Privacy Policy

Privacy Policy

This is a translation for your convenience. In case of any discrepancy, the German version shall prevail.

Introduction and Overview

We have written this privacy policy (version 07.10.2025-113064783) to explain to you, in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (data for short) we as the controller, and the processors commissioned by us (e.g. providers), process, will process in the future, and what lawful options you have. All terms used are to be understood as gender neutral.
In short: we inform you comprehensively about the data we process about you.

Privacy policies usually sound very technical and use legal jargon. This privacy policy, on the other hand, is intended to describe the most important things to you as simply and transparently as possible. Where it helps transparency, technical terms are explained in a reader friendly way, links to further information are provided and graphics are used. In this way, we inform you in clear and simple language that we only process personal data in the course of our business activities if there is a corresponding legal basis. This is certainly not possible with explanations that are as brief, unclear and legalistic as possible, as is often the standard on the internet when it comes to data protection.
If you still have questions, please contact the responsible party named below or in the imprint, follow the links provided and look at further information on third party websites. You can of course also find our contact details in the imprint.

Scope

This privacy policy applies to all personal data processed by us in the company and to all personal data processed by companies commissioned by us (processors). By personal data, we mean information within the meaning of Art. 4 No. 1 GDPR, such as a person's name, email address and postal address. Processing personal data enables us to offer and invoice our services and products, whether online or offline. The scope of this privacy policy covers:

all online presences (websites, online shops) that we operate

social media presences and email communication

mobile apps for smartphones and other devices

In short: this privacy policy applies to all areas in which personal data is processed in a structured manner within the company via the channels mentioned. Should we enter into legal relations with you outside these channels, we will inform you separately if necessary.

Legal Bases

In the following privacy policy, we provide you with transparent information on the legal principles and regulations, i.e. the legal bases of the General Data Protection Regulation, that allow us to process personal data.
As far as EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can of course read this General Data Protection Regulation of the EU online on EUR-Lex, the gateway to EU law, at https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32016R0679

We only process your data if at least one of the following conditions applies:

Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be storing the data you enter in a contact form.

Contract (Article 6(1)(b) GDPR): We process your data in order to fulfil a contract or pre-contractual obligations with you. For example, if we conclude a purchase contract with you, we need personal information in advance.

Legal obligation (Article 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally obliged to keep invoices for accounting purposes. These usually contain personal data.

Legitimate interests (Article 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data in order to operate our website securely and economically efficiently. This processing is therefore a legitimate interest.

Other conditions, such as the performance of tasks in the public interest, the exercise of official authority and the protection of vital interests, do not generally apply to us. Should such a legal basis nevertheless be relevant, it will be indicated in the appropriate place.

In addition to the EU regulation, national laws also apply:

In Austria, this is the Federal Act on the Protection of Individuals with regard to the Processing of Personal Data (Datenschutzgesetz), DSG for short.

If further regional or national laws apply, we will inform you about them in the following sections.

Contact Details of the Controller

If you have any questions about data protection or the processing of personal data, you will find the contact details of the controller in accordance with Article 4(7) of the EU General Data Protection Regulation (GDPR) below:

Karin Raleigh
Innstraße 10/Top 14
6020 Innsbruck
Austria

Email: info@karin-raleigh.com
Phone: +43 67761172941
Imprint: https://www.karin-raleigh.com/en/impressum

Storage Period

As a general criterion, we only store personal data for as long as is absolutely necessary to provide our services and products. This means that we delete personal data as soon as the reason for processing the data no longer exists. In some cases, we are legally obliged to store certain data even after the original purpose no longer applies, for example for accounting purposes.

If you wish your data to be deleted or withdraw your consent to data processing, the data will be deleted as quickly as possible, provided there is no obligation to store it.

We will inform you below about the specific duration of each data processing activity, provided we have further information on this.

Rights under the General Data Protection Regulation

In accordance with Articles 13 and 14 GDPR, we inform you of the following rights to which you are entitled, so that data is processed fairly and transparently:

Under Article 15 GDPR, you have the right to information as to whether we are processing your data. If this is the case, you have the right to receive a copy of the data and to be informed of the following:

the purpose for which we carry out the processing;

the categories, i.e. the types of data being processed;

who receives this data and, if the data is transferred to third countries, how security can be guaranteed;

how long the data will be stored;

the existence of the right to rectification, erasure or restriction of processing and the right to object to processing;

that you can lodge a complaint with a supervisory authority (links to these authorities can be found below);

the origin of the data if we did not collect it from you;

whether profiling is carried out, i.e. whether data is evaluated automatically to create a personal profile of you.

Under Article 16 GDPR, you have the right to rectification of your data, which means that we must correct data if you find errors.

Under Article 17 GDPR, you have the right to erasure ("right to be forgotten"), which specifically means that you may request the deletion of your data.

Under Article 18 GDPR, you have the right to restriction of processing, which means that we may only store the data but not use it any further.

Under Article 20 GDPR, you have the right to data portability, which means that we will provide you with your data in a common format on request.

Under Article 21 GDPR, you have the right to object, which, once enforced, results in a change in processing.

If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you can object to the processing. We will then check as quickly as possible whether we can legally comply with this objection.

If data is used for direct marketing, you can object to this type of data processing at any time. We may then no longer use your data for direct marketing.

If data is used for profiling, you can object to this type of data processing at any time. We may then no longer use your data for profiling.

Under Article 22 GDPR, you may have the right not to be subject to a decision based solely on automated processing (for example profiling).

Under Article 77 GDPR, you have the right to lodge a complaint. This means that you can complain to the data protection authority at any time if you believe that the processing of personal data violates the GDPR.

In short: you have rights. Do not hesitate to contact the responsible party listed above!

If you believe that the processing of your data violates data protection law or that your data protection rights have been infringed in any other way, you can lodge a complaint with the supervisory authority. For Austria, this is the Data Protection Authority (Datenschutzbehörde), whose website you can find at https://www.dsb.gv.at/. The following local data protection authority is responsible for our company:

Austrian Data Protection Authority
Head: Dr. Matthias Schmidl
Address: Barichgasse 40-42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

Data Transfer to Third Countries

We only transfer or process data in countries outside the scope of the GDPR (third countries) if you consent to this processing or if there is another legal permission. This applies in particular if the processing is required by law or necessary for the performance of a contractual relationship, and in any case only to the extent that this is generally permitted. In most cases, your consent is the most important reason for us to have data processed in third countries. The processing of personal data in third countries such as the USA, where many software manufacturers offer services and have their server locations, may mean that personal data is processed and stored in unexpected ways.

We expressly point out that, in the opinion of the European Court of Justice, an adequate level of protection for data transfers to the USA currently only exists if a US company that processes personal data of EU citizens in the USA is an active participant in the EU-US Data Privacy Framework. More information can be found at: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

Data processing by US services that are not active participants in the EU-US Data Privacy Framework may result in data being processed and stored in a non-anonymised form. Furthermore, US government authorities may be able to access individual data. It may also happen that collected data is linked with data from other services of the same provider, if you have a corresponding user account. Where possible, we try to use server locations within the EU, if this is offered.
We will inform you in more detail about data transfers to third countries at the relevant points in this privacy policy, where applicable.

Security of Data Processing

To protect personal data, we have implemented both technical and organisational measures. Where possible, we encrypt or pseudonymise personal data. In this way, we make it as difficult as we can for third parties to draw conclusions about personal information from our data.

Art. 25 GDPR refers here to "data protection by design and by default", meaning that security should always be considered and appropriate measures taken for both software (e.g. forms) and hardware (e.g. access to the server room). Below, we go into specific measures where necessary.

TLS Encryption with HTTPS

TLS, encryption and HTTPS sound very technical, and they are. We use HTTPS (Hypertext Transfer Protocol Secure) to transfer data securely over the internet.
This means that the entire transfer of all data from your browser to our web server is secured, so nobody can "listen in".

We have thus introduced an additional layer of security and comply with data protection by design (Article 25(1) GDPR). By using TLS (Transport Layer Security), an encryption protocol for secure data transfer on the internet, we can ensure the protection of confidential data.
You can recognise the use of this secure data transfer by the small lock symbol in the top left of your browser, to the left of the web address (e.g. examplepage.com), and by the use of the https scheme (instead of http) as part of our web address.
If you would like to know more about encryption, we recommend searching Google for "Hypertext Transfer Protocol Secure wiki" to find good links to further information.

Communication

Communication Summary
👥 Data subjects: Everyone who communicates with us by phone, email or online form
📓 Data processed: e.g. phone number, name, email address, form data entered. You can find more details under each type of contact used
🤝 Purpose: Handling communication with customers, business partners, etc.
📅 Storage period: Duration of the business case and as required by law
⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (legitimate interests)

When you contact us and communicate by phone, email or online form, personal data may be processed.

The data is processed for handling and processing your question and the related business transaction. The data is stored for as long as this requires, or for as long as required by law.

Data subjects
The processes described affect everyone who contacts us via the communication channels we provide.

Phone
When you call us, the call data is stored in pseudonymised form on the respective device and with the telecommunications provider used. In addition, data such as name and phone number may subsequently be sent by email and stored in order to respond to the enquiry. The data is deleted as soon as the business case has been concluded and legal requirements permit.

Email
When you communicate with us by email, data may be stored on the respective device (computer, laptop, smartphone, etc.) and data is stored on the email server. The data is deleted as soon as the business case has been concluded and legal requirements permit.

Online forms
When you communicate with us using an online form, data is stored on our web server and, where applicable, forwarded to one of our email addresses. The data is deleted as soon as the business case has been concluded and legal requirements permit.

Legal bases
The processing of the data is based on the following legal bases:

Art. 6(1)(a) GDPR (consent): You give us your consent to store your data and continue to use it for purposes related to the business case;

Art. 6(1)(b) GDPR (contract): Processing is necessary for the performance of a contract with you or with a processor such as the telephone provider, or we need to process the data for pre-contractual activities, such as preparing a quote;

Art. 6(1)(f) GDPR (legitimate interests): We want to handle customer enquiries and business communication in a professional manner. This requires certain technical facilities, such as email programs, Exchange servers and mobile network operators, in order to communicate efficiently.

Contact form
If you contact us via the contact form on our website, we process the data you enter (such as name, email address and message text) exclusively to process and respond to your enquiry.

This data is processed on the basis of Art. 6(1)(b) GDPR (for the performance of a contract or pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in processing enquiries).

The data you submit will be treated confidentially and only stored for as long as necessary to process your enquiry. It will not be passed on to third parties unless there is a legal obligation to do so.

Data Processing Agreement (DPA)

In this section, we would like to explain what a data processing agreement is and why it is needed. As the term "data processing agreement" is quite a mouthful, we will often simply use the acronym DPA in this text. Like most companies, we do not work alone, but also use the services of other companies or individuals. By involving various companies or service providers, we may pass on personal data for processing. These partners then act as processors, with whom we conclude a contract known as a data processing agreement (DPA). The most important thing for you to know is that your personal data is processed exclusively on our instructions and must be governed by the DPA.

Who are processors?
As a company and website owner, we are responsible for all data that we process about you. In addition to controllers, there may also be so called processors. This includes any company or person that processes personal data on our behalf. More precisely, and according to the GDPR definition: any natural or legal person, public authority, agency or other body that processes personal data on our behalf is considered a processor. Processors can therefore be service providers such as hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

To make the terms easier to understand, here is an overview of the three roles in the GDPR:

Data subject (you as a customer or prospective customer) → Controller (us as the company and client) → Processor (service provider such as a web host or cloud provider)

Content of a data processing agreement
As mentioned above, we have concluded a DPA with our partners who act as processors. Above all, it states that the processor processes the data exclusively in accordance with the GDPR. The contract must be concluded in writing, although in this context an electronic contract also counts as "in writing". Personal data is only processed on the basis of the contract. The contract must contain the following:

commitment to us as the controller

obligations and rights of the controller

categories of data subjects

type of personal data

nature and purpose of the data processing

subject matter and duration of the data processing

location where the data processing takes place

The contract also contains all of the processor's obligations. The most important obligations are:

to ensure data security measures

to take possible technical and organisational measures to protect the rights of the data subject

to keep a record of processing activities

to cooperate with the data protection supervisory authority on request

to carry out a risk analysis regarding the personal data received

sub-processors may only be engaged with the written approval of the controller

You can see what such a DPA looks like in practice, for example, at https://www.wko.at/service/wirtschaftsrecht-gewerberecht/eu-dsgvo-mustervertrag-auftragsverarbeitung.html, where a model contract is presented (in German).

Web Hosting Wix

Our website is hosted on the servers of the website builder Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel.
Wix stores personal data of website visitors, such as IP addresses, technical data about the browser and operating system, and other usage data in so called server log files. This data is necessary to ensure the stability and security of the web hosting.

Wix operates servers at various locations worldwide, including Europe, Israel and the USA. Data may therefore be transferred to third countries (e.g. the USA). Wix ensures compliance with European data protection regulations by concluding standard contractual clauses in accordance with Art. 46 GDPR.

Further information on data processing by Wix can be found in the Wix privacy policy:

https://www.wix.com/about/privacy

Website Builder Wix

We use the Wix website builder from Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel, for our website. Wix stores data of website visitors in order to ensure the display and functions of our website. This includes, among other things, IP address, technical data about the browser and operating system, and other usage data.

Wix uses cookies for this purpose and may also transfer data to servers outside the EU, in particular in the USA and Israel. Wix undertakes to comply with the requirements of the GDPR and relies on standard contractual clauses in accordance with Art. 46 GDPR for international data transfers.

Further information can be found in the Wix privacy policy:
https://www.wix.com/about/privacy

Web Analytics by Wix

We use the analytics tools of Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel, for our website. Wix collects data on the behaviour of website visitors (e.g. pages viewed, time spent on the site, geographical origin, device, browser type). This information helps us to optimise our website and make it more user friendly.

Wix may use cookies to collect this data. Processing is based on Art. 6(1)(f) GDPR (legitimate interest in analysing user behaviour in order to improve our offering).

The data collected may be transferred to Wix servers in Israel and the USA. Wix uses standard contractual clauses in accordance with Art. 46 GDPR to ensure an adequate level of data protection.

Further information can be found in the Wix privacy policy:
https://www.wix.com/about/privacy

Security & Anti Spam

To secure our website and protect it against misuse, Wix uses security and anti spam technologies. Technical data (e.g. IP address, browser information) may be collected and processed in order to prevent attacks or spam.
Processing is based on Art. 6(1)(f) GDPR (legitimate interest in the security and functionality of the website).

Cookies

Cookies & Cookie Banner (Wix)
Our website uses cookies to improve user friendliness and provide certain functions. Both technically necessary cookies and cookies for statistical and marketing purposes may be used.
When you first visit our website, a Wix cookie banner asks for your consent to store non essential cookies. You can withdraw or adjust your consent at any time.
Processing is based on Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (legitimate interest in a functioning website).
We use the Wix cookie banner as our consent management tool.

Cookies Summary
👥 Data subjects: Website visitors
🤝 Purpose: Depends on the respective cookie. You can find more details below or from the manufacturer of the software that sets the cookie.
📓 Data processed: Depends on the cookie used. You can find more details below or from the manufacturer of the software that sets the cookie.
📅 Storage period: Depends on the respective cookie; can vary from hours to years
⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What are cookies?
Our website uses HTTP cookies to store user specific data.
Below we explain what cookies are and why they are used, so that you can better understand the following privacy policy.

Whenever you surf the internet, you use a browser. Well known browsers include Chrome, Safari, Firefox, Internet Explorer and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.

One thing cannot be denied: cookies are really useful little helpers. Almost all websites use cookies. More precisely, they are HTTP cookies, as there are also other cookies for other applications. HTTP cookies are small files that are stored on your computer by our website. These cookie files are automatically placed in the cookie folder, effectively the "brain" of your browser. A cookie consists of a name and a value. When defining a cookie, one or more attributes must also be specified.

Cookies store certain user data, such as language or personal page settings. When you visit our site again, your browser transmits the user related information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are used to. In some browsers, each cookie has its own file; in others, such as Firefox, all cookies are stored in a single file.

The following graphic shows a possible interaction between a web browser such as Chrome and the web server. The web browser requests a website and receives a cookie back from the server, which the browser uses again as soon as another page is requested.

 

There are both first party cookies and third party cookies. First party cookies are created directly by our site; third party cookies are created by partner websites (e.g. Google Analytics). Each cookie must be assessed individually, as each cookie stores different data. The expiry time of a cookie also varies from a few minutes to a few years. Cookies are not software programs and do not contain viruses, Trojans or other "pests". Cookies also cannot access information on your PC.

This is an example of what cookie data can look like:

Name: _ga
Value: GA1.2.1326744211.152113064783-9
Purpose: Distinguishing website visitors
Expiry date: after 2 years

A browser should be able to support these minimum sizes:

At least 4096 bytes per cookie

At least 50 cookies per domain

At least 3000 cookies in total

What types of cookies are there?
Which cookies we use in particular depends on the services used and is explained in the following sections of the privacy policy. At this point, we would like to briefly discuss the different types of HTTP cookies.

There are 4 types of cookies:

Essential cookies
These cookies are necessary to ensure basic functions of the website. For example, these cookies are needed when a user puts a product in the shopping basket, then continues browsing other pages and only goes to the checkout later. These cookies ensure that the shopping basket is not deleted, even if the user closes the browser window.

Functional cookies
These cookies collect information about user behaviour and whether the user receives any error messages. These cookies are also used to measure the loading time and behaviour of the website in different browsers.

Preference cookies
These cookies ensure better user friendliness. For example, locations entered, font sizes or form data are saved.

Advertising cookies
These cookies are also called targeting cookies. They are used to deliver individually tailored advertising to the user. This can be very practical, but also very annoying.

You are usually asked which of these types of cookies you want to allow when you first visit a website. And of course, this decision is also stored in a cookie.

If you would like to know more about cookies and are not afraid of technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Request for Comments of the Internet Engineering Task Force (IETF) called "HTTP State Management Mechanism".

Purpose of processing via cookies
The purpose ultimately depends on the respective cookie. You can find more details below or from the manufacturer of the software that sets the cookie.

What data is processed?
Cookies are little helpers for many different tasks. Unfortunately, it is not possible to generalise about which data is stored in cookies, but we will inform you about the data processed or stored in the following privacy policy.

Storage period of cookies
The storage period depends on the respective cookie and is specified further below. Some cookies are deleted after less than an hour, others can remain stored on a computer for several years.

You also have an influence on the storage period yourself. You can delete all cookies manually at any time via your browser (see also "Right to object" below). Furthermore, cookies based on consent are deleted at the latest when you withdraw your consent, although the lawfulness of the storage up to that point remains unaffected.

Right to object: how can I delete cookies?
You decide for yourself how and whether you want to use cookies. Regardless of which service or website the cookies come from, you always have the option to delete, disable or only partially allow cookies. For example, you can block third party cookies but allow all other cookies.

If you want to find out which cookies have been stored in your browser, or if you want to change or delete cookie settings, you can find this in your browser settings:

Chrome: Clear, enable and manage cookies in Chrome

Safari: Manage cookies and website data in Safari

Firefox: Clear cookies and site data in Firefox

Internet Explorer: Delete and manage cookies

Microsoft Edge: Delete and manage cookies

If you generally do not want cookies, you can set up your browser so that it always informs you when a cookie is about to be set. This way, you can decide for each individual cookie whether to allow it or not. The procedure differs depending on the browser. It is best to search for instructions on Google using the search term "delete cookies Chrome" or "disable cookies Chrome" in the case of a Chrome browser.

Legal basis
The so called "Cookie Directive" has existed since 2009. It states that storing cookies requires your consent (Article 6(1)(a) GDPR). However, reactions to this directive still vary widely within the EU countries. In Austria, this directive was implemented in § 165(3) of the Telecommunications Act (2021). In Germany, the Cookie Directive was not implemented as national law. Instead, the directive was largely implemented in § 15(3) of the Telemedia Act (TMG), which has been replaced by the Digital Services Act (DDG) since May 2024.

For strictly necessary cookies, even where no consent has been given, there are legitimate interests (Article 6(1)(f) GDPR), which in most cases are of an economic nature. We want to provide website visitors with a pleasant user experience, and certain cookies are often strictly necessary for this.

Insofar as cookies that are not strictly necessary are used, this only happens with your consent. The legal basis in this respect is Art. 6(1)(a) GDPR.

In the following sections, you will be informed in more detail about the use of cookies, insofar as the software used uses cookies.

Instagram Privacy Policy

Social Media (Instagram)
Our website contains links to our profile on Instagram (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland). If you click on these links, data (e.g. IP address, usage data) is transferred to Instagram.
Instagram is a participant in the EU-US Data Privacy Framework.
Further information on the processing of personal data by Instagram can be found at: https://privacycenter.instagram.com/policy

Cookie Consent Management Platform

Cookie Consent Management Platform Summary
👥 Data subjects: Website visitors
🤝 Purpose: Obtaining and managing consent to certain cookies and thus to the use of certain tools
📓 Data processed: Data for managing the cookie settings selected, such as IP address, time of consent, type of consent, individual consents. You can find more details from the respective tool used.
📅 Storage period: Depends on the tool used; periods of several years should be expected
⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What is a cookie consent management platform?
On our website we use consent management platform (CMP) software that makes it easier for us and for you to handle the scripts and cookies used correctly and securely. The software automatically creates a cookie popup, scans and controls all scripts and cookies, provides you with the cookie consent required under data protection law and helps us and you keep track of all cookies. Most cookie consent management tools identify and categorise all existing cookies. You as a website visitor then decide for yourself whether and which scripts and cookies you allow or do not allow. The following graphic shows the relationship between browser, web server and CMP.

Why do we use a cookie management tool?
Our aim is to offer you the greatest possible transparency in the area of data protection. We are also legally obliged to do so. We want to inform you as well as possible about all tools and all cookies that can store and process your data. It is also your right to decide for yourself which cookies you accept and which you do not. In order to grant you this right, we first need to know exactly which cookies have ended up on our website. Thanks to a cookie management tool that regularly scans the website for all existing cookies, we know about all cookies and can provide you with information about them in compliance with the GDPR. You can then accept or reject cookies via the consent system.

What data is processed?
As part of our cookie management tool, you can manage each individual cookie yourself and have full control over the storage and processing of your data. Your declaration of consent is stored so that we do not have to ask you again every time you visit our website and so that we can also prove your consent where required by law. This is stored either in an opt in cookie or on a server. The storage period of your cookie consent varies depending on the provider of the cookie management tool. This data (such as a pseudonymous user ID, time of consent, details of the cookie categories or tools, browser, device information) is usually stored for up to two years.

Duration of data processing
We will inform you below about the duration of the data processing, provided we have further information on this. In general, we only process personal data for as long as is absolutely necessary to provide our services and products. Data stored in cookies is stored for different lengths of time. Some cookies are deleted as soon as you leave the website, others can be stored in your browser for several years. The exact duration of data processing depends on the tool used; in most cases you should expect a storage period of several years. The privacy policies of the individual providers usually contain precise information about the duration of data processing.

Right to object
You also have the right and the option to withdraw your consent to the use of cookies at any time. This works either via our cookie management tool or via other opt out functions. For example, you can also prevent data collection by cookies by managing, disabling or deleting cookies in your browser.

Information on specific cookie management tools, where available, can be found in the following sections.

Legal basis
If you consent to cookies, your personal data is processed and stored via these cookies. If we are permitted to use cookies on the basis of your consent (Article 6(1)(a) GDPR), this consent is also the legal basis for the use of cookies and the processing of your data. Cookie consent management platform software is used to manage consent to cookies and to enable you to give your consent. The use of this software enables us to operate the website efficiently and in compliance with the law, which constitutes a legitimate interest (Article 6(1)(f) GDPR).

Review Platforms

Review Platforms Summary
👥 Data subjects: Visitors to the website or to a review platform
🤝 Purpose: Feedback on our products and/or services
📓 Data processed: Including IP address, email address, name. You can find more details below or on the respective review platforms used.
📅 Storage period: Depends on the respective platform
⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What are review platforms?
You can rate our products or services on various review platforms. We participate in some of these platforms so that we receive feedback from you and can optimise our offering. If you rate us via a review platform, the privacy policy and general terms and conditions of the respective review service apply. Very often you also have to register in order to submit a review. Review technologies (widgets) may also be integrated into our website. When such an integrated tool is used, data is also transferred to, processed and stored by the respective provider.

Many of these integrated programs work on a similar principle. After you have ordered a product or used a service from us, you are asked, by email or on the website, to submit a review. You are usually redirected to a review page via a link, where you can create a review quickly and easily. Some review systems also offer an interface to various social media channels in order to make the feedback accessible to more people.

Why do we use review platforms?
Review platforms collect feedback and reviews about our offering. Through your reviews, we quickly receive feedback and can improve our products and/or services much more efficiently. The reviews therefore serve, on the one hand, to optimise our offering and, on the other hand, give you and all our future customers a good overview of the quality of our products and services.

What data is processed?
With your consent, we transmit information about you and the services you have used to the respective review platform. We do this to ensure that you have actually used one of our services, because only then can you give genuine feedback. The transmitted data is used solely to recognise the user. Exactly which data is stored and processed naturally depends on the providers used. In most cases, personal data such as IP address, email address or your name is also made available to the review platforms. After you have submitted your review, order information such as the order number of a purchased item may also be forwarded to the respective platform. If your email address is transmitted, this is done so that the review platform can send you an email after you have purchased a product. So that we can also integrate your review into our website, we also inform the providers that you have visited our site. The review platform used is responsible for the personal data collected.

How long and where is the data stored?
You can find more details about the duration of data processing below in the respective privacy policy of the provider, provided we have further information on this. In general, we only process personal data for as long as is absolutely necessary to provide our services and products. Personal data mentioned in a review is usually anonymised by employees of the platform used and is therefore only visible to the company's administrators. The data collected is stored on the providers' servers and, with most providers, deleted after the end of the order.

Right to object
You also have the right and the option to withdraw your consent to the use of cookies or third party providers at any time. This works either via our cookie management tool or via other opt out functions. For example, you can also prevent data collection by cookies by managing, disabling or deleting cookies in your browser.

Legal basis
If you have consented to the use of a review platform, this consent is the legal basis for the corresponding data processing. According to Art. 6(1)(a) GDPR (consent), this consent constitutes the legal basis for the processing of personal data that may occur when data is collected by a review portal.

We also have a legitimate interest in using a review platform in order to optimise our online service. The corresponding legal basis for this is Art. 6(1)(f) GDPR (legitimate interests). Nevertheless, we only use a review platform if you have given your consent.

We hope we have been able to give you the most important general information about data processing by review platforms. You can find more detailed information below in the privacy texts or in the linked privacy policies of the company.

Google Business Privacy Policy

We use the Google Business Profile service (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to make our business visible in Google Search and on Google Maps. If you access our Google Business Profile via our website or submit a review, personal data (e.g. IP address, usage data) may be transmitted to Google.
Google is a participant in the EU-US Data Privacy Framework, which ensures an adequate level of data protection.
Further information on data processing by Google can be found at: https://policies.google.com/privacy

Google Fonts

On individual pages of this website, we use embedded content that loads fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you access these pages, your browser connects to Google's servers, and your IP address is transmitted to Google. This is done in the interest of a consistent presentation of our website. The legal basis is Art. 6(1)(f) GDPR (legitimate interest). Google is a participant in the EU-US Data Privacy Framework. Further information can be found at https://policies.google.com/privacy

Explanation of Terms Used

We always strive to write our privacy policy as clearly and comprehensibly as possible. However, this is not always easy, especially when it comes to technical and legal topics. It often makes sense to use legal terms (such as personal data) or certain technical expressions (such as cookies, IP address). However, we do not want to use them without explanation. Below you will find an alphabetical list of important terms used that we may not yet have covered sufficiently in the privacy policy so far. Where these terms are taken from the GDPR and are definitions, we also quote the GDPR texts here and add our own explanations where appropriate.

Consent
Definition according to Article 4 GDPR

For the purposes of this Regulation:

"consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Explanation: On websites, such consent is usually given via a cookie consent tool. You are surely familiar with this. Whenever you visit a website for the first time, you are usually asked via a banner whether you agree or consent to data processing. You can usually also make individual settings and thus decide for yourself which data processing you allow and which you do not. If you do not consent, no personal data may be processed about you. In principle, consent can of course also be given in writing, i.e. not via a tool.

Controller
Definition according to Article 4 GDPR

For the purposes of this Regulation:

"controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Explanation: In our case, we are responsible for the processing of your personal data and are therefore the "controller". If we pass on collected data to other service providers for processing, they are "processors". For this, a "data processing agreement (DPA)" must be signed.

Personal Data
Definition according to Article 4 GDPR

For the purposes of this Regulation:

"personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Explanation: Personal data is therefore all data that can identify you as a person. This usually includes data such as:

Name

Address

Email address

Postal address

Phone number

Date of birth

Identification numbers such as social security number, tax identification number, identity card number or student ID number

Bank details such as account number, credit information, account balances and much more

According to the European Court of Justice (ECJ), your IP address is also personal data. IT experts can use your IP address to determine at least the approximate location of your device and, subsequently, you as the owner of the connection. Storing an IP address therefore also requires a legal basis within the meaning of the GDPR. There are also so called "special categories" of personal data that are particularly worthy of protection. These include:

racial and ethnic origin

political opinions

religious or philosophical beliefs

trade union membership

genetic data, such as data obtained from blood or saliva samples

biometric data (information on physical, physiological or behavioural characteristics that can identify a person)

health data

data concerning sexual orientation or sex life

Processing
Definition according to Article 4 GDPR

For the purposes of this Regulation:

"processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Note: When we speak of processing in our privacy policy, we mean any kind of data processing. As mentioned above in the original GDPR definition, this includes not only collecting but also storing and processing data.

Processor
Definition according to Article 4 GDPR

For the purposes of this Regulation:

"processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

Explanation: As a company and website owner, we are responsible for all data that we process about you. In addition to controllers, there may also be so called processors. This includes any company or person that processes personal data on our behalf. In addition to service providers such as tax advisors, processors can therefore also be hosting or cloud providers, payment or newsletter providers, or large companies such as Google or Microsoft.

Profiling
Definition according to Article 4 GDPR

For the purposes of this Regulation:

"profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

Explanation: Profiling involves gathering various pieces of information about a person in order to learn more about that person. On the web, profiling is often used for advertising purposes or for credit checks. Web or advertising analytics programs, for example, collect data about your behaviour and interests on a website. This results in a specific user profile that can be used to target advertising at a specific audience.

Closing Remarks

Congratulations! If you are reading these lines, you have really "fought" your way through our entire privacy policy, or at least scrolled this far. As you can see from the length of our privacy policy, we take the protection of your personal data anything but lightly.
It is important to us to inform you about the processing of personal data to the best of our knowledge and belief. We not only want to tell you which data is processed, but also explain the reasons for using various software programs. Privacy policies usually sound very technical and legalistic. However, since most of you are not web developers or lawyers, we also wanted to take a different approach in terms of language and explain the facts in simple and clear language. Of course, this is not always possible due to the subject matter. That is why the most important terms are explained in more detail at the end of the privacy policy.
If you have any questions about data protection on our website, please do not hesitate to contact us or the responsible party. We wish you a pleasant time and hope to welcome you back to our website soon.

All texts are protected by copyright.

Parts of this privacy policy were created using the AdSimple privacy policy generator and supplemented and adapted by us with our own content (contact form, web hosting Wix, website builder Wix, web analytics by Wix, cookies & cookie banner (Wix), Google Business / Google reviews, downloads (freebies, newsletter consent), social media (Instagram), security & anti spam).