Disclaimer

j) Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on our websites. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

reCAPTCHA is used to check whether data entry on our websites (e.g., in a contact form) is made by a human or by an automated program. To do this, reCAPTCHA analyzes the website visitor’s behavior based on various characteristics. This analysis starts automatically as soon as the website visitor enters the website. For the analysis, reCAPTCHA evaluates various information (e.g., IP address, dwell time of the website visitor on the website, or mouse movements made by the user). The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyses run completely in the background. Website visitors are not notified that an analysis is taking place.

The use of Google reCAPTCHA is based exclusively on your express consent pursuant to Article 6 Paragraph 1 Letter a GDPR. You can revoke your consent at any time with effect for the future. Revocation does not affect the lawfulness of processing that has taken place up to that point.

Further information on Google reCAPTCHA and Google’s Privacy Policy can be found at the following links:
https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/intro/android.html.

k) Instagram

We maintain a company presence on the Instagram platform, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Additionally, Instagram functions may be integrated on our website (e.g., social plugins, embedded posts, images, or videos).

Processing occurs to:

• Communicate with users, prospects, and business partners

• Present our company, products, and services

• Obtain reach analyses and statistical evaluations

• Evaluate interactions (e.g., likes, comments, profile views)

When you visit our Instagram page or use Instagram plugins, Instagram processes personal data to provide the platform and analyze user behavior.

Depending on usage, the following data may be processed:

• Profile data (e.g., name, username, interests, follower information)

• Communication content (e.g., messages, comments, interactions)

• Technical data (e.g., IP address, browser information, device information)

• Location data (if shared)

• Data about your user behavior on Instagram and linked pages

If you are logged into Instagram, Instagram can assign your behavior to your profile.

Processing is based on:

• Article 6 Paragraph 1 Letter f GDPR (legitimate interest) – Our interest lies in professional external presentation and communication.

• Article 6 Paragraph 1 Letter a GDPR, if you activate Instagram plugins on our website or use consent-required functions.

For processing so-called Insights data, there is joint controllership between us and Meta pursuant to Article 26 GDPR. Meta assumes primary responsibility for data processing on the platform.

Further information on Instagram Insights: https://www.facebook.com/legal/terms/information_about_page_insights_data

Instagram may transfer data to the USA or other third countries. The transfer is based on:

• EU standard contractual clauses (SCC)

• Additional security measures by Meta

You can adjust your privacy settings directly on Instagram: https://www.instagram.com/accounts/privacy_and_security/

If you do not want Instagram to collect data about you, you should log out of your Instagram account and delete cookies before visiting our Instagram page.

Instagram’s Privacy Policy can be found at: https://privacycenter.instagram.com/policy

l) OpenStreetMap

We use map material from the OpenStreetMap (OSM) service on our website, provided by the OpenStreetMap Foundation (OSMF). The maps serve to display locations, routes, or geographic information. The use is based on our legitimate interest in an appealing presentation of our online offerings pursuant to Article 6 Paragraph 1 Letter f GDPR.

When calling a page containing an OSM map, the following data may be processed:

• User’s IP address

• Browser and device data

• Date and time of access

• Referrer URL (previously visited page)

• Usage data (e.g., zoom level, map movements)

This data is transmitted directly to servers of the OpenStreetMap Foundation.

OSM may set cookies to:

• Enable map display

• Store user settings (e.g., zoom level)

Since OSMF servers may be operated outside the EU, transfer to third countries is possible. The OSMF commits to compliance with European data protection standards.

Further information on data processing by the OpenStreetMap Foundation can be found in the privacy policy at: https://wiki.osmfoundation.org/wiki/Privacy_Policy

m) Cloudflare Turnstile

We use Cloudflare Turnstile on our website, a service of Cloudflare, Inc., to secure forms and prevent spam and bot requests. Turnstile serves as a privacy-friendly alternative to traditional CAPTCHA systems and enables verification of whether an input originates from a human or an automated system.

The use is based on our legitimate interest pursuant to Article 6 Paragraph 1 Letter f GDPR in ensuring the security of our website and protection against abusive access and spam, as well as Article 6 Paragraph 1 Letter a GDPR if Turnstile is used within a form that loads additional tracking or marketing services (in this case, activation occurs only after consent).

Cloudflare Turnstile is designed to process as few personal data as possible. Nevertheless, the following data may be collected during use:

IP address (shortened or complete, depending on region and Cloudflare configuration)

Browser and device information

• Browser type and version

• Operating system

• Screen resolution

• Language settings

Usage data

• Mouse movements or interactions (not used for profiling)

• Timestamp

• Referrer URL

Technical telemetry data

• Information about the connection to the Cloudflare network

• Security-relevant signals for bot detection

Cloudflare states that Turnstile does not use personal data for advertising purposes and does not set tracking cookies.

Cloudflare may transfer data to the USA or other third countries. Cloudflare is certified under the EU-US Data Privacy Framework and additionally implements standard contractual clauses pursuant to Article 46 GDPR to ensure an adequate level of data protection.

Processing occurs exclusively for the following purposes:

• Protection against automated attacks and spam

• Ensuring the functionality of forms

• Improving website security

No profiling takes place.

Further information on data processing by Cloudflare can be found in the official privacy policy:
https://www.cloudflare.com/privacypolicy/

n) Vimeo

We embed videos from the provider Vimeo on our website. Vimeo is a service of Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA. The embedding is used to present video content in an appealing and performant manner. This constitutes a legitimate interest within the meaning of Article 6 Paragraph 1 Letter f GDPR. If consent is obtained via a consent tool, Article 6 Paragraph 1 Letter a GDPR serves as the legal basis.

When accessing a page containing an embedded Vimeo video, a connection to the Vimeo servers is established. The following data may be processed in this process:

• User’s IP address

• Browser and device information

• Date and time of access

• Referrer URL (the previously visited page)

• Usage data (e.g., starting, pausing, or playing the video)

• Cookies and similar technologies, if you permit them in the consent banner

Vimeo can link this data with other services, particularly if you have a Vimeo account and are logged in.

Vimeo sets various cookies to:

• Enable video playback

• Store user interactions

• Create statistical evaluations

If you reject tracking or marketing cookies in the consent banner, Vimeo videos are loaded only after your active consent (e.g., by clicking on a placeholder graphic).

As Vimeo is a US provider, personal data may be transferred to the USA. Vimeo relies on standard contractual clauses pursuant to Article 46 GDPR to ensure an adequate level of data protection.

Further information on data processing by Vimeo can be found in the official privacy policy:
https://vimeo.com/privacy

o) X (formerly Twitter)

We maintain a company presence on the X platform (formerly Twitter), operated by X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. Additionally, X functions may be integrated on our website (e.g., tweet embeddings, share buttons, or social plugins).

Processing occurs to:

• Communicate with users, prospects, and business partners

• Present our company, products, and services

• Obtain reach analyses and statistical evaluations

• Evaluate interactions (e.g., likes, reposts, comments, profile views)

When you visit our X page or use X plugins, X processes personal data to provide the platform and analyze user behavior.

Depending on usage, the following data may be processed:

• Profile data (e.g., username, name, interests, follower information)

• Communication content (e.g., messages, comments, interactions

• Technical data (for example IP address, browser information, device information)

• Location data (if shared)

• Data about your user behaviour on X and linked pages

• If you are logged in to X, X can associate your behaviour with your profile.

  Processing is based on:

  • Article 6 paragraph 1 letter f GDPR (legitimate interest) – our interest lies in a professional external presentation and communication.

  • Article 6 paragraph 1 letter a GDPR, insofar as you activate X plugins on our website or use functions requiring consent.

  X may transfer data to the USA or other third countries. The transfer is based on:

  • EU standard contractual clauses (SCC)

  • Additional security measures implemented by X

  As X is a US‑based company, it cannot be ruled out that US authorities may gain access to the data.

  You can adjust your privacy settings directly on X:
  https://twitter.com/settings/privacy

  If you do not want X to collect data about you, you should log out of your X account and delete cookies before visiting our X page.

  X’s Privacy Policy can be found at:
  https://twitter.com/privacy

  p) YouTube

  Our website uses components of the YouTube video portal, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you access a page containing an embedded YouTube video, a connection to YouTube’s servers is established.

  When loading a YouTube video, the following data may be processed depending on settings and your user behaviour:

  • IP address of the accessing device

  • Information about the browser and operating system used

  • Page of our website accessed

  • Date and time of access

  • Cookies and similar technologies, if you have permitted them

  • If you are logged into your Google account: Attribution of your surfing behaviour to your personal profile

  YouTube or Google may use this data for its own purposes such as profile building, market research, or personalised advertising.

  The embedding is based on Article 6 Paragraph 1 Letter a GDPR, provided you have consented to the use (e.g., via a cookie banner or consent management platform). Without your consent, YouTube content will not be loaded.

  Google may also transfer personal data to the USA. The transfer is subject to the protection mechanisms implemented by Google in accordance with GDPR.

  Further information on data processing by YouTube can be found in Google’s Privacy Policy:
  https://policies.google.com/privacy

  We use YouTube in extended data protection mode where available. According to YouTube, this results in less data being transferred to Google before you actively play the video. Nevertheless, data transfer cannot be completely ruled out.

  9. Collection and Storage of Personal Data and Their Nature and Purpose of Use

  a) During Website Visit

  When you access our website, information is automatically sent to the server of our website by the browser used on your end device. This information is temporarily stored in what is known as a log file. To improve the quality of our website, the following information is therefore collected without your intervention and stored until automatic deletion:

  • IP address of the requesting computer

  • Date and time of access

  • Name and URL of the retrieved file

  • Website from which access is made (referrer URL)

  • Browser used and, if applicable, the operating system of your computer as well as the name of your access provider

  These data cannot be attributed to specific persons. No merging of this data with other data sources takes place.

  b) Contact via Email, Phone or Fax

  If you contact us by email, telephone, or fax, your inquiry including all personal data resulting from it (name, inquiry) will be stored and processed by us for the purpose of processing your request. We do not pass on this data without your consent.

  Processing of this data is based on Article 6 GDPR. The content of your inquiry determines which legal basis for data processing applies.

  The data you send us via contact requests remain with us until you ask us to delete it, revoke your consent to storage, or the purpose for data storage no longer applies (e.g., after your request has been fully processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

  c) Use of Our Contact Form

  If you send us inquiries via the contact form, your details from the inquiry form including the contact details you provided there will be stored by us for the purpose of processing the inquiry and for follow-up questions. We do not pass on this data without your consent.

  The legal basis for processing the data entered into the contact form is our legitimate interest in processing your inquiry pursuant to Article 6 Paragraph 1 Sentence 1 Letter f GDPR. If your contact aims at concluding a contract, the legal basis for processing is Article 6 Paragraph 1 Sentence 1 Letter b GDPR. Processing of voluntary data entered into the contact form is based on your consent pursuant to Article 6 Paragraph 1 Sentence 1 Letter a GDPR. You can revoke this consent at any time. A simple notification by email to us is sufficient. The lawfulness of data processing operations carried out until revocation remains unaffected by the revocation.

  When submitting the form, the following data is also stored: your IP address, date and time of submission. The legal basis for this is our legitimate interest pursuant to Article 6 Paragraph 1 Sentence 1 Letter f GDPR. We have a legitimate interest in preventing or proving abuse of our contact form.

  The data will be deleted as soon as it is no longer required for the purpose for which it was collected and statutory retention obligations do not preclude deletion.

  d) Use of Borlabs Cookie

  We use the consent management tool Borlabs Cookie from provider Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg, on our website to obtain your consent for the use of third-party services and storage of certain cookies in your browser and to document this in a data protection-compliant manner.

  When you enter our website, a cookie is stored in your browser in which the consents you have given or the revocation of these consents are stored. This data is not forwarded to the Borlabs Cookie provider. You can change the cookie settings at any time via the button at the bottom left on every page.

  The collected data will be stored until you request us to delete it or delete the Borlabs Cookie itself or the purpose for data storage no longer applies. Mandatory statutory retention periods remain unaffected. Details on data processing by Borlabs Cookie can be found at https://de.borlabs.io/kb/welche-daten-speichert-borlabs-cookie/.

  The use of Borlabs Cookie is based on Article 6 Paragraph 1 Sentence 1 Letter c GDPR to obtain the legally required consents for the use of cookies and other technologies.

   

  e) Register for the Webcast

   

  Processing of Personal Data in the Context of Webcasts via Microsoft Teams

  Subject Matter of Processing
  In the course of conducting webcasts via the “Microsoft Teams” platform, we process personal data of participants to the extent necessary for the preparation, execution, follow-up, and documentation of the event.

   

  Categories of Personal Data
  (1) For registration and participation in the webcast, the following personal data are collected and processed:

  • First name,

  • Last name,

  • Organization / Company,

  • Position / Function,

  • E-mail address,

  • Consent to the privacy policy.

  (2) During participation in the webcast, the following data may additionally be processed:

  • Technical usage and metadata (e.g., participation time, technical log data),

  • Chat or question contributions from participants, if actively used,

  • Visibility in the participant list (accessible exclusively to speakers and moderators),

  • Image and audio data of the speakers.

  (3) Participants’ cameras are disabled by default. No processing of participants’ image data occurs.

   

  Recording and Publication
  (1) The webcast is fully recorded. The recording includes, in particular, presentation content, image and audio recordings of speakers, and displayed content.
  (2) The recording is further processed and provided for the following purposes:

  • Sending to registered participants via e-mail,

  • Publication on our YouTube channel,

  • Publication on our website.
    (3) The legal basis for the recording and publication is

  • Consent pursuant to Art. 6(1)(a) GDPR or, where applicable,

  • Our legitimate interest pursuant to Art. 6(1)(f) GDPR in external presentation, knowledge transfer, and documentation.

   

  Use of Data for Marketing Purposes
  (1) Following the webcast, the provided contact details may be used to inform participants about related offers, events, or information.
  (2) Processing occurs exclusively on the basis of consent pursuant to Art. 6(1)(a) GDPR or – where legally permissible – on the basis of our legitimate interest in direct marketing pursuant to Art. 6(1)(f) GDPR.
  (3) Objection to use for marketing purposes is possible at any time.

   

  Use of Microsoft Teams
  (1) For conducting the webcast, we use the “Microsoft Teams” service provided by Microsoft Corporation (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland).
  (2) Processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.
  (3) In connection with volume licensing and program agreements, data protection regulations are established with Microsoft to ensure data security. These regulations (Online Services Terms (OSTs) and Data Protection Addendum for Online Services (DPA)) include, among others, EU Standard Contractual Clauses and further GDPR provisions (https://www.microsoft.com/de-de/licensing/product-licensing/products.aspx).

  (4) Microsoft processes data in accordance with European data protection standards. Further information on Microsoft’s data protection is available at: https://privacy.microsoft.com/de-de/privacystatement.

  (5) If you log in with an existing Microsoft account, the agreements between you and Microsoft apply.

  The controller may transmit personal data to courts, supervisory authorities, or law firms where a legal obligation exists pursuant to Art. 6(1)(c) GDPR or where necessary pursuant to Art. 6(1)(f) GDPR for the assertion, exercise, or defense of legal claims, and no reason exists to assume that participants have an overriding legitimate interest in not disclosing the data.

  (6) Transmission of your provided data to a third country or international organization cannot be ruled out, as Microsoft is an international company headquartered in the USA, and access from the USA or other third countries for maintenance or support services may occur. Furthermore, U.S. authorities may legally access personal data on Microsoft’s systems without our or your knowledge.
  Microsoft Corporation holds certification under the “EU-US Data Privacy Framework” (DPF). The list of certified companies is available at https://www.dataprivacyframework.gov/list, where you can search for the provider and view the certification directly.

   

  Technical and Organizational Security Measures
  We implement appropriate technical and organizational measures pursuant to Art. 32 GDPR to ensure the security of processed personal data. These include, in particular:

  • Encrypted data transmission,

  • Role-based access restrictions for moderators and administrators,

  • Secure storage of recordings,

  • Regular review and updating of IT security measures,

  • Data-minimizing configuration of the webcast environment.

   

  Storage Duration
  (1) Personal data are stored only as long as necessary for conducting the webcast, providing the recording, or fulfilling legal retention obligations.
  (2) Consents may be revoked at any time with effect for the future.

   

  10. Download Remote Support

  By clicking ‘Download Remote Support’, our client application for installing AnyDesk is downloaded to your computer. XTRAS forward thinking does not collect any personal data in this process. Only connection IDs are stored for the purpose of efficient connection between the client and server.

  Data protection information on the use of AnyDesk can be found at the following link: https://anydesk.com/de/datenschutz

  11. Rights of Data Subjects in General

  When processing your personal data, the GDPR grants you the following rights as a website user:

  a) Right of Access (Article 15 GDPR)

  You have the right to request confirmation as to whether personal data concerning you is being processed; if so, you have the right to access this personal data and the information specified in detail in Article 15 GDPR.

  b) Right to Rectification and Erasure (Articles 16 and 17 GDPR)

  You have the right to request immediate rectification of inaccurate personal data concerning you and, if necessary, completion of incomplete personal data. You also have the right to request erasure of personal data concerning you without undue delay if one of the reasons specified in detail in Article 17 GDPR applies, for example if the data is no longer needed for the purposes pursued.

  c) Right to Restriction of Processing (Article 18 GDPR)

  You have the right to request restriction of processing if one of the prerequisites specified in Article 18 GDPR is met, for example if you have objected to processing pursuant to Article 21 GDPR, for the duration of any examination as to whether our legitimate interests override yours.

  d) Right to Data Portability (Article 20 GDPR)

  In certain cases specified in detail in Article 20 GDPR, you have the right to receive personal data concerning you in a structured, common, and machine-readable format or to request transmission of this data to a third party.

  e) Right to Object (Article 21 GDPR)

  If data is collected based on Article 6 Paragraph 1 Sentence 1 Letter f GDPR (data processing for legitimate interests), you have the right to object at any time to processing on grounds relating to your particular situation. We will then no longer process the personal data unless there are demonstrably compelling legitimate grounds for processing that override your interests, rights, and freedoms, or processing serves the establishment, exercise, or defense of legal claims.

  f) Right to Withdraw Consent (Article 7 Paragraph 3 GDPR)

  If data is processed based on your consent pursuant to Article 7 GDPR, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent carried out until withdrawal.

  g) Right to Lodge a Complaint with a Supervisory Authority

  Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that processing of personal data concerning you infringes data protection provisions. The right to lodge a complaint may in particular be exercised with a supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged infringement.

  12. Existence of Automated Decision-Making/Profiling

  We do not engage in automated decision-making or profiling.

  13. Changes and Updates to This Privacy Policy

  We reserve the right to change or supplement this Privacy Policy at any time to ensure it always complies with current legal requirements or to implement changes to our services in the Policy. The respective updated version will apply on your subsequent visit. We therefore recommend that you read this Privacy Policy regularly.