Privacy Policy

Privacy Policy

Last updated: 30 July 2025, Source: https://www.e-recht24.de

Thank you for your interest in my business. I attach particular importance to data protection. You may generally use my website without providing any personal data. However, should you wish to make use of specific services offered online, the processing of personal data may become necessary. Where this is the case and there is no legal basis for such processing, I shall obtain your consent.

The processing of your personal data, such as your name, address, email address or telephone number, is always carried out in accordance with the General Data Protection Regulation (GDPR) and the applicable country-specific data protection provisions. Through this Privacy Policy, I wish to inform you of the nature, scope and purpose of the personal data I collect, use and process. You will also be informed of the rights to which you are entitled.

As the controller, I, Theresa Zander, have implemented numerous technical and organisational measures to protect your data as effectively as possible. Nevertheless, internet-based data transmissions may be subject to security vulnerabilities, which means that absolute protection cannot be guaranteed. You are, of course, most welcome to send me personal data by alternative means, for example by telephone.

Controller

Theresa Zander
Heilholtkamp 11
22297 Hamburg
Germany

Tel.: 01575 0147582
Email: info@theresazander.de
Website: www.theresazander.de

Overview of Processing Activities

Below you will find a summary of the types of data processed and the purposes of their processing, including the data subjects concerned.

Types of data processed: Master data, payment data, contact data, content data, contract data, usage data, meta, communication and procedural data, log data.

Categories of data subjects: Service recipients and clients, prospective clients, communication partners, users, prize draw and competition participants, business and contractual partners, education and course participants, participants.

Purposes of processing: Provision of contractual services and fulfilment of contractual obligations, communication, security measures, direct marketing, reach measurement, tracking, office and organisational procedures, conversion measurement, audience building, organisational and administrative procedures, running prize draws and competitions, server monitoring and error detection, feedback, surveys and questionnaires, marketing, profiles containing user-related information, provision of my online services and user-friendliness, information technology infrastructure, public relations, sales promotion, business processes and commercial procedures.

Relevant Legal Bases

Personal data is processed on the basis of the following legal bases under the GDPR:

• Consent (Art. 6(1)(a) GDPR): Where you have given your consent to the processing of your data for one or more specific purposes.

• Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR): Where processing is necessary for the performance of a contract or for pre-contractual measures.

• Legal obligation (Art. 6(1)(c) GDPR): Where I am subject to a legal obligation to process data.

• Legitimate interests (Art. 6(1)(f) GDPR): Where processing is necessary to safeguard my legitimate interests or those of a third party, provided these are not overridden by your fundamental rights and freedoms.

In addition to the GDPR, national data protection regulations apply in Germany, in particular the Federal Data Protection Act (BDSG) and, where applicable, the data protection acts of the federal states.

Note on the applicability of the GDPR and the Swiss FADP: This privacy notice serves to provide information in accordance with both the Swiss Federal Act on Data Protection (FADP) and the GDPR. For the sake of clarity, the terminology of the GDPR is used. However, within the scope of the Swiss FADP, the legal meaning of these terms continues to be determined by the Swiss FADP.

Security Measures

I take appropriate technical and organisational measures in accordance with legal requirements, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the varying likelihood and severity of the risks to your rights and freedoms.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling access to, input, transfer, availability and separation of the data. I have also established procedures to ensure that you are able to exercise your rights as a data subject, that data is erased, and that any threats to data are responded to. The protection of personal data is taken into account from the outset in the development and selection of hardware, software and procedures, in line with the principles of data protection by design and by default.

Transfer of Personal Data

In the course of my data processing, data may be transferred or disclosed to other bodies, companies, legally independent organisational units or individuals. These may include, for example, IT service providers or providers of services embedded in my website. In doing so, I always observe the legal requirements and conclude appropriate agreements designed to protect your data.

General Information on Data Retention and Erasure

I erase personal data in accordance with the statutory provisions as soon as your consent is withdrawn or there is no longer any legal basis for the processing. This is the case where the original purpose of processing no longer applies or the data is no longer required. Exceptions apply where statutory obligations or particular interests require longer retention (e.g. for reasons of commercial or tax law, or for the pursuit of legal claims).

General retention and archiving periods under German law:

• 10 years: Books and records, annual financial statements, inventories, management reports, opening balance sheets, as well as the necessary working instructions and organisational documents.

• 8 years: Accounting vouchers such as invoices and expense receipts.

• 6 years: Other business documents, such as commercial or business correspondence received and sent, as well as documents relevant for tax purposes (e.g. hourly timesheets).

• 3 years: Data relevant to warranty, damages or similar contractual claims and enquiries is stored for the standard statutory limitation period of three years.

Rights of Data Subjects

As a data subject, you have various rights under the GDPR (in particular Articles 15 to 21 GDPR):

• Right to object: You may object at any time to the processing of your personal data carried out on the basis of legitimate interests. This also applies to direct marketing and any associated profiling.

• Right to withdraw consent: You may withdraw any consent you have given at any time.

• Right of access: You may request confirmation as to whether data concerning you is being processed, and obtain information about this data as well as a copy of it.

• Right to rectification: You have the right to request the completion or correction of inaccurate data.

• Right to erasure and restriction of processing: You may request that data concerning you be erased without undue delay or that its processing be restricted.

• Right to data portability: You have the right to receive the data you have provided to me in a structured, commonly used and machine-readable format, or to request its transfer to another controller.

• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR.

Business Services

I process the data of my contractual partners (clients and prospective clients) within the framework of contractual and comparable legal relationships, as well as the associated communications and measures. This data serves to fulfil my contractual obligations, to safeguard my rights and to carry out administrative tasks. Data is only disclosed within the scope of applicable law where this is necessary for the aforementioned purposes or to fulfil legal obligations.

Types of data processed: Master data, payment data, contact data, contract data. Data subjects: Service recipients and clients, prospective clients, business and contractual partners, education and course participants. Purposes of processing: Provision of contractual services and fulfilment of contractual obligations, communication, office and organisational procedures, business processes and commercial procedures. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing activities:

• Agency services: I process client data in order to provide my services (e.g. consultancy, campaign planning, software development, data analysis, training).

  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR).

• Education and training services: I process participant data in order to provide my training services, including performance assessment and evaluation. Where necessary, special categories of data (e.g. health data) are processed only with explicit consent or for reasons of health protection or safety.

  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR).

• Project and development services: I process customer and client data to enable the selection, acquisition and delivery of services, as well as payment. Mandatory information is clearly marked and comprises the details required for service delivery and invoicing, as well as contact information.

  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR).

• Event management: I process participant data to enable participation in events and the use of associated services. Special categories of data are processed only where they have been manifestly made public, for the purposes of health protection, or with consent.

  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR).

Business Processes and Procedures

Personal data of service recipients and clients, including customers and other third parties, is processed within the context of contractual and pre-contractual relationships. This data processing supports business operations such as customer management, sales, payment transactions, accounting and project management. The data collected serves to fulfil contractual obligations and to ensure efficient business processes.

Types of data processed: Master data, payment data, contact data, content data, contract data, usage data, meta, communication and procedural data. Data subjects: Service recipients and clients, prospective clients, communication partners, business and contractual partners. Purposes of processing: Provision of contractual services and fulfilment of contractual obligations, office and organisational procedures, business processes and commercial procedures. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing activities:

• Economic analyses and market research: For business purposes and to identify market trends, data relating to business transactions, contracts and enquiries is analysed. This serves the purposes of business evaluation, marketing and market research. Analyses are carried out primarily in pseudonymised form and, wherever possible, in anonymised form.

  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Provision of Online Services and Web Hosting

I process users' data in order to provide them with my online services. For this purpose, I process the user's IP address, which is necessary to deliver the content and functions to their browser or device.

Types of data processed: Usage data, meta, communication and procedural data, log data, content data. Data subjects: Users (e.g. website visitors, users of online services). Purposes of processing: Provision of my online services and user-friendliness, information technology infrastructure, security measures, reach measurement, conversion measurement, server monitoring and error detection. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Use of Cookies

I use cookies to ensure the functionality, security and user-friendliness of my online services and to analyse visitor flows. Cookies are small files that store and read information on your device. I use cookies in accordance with the statutory requirements. Where your consent is required, I shall obtain it in advance. Where consent is not required, I rely on my legitimate interests, particularly where storing and reading information is essential in order to provide requested content and functions (e.g. saving settings) and to ensure the security of my online services. You may withdraw your consent at any time. I keep you transparently informed about the scope and nature of the cookies used.

Legal bases: The processing of personal data by means of cookies is based on your consent (Art. 6(1)(a) GDPR), where this has been given. Otherwise, I rely on my legitimate interests (Art. 6(1)(f) GDPR), as explained above and in the context of the specific services.

Storage period:

• Temporary cookies (session cookies): These are deleted as soon as you leave my online services and close your browser or app.

• Persistent cookies: These remain stored even after your device has been closed, for example to retain your login status or to record user-related data for reach measurement. Where no explicit storage period is specified, these cookies may remain stored for up to two years.

Withdrawal and objection (opt-out): You may withdraw any consent given at any time and object to data processing via the privacy settings of your browser.

Types of data processed: Meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers). Data subjects: Users (e.g. website visitors, users of online services). Legal bases: Legitimate interests (Art. 6(1)(f) GDPR), consent (Art. 6(1)(a) GDPR).

Additional information on processing activities:

• Processing of cookie data on the basis of consent: I use a consent management system to obtain, record and manage your consent to the use of cookies and to enable its withdrawal. This system serves the legally compliant management of your preferences regarding cookies and similar technologies. Your declarations of consent are stored in order to avoid repeated requests and to provide evidence of consent. Storage takes place on the server side and/or in a cookie (opt-in cookie) and includes a pseudonymous user identifier, the time of consent, the scope of consent, as well as browser and device data. Consent is stored for up to two years.

  • Legal bases: Consent (Art. 6(1)(a) GDPR).

Contact and Enquiry Management

When you contact me (e.g. by post, contact form, email, telephone or via social media), or within the context of existing relationships, I process the information you provide in order to respond to your enquiries and take any necessary action.

Types of data processed: Master data (e.g. name, address, customer number), contact data (e.g. postal and email addresses, telephone numbers), content data (e.g. messages, posts), usage data (e.g. page views, interactions), meta, communication and procedural data (e.g. IP addresses, timestamps). Data subjects: Communication partners. Purposes of processing: Communication, organisation and administration, feedback, provision of my online services and user-friendliness. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Legal bases: Legitimate interests (Art. 6(1)(f) GDPR), performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR).

Additional information on processing activities:

• Contact form: When you get in touch via my contact form or other means of communication, I process the personal data provided in order to respond to and deal with your request. This generally includes your name, contact details and any other relevant information. The data is used exclusively for the purpose of making contact and communicating with you.

  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Communication via Messenger Services

I use messenger services for communication and kindly ask you to take note of the information regarding their functionality, encryption and the processing of metadata. You are, of course, also welcome to contact me by alternative means, such as telephone or email.

With end-to-end encryption, your messages and attachments are protected from being viewed by third parties, including the messenger providers themselves. Please always use an up-to-date version of the messenger with encryption enabled. Please note that messenger providers may process metadata such as the times of communication, technical device information and, depending on your settings, location information.

Legal bases: Where I ask for your permission, your consent (Art. 6(1)(a) GDPR) constitutes the legal basis. Where you contact me on your own initiative, I use messenger services within the scope of contractual relationships as a contractual measure, or on the basis of my legitimate interests (Art. 6(1)(f) GDPR) in swift and efficient communication. I do not pass your contact details on to messenger providers without your consent.

Types of data processed: Contact data (e.g. postal and email addresses, telephone numbers), content data (e.g. messages, posts). Data subjects: Communication partners. Purposes of processing: Communication. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Legal bases: Consent (Art. 6(1)(a) GDPR), performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Newsletters and Electronic Notifications

I send newsletters and other electronic notifications only with your consent or on the basis of a legal basis. The newsletter content described to you upon subscribing is decisive for your consent. Ordinarily, your email address is sufficient to subscribe. However, in order to provide a personalised service, I may ask for your name or further information, insofar as this is necessary for the purpose of the newsletter.

Erasure and restriction of processing: I may store unsubscribed email addresses for up to three years in order to be able to demonstrate that consent was previously given. This data processing is restricted to the defence against potential claims. Individual erasure is possible at any time, provided that the former consent is confirmed. In the case of permanent objections, I reserve the right to store your email address on a blocklist. The logging of the subscription process serves as evidence that it was carried out properly. Where I engage a service provider to send emails, I do so on the basis of my legitimate interests in an efficient and secure mailing system.

Content: Information about me, my services, promotions and offers.

Types of data processed: Master data (e.g. name, address), contact data (e.g. postal and email addresses, telephone numbers), meta, communication and procedural data (e.g. IP addresses, timestamps), usage data (e.g. page views, click paths, interactions). Data subjects: Communication partners, users (e.g. website visitors, users of online services). Purposes of processing: Direct marketing, provision of contractual services and fulfilment of contractual obligations. Legal bases: Consent (Art. 6(1)(a) GDPR).

Option to object (opt-out): You may unsubscribe from my newsletter at any time, i.e. withdraw your consent or object to receiving it in future. You will find a corresponding link at the end of every newsletter, or you may use any of the contact options listed above, preferably email.

Additional information on processing activities:

• Measurement of open and click rates: My newsletters may contain "web beacons" – pixel-sized files that are retrieved from my server when the newsletter is opened. In the process, technical information (browser, system), your IP address and the time of retrieval are recorded. This information is used to improve the newsletter technically, to tailor it to target audiences and reading behaviour (as determined by places and times of retrieval), and to establish whether and when newsletters have been opened and which links have been clicked. The information is assigned to individual newsletter recipients and stored in their profiles until erasure. These evaluations help me to understand reading habits and to adapt content accordingly.

  • Legal bases: Consent (Art. 6(1)(a) GDPR).

• Prerequisite for the use of free services: Consent to receiving mailings may be a prerequisite for the use of free services (e.g. access to certain content or promotions). Should you wish to make use of the free service without subscribing to the newsletter, please do get in touch with me.

Very well, here is the revised text, shortened and GDPR-compliant, without any mention of the privacy policy generator.

Promotional Communication via Email, Post, Fax or Telephone

I process personal data for promotional communication via various channels such as email, telephone, post or fax, always in accordance with the statutory requirements.

You have the right to withdraw any consent you have given or to object to promotional communication at any time. Following a withdrawal or objection, I store the contact data necessary to demonstrate the prior authorisation for up to three years after the end of the year in which the withdrawal or objection occurred. This storage is based on my legitimate interests (Art. 6(1)(f) GDPR) and serves solely to defend against potential claims. In order to avoid contacting you again, I also store the data required for this purpose (e.g. email address, telephone number, name) on a blocklist.

Types of data processed: Master data (e.g. name, address), contact data (e.g. email addresses, telephone numbers), content data (e.g. messages). Data subjects: Communication partners. Purposes of processing: Direct marketing, marketing, sales promotion. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Prize Draws and Competitions

I process the personal data of participants in prize draws and competitions only where this is contractually necessary for running the prize draw, where participants have given their consent, or where it serves my legitimate interests (Art. 6(1)(f) GDPR) (e.g. to protect against misuse).

Where participants' entries are published as part of prize draws (e.g. in the case of votes, presentations of entries or winners, or reporting), participants' names may also be published. You may object to this at any time.

Where the prize draw takes place on an online platform (e.g. Facebook, Instagram), that platform's terms of use and privacy policies also apply. I am responsible for the information provided in the context of the prize draw, and any enquiries regarding the prize draw should be addressed to me.

Participant data is erased as soon as the prize draw has ended and the data is no longer required to notify the winners or to respond to queries. As a rule, erasure takes place no later than six months after the end of the prize draw. Winners' data may be stored for longer in order to deal with queries or the delivery of prizes; in this case, the retention period depends on the nature of the prize (e.g. up to three years for goods or services for warranty purposes). Data may also be stored for longer for the purpose of reporting on the prize draw in the media. Where data has also been collected in the context of the prize draw for other purposes (e.g. newsletter subscription), its processing is governed by the corresponding privacy notices.

Types of data processed: Master data (e.g. name, address), contact data (e.g. email addresses, telephone numbers), content data (e.g. entries). Data subjects: Prize draw and competition participants. Purposes of processing: Running prize draws and competitions. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Surveys and Questionnaires

I conduct surveys and questionnaires in order to gather information for the respective purpose. The surveys are evaluated anonymously. Personal data is processed only where this is necessary for the provision and technical execution of the surveys (e.g. processing the IP address to display the survey in the browser or to enable you to resume it by means of a cookie).

Types of data processed: Master data (e.g. name, address), contact data (e.g. email addresses, telephone numbers), content data (e.g. responses), usage data (e.g. page views, interactions). Data subjects: Participants. Purposes of processing: Feedback, surveys and questionnaires. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Additional information on processing activities:

• Google Forms: I use Google Forms to create and evaluate online forms, surveys and feedback questionnaires.

  • Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

  • Privacy policy: https://policies.google.com/privacy

  • Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses.

Web Analytics, Monitoring and Optimisation

Web analytics (also referred to as reach measurement) serves to evaluate the flow of visitors to my online services. This may include pseudonymous information about visitors' behaviour, interests or demographic data. Through such analysis, I can, for example, identify when my online services are used most frequently and which areas require optimisation.

In addition to web analytics, I use testing procedures in order to test and improve different versions of my online services or their components.

Unless otherwise stated, user profiles may be created for these purposes and information may be stored in and read from your browser or device. The data collected includes, in particular, websites visited and elements used, as well as technical information (e.g. browser, operating system, times of use). Where you have consented to the collection of your location data, this may also be processed.

Your IP addresses are stored; however, I use an IP masking procedure (pseudonymisation by truncation) to protect your data. In the context of web analytics, A/B testing and optimisation, I generally do not store any plain data (such as email addresses or names), but rather pseudonyms. Neither I nor the providers of the software used know your actual identity, only the information stored in the user profiles.

Legal bases: Where I obtain your consent (Art. 6(1)(a) GDPR) for the use of third-party providers, this constitutes the legal basis. Otherwise, user data is processed on the basis of my legitimate interests (Art. 6(1)(f) GDPR) in efficient, economical and user-friendly services. Please also refer to the information on the use of cookies in this Privacy Policy.

Types of data processed: Usage data (e.g. page views, time spent, click paths, device types, interactions), meta, communication and procedural data (e.g. IP addresses, timestamps). Data subjects: Users (e.g. website visitors, users of online services). Purposes of processing: Reach measurement, profiles containing user-related information, provision of my online services and user-friendliness. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Cookies may be stored for up to 2 years. Security measures: IP masking (pseudonymisation of the IP address). Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Additional information on processing activities:

• Adobe Analytics:

  • Service provider: Adobe Systems Software Ireland, 4-6, Riverwalk Drive, Citywest Business Campus, Brownsbarn, Dublin 24, D24 DCW0, Ireland.

  • Legal bases: Consent (Art. 6(1)(a) GDPR).

  • Privacy policy: https://www.adobe.com/de/privacy.html

  • Basis for third-country transfers: Data Privacy Framework (DPF).

• Google Analytics: I use Google Analytics for the pseudonymous measurement and analysis of the use of my online services. The identification number does not contain names or email addresses; rather, it assigns analytical information to a device in order to identify usage patterns. The time and duration of use, the referrer and technical aspects of the device are also stored. Pseudonymous user profiles are created across devices, for which cookies may be used. Google Analytics does not log individual IP addresses for EU users. IP address data is used solely to derive approximate geographical location data on EU servers and is deleted immediately thereafter. All IP lookups for EU traffic take place on EU-based servers.

  • Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

  • Legal bases: Consent (Art. 6(1)(a) GDPR).

  • Security measures: IP masking (pseudonymisation of the IP address).

  • Privacy policy: https://policies.google.com/privacy

  • Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses.

  • Option to object (opt-out): Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=de, settings for ad personalisation: https://myadcenter.google.com/personalizationoff.

• Google Tag Manager: I use Google Tag Manager, a piece of software that allows me to manage website tags centrally. Tags are small code elements used to record and analyse visitor activity, which help me to improve my website. Google Tag Manager itself does not create user profiles and does not store cookies containing user profiles. It merely simplifies the integration and management of tools and services on my website. When it is used, users' IP addresses are transmitted to Google, which is technically necessary for implementing the services. Cookies may also be set in the process. This data processing only takes place where services are integrated via Tag Manager. Further information on these services and their data processing can be found in the corresponding sections of this Privacy Policy.

  • Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

  • Legal bases: Consent (Art. 6(1)(a) GDPR).

  • Privacy policy: https://policies.google.com/privacy

Certainly, here is the revised text, shortened and GDPR-compliant, without any mention of the privacy policy generator.

Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses.

Online Marketing

I process personal data for online marketing purposes, which includes, in particular, the placement and display of advertising and the measurement of its effectiveness.

For this purpose, user profiles are created and stored in cookies or by similar means. These profiles contain relevant information about user behaviour, such as content viewed, websites visited, online networks used, communication partners and technical details (browser, operating system, times of use, functions used). Where you have consented to the collection of your location data, this may also be processed.

Your IP addresses are stored; however, I use IP masking procedures (truncation of the IP address) to protect your data. In online marketing, no plain data (such as email addresses or names) is generally stored, but rather pseudonyms. This means that neither I nor the providers of the online marketing procedures know your actual identity, only the pseudonymous information stored in the profiles.

The information contained in the profiles is generally stored in cookies or by similar means. These cookies may later also be read, analysed and supplemented with further data on the provider's server on other websites that use the same online marketing procedure. In exceptional cases, plain data may be assigned to the profiles, for example where you are a member of a social network whose online marketing procedures I use and the network links your profiles to your plain data. Please note that you may have entered into additional agreements with the providers (e.g. by giving consent during registration).

As a rule, I receive only aggregated information about the success of my advertisements. However, by means of conversion measurement, I am able to verify which of my online marketing procedures have led to a successful outcome (e.g. the conclusion of a contract). Conversion measurement serves exclusively to analyse the success of my marketing activities.

Unless otherwise stated, the cookies used are stored for a period of up to two years.

Legal bases: Where I obtain your consent (Art. 6(1)(a) GDPR) for the use of third-party providers, this constitutes the legal basis. Otherwise, I process your data on the basis of my legitimate interests (Art. 6(1)(f) GDPR) in efficient, economical and user-friendly services. Please also refer to the information on the use of cookies in this Privacy Policy.

Information on withdrawal and objection: Please refer to the privacy notices of the respective providers and the options to object (opt-out) set out therein. Where no explicit opt-out option is provided, you may deactivate cookies in your browser settings. However, this may restrict the functionality of my online services. I additionally recommend the following overarching opt-out options:

a) Europe: https://www.youronlinechoices.eu b) Canada: https://www.youradchoices.ca/choices c) USA: https://www.aboutads.info/choices d) Cross-regional: https://optout.aboutads.info

Types of data processed: Usage data (e.g. page views, time spent, click paths, device types, interactions), meta, communication and procedural data (e.g. IP addresses, timestamps). Data subjects: Users (e.g. website visitors, users of online services). Purposes of processing: Reach measurement, tracking, audience building, marketing, profiles containing user-related information, conversion measurement. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Cookies may be stored for up to 2 years. Security measures: IP masking (pseudonymisation of the IP address). Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Additional information on processing activities:

• Google Ads and conversion measurement: I use Google Ads for online marketing in order to place content and advertisements within the Google advertising network based on potential user interests, and to measure their effectiveness (conversions). In doing so, I receive only anonymous information and no personal data of individual users.

  • Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

  • Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

  • Privacy policy: https://policies.google.com/privacy

  • Basis for third-country transfers: Data Privacy Framework (DPF).

• Google AdSense with personalised ads: I integrate Google AdSense in order to display personalised advertisements within my online services. Google AdSense analyses user behaviour in order to deliver targeted advertising, for which I receive remuneration.

  • Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

  • Legal bases: Consent (Art. 6(1)(a) GDPR).

  • Privacy policy: https://policies.google.com/privacy

  • Basis for third-country transfers: Data Privacy Framework (DPF).

• Google AdSense with non-personalised ads: I use Google AdSense to display non-personalised advertisements within my online services. These advertisements are based on general characteristics such as the page content or your approximate geographical location, rather than on individual user behaviour. I receive remuneration for this.

  • Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

  • Legal bases: Consent (Art. 6(1)(a) GDPR).

  • Privacy policy: https://policies.google.com/privacy

  • Basis for third-country transfers: Data Privacy Framework (DPF).

• LinkedIn Insight Tag: A piece of code that tracks user behaviour and conversions and stores them in a profile (e.g. to measure campaign performance, optimise advertisements or build audiences).

  • Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

  • Legal bases: Consent (Art. 6(1)(a) GDPR).

  • Privacy policy: https://www.linkedin.com/legal/privacy-policy

  • Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses.

  • Option to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Presence on Social Networks (Social Media)

I maintain online presences on social networks in order to communicate with the users active there and to provide information about myself.

Please note that user data may be processed outside the European Union in this context, which may entail risks with regard to the enforcement of your rights as a user.

Furthermore, your data on social networks is generally processed for market research and advertising purposes. Based on your usage behaviour and interests, profiles may be created which can in turn be used for targeted advertising both within and outside the networks. For this purpose, cookies are generally stored on your devices which record your usage behaviour and interests. Profiles may also store data across devices (particularly if you are a member of the platforms and are logged in).

For detailed information on the forms of processing and the options to object, please refer to the privacy policies of the respective network operators.

Requests for information and the exercise of your data subject rights can be pursued most effectively directly with the providers, as only they have access to the user data. Should you nevertheless require assistance, please do not hesitate to contact me.

Types of data processed: Contact data (e.g. email addresses, telephone numbers), content data (e.g. messages, posts), usage data (e.g. page views, interactions). Data subjects: Users (e.g. website visitors, users of online services). Purposes of processing: Communication, feedback, public relations. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Additional information on processing activities:

• Instagram: Social network for sharing photos and videos, commenting, sending messages and following profiles.

  • Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

  • Privacy policy: https://privacycenter.instagram.com/policy/

  • Basis for third-country transfers: Data Privacy Framework (DPF).

• LinkedIn: Social network. Together with LinkedIn Ireland Unlimited Company, I am jointly responsible for the collection of data from visitors to my LinkedIn profiles, which is used to create "Page Insights" (statistics). This data includes information about content, interactions, devices used (IP addresses, operating system, browser, language settings, cookie data) as well as details from user profiles (job function, country, industry, seniority, company size, employment status). Detailed privacy information can be found in LinkedIn's privacy notice: https://www.linkedin.com/legal/privacy-policy. I have concluded an agreement with LinkedIn Ireland ("Page Insights Joint Controller Addendum"), which governs security measures and the fulfilment of data subject rights. Your rights are not restricted by this. Joint responsibility is limited to the collection of data and its transfer to LinkedIn Ireland Unlimited Company. Any further processing is the sole responsibility of LinkedIn Ireland Unlimited Company.

  • Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

  • Privacy policy: https://www.linkedin.com/legal/privacy-policy

  • Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses.

  • Option to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

• Xing: Social network.

  • Service provider: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.

  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

  • Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

Plug-ins and Embedded Functions and Content

I integrate functional and content elements (e.g. graphics, videos, city maps) from third-party providers into my online services. Such integration requires the third-party providers to process your IP address in order to send the content to your browser. I endeavour to use only content whose providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use pixel tags (invisible graphics) for statistical or marketing purposes. These pixel tags can be used to evaluate information about visitor traffic on my website. The pseudonymous information may also be stored in cookies on your device and may contain technical information about the browser, operating system, referring websites, time of visit and other usage data, and may be linked with information from other sources.

Legal bases: Where I obtain your consent (Art. 6(1)(a) GDPR) for the use of third-party providers, this constitutes the legal basis. Otherwise, I process your data on the basis of my legitimate interests (Art. 6(1)(f) GDPR) in efficient, economical and user-friendly services. Please also refer to the information on the use of cookies in this Privacy Policy.

Types of data processed: Usage data (e.g. page views, time spent, click paths, device types, interactions), meta, communication and procedural data (e.g. IP addresses, timestamps). Data subjects: Users (e.g. website visitors, users of online services). Purposes of processing: Provision of my online services and user-friendliness. Retention and erasure: In accordance with the information provided in the section "General Information on Data Retention and Erasure". Cookies may be stored for up to 2 years. Legal bases: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Additional information on processing activities:

• Integration of third-party software, scripts or frameworks (e.g. jQuery): I integrate software from other providers' servers (e.g. function libraries for the display or user-friendliness of my online services). In doing so, the providers collect your IP address and may process it in order to deliver the software to your browser, as well as for the security, evaluation and optimisation of their services.

  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

• Google Fonts (hosted on my own server): I host font files on my own server in order to ensure a user-friendly presentation of my online services. No data is transmitted to Google in this process.

  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

• Google Fonts (retrieved from Google servers): I obtain fonts (and icons) from Google servers for technically secure, maintenance-free and efficient use (up-to-dateness, loading times, consistent display, licensing restrictions). Your IP address is communicated to the font provider so that the fonts can be made available in your browser. Technical data (language settings, screen resolution, operating system, hardware used) necessary for providing the fonts is also transmitted. This data may be processed on a server belonging to the provider in the USA. According to its own statements, Google Fonts itself does not log or store IP addresses, nor does it analyse them. According to its own statements, Google does not use the information collected by Google Fonts to create profiles of end users or for targeted advertising.

  • Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

  • Privacy policy: https://policies.google.com/privacy

  • Basis for third-country transfers: Data Privacy Framework (DPF).

Amendments and Updates

I shall keep you regularly informed of the content of my Privacy Policy. I will amend it as soon as changes to the data processing I carry out make this necessary. Should any changes require your involvement (e.g. consent) or an individual notification, I shall inform you separately.

Please note that the addresses and contact details of companies and organisations provided in this Privacy Policy may change. I would therefore kindly ask you to verify this information before getting in touch.

Definitions of Terms

This section provides an overview of the terms used in this Privacy Policy. Terms defined by law retain their legal meaning; the following explanations are intended primarily to aid understanding.

• Master data: Essential information for the identification and management of contractual partners, user accounts and profiles. This includes personal and demographic details such as names, contact details (addresses, telephone numbers, email addresses), dates of birth and identifiers (user IDs). It forms the basis for formal interactions.

• Content data: Information generated in the course of creating, editing and publishing content (texts, images, videos, audio files). This also includes metadata such as tags, descriptions, author information and publication dates.

• Contact data: Information that enables communication with individuals or organisations, e.g. telephone numbers, postal addresses, email addresses, social media handles and instant messaging identifiers.

• Conversion measurement: A procedure for determining the effectiveness of marketing activities. Typically, a cookie is stored on users' devices on the marketing websites and read again on the target website, for example in order to track the success of advertisements.

• Meta, communication and procedural data: Information about the processing, transmission and management of data. Metadata describes the context, origin and structure of other data (e.g. file size, creation date). Communication data records the exchange of information (e.g. emails, call logs, messages), including the parties involved and timestamps. Procedural data describes processes and sequences (e.g. workflows, transaction logs) for tracking purposes.

• Usage data: Information about how users interact with digital products, services or platforms (e.g. functions used, time spent, navigation paths, frequency of use, timestamps, IP addresses, device information, location data). It is valuable for analysing user behaviour, optimisation, personalisation and trend analysis.

• Personal data: Any information relating to an identified or identifiable natural person. A person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier (name, number, location data, online identifier such as a cookie) or to specific characteristics (physical, physiological, genetic, mental, economic, cultural or social identity).

• Profiles containing user-related information (profiles): Any automated processing of personal data intended to analyse, evaluate or predict personal aspects of a natural person (demographics, behaviour, interests, interaction with content) (e.g. interest in products, click behaviour, whereabouts). Cookies and web beacons are frequently used for this purpose.

• Log data: Information about events or activities recorded in a system or network (e.g. timestamps, IP addresses, user actions, error messages). It is used to analyse system problems, for security monitoring and for performance logging.

• Reach measurement: Analysis of the flow of visitors to an online service, including their behaviour or interests. It helps to identify times of use and popular content in order to tailor the service accordingly. Pseudonymous cookies and web beacons are often used to recognise returning visitors.

• Server monitoring and error detection: Measures to ensure the availability and integrity of my online services. Performance, load and technical values are processed in order to monitor stability and, in the event of errors, to identify and resolve their causes.

• Tracking: Following user behaviour across multiple online services. Information on behaviour and interests is generally stored in cookies or on the tracking providers' servers (profiling) in order to display advertising to users that is likely to match their interests.

• Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

• Processing: Any operation or set of operations performed on personal data, whether or not by automated means (e.g. collection, evaluation, storage, transmission, erasure). The term is very broad in scope.

• Contract data: Specific information relating to the formalisation of an agreement between parties, documenting the terms of services, products or sales. This includes the start and end of the contract, services, prices, payment terms, termination rights and special clauses. It serves as a legal basis.

• Payment data: All information required to process payment transactions (e.g. credit card numbers, bank details, amounts, transaction data, verification numbers, invoice information, payment status, chargebacks, authorisations and fees).

• Audience building: The determination of target audiences for advertising purposes (e.g. "Custom Audiences" based on interest in specific products, or "Lookalike Audiences" for users with similar interests). Cookies and web beacons are generally used for this purpose.