Data Privacy Information for Social Media Presences

Further data privacy information can be found here:

General Privacy Policy
Data Privacy Information for Customers, Suppliers, Business Partners and Prospective Business Contacts

We, plicatec business development GmbH, Jechtinger Straße 11, 79111 Freiburg, Germany (hereinafter also referred to as “we”, “us” or “plicatec”), would like to provide you with the following information on the processing of your personal data (hereinafter also referred to as “data”) in connection with the use of our presences on the social media platforms (hereinafter collectively referred to as “social media presences”) Facebook, YouTube, LinkedIn and Xing (hereinafter collectively referred to as “social media platforms”), available at

https://www.facebook.com/plicatec
https://www.youtube.com/@plicatecbusinessdevelopmen2685
https://www.linkedin.com/company/plicatec-gmbh/
https://www.xing.com/pages/plicatecbusinessdevelopmentgmbh

as well as about the legal bases and purposes of this processing and your rights under data protection law.

We take the protection of your personal data very seriously. Your data is processed exclusively in accordance with the applicable data protection regulations, in particular the provisions of the European General Data Protection Regulation (hereinafter: “GDPR”), the German Federal Data Protection Act (hereinafter: “BDSG”) and the German Telecommunications Digital Services Data Protection Act (hereinafter: “TDDDG”) (hereinafter collectively referred to as “data protection laws”).

This data privacy information applies only to the social media presences operated by us as listed above. In particular, the following information does not apply to third-party social media presences or websites of other providers that may be linked from our social media presences.

For reasons of readability, the generic feminine form is used below. Male and all other gender identities are expressly included and referred to equally.

Please note that the terms used, such as “personal data” or “processing”, correspond to the definitions in Article 4 GDPR. If you wish to review the GDPR yourself, you can find it online at: http://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32016R0679. The BDSG can be accessed at https://www.gesetze-im-internet.de/bdsg_2018/; the TDDDG can be found here: https://www.gesetze-im-internet.de/ttdsg/.

Information on the Controller

The controller within the meaning of the GDPR responsible for processing your data is:

plicatec business development GmbH
Jechtinger Straße 11
D-79111 Freiburg

Email: plicatec@plicatec.com
Phone: +49 (0)761 – 21684 0

If you have any questions regarding the processing of your data or wish to exercise your rights as a data subject, please contact us using the contact details provided above.

You may also contact our Data Protection Officer directly. You can reach the Data Protection Officer by email at dsb@plicatec.com or using the following contact details:

V-Formation GmbH
Daniel Nübling
Stephanienstraße 18
76133 Karlsruhe

Email: dsb@plicatec.com
Phone: +49 (0)155 60 79 89 59

In addition to us, the providers of the respective social media platforms are also controllers responsible for data processing on our respective social media presence. These are as follows:

For our Facebook, Instagram and Threads presences: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter also referred to as “Meta Ireland”). Your respective use of the Facebook, Instagram and Threads platforms and the respective data processing by Meta Ireland are primarily governed by the terms of use (https://de-de.facebook.com/legal/terms/, https://help.instagram.com/581066165581870 and https://help.instagram.com/769983657850450) and the privacy policies (https://de-de.facebook.com/about/privacy, https://help.instagram.com/581066165581870 and https://help.instagram.com/515230437301944) of Meta Ireland.

For our YouTube presence: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter also referred to as “Google Ireland”). Your use of the YouTube platform and the processing of data by Google Ireland are primarily governed by the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Privacy Policy (https://policies.google.com/privacy) of Google Ireland.

For our LinkedIn presence: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter also referred to as “LinkedIn Ireland”). Your use of the LinkedIn platform and the processing of data by LinkedIn Ireland are primarily governed by the User Agreement (https://www.linkedin.com/legal/user-agreement) and the Privacy Policy (https://www.linkedin.com/legal/privacy-policy) of LinkedIn Ireland.

For our Xing presence: New Work SE, Am Strandkai 1, 20457 Hamburg, Germany (hereinafter also referred to as “Xing”). Your use of the Xing platform and the processing of data by Xing Work SE are primarily governed by the General Terms and Conditions (https://www.xing.com/terms) and the Data Privacy Information (https://privacy.xing.com/de/datenschutzerklaerung) of Xing Work SE.

(hereinafter collectively also referred to as “providers of the social media platforms”)

Where applicable, we are jointly responsible with the respective provider of the social media platform for data processing in connection with the use of our social media presences. Joint controllership within the meaning of the GDPR exists in particular

with Meta Ireland in connection with the use of statistical information, such as information on likes, clicks and reach on our Facebook, Instagram and Threads presences (so-called “Page Insights”). We have concluded a joint controllership agreement with Meta Ireland regulating our respective obligations under the GDPR. It can be accessed at https://www.facebook.com/legal/controller_addendum. Further information on the “Page Insights” function and the essential content of our agreement with Meta Ireland can be found in Section 6;
with LinkedIn Ireland in connection with the use of statistical information, such as information on likes, clicks and reach on our LinkedIn presence (so-called “LinkedIn Analytics”). We have concluded a joint controllership agreement with LinkedIn Ireland regulating our respective obligations under the GDPR. It can be accessed at https://legal.linkedin.com/pages-joint-controller-addendum. Further information on the “LinkedIn Analytics” function and the essential content of our agreement with LinkedIn Ireland can be found in Section 6.

General Information

Our social media presences can in some cases be used without registering with the respective social media platform. Even if you use the respective social media platform without registering, personal data may be processed.

We operate our social media presences to provide you with information about our company and our activities and to enable direct communication between you and us.

In principle, we have no influence on the collection of data and the further use of data processed by the providers of the social media platforms. We are unable to determine or influence the extent to which, where and for how long the data is stored, the extent to which the providers of the social media platforms comply with their deletion obligations, what analyses and links are made with the data, or to whom the data is disclosed.

We would like to point out that the providers of the social media platforms may process data relating to users registered with the respective social media platform and visitors to the respective social media platform, such as IP addresses, cookies, etc., including outside the European Union (EU) or European Economic Area (EEA, EU Member States plus Iceland, Liechtenstein and Norway), and may also use such data for their own purposes.

Contact via Social Media Presences

You may contact us directly via our social media presences, for example by personal message or messenger. In this case, the data you provide in the respective message (e.g. name, email address, etc.) is processed for the purpose of receiving and, where applicable, responding to your enquiry and may be transferred to our systems. Please refrain from sending us sensitive information, such as health data, application documents, bank details or credit card data, via our social media presences. For such information, we recommend using a secure transmission method, such as postal mail or sufficiently encrypted email.

Where the purpose is to initiate a contractual relationship, the data you provide to us in connection with your direct contact is processed on the basis of Article 6(1)(b) GDPR. Where you have given us your consent to data processing, for example via a contact form provided by us, the data processing is based on Article 6(1)(a) GDPR. Otherwise, data provided by you in connection with direct contact is processed for the purposes of our legitimate interests on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in properly handling contact enquiries voluntarily addressed to us.

You may withdraw any consent you have given at any time without giving reasons, with effect for the future and without suffering any disadvantage. The lawfulness of processing carried out before the withdrawal of consent remains unaffected. Where data processing is carried out for the purposes of our legitimate interests pursuant to Article 6(1)(f) GDPR, you may object to such processing at any time in accordance with the GDPR. Please send an appropriate email to dsb@plicatec.com.

User Interactions

Facebook

In accordance with the functionality of a social media platform, we may become aware of users who interact with our Facebook, Instagram and/or Threads presence or with our posts on the respective social media presence, for example by liking, rating, commenting on or sharing them, provided that you have made your interactions on the respective social media platform public and have not expressly marked them as “private”. Where you have consented to this in advance, we may evaluate this information in aggregated form, for example by means of the Page Insights function (see Section 6), in order to provide you with more relevant content that may be of greater interest to you. The information obtained in this way does not allow us to identify a specific individual.

Your data is processed for the purposes of our legitimate interests on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in communicating with you as a user/visitor and, where applicable, carrying out marketing activities on the respective social media presence. Where you have given us your consent to the use of the Page Insights function, your data is also processed on the basis of Article 6(1)(a) GDPR.

As a user, you have the option in your Facebook profile to actively hide, for example, your “posts”, “likes” or “subscriptions” or to stop following our presence on the respective social media platform. You will then no longer appear in the list of subscribers to our respective social media presence.

As a user, you can use the advertising preference settings of the Facebook platform (https://de-de.facebook.com/ads/preferences) to control the extent to which your usage behaviour may be collected and used by Meta Ireland.

YouTube

In accordance with the functionality of a social media platform, we may become aware of users who interact with our YouTube presence or with our posts on it, for example by liking, rating, commenting on or sharing them. We may evaluate this information in aggregated form in order to provide you with more relevant content that may be of greater interest to you. The information obtained in this way does not allow us to identify a specific individual.

Your data is processed for the purposes of our legitimate interests on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in the commercial operation, optimisation and usage analysis of our YouTube presence as well as in communicating with you as a user/visitor and, where applicable, carrying out marketing activities on our YouTube presence.

As a user, you have the option in your YouTube profile to mark, for example, your uploaded videos, created playlists and subscriptions as “private”, so that they cannot be viewed by other users. You can also decide to stop following our YouTube presence. You will then no longer appear in the list of subscribers to our YouTube presence.

In accordance with the functionality of a social media platform, we may become aware of users who interact with our LinkedIn presence or with our posts on it, for example by liking, rating, commenting on or sharing them. We may evaluate this information in aggregated form, for example by means of the LinkedIn Analytics function (see Section 6), in order to provide you with more relevant content that may be of greater interest to you. The information obtained in this way does not allow us to identify a specific individual.

Your data is processed for the purposes of our legitimate interests on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in communicating with you as a user/visitor and, where applicable, carrying out marketing activities on our LinkedIn presence. Where you have given us your consent to the use of LinkedIn Analytics, your data is also processed on the basis of Article 6(1)(a) GDPR.

As a user of the LinkedIn platform, you may stop following our LinkedIn presence at any time. You may also deactivate your consent to the use of LinkedIn Analytics at any time with effect for the future.

Xing

In accordance with the functionality of a social media platform, we may become aware of users who interact with our Xing presence or with our posts on it, for example by liking, rating, commenting on or sharing them.

As a user of the Xing platform, you may stop following our Xing presence at any time.

Cookies

The providers of the social media platforms use cookies and similar technologies, generally small identifiers stored on your terminal device (hereinafter collectively referred to as “cookies”), among other things to provide you with a comprehensive range of functions, make the platforms more convenient to use and optimise their services. Data obtained by means of cookies is collected and processed directly by the providers of the social media platforms. Cookies may be stored on your terminal device and/or cookies already stored on your terminal device may be read. Data obtained by means of cookies is collected and processed directly by the providers of the social media platforms. plicatec has no access to this data and no influence on how the providers of the social media platforms use it.

The social media providers use both so-called session cookies, which are stored only temporarily during a visit to the respective social media platform, and so-called persistent cookies, which may be stored on your terminal device for several weeks or months. These cookies are set regardless of whether you have a user account for the respective social media platform or are logged into an existing user account at the time of your visit.

The information obtained by means of cookies may be used by the providers of the social media platforms within the respective social media platform as well as in other social media services and third-party services that use the social media services to create user profiles for market research and advertising purposes. In particular, your usage behaviour and the interests derived from it may be taken into account. In this context, the providers of the social media platforms may enable third parties to use this data to display advertising both within and outside the respective social media platform. If you use the respective social media platform on several terminal devices, collection and evaluation may also take place across devices, particularly if you are logged in as a user.

Facebook

Further information on the nature, scope, purposes, legal bases and options for objecting to the use of cookies by Meta Ireland can be found in Facebook’s Cookie Policy (https://de-de.facebook.com/policies/cookies).

According to Meta Ireland, non-essential cookies (also referred to as “optional cookies”) are stored and used only where you have given your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. This may in particular apply to third-party cookies used, for example, in connection with personalised advertising or analytics and the provision of certain functions. According to Meta Ireland, essential cookies that are necessary for the use of the Facebook platform cannot be disabled.

You also have the option of purchasing an ad-free Facebook experience by taking out a paid subscription with Meta. According to Meta, if you take out such a subscription, Meta will no longer display advertisements to you while you use Facebook for the duration of the subscription. Furthermore, according to Meta, your information (including corresponding cookies for advertising purposes) will not be used for advertising purposes for the duration of the subscription. Further information on taking out such a subscription with Meta can be found here: https://facebook.com/help/1241090626576242?helpref=faq_content.

YouTube

Further information on the nature, scope, purposes, legal bases and options for objecting to the use of cookies by Google Ireland can be found in Google Ireland’s cookie information (https://policies.google.com/technologies/cookies).

According to Google Ireland as the provider of the YouTube platform, cookies in connection with personalised advertising, personalised content and other personalised services are stored and used only where you have given your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. According to Google Ireland, other cookies used for website statistics, to ensure the security of visitors, users and the YouTube platform, to identify users when using the YouTube platform, to retrieve settings and to ensure the functionality of the YouTube platform cannot be disabled.

Further information on the nature, scope, purposes, legal bases and options for objecting to the use of cookies by LinkedIn Ireland can be found in LinkedIn Ireland’s Cookie Policy (https://www.linkedin.com/legal/cookie-policy).

According to LinkedIn Ireland, cookies used in connection with personalised advertising, analytics and research as well as functional cookies are stored and used only where you have given your consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. According to LinkedIn Ireland, other cookies used to ensure the security of visitors, users and the LinkedIn platform, to identify users when using the LinkedIn platform, to retrieve settings and to ensure the functionality of the LinkedIn platform cannot be disabled.

You may also prevent cookies from being stored by selecting “do not accept cookies” in your device or browser settings. Please refer to the respective “Help” function for information on the technical management and deletion of cookies in your device or browser settings. You can also technically prevent cookies from being stored by using free browser add-ons. Please note that preventing cookies from being stored may result in functional restrictions on the respective social media platform.

Usage Analysis

Facebook

In connection with operating our Facebook presence, we use Meta Ireland’s “Page Insights” function (also referred to as “Insights”), through which Meta Ireland provides us with statistical data regarding the use of our Facebook, Instagram and Threads presences that is anonymous to us. This means that the personal data of individual users is not visible to us. Information about the data Meta Ireland uses for usage analysis in connection with our Facebook presence (“Page Insights Data”) and the information Meta Ireland provides regarding data processing in connection with the Page Insights function can be found at https://de-de.facebook.com/legal/terms/information_about_page_insights_data and at https://www.facebook.com/legal/terms/page_controller_addendum. In particular, Meta Ireland provides us with aggregated data regarding the following areas:

activities (e.g. interactions such as profile visits and website clicks or the number of people who see content and where they are located);
content (analyses relating to posts, stories and promotions); and
audience (demographic information relating to subscribers and other visitors).

With regard to Page Insights Data, we are jointly responsible with Meta Ireland for the data processing and have concluded an agreement between joint controllers (https://www.facebook.com/legal/terms/page_controller_addendum), which regulates our respective obligations under the GDPR. In this agreement, we have agreed, for example, that

we and Meta Ireland are jointly responsible for collecting Page Insights Data and transmitting it to Meta Ireland;
we are primarily responsible for providing you with information about the joint processing;
Meta Ireland assumes primary responsibility and is primarily responsible for enabling you to exercise your rights under the GDPR;
Meta Ireland alone may make and, where applicable, implement decisions regarding the processing of Page Insights Data and fulfilment of its data protection obligations;
Meta Ireland may, following transmission by us, process your data for its own purposes under its own responsibility on the basis of a separate legal basis;
the Irish Data Protection Commission (https://dataprotection.ie) is the supervisory authority acting as lead supervisory authority for processing under joint controllership.

Information on the technical and organisational measures used by Meta Ireland to ensure the security of your data can be found in the appendix to the “Page Insights Controller Addendum” at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

Meta Ireland also uses cookies to obtain Page Insights Data, for example to determine whether a user is logged into the Facebook, Instagram or Threads platform. For details, please refer to the “Cookies” section above. According to Meta Ireland, events used to create Page Insights do not store IP addresses, cookie IDs or other identifiers that can be associated with individuals or their devices, apart from a user ID for persons logged into the respective platform.

YouTube

In connection with operating our YouTube presence, we use the “Analytics” function of the YouTube platform, through which Google Ireland, as the provider of YouTube, provides us with statistical data regarding the use of our YouTube presence that is anonymous to us, i.e. the personal data of individual users or visitors is not visible to us. We are not aware of the specific data used by Google Ireland for usage analysis in connection with our YouTube presence. In particular, we can view the following aggregated data:

overview (e.g. number of video views, total duration of video views);
reach (e.g. types of traffic sources);
engagement (e.g. information on videos with the longest watch time);
audience (e.g. age, gender and region of viewers);
revenue (e.g. information on estimated revenue and revenue sources).

In connection with operating our LinkedIn presence, we use the “LinkedIn Analytics” function of the LinkedIn platform (also referred to by LinkedIn as “Page Insights” or “Insights”), through which LinkedIn Ireland provides us with statistical data regarding the use of our LinkedIn presence that is anonymous to us, i.e. the personal data of individual users or visitors is not visible to us. Information about the specific data used by LinkedIn Ireland for usage analysis in connection with our LinkedIn presence (“LinkedIn Analytics Data”) and the information LinkedIn Ireland provides regarding data processing in connection with the LinkedIn Analytics function can be found here: https://www.linkedin.com/help/linkedin/answer/a547077 and here: https://www.linkedin.com/help/linkedin/answer/a566056.

With regard to LinkedIn Analytics Data, we are jointly responsible with LinkedIn Ireland for data processing and have concluded an agreement between joint controllers (“Page Insights Joint Controller Addendum” - https://legal.linkedin.com/pages-joint-controller-addendum), which regulates our respective obligations under the GDPR. In this agreement, we have agreed, for example, that

we and LinkedIn Ireland are jointly responsible for processing LinkedIn Analytics Data;
LinkedIn Ireland is primarily responsible for ensuring the security of data processing by implementing appropriate technical and organisational measures. Further information can be found at https://security.linkedin.com/;
LinkedIn Ireland assumes primary responsibility and is primarily responsible for enabling you to exercise your rights under the GDPR;
the Irish Data Protection Commission (https://www.dataprotection.ie) is the supervisory authority acting as lead supervisory authority for processing under joint controllership.

LinkedIn Ireland also uses cookies to obtain LinkedIn Analytics Data, for example to determine whether a user is logged into the LinkedIn platform. For details, please refer to the “Cookies” section above.

We cannot deactivate the Analytics function. However, we do not actively use the data made available to us for our own analysis purposes. Further information on the LinkedIn Analytics function, the nature, scope, purposes, legal bases and options for objecting to data processing by LinkedIn Ireland as well as your privacy settings can be found in LinkedIn Ireland’s Privacy Policy at https://de.linkedin.com/legal/privacy-policy and at https://www.business.linkedin.com/de-de/marketing-solutions/insight-tag and https://www.linkedin.com/help/linkedin/answer/a1444756/linkedin-marketing-solutions-und-die-datenschutz-grundverordnung-dsgvo-?lang=de.

Interest-Based Advertising

Facebook

We are able to use demographic and geographical analyses of our target audiences provided to us by Meta Ireland in order to display targeted interest-based advertisements on our Facebook presence or promote our posts, without directly learning the identity of the user or visitor to whom the advertisements are displayed. In this case, advertisements or promoted posts on our Facebook presence are displayed on the basis of an analysis of previous usage behaviour by Meta Ireland. However, we receive only anonymised or pseudonymised information, which generally does not enable us to identify you and is never combined with any personal data we may have stored.

We are able to use demographic and geographical analyses of our target audiences provided to us by LinkedIn Ireland in order to display targeted interest-based advertisements on our LinkedIn presence or promote our posts, without directly learning the identity of the user or visitor to whom the advertisements are displayed. In this case, advertisements or promoted posts on our LinkedIn presence are displayed on the basis of an analysis of previous usage behaviour by LinkedIn Ireland. However, we receive only anonymised or pseudonymised information, which generally does not enable us to identify you and is never combined with any personal data we may have stored.

As a user, you can use the settings of your LinkedIn user account (https://www.linkedin.com/help/linkedin/answer/a1337839?lang=de) to control the extent to which your usage behaviour may be collected and used by LinkedIn Ireland.

Recipients of Personal Data

Your personal data is transferred to external recipients only to the extent necessary to achieve the purposes described above, where we have your consent to do so or where another legal basis permits such transfer. Where applicable, your data may be transferred to external service providers that we use to achieve the purposes described above and with whom we have concluded a data processing agreement pursuant to Article 28(3) GDPR. External service providers engaged by us process your data only for the respective purposes and in accordance with our instructions.

External recipients of your personal data may include in particular:

service providers acting on our instructions that we use to achieve the purposes described above;
business partners;
tax advisers and auditors; and
courts, arbitration tribunals, authorities or legal advisers where this is necessary to comply with applicable law or to establish, exercise or defend legal claims.

Information on how Meta Ireland, as the provider of the Facebook platform, transfers your data within and outside the Meta group of companies can be found in the data policies of Facebook (https://de-de.facebook.com/about/privacy), Instagram (https://help.instagram.com/519522125107875) and Threads (https://help.instagram.com/515230437301944).

Information on how Google Ireland, as the provider of the YouTube platform, transfers your data within and outside the Google group of companies can be found in Google Ireland’s Privacy Policy (https://policies.google.com/privacy#infosharing).

Information on how LinkedIn Ireland transfers your data within and outside the LinkedIn group of companies can be found in LinkedIn Ireland’s Privacy Policy (https://www.linkedin.com/legal/privacy-policy).

Information on how Xing transfers your data within and outside the Xing group of companies can be found in Xing’s Privacy Policy (https://privacy.xing.com/de/datenschutzerklaerung/wer-erhaelt-daten-zu-ihrer-person).

Data Processing in Third Countries

Where, in accordance with the explanations above, we transfer your data to entities in countries outside the EU or the EEA (hereinafter referred to as “third countries”), we ensure before the transfer that, except in cases permitted by law, either an adequate level of data protection exists at the recipient or you consent to the data transfer. An adequate level of data protection may, for example, be ensured by concluding EU Standard Contractual Clauses, by an adequacy decision of the European Commission or by so-called Binding Corporate Rules (BCRs). Please contact us using the contact details provided above if you would like to receive a copy of the specific safeguards used for transferring your data to third countries.

Data processing by Meta Ireland, Google Ireland and LinkedIn Ireland regularly also takes place in third countries, in particular the United States.

Meta’s parent company Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. The corresponding certificate can be found here: https://www.dataprivacyframework.gov/list. Any data transfers to Meta Platforms, Inc. in the United States are therefore covered by the corresponding adequacy decision of the European Commission pursuant to Article 45(3) GDPR (https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_de).

Google’s parent company Google LLC is certified under the EU-U.S. Data Privacy Framework. The corresponding certificate can be found here: https://www.dataprivacyframework.gov/list. Any data transfers to Google LLC in the United States are therefore covered by the corresponding adequacy decision of the European Commission pursuant to Article 45(3) GDPR (https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_de).

LinkedIn’s parent company LinkedIn Corporation is certified under the EU-U.S. Data Privacy Framework. The corresponding certificate can be found here: https://www.dataprivacyframework.gov/list. Any data transfers to LinkedIn Corporation in the United States are therefore covered by the corresponding adequacy decision of the European Commission pursuant to Article 45(3) GDPR (https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_de).

In the event that the existing adequacy decision for the EU-U.S. Data Privacy Framework is declared invalid in the future, we have already agreed, as a precaution, additional transfer instruments with the relevant service providers, in particular EU Standard Contractual Clauses, or will do so in good time where necessary.

Storage Period and Deletion

We store your personal data only for as long as necessary to fulfil the purposes described above or, where processing is based on consent, until you withdraw your consent. In the event of an objection, we will likewise no longer process your personal data unless further processing is permitted or required under the applicable legal provisions, for example under commercial and tax law retention obligations, or unless we can demonstrate compelling legitimate grounds for further processing. We also delete your personal data where we are legally required to do so.

At least once a year, we review whether the personal data stored by us in connection with our social media presences is still necessary and carry out appropriate deletion routines, for example by initiating the deletion of messages sent to us. However, because we do not have technical control over the respective social media platform, we cannot ensure that the respective provider of the social media platform actually deletes the data as a result.

In principle, we have no influence on how the providers of the social media platforms store or delete your data within the respective social media platform.

Your Rights

As a data subject, you have the following rights in accordance with the GDPR:

Right of Access (Article 15 GDPR)

You have the right to obtain information about the personal data concerning you that we process, provided the statutory requirements are met.

Right to Rectification (Article 16 GDPR)

You have the right to request the immediate correction of inaccurate data and the completion of incomplete data, provided the statutory requirements are met.

Right to Erasure (Article 17 GDPR)

You have the right to request the erasure of your personal data, provided the statutory requirements are met and, in particular, where (1) your data is no longer necessary for the purposes specified in this data privacy information, (2) you have withdrawn your consent and there is no legal basis for further retention or storage, (3) your data has been processed unlawfully, or (4) you have objected to the processing of your data and there are no overriding legitimate grounds for the processing.

Right to Restriction of Processing (Article 18 GDPR)

You have the right to request that we restrict the processing of personal data concerning you, provided the statutory requirements are met. This applies in particular where you contest the accuracy of the data or where the processing of your data is unlawful and you request restriction instead of erasure.

Right to Data Portability (Article 20 GDPR)

Where your data is processed on the basis of a contract or your consent, you have the right to receive your data in a structured, commonly used and machine-readable format or to have your data transmitted to another controller, provided the statutory requirements are met.

Right to Object (Article 21 GDPR)

You have the right, on grounds relating to your particular situation, to object at any time to our processing of your data where the legal basis for our processing is the pursuit of our legitimate interests pursuant to Article 6(1)(f) GDPR. If you exercise your right to object, we will stop processing your data unless we can demonstrate compelling legitimate grounds for continuing the processing which override your interests, rights and freedoms or the processing serves to establish, exercise or defend legal claims.

Right to Withdraw Consent (Article 7(3) GDPR)

Where we process your data on the basis of your consent, you have the right to withdraw this consent at any time with effect for the future, without suffering any disadvantage as a result. The lawfulness of processing carried out before the withdrawal of consent remains unaffected.

Right to Lodge a Complaint with a Supervisory Authority (Article 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you infringes the GDPR (Article 77 GDPR). You may exercise this right before a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement, or before the supervisory authority responsible for us. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

If you have any questions concerning the processing of your data or wish to exercise your rights as a data subject, please contact us using the contact details provided above.

This data privacy information may be amended from time to time. The current version of this data privacy information shall apply.

Last updated: March 2026