QUESTIONS ABOUT DATA PRIVACY

What is personal data?
Personal data includes all information that is used to identify you personally (e.g. first and last name, e-mail address, telephone number) as well as, e.g., the IP address of your computer.

What types of personal data are collected?
Personal data is only collected and used if there is a legal reason for collecting and using it. We collect and use personal data only to the extent necessary to provide a functional website as well as our content and services. Based on your voluntary entries at the website, we collect data for example in the contact form (first and last name and your e-mail address), when you order publications (content and address) and in the order form for a newsletter (e-mail address). The data you enter will be deleted as soon as it is no longer required for the purpose for which it was collected. We do not collect any further data.

What other information is collected?
When you access the website, your IP address is recorded with the time and content of your access, including the amount of data transferred and the message as to whether the access was successful. The IP address is stored temporarily to ensure that the website functions correctly. This data is deleted when you leave the website, because the purpose for collecting the data has been fulfilled, making collection no longer necessary. Please refer to the “Server Logfiles” section for more information.

How is data collected?
The data collected each time you access the site is automatically logged, otherwise it is only recorded on the basis of your input (e.g. when you place an order) with a temporary cookie. For more information, please refer to the "Use of Cookies" section.

What is the data used for?
The data is used exclusively for providing and optimising the website and ensuring that it is secure. With your consent, your data will only be used to receive your message (e.g. a contact request or appointment booking) or to process your order.

The data is NOT used...
We do not use your data to create a personal profile or for advertising purposes and do not pass your data on to third parties, unless this is necessary, for example, to process an order. Further information is provided in the following sections.

Use of Cookies
This page uses cookies in order to facilitate the operation of the website. Cookies are small text files that your Internet browser stores on your computer. If you call up the website a second time, the cookies enable the website to recognize your computer.
This means, for example, that data that you previously entered will be available when you fill out the contact or order form again. In most cases, we use cookies which are automatically deleted from your hard drive after the Internet browser is closed (so-called session cookies). Other cookies remain on your computer and enable us to recognize your computer at your next visit (so-called permanent cookies).
You can change your browser settings regarding storage of cookies at any time by selecting the function "do not accept cookies". However, we would like to point out that in this case you may no longer be able to fully utilise our website.

Online Forms
Our site offers you various functions (e.g. contact, application or registration forms). We use these forms to collect, process and store personal data.
The data you enter in the online forms will be forwarded to us by e-mail via our provider. The collected data will only be used for processing your request. After processing your request, the collected data will be deleted.
In addition, the data entered in the form is stored in a database on the web server together with the IP address of the user. This storage helps prevent spam. The data is deleted from the server after 7 days.
The data will not be used for any other purpose or passed on to third parties.

Server Logfiles
When a website is accessed, our host’s web server stores specific data in logfiles. Among other things, these logfiles contain: the address of the accessed page (URL), the browser used, the referrer, the time and date of the access and the system used by the person accessing the website. To this end, the server uses Apache's standardized combined logfile format.
Storage of this data enables the analysis of errors if problems or functional failures occur on the server (e.g. errors when calling up a page or attacks by hackers or spambots).
In general, this data will not be combined with other data sources, in particular with personal user data. However, we reserve the right to check any logfiles still stored in the event of a concrete breach of law or contract by a user. This serves above all the protection and security of user data.
The IP addresses of visitors to the website are stored as pseudonymised data – the actual IP address of the visitor is not stored in the logfile. This means that it is no longer possible to connect the IP address to an individual person.

Services of External Providers
To shorten the loading time for our visitors and to increase functionality, this website uses APIs and CDNs from various external providers, e.g. for providing web fonts, displaying maps or frequently used script libraries, which also accelerate loading. 
This always means that the third-party providers of this content require the IP address of the users in order to send the content to the users’ browsers. The IP address is therefore needed to display these contents. We strive to use such contents only if the corresponding provider restricts use of the IP address to the purpose of distributing the contents.
Here you will find an overview of the third-party providers, their contents and links to their data privacy declarations, which contain further information on the processing of data and, if applicable, possibilities for objection (so-called opt-out).

Google Analytics
On the basis of our legitimate interests (i.e. interest in analysing, optimising and operating our online offer in an economic manner, in accordance with with Art. 6 Para. 1 Letter f. GDPR), we use Google Analytics, a web analysis service of Google Inc. ("Google"). Google uses cookies. The information produced by a cookie concerning your use of this website is generally transferred to a Google server in the USA and stored there.
Google is certified under the Privacy Shield Agreement and thereby guarantees that it complies with European privacy laws (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).
Google uses this information on our behalf to evaluate the use of our website by users, to compile reports on the activities at the website and to provide us with other services associated with the use of the website and the Internet. To this end, pseudonymous user profiles of the users can be created from the processed data.
We only use Google Analytics if IP anonymisation is enabled. This means that the user’s IP address is shortened by Google within the EU Member States and other contracting parties of the Agreement governing the European Economic Area. The full IP address is transferred to a Google server in the USA and shortened there only in exceptions.
The IP address transmitted by the user’s web browser is not combined with other Google data. Users can prevent the storage of cookies by selecting the appropriate settings in their browser. They can also download and install the browser plug-in available at the following link – tools.google.com/dlpage/gaoptout – in order to prevent Google from collecting information generated by the cookies and related to their use of the website as well as to prevent Google from processing such information.
Alternatively, you can deactivate tracking by clicking on the following link: Deactivate Google Analytics
For more information about Google's use of data and about setting and objection options, please visit the following Google web pages: www.google.com/intl/de/policies/privacy/partners ("Use of data by Google when using the websites or apps of our partners"), www.google.com/policies/technologies/ads ("Use of data for advertising purposes"), www.google.de/settings/ads ("Managing information Google uses to display advertising").

Google Fonts
We integrate the fonts ("Google Fonts") of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: www.google.com/policies/privacy/, Opt-out: www.google.com/settings/ads/

jQuery
We integrate the external code of the JavaScript framework "jQuery", provided by the third-party provider jQuery Foundation, jquery.org.

Rights of the Data Subject
a) Right to Confirmation
All data subjects have the right, granted by the European body issuing directives and regulations, to request confirmation from the data controller as to whether their own personal data is being processed. If a data subject wishes to exercise this right of confirmation, he or she may contact an employee of the organisation controlling the data at any time.

b) Right of Access to Information
Any person affected by the processing of personal data has the right, granted by European body issuing directives and regulations, to request information from the data controller on his or her own personal data as well as a copy of the information at any time and free of charge. In addition, the European body issuing directives and regulations gives the data subject the right to access the following information:

•    the purposes for processing
•    the categories of personal data processed
•    if possible, the planned duration for which the personal data will be stored or, if that is not possible, the criteria for determining that duration
•    the existence of a right to have one’s own personal data rectified or erased or to limit processing carried out by the data controller or a right to object to such processing
•    the existence of a right of appeal to a supervisory authority
•    if the personal data is not collected from the data subject: all available information on the origin of the data
•    the existence of automated decision-making, including profiling, in accordance with Art. 22 Para. 1 and 4 GDPR and, at least in these cases, meaningful information on the logic involved and the scope and intended impact of such processing on the data subject
The data subject also has the right to know whether personal data has been transferred to a third country or to an international organisation. If this is the case, the data subject has the right to obtain information on the appropriate safeguards in connection with the transfer. If a data subject wishes to exercise this right of access to information, he or she can contact an employee of the organisation responsible for controlling the data at any time.

c) Right to Rectification
Any person affected by the processing of personal data has the right, granted by the European body issuing directives and regulations, to request that inaccurate personal data concerning him or her is rectified without delay. Furthermore, depending on the purpose for processing the data, the data subject has the right to request that incomplete personal data is completed, also by adding a supplementary statement. If a data subject wishes to exercise this right of rectification, he or she can contact an employee of the organisation responsible for controlling the data at any time.

d) Right to Deletion (Right to be Forgotten)
Any person affected by the processing of personal data has the right,  granted by the European body issuing directives and regulations, to demand that the data controller erases his or her own personal data without delay providing that one of the following conditions applies and that the processing is not necessary:
•    The personal data has been collected for specific purposes or processed in a way way for which the data is no longer needed.
•    The data subject has withdrawn his or her consent on which the processing was based pursuant to Art. 6 Para. 1 Letter a GDPR or Art. 9 Para. 2 Letter a GDPR, and there is no other legal basis for processing the data.
•    The data subject objects to the processing under Art. 21 Para. 1 GDPR, and there are no overriding legitimate reasons for processing the data, or the data subject objects to the processing under Art. 21 Para. 2 GDPR.
•    The personal data has been processed unlawfully.
•    The deletion of personal data is necessary to fulfil a legal obligation under European Union law or the law of the Member States governing the data controller.
•    The personal data has been collected in relation to the provision of information society services pursuant to Art. 8 Para. 1 GDPR.

If one of the above reasons applies and a data subject wishes to have personal data stored by us deleted, he or she can contact an employee of the organization responsible for controlling the data at any time. The employee shall arrange for the data to be deleted immediately. If we have made personal data public and if our company, as the organization responsible, is obliged to delete the personal data pursuant to Art. 17 Para. 1 GDPR, we shall take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform other data controllers who have processed the published personal data that the data subject has requested that these other data controllers delete all links to this personal data or copies or replications of this personal data, insofar as processing of this data is not necessary. The employee will take the necessary steps in individual cases.

e) Right to Limitation of Processing
Any person affected by the processing of personal data has the right, granted by the European body issuing directives and regulations, to request that the data controller limits processing if one of the following conditions is met:
•    The accuracy of the personal data is contested by the data subject; thus, processing is limited for the period of time necessary for the data controller to verify the accuracy of the personal data.
•    The processing is unlawful; the data subject opposes the deletion of his or her personal data and instead requests that use of the personal data is restricted.
•    The data controller no longer needs the personal data for the purposes of processing, but the data subject needs it for the assertion, exercise or defence of legal claims.
•    The data subject has made an objection against the processing pursuant to Art. 21 Para. 1 GDPR and it is not yet clear whether the legitimate reasons of the data controller outweigh those of the data subject.
If one of the above reasons applies and a data subject wants that the personal data stored by us is restricted, he or she can contact an employee of the organization responsible for controlling the data at any time. The employee will initiate the restriction of processing.

f) Right to Data Transferability
Any person affected by the processing of personal data has the right, granted by the European body issuing directives and regulations, to obtain personal data which he or she has provided to the data controller in a structured, commonly accessible and machine-readable format. This person also has the right to communicate such data to another data controller without interference from the data controller to whom the personal data has been disclosed, provided that the processing is based on consent in accordance with Art. 6 Para. 1 Letter a GDPR or Art. 9 Para. 2 Letter a GDPR or on a contract in accordance with Art. 6 Para. 1 Letter b GDPR and that the processing is carried out through automated procedures, provided that the processing is not necessary for the performance of a task that has to be carried out in the public interest or for the exercise of official authority vested in the data controller. Furthermore, when exercising his or her right to data transferability pursuant to Art. 20 Para. 1 GDPR, the data subject shall have the right to ensure that the personal data is transferred directly from one data controller to another data controller, insofar as this is technically feasible and insofar as this does not infringe upon the rights and freedoms of other persons. In order to assert the right to data transferability, the data subject can contact an employee at any time.

(g) Right of Appeal
Any person affected by the processing of personal data has the right, granted by the European body issuing directives and regulations, to object to the processing of his or her own personal data pursuant to Art. 6 Para. 1 Letters e or f GDPR at any time, for reasons relating to his or her particular situation. This also applies to profiling based on these provisions. In the event of an objection, we will no longer process personal data unless we can prove compelling and legitimate reasons for processing which outweigh the interests, rights and freedoms of the data subject, or unless the purpose of the processing is to enforce, exercise or defend legal claims. If we process personal data in order to conduct direct advertising, the data subject has the right to object to the processing of personal data for the purpose of such advertising at any time. This also applies to profiling in so far as it is related to such direct advertising. If the data subject objects to us processing data for direct advertising purposes, we will no longer process the personal data for these purposes. In addition, for reasons arising from his or her particular situation, the data subject has the right to object to us processing his or her personal data, if we process the data for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 Para. 1 GDPR, unless such processing is necessary for the performance of a task in the public interest. In order to exercise his or her right of appeal, the data subject can contact an employee at any time. The data subject is also free to exercise his or her right of appeal in relation to the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures using technical specifications.

h) Automated Case-by-Case Decisions Including Profiling
Any person affected by the processing of personal data has the right, granted by the European body issuing directives and regulations, not to be subject to a decision based solely on automated processing – including profiling – which has legal effects upon him or her or significantly affects him or her in a similar manner, provided that the decision (1) is not necessary for the conclusion or performance of a contract between the data subject and the data controller, or (2) is authorised by the legal provisions of the European Union or of the Member States which govern the data controller and that these legal provisions provide for adequate measures to safeguard the rights and freedoms and the legitimate interests of the data subject, or (3) that the decision is taken with the express consent of the data subject. If the decision (1) is necessary for the conclusion or performance of a contract between the data subject and the data controller or (2) is taken with the express consent of the data subject, we shall take appropriate steps to safeguard the rights and freedoms and the legitimate interests of the data subject, including at least the right to have an employee of the organisation responsible for controlling the data intervene, the right to present one’s point of view and to contest a decision. If a data subject wishes to exercise rights related to automated decisions, he or she can contact an employee of the organisation responsible for controlling the data at any time.

i) Right to Revoke Consent under Data Protection Law
Any person affected by the processing of personal data has the right, granted by the European body issuing directives and regulations, to revoke his or her consent to the processing of personal data at any time. If a data subject wishes to exercise his or her right to revoke consent, he or she can do so at any time by contacting an employee of the organisation responsible for controlling the data.

Information, Correction, Blocking and Deletion
You can request information about your stored data at any time free of charge.
In accordance with the conditions of the German Data Protection Act (BDSG), you have the right to have your stored data rectified, blocked or deleted. If deletion conflicts with legal or contractual storage obligations, we will block the data.
On request, we will provide you with all information about the data stored about you or your company free of charge at any time, rectify, block or delete your data and answer any questions you may have regarding the collection, storage and use of your data. Please contact the person specified in the imprint.