art. 46 (2) GDPR. The company that operates the service may be a certified member of one or more of the data privacy frameworks. You can find more information at https://www.dataprivacyframework.gov/list. You can request a copy of the suitable or appropriate safeguards from us.

The criteria for determining the duration for which the Personal Data is processed are the contractual relationship between us and the company that operates the service or statutory or contractual retention periods. The provision of Personal Data is not required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide us or the company that operates the service with Personal Data. However, if you do not provide it, you may not be able to use our services or those of the company operating the service.

Further information and the applicable data protection provisions of YouTube can be found at https://policies.google.com.