Privacy Policy

1. Name and Address of the Data Controller

The data controller within the meaning of the General Data Protection Regulation and other national data protection laws of the
In accordance with the regulations of the member states and other data protection provisions, the following applies:

NETWAYS GmbH and its affiliated companies—NETWAYS Professional Services GmbH, NETWAYS Event Services GmbH, and NETWAYS Managed Services GmbH (NETWAYS Web Services)—each for the online services they operate

2. Name and address of the data protection officer

The data protection officer for the responsible company is:

3. General Information on Data Processing

3.1 Scope of the Processing of Personal Data

As a general rule, we process our users’ personal data only to the extent necessary to provide a
is necessary for the proper functioning of our website, as well as for our content and services. The Processing
Personal data is processed only if one of the legal bases listed in Section 3.2 applies, that is,
in particular based on your consent, to fulfill a contract, or based on a legal obligation
or on the basis of a legitimate interest.

3.2 Legal Basis for the Processing of Personal Data

To the extent that we require the data subject’s consent for the processing of personal data,
To obtain this, Art. 6, para. 1(a). The EU General Data Protection Regulation (GDPR) as the legal basis. During processing
of personal data necessary for the performance of a contract to which the data subject is a party,
is required, Art. 6, para. 1(a). b) The GDPR as the legal basis. This also applies to
Processing operations necessary for the implementation of precontractual measures. To the extent that a
The processing of personal data is necessary to fulfill a legal obligation to which our
The company is subject to Art. 6, para. 1(a). c) The GDPR as the legal basis.

In the event that the vital interests of the data subject or another natural person
require the processing of personal data, Article 6( 1(a). Article 5 of the GDPR as the legal basis.
Is the processing necessary to safeguard a legitimate interest of our company or a third party?
and if the interests, fundamental rights, and fundamental freedoms of the person concerned do not outweigh the first-mentioned interest,
Thus, Article 6, paragraph 1(a). Article 6 of the GDPR as the legal basis for processing.

3.3 Data Deletion and Retention Periods

The data subject’s personal data will be deleted or its processing restricted as soon as the purpose of the
No storage required. Data may also be stored if this is required by the European
or by national legislators in EU regulations, laws, or other provisions to which the
It was stipulated that the responsible party would be subject to this. Data will also be erased or its processing restricted if a
the retention period prescribed by the aforementioned standards expires, unless there is a need to
there is a need to continue storing the data for the purpose of entering into or fulfilling a contract.

3.4 Validity

This Privacy Policy informs users about the nature, scope, and purposes of the collection and
Use of Personal Data by the Provider Responsible for Data Processing. It applies to our
Online platforms such as websites, blogs, online stores, and event pages.

4. Website Hosting and Log File Creation

4.1 Description and Scope of Data Processing

Every time you visit our website, our system automatically collects data and information from your computer system
of the calling computer.

The following data is collected in this process:

• Information about the browser type and version being used
• The user’s operating system
• The user’s Internet service provider
• The user’s IP address
• Date and time of access
• Websites from which the user’s system accesses our website
• Websites accessed by the user’s system through our website

4.2 Legal Basis for Data Processing

The legal basis for the temporary storage of the data is Art. 6, para. 1(a). Article f of the GDPR.

4.3 Purpose of Data Processing

Data is stored in log files to ensure the website functions properly. In addition, the
Data used to optimize the website and ensure the security of our information technology systems. One
In this context, the data is not analyzed for marketing purposes.

4.4 Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected
are. In the case of data collection for the purpose of providing the website, this occurs when the respective session
has ended.

If the data is stored in log files, this occurs no later than six months after it is recorded. One
Storage beyond that is possible. In this case, the users’ IP addresses are
deleted or altered in such a way that it is no longer possible to identify the client that made the request.

4.5 Right to Object and Remedy

The collection of data for the purpose of providing the website and the storage of that data in log files is necessary for the
Operation of the website is absolutely necessary. Although you may object to the processing under Article 21 of the GDPR,
contradict (see Section 15.7); however, as a rule, our compelling interests worthy of protection
Reasons for the secure operation of the website.

5. Use of Cookies

5.1 Description and Scope of Data Processing

Our website uses cookies. Cookies are text files that are stored in the browser or by the browser on the
…are stored on the user’s computer system. When a user visits a website, a cookie may be stored on the
stored on the user’s device. This cookie contains a unique string that
enables the browser to be uniquely identified when the website is visited again.

We use cookies to make our website more user-friendly. Some elements of our website
require that the requesting browser can be identified even after a page change.

The following data is stored and transmitted in the cookies:

• Software configuration settings, such as language settings, time zone, etc.
• Items in a shopping cart
• Login Information

5.2 Legal Basis for Data Processing

Information is stored on and accessed from your device when technically necessary
Cookies based on Section 25, para. 2 No. 2 TDDDG; the subsequent processing of personal data
is based on Art. 6, para. 1(a). Article f of the GDPR. All other cookies and similar technologies, in particular
For analysis and marketing purposes (see Section 14), we will only do so with your consent pursuant to § 25(1)
TDDDG in conjunction with Art. 6, para. 1(a). a GDPR.

5.3 Purpose of Data Processing

The purpose of using technically necessary cookies is to make it easier for users to use websites
simplify. Some features of our website cannot be provided without the use of cookies.
For this to work, the browser must be recognized even after a page change.

The user data collected through technically necessary cookies is not used to create user profiles
used.

5.4 Duration of Storage, Right to Object, and Right to Erasure

Cookies are stored on the user’s computer and transmitted to our website. Therefore, as
Users also have full control over the use of cookies. By changing the settings in
You can disable or restrict the use of cookies in your browser. Already
Stored cookies can be deleted at any time. This can also be done automatically. Are cookies
If cookies are disabled on our website, you may no longer be able to use all of the website’s features
be fully utilized. You may revoke your consent at any time, effective as of
You can revoke this consent at any time through the cookie settings on the respective website.

6. Newsletter

6.1 Description and Scope of Data Processing

On our website, you can subscribe to a free newsletter. In this context,
submits the data from the form to us when signing up for the newsletter.

If you purchase goods or services on our website and provide your email address in the process,
We may subsequently use this information to send you a newsletter. In such a case,
Using the newsletter exclusively for direct marketing of the company’s own similar goods or services
sent.

6.2 Legal Basis for Data Processing

The legal basis for processing the data after the user subscribes to the newsletter is, if applicable,
the user’s consent, Art. 6, para. 1(a). a GDPR.

The legal basis for sending the newsletter following the sale of goods or services is Article 6
Par. 1(a). Article 6 of the GDPR in conjunction with Section 7, para. 3 UWG. You can opt out of this use of your email address
object at any time, without incurring any costs other than the transmission costs charged at the basic rates
arise.

6.3 Purpose of Data Processing

The user’s email address is collected for the purpose of delivering the newsletter.

The collection of other personal data as part of the registration process is intended to prevent misuse of the services
or to prevent the use of the email address provided.

6.4 Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected
are. Accordingly, the user’s email address will be stored for as long as the newsletter subscription remains active.

Other personal data collected as part of the registration process is generally retained for a period of
deleted after six months.

6.5 Right to Object and Remedy

The user in question may cancel their newsletter subscription at any time. For this purpose
Each newsletter contains a link to this page. This also results in the revocation of the consent of the
Enables the storage of personal data collected during the registration process.

7. Registration

7.1 Description and Scope of Data Processing

On our website, we offer users the option to, by providing personal information,
Register. The data from the input form is transmitted to us and stored. In this process, only relevant
Data collected, such as contact information (last name, first name, email addresses, etc.) or content data.

The following data is also stored at the time of registration:

• The user’s IP address
• Date and time of registration

As part of the registration process, the user’s consent to the processing of this data is obtained.

7.2 Legal Basis for Data Processing

Is the registration intended to fulfill a contract to which the user is a party, or to
If pre-contractual measures are carried out, an additional legal basis for the processing is required
Data, Art. 6, para. 1(a). Article 6 of the GDPR. Otherwise, consent is required under Art. 6, para. 1(a). a Obtained in accordance with the GDPR.

7.3 Purpose of Data Processing

User registration is required to fulfill a contract with the user or to carry out
pre-contractual measures or for the provision and review of content in blog systems and mailing lists
or discussion forums are required.

7.4 Disclosure of Data to Third Parties

An order or a request by the user for a quote or for individual contact
may result in the information being forwarded to a partner company. In this case, explicit reference is made to the possible
We have notified the parties concerned of the disclosure and obtained the necessary consent. If necessary, the information will be disclosed to:

• Affiliated Sales Partners
• Hotels and Restaurants for Events and Training Sessions
• Logistics Partner

7.5 Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected
are.

This is required during the registration process to fulfill a contract or to
Pre-contractual measures are carried out when the data is needed to carry out the
are no longer required under the contract. Even after the contract has been concluded, it may still be necessary to process personal
There is a need to store the contracting party’s data in order to comply with contractual or legal obligations.

7.6 Right to Object and Remedy

As a user, you can cancel your registration at any time. The information about you
You can have the stored data modified at any time.

Is the data necessary for the performance of a contract or for the implementation of precontractual measures?
If required, early deletion of the data is possible only to the extent that there are no contractual or statutory
Obligations that preclude deletion.

8. Contact Form and Email Contact

8.1 Description and Scope of Data Processing

Our website features a contact form that can be used to contact us electronically
can be used. If a user chooses this option, the data entered in the input form will be
transmitted to us and stored. Only relevant data is collected, such as contact information (last name, first name,
(e-mail addresses, etc.) or content data.

At the time the message is sent, the following data is also stored:

• The user’s IP address
• Date and time of transmission

Your consent to the processing of your data will be obtained as part of the transmission process, and based on this
See the Privacy Policy.

Alternatively, you can contact us using the email address provided. In this case,
the user’s personal data transmitted via email is stored.

Data will be disclosed to third parties only in the cases specified in Section 8.4. The data is
used exclusively for the purposes specified in Section 8.3.

8.2 Legal Basis for Data Processing

The legal basis for processing the data is Article 6(1) if the user has given consent.
lit. a GDPR.

Legal basis for the processing of data transmitted when sending an email
is Article 6, paragraph 1(a). Article f of the GDPR. If the purpose of the email contact is to enter into a contract, then
Additional legal basis for processing: Art. 6, para. 1(a). Article 6 of the GDPR.

8.3 Purpose of Data Processing

We use the personal data entered in the form to process your inquiry and
for customer service and quality management. If you contact us by email, this is also the reason for
legitimate interest in the processing of the data. Otherwise, the user’s consent is required
required.

The other personal data processed during the transmission process is used to prevent misuse of the
To prevent misuse of the contact form and ensure the security of our information technology systems.

8.4 Disclosure of Data to Third Parties

An order or a request by the user for a quote or for individual contact
may result in the information being forwarded to a partner company. In this case, explicit reference is made to the possible
We have notified the parties concerned of the disclosure and obtained the necessary consent. If necessary, the information will be disclosed to:

• Affiliated Sales Partners
• Hotels and Restaurants for Events and Training Sessions
• Logistics Partner

8.5 Publication of Data

When success stories are submitted, the collected data will be published along with the user’s name
published on the website. In this case, explicit reference is made to the publication, and the
Appropriate consent (Art. 6(1)(a) of the GDPR) has been obtained.

8.6 Duration of Storage

The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected
…the purpose no longer applies or the user’s consent has been revoked.

The personal data collected in addition during the transmission process will be deleted no later than
deleted after a period of six months.

8.7 Right to Object and Remedy

The user may at any time withdraw their consent to the processing of their personal data
revoke. If a user contacts us via email, he or she may object to the storage of his or her personal data
object at any time. In such a case, the conversation cannot continue.

In this case, all personal data stored when you contacted us will be
Deleted.

9. Posting Job Listings / Online Job Applications

9.1 Description and Scope of Data Processing

We collect application data electronically for the purpose of processing the application and
processed. In this process, various types of data are processed, such as name, phone number, email address, etc. These
Data is generally used for establishing contact and communication.

Characteristics that may not be taken into account under the General Equal Treatment Act (ethnic
(origin, gender, religion or belief, disability, age, or sexual identity) are not taken into account
in our selection decision.
Information regarding illnesses, pregnancy, ethnic origin, political views, philosophical or
religious beliefs, union membership, physical or mental health
or your sex life; please do not include this information either. The same applies to content that is likely to,
Infringing the rights of third parties (e.g., copyrights, press rights, or general rights of third parties).

If an application is followed by the signing of an employment contract, the data provided may be used for
For the purposes of standard organizational and administrative processes, in compliance with the relevant legal
Our policies are stored in a personnel file.

9.2 Legal Basis for Data Processing

The legal basis for the processing of your application data is Art. 6, para. 1(a). b GDPR (Implementation
pre-contractual measures in connection with a potential employment relationship). To the extent that you are in
If you consent to longer-term storage, such as in our prospect database, Art. 6, para. 1(a). a GDPR
Legal basis. Data is retained to defend against potential legal claims in accordance with Article 6
Par. 1(a). Article f of the GDPR.

9.3 Purpose of Data Processing

We process your application data solely for the purpose of conducting the application process and for
Recruitment.

9.4 Duration of Storage

If the application is rejected, the submitted data is automatically deleted after five months.
to be announced. This does not apply if, due to legal requirements (such as the burden of proof under the
General Equal Treatment Act) requires longer retention or longer retention
express consent was given in our prospective customer database.

9.5 Right to Object and Remedy

The user may at any time withdraw their consent to the processing of their personal data
revoke. Unless there are legitimate interests of the data controller or the user that take precedence, the
Data deleted immediately. In the cases provided for by law, deletion may be replaced by a
Restrictions on processing may apply.

10. Blog Systems, Mailing Lists, and Discussion Forums

10.1 Description and Scope of Data Processing

Within these systems, it is possible to post comments, write guest articles, or participate in a
Join the discussion. Only relevant data is collected, such as contact information (last name, first name, email addresses,
(etc.) or content data.

The following data is also stored at the time of registration:

• The user’s IP address
• Date and time of registration

If comments are posted, other users can subscribe to them. At the time of the
When you comment, the other users will be notified. No personal information is included in the comments.
Transfer data that allows for direct identification.

Furthermore, we reserve the right, based on our legitimate interests in accordance with Art. 6, para. 1(a). Article 6 of the GDPR,
to process user information for the purpose of spam detection or to delete posts that violate the
Violates the personal rights of third parties.

We will retain the data provided in comments and posts until users object
stored permanently.

10.2 Legal Basis for Data Processing

The legal basis for processing the data is your consent
in accordance with Article 6(1)(a) of the GDPR or based on the legitimate interests of the controller pursuant to Article 6(1)
lit. Article f of the GDPR.

10.3 Purpose of Data Processing

For marketing purposes, to recruit employees and attract customers, and to provide general information, we operate
the systems listed above. The main focus here is on providing relevant user groups with general information from the
to make it available to the data controller’s business unit.

10.4 Duration of Storage

We retain the content and communication data provided through the systems until users object
stored permanently. Log data is deleted after six months at the latest.

10.5 Right to Object and Remedy

The user may at any time withdraw their consent to the processing of their personal data
revoke. We may retain the email addresses of users who have unsubscribed for up to three years based on our legitimate
We store data related to legitimate interests (Art. 6(1)(f) of the GDPR) before we delete it, in order to be able to demonstrate that consent was previously given. The
The processing of this data is limited to the purpose of potentially defending against claims. A
An individual request for deletion may be submitted at any time, provided that the former existence of a
Consent is confirmed.

11. Events: Ticket Sales and Personal Event Schedule

11.1 Ticket Sales via pretix

11.1.1 Description and Scope of Data Processing

We use the pretix ticketing system to sell tickets for our events. In the case of a
When processing an order, we use the information provided on the order form, specifically your name, email address, and billing address.
and, if applicable, the company, the selected tickets, and the participant information required for the respective event
be queried. Required fields are marked as such on the order form. Payment is made via the
the payment service providers referred to in Section 13.

To the extent that we use an external service provider to operate the ticketing system, that provider processes the data
exclusively on our behalf and in accordance with our instructions, based on a contract for
Data Processing (Art. 28 of the GDPR).

11.1.2 Legal Basis for Data Processing

The legal basis is Art. 6, para. 1(a). b GDPR (Performance of the Agreement on Participation in the
(Event) as well as for the legally required retention period under Art. 6, para. 1(a). c GDPR.

11.1.3 Purpose of Data Processing

We process this data to fulfill your order, issue invoices, issue tickets, and grant admission
to organize the event and to keep you informed of any organizational changes to the event.

11.1.4 Duration of Storage

The data will be deleted as soon as it is no longer needed for the event.
are. We delete data subject to statutory retention requirements once those requirements have expired (see
Section 12.4).

11.1.5 Right to Object and Remedy

Since the data is necessary for the performance of the contract, early deletion is only
possible, provided that no contractual or legal obligations prevent it. Your rights under
Section 15 remains unaffected.

11.2 Personal Event Schedule

11.2.1 Description and Scope of Data Processing

On our event websites, you can create your own personalized event schedule
compile. Use of this feature is optional. When you use them, we store the following data:

• Your email address, which you must confirm after entering it
• the sessions you selected
• Your feedback on sessions, if you choose to provide any

11.2.2 Legal Basis for Data Processing

The legal basis for processing your email address and the selected sessions is Art. 6, para. 1(a). b
GDPR, as this allows us to provide you with the feature you requested. Providing feedback is voluntary;
The legal basis for this is your consent pursuant to Art. 6, para. 1(a). a GDPR.

11.2.3 Purpose of Data Processing

We process this data to provide you with your personalized event schedule on all your devices
to provide you with your selected sessions as a calendar feed that you can add to your
to integrate the calendar app and to share your feedback with the organizers.
Verifying your email address ensures that only you can access your plan.

11.2.4 Duration of Storage

We delete unconfirmed email addresses after 48 hours. All other data, that is,
We delete verified email addresses, flagged sessions, and feedback 90 days after the end of the respective
Event.

11.2.5 Right to Object and Remedy

You can access all the information saved in your personal event schedule at any time via the
Delete the “Delete my data” button. Consent granted for the processing of your
You may revoke your consent at any time, effective for the future. Your Rights Under Section 15
remain unaffected by this.

12. Order Processing in the Online Store and Customer Account

We process our customers’ data as part of the ordering process in our online store in order to provide them with the
Selection and ordering of the chosen products and services, as well as their payment and delivery, or
To enable implementation.

12.1 Data Processing

The data processed includes inventory data, communication data, contract data, payment data, and
Data subjects affected by the processing include our customers, prospective customers, and others
Business partners. Data is processed for the purpose of providing contractual services in the course of business operations
an online store, billing, shipping, and customer service. To do this, we set session cookies for the
Enable saving of shopping cart contents and persistent cookies for storing the login status.

12.2 Legal Basis for Data Processing

Processing is carried out on the basis of Art. 6, para. 1(a). b (Processing orders) and c
(Archiving Required by Law) GDPR. The information marked as required regarding
Necessary for the formation and performance of the contract. We disclose the data to third parties only in the
In connection with delivery, payment, or in accordance with legal permissions and obligations toward
Legal advisors and government agencies. Data is processed in third countries only if this is necessary for
is necessary for the performance of the contract (e.g., at the customer’s request upon delivery or payment).

12.3 Data Storage

Users have the option to create a user account, which allows them, in particular, to view their orders.
During the registration process, users are informed of the required information. The user accounts are
are not public and cannot be indexed by search engines. When users create their user account
have canceled their accounts, their data associated with the user account will be deleted, unless their
Records must be retained for commercial or tax law reasons in accordance with Art. 6, para. 1(a). c Required under the GDPR.
Information in the customer account remains there until the account is deleted, after which it is archived in the event of a
legal obligation. It is the users’ responsibility to back up their data upon termination prior to the end of the contract.
save.

As part of the registration process, subsequent logins, and the use of our online services, we store the
IP address and the time of each user’s activity. Data is stored in accordance with our
legitimate interests, as well as the interests of users in protection against misuse and other unauthorized use
(Art. 6(1)(f) of the GDPR). One
This data is not disclosed to third parties under any circumstances, unless it is necessary for the pursuit of our
Claims are required, or there is a legal obligation to do so pursuant to Art. 6, para. 1(a). c GDPR.

12.4 Duration of Storage

The data will be deleted upon the expiration of statutory warranty obligations and comparable obligations, which
The necessity of retaining the data is reviewed every three years; in the event of a legal
In accordance with archiving requirements, the data is deleted upon expiration of the retention period (6, 8, or 10 years, depending on the document, in accordance with
§ 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO)).

13. External Payment Service Providers

We use external payment service providers through whose platforms users and we process payment transactions
can perform.

In connection with the performance of contracts, we use payment service providers on the basis of Article 6(1)
lit. b GDPR. In addition, we use external payment service providers based on our legitimate
Interests pursuant to Art. 6, para. 1(a). in accordance with the GDPR to provide our users with effective and secure payment options
offer.

13.1 Processed Data

The data processed by payment service providers includes master data, such as the name and the
Address, banking information (such as account numbers or credit card numbers), passwords, TANs, and checksums, as well as
the information related to the contract, the amount, and the recipient. This information is required to process the transactions
to carry out. However, the data you enter is processed only by the payment service providers and at
saved it. In other words, we do not receive any account- or credit card-related information, but only
Information confirming or denying the payment. Under certain circumstances, the data may be
transmitted by payment service providers to credit bureaus. The purpose of this transmission is to
Identity and credit checks. For more information, please refer to the Terms and Conditions and Privacy Policy of the
Payment service provider.

Payment transactions are subject to the terms and conditions and privacy policy of the respective
Payment service providers that can be accessed within the respective websites or transaction applications. We
Please refer to this section for further information and to exercise your rights of withdrawal, access, and other
Data Subject Rights: PayPal and Computop.

14. Use of Third-Party Providers

We use the services described in this section for analytics, marketing, and convenience purposes only if you
have consented to the cookie settings herein (Section 25(1) of the TDDDG in conjunction with Article 6(1)
lit. (a) GDPR). Exceptions are Gravatar and Akismet, for which the respective legal basis applies. Yours,
You may revoke your consent at any time, effective for the future.

Some providers are based in the United States or process data there. For companies operating under the EU-U.S.
If they are certified under the Data Privacy Framework, there is an adequacy decision by the European Commission (Art. 45 of the GDPR). In the
In all other cases, the transfer is based on the European Commission’s Standard Contractual Clauses (Art. 46
Par. 2 lit. (Article 6 of the GDPR).

14.1 Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow
Street, Dublin 4, Ireland (“Google”). Use is permitted only with your consent, based on
Art. 6, para. 1(a). a GDPR and § 25, para. 1 TDDDG. Google Analytics uses so-called “cookies,”
Text files that are stored on your computer and that track your use of the website
enable.

14.1.1 Data Storage

The following information generated by the cookie regarding your use of the website is generally transmitted to a
Transferred to Google’s servers in the U.S. and stored there:

• Browser Type/Version
• Operating system used
• Referrer URL (the previously visited page)
• Hostname of the accessing computer (IP address)
• Time of the server request

The IP address transmitted by your browser as part of Google Analytics is not combined with other data from
Merged with Google. In Google Analytics 4, Google does not log IP addresses or
stored; they are used solely to derive approximate location data and are then
rejected. The collected data is therefore pseudonymous, but not anonymous.

14.1.2 Data Analysis

On behalf of the operator of this website, Google will use this information to analyze your use of the website
to analyze in order to compile reports on website activity and to further
Website use and services related to Internet use with respect to the website operator
provide. You can prevent cookies from being stored by adjusting the settings in your browser software
prevent; however, please note that in this case, you may not be able to access all
You will be able to use all the features of this website.

14.1.3 Prevention of Processing

You can also prevent the collection of data generated by the cookie and related to your use of the website
data collected (including your IP address) from being sent to Google and to prevent Google from processing this data by
Download and install the browser plugin available at the following link:

tools.google.com/dlpage/gaoptout

As an alternative to the browser add-on—especially for browsers on mobile devices—you can enable data collection
You can prevent Google Analytics from collecting data by not giving your consent in the cookie settings on this website
grant or revoke.

We continue to use Google Analytics to collect data from Google’s advertising cookies and from Google Ads for statistical
to evaluate for various purposes. If you do not wish to receive this, you can opt out via “My Ad Center”

https://myadcenter.google.com/home

Disable. For more information on data protection in connection with Google Analytics, please see the
Google’s Privacy Policy:

https://policies.google.com/privacy

14.2 Google Ads

We also use the Google advertising tool “Google Ads” (formerly Google AdWords) to promote our website. In this context, use
On our website, we use the “Conversion Tracking” analytics service provided by Google Ireland Limited, Gordon House,
Barrow Street, Dublin 4, Ireland, hereinafter “Google.” Use is permitted only with your consent
(Art. 6(1)(a) of the GDPR, § 25(1) of the TDDDG).

14.2.1 Data Storage

If you arrived at our website via a Google ad, a cookie will be stored on your computer.
Cookies are small text files that your web browser places and stores on your computer. This so-called
“Conversion cookies” expire after a limited period of time and are not used for your personal
Identification. If you visit certain pages on our website and the cookie has not yet expired, you can
We and Google recognize that you, as a user, have clicked on one of our ads placed on Google and have been directed to
were redirected to our site.

14.2.2 Data Processing

Google uses the information collected through “conversion cookies” to compile visitor statistics for
to create our website. These statistics show us the total number of users who clicked on our ad
clicked on and, in addition, which pages of our website were subsequently visited by the respective user. We, or
However, other advertisers using Google Ads do not receive any information that would allow users to
can be used to identify a person.

14.2.3 Prevention of Processing

You can prevent the installation of “conversion cookies” by adjusting your browser settings accordingly
prevent, e.g., settings that generally disable the automatic placement of cookies or, specifically, only the
Cookies from the “googleadservices.com” domain are blocked.

You can find Google’s privacy policy regarding this matter at the following link:

https://policies.google.com/technologies/ads?hl=de

14.3 Google Maps

On our website, we use the “Google Maps” component provided by Google Ireland Limited, Gordon House, Barrow Street,
Dublin 4, Ireland, hereinafter referred to as “Google,”.

Each time the “Google Maps” component is called, Google sets a cookie to ensure that when the
Page on which the “Google Maps” component is embedded, to process user settings and data.

14.3.1 Data Processing

This cookie is not usually deleted when you close your browser; instead, it remains active until
after a certain period of time, unless you delete it manually beforehand.

14.3.2 Prevention of Processing

If you do not consent to this processing of your data, you have the option to cancel the service
to disable “Google Maps” and thereby prevent data from being transmitted to Google. In addition,
You can refuse or withdraw your consent in the cookie settings or disable JavaScript in your
Disable the browser. However, please note that in
In this case, they may not be able to use “Google Maps” at all, or only to a limited extent.

The use of “Google Maps” and the information obtained through “Google Maps” is governed by the
Google Terms of Service

https://policies.google.com/terms?hl=de

as well as the additional terms and conditions for “Google Maps”

https://www.google.com/intl/de_de/help/terms_maps.html

14.4 Google Fonts

On our website, we use the “Google Fonts” component provided by Google Ireland Limited, Gordon House, Barrow Street,
Dublin 4, Ireland, hereinafter referred to as “Google,”.

14.4.1 Data Processing

Unless fonts are loaded locally from our servers, your browser will display a
Connects to Google’s servers to load the required fonts. In particular, your
Your IP address, browser information, and the page you visited are transmitted to Google. Google logs
It collects these queries and analyzes them in aggregate form, for example, to determine the prevalence of individual font families.
For more information on data collection and processing, please see Google’s Privacy Policy:

https://policies.google.com/privacy?hl=de

14.4.2 Prevention of Processing

If you do not consent to this processing of your data, you may withdraw your consent to the
Decline or revoke cookie settings. Your browser will then use a default font, so that the
The website’s appearance may differ.

14.5 Reddit

On this website, we use conversion tracking (“Reddit Pixel”) provided by Reddit, Inc., USA.
for marketing, market research, and optimization purposes. This data will only be used with your consent (Art. 6
Par. 1(a). a GDPR, Article 25, para. 1 TDDDG). This loads JavaScript code from Reddit that retrieves information
about your visit, such as the pages you viewed and your interactions. The collected information is hashed
and is thus pseudonymized; however, Reddit cannot link it to an existing Reddit account
can be ruled out.

14.5.1 Data Processing and Storage

The data stored as part of reddit® is deleted as soon as it is no longer needed for its intended purpose
are no longer necessary and there are no legal retention requirements that prevent their deletion.

14.5.2 Prevention of Processing

You can prevent this processing by withdrawing your consent in the cookie settings or
revoke consent, disable cookies in your browser altogether, or specifically block cookies from Reddit
block.

14.6 Meta Pixel (Facebook and Instagram)

We use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, on our website,
Ireland (“Meta”). This allows us to measure the impact of our ads on Facebook and Instagram and
Target ads specifically at people who have shown interest in our offerings. Use is permitted only with
Your consent (Art. 6(1)(a) of the GDPR, § 25(1) of the TDDDG). For the collection of data and its
We are jointly responsible with Meta for the transfer of data to Meta (Art. 26 of the GDPR); for the further
Meta is solely responsible for processing.

14.6.1 Data Storage

When you visit our website, the Meta Pixel collects, in particular, your IP address, information about your browser, and
The device you’re using, the pages you visit, and certain actions on our website, such as logging in or
Order submitted to Meta. To do this, cookies are stored on your device. Are you on Facebook?
If you’re logged in to Instagram, Meta can associate this information with your account. We ourselves receive only
Aggregated analyses that do not allow for any conclusions to be drawn about individual persons. Meta processes
Data is also stored in the U.S.; Meta is certified under the EU-U.S. Data Privacy Framework.

14.6.2 Prevention of Processing

You can prevent this processing by withdrawing your consent in the cookie settings or
revoke. In your Facebook or Instagram account, you can also choose whether Meta can collect information from
may use on other websites for advertising purposes. For more information about Meta’s data processing, please see
Meta’s Privacy Policy:

https://www.facebook.com/privacy/policy/

14.7 LinkedIn

We use LinkedIn features on our website. LinkedIn is a service provided by LinkedIn
Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Every time our website is accessed, which is done via
If a device is equipped with such a component, that component causes the browser you are using to display a
downloads the corresponding image of the component from LinkedIn.

14.7.1 Data Storage

This process notifies LinkedIn of the specific page on our
The website is currently being visited. If you click the LinkedIn “Share” button while
If you are logged in to your LinkedIn account, you can share the content from our pages on your LinkedIn profile
link to. This allows LinkedIn to associate your visit to our pages with your LinkedIn user account.

14.7.2 Prevention of Processing

If you do not want LinkedIn to associate your data with your account, you must, before visiting the site,
Log out of our website on LinkedIn. Information about the purpose and scope of data collection and the further
LinkedIn’s Processing and Use of Data, as well as Settings to Protect Your
For information on privacy, please refer to LinkedIn’s Privacy Policy.

14.8 Gravatar (Profile Pictures)

Within our online platform, and particularly on our blog, we use the Gravatar service provided by Automattic Inc., 60
29th Street #343, San Francisco, CA 94110, USA.

14.8.1 Data Storage

Gravatar is a service where users can sign up and upload profile pictures and their email addresses
can. If users with that email address visit other websites (especially blogs)
When users leave posts or comments, their profile pictures will appear next to the posts or
be displayed in the comments. To this end, the email address provided by users is sent to Gravatar for the purpose of
A check to see if a profile is stored for her, transmitted in the form of a hash value. This is the sole purpose
the email address is provided, and it will not be used for any other purpose, but rather
Deleted.

The use of Gravatar is based on our legitimate interests within the meaning of Article 6( 1(a). f)
GDPR, since we use Gravatar to give the authors of posts and comments the option to
allow users to personalize their posts with a profile picture.

By displaying the images, Gravatar obtains the users’ IP addresses, since this is necessary for a
Communication between a browser and an online service is necessary. More information about the survey and
Information about Gravatar’s use of data can be found in Automattic’s privacy policy:

https://automattic.com/privacy/

14.8.2 Prevention of Processing

If users do not want a profile picture linked to their email address on Gravatar to appear in the
If your comments appear, you should use an email address that is not registered with Gravatar when posting comments
is. We would also like to point out that it is possible to use an anonymous email address or no email address at all to
Use this if users do not want their email address to be sent to Gravatar.
Users can completely prevent the transfer of data by not using our comment system.

14.9 Akismet (Anti-Spam Check)

Our website uses the Akismet service, which is provided by Automattic Inc., 60 29th Street #343, San Francisco, CA
94110, USA. This processing is based on our legitimate interests within the meaning of Article 6(
1(a). f) GDPR.

14.9.1 Data Storage

This service helps distinguish comments from real people from spam comments. To do this, all
Data from a comment is sent to a server in the U.S., where it is analyzed and, for comparison purposes, four
can be stored for days. If a comment has been flagged as spam, the data will be retained for this period
stored elsewhere. This information includes the name entered, the email address, the IP address, the
Comment content, the referrer, information about the browser and computer system used, and the time of the entry.

For more information about how Akismet collects and uses data, please see the privacy policy
From Automattic:

https://automattic.com/privacy/

14.9.2 Prevention of Processing

Users are welcome to use pseudonyms or choose not to provide their name or email address. You
You can completely prevent the transfer of data by not using our comment system.

15. Rights of the Data Subject

If your personal data is processed, you are a data subject as defined by the GDPR, and you have the following
Rights with respect to the data controller:

15.1 Right to Information

You may request confirmation from the data controller as to whether
Personal data is processed. If such processing is taking place, you may exercise the
Request the following information from the responsible party:

• the purposes for which the personal data is processed
• the categories of personal data that are processed
• the recipients or categories of recipients to whom the personal data concerning you
  personal data has been disclosed or will be disclosed
• the planned duration of the storage of your personal data or, if specific details
  Since this is not possible, criteria for determining the retention period
• the existence of a right to have personal data concerning you corrected or erased, a
  The right to have the controller restrict processing or the right to object to such processing
  Processing
• the existence of a right to file a complaint with a supervisory authority
• all available information about the origin of the data, if the personal data was not collected by
  collected from the data subject
• the existence of automated decision-making, including profiling, pursuant to Article 22
  Par. Articles 1 and 4 of the GDPR and—at least in these cases—meaningful information about
  the logic involved, as well as the scope and intended effects of such processing for
  the data subject

You have the right to request information regarding whether the personal data concerning you has been transferred to a
transferred to a third country or to an international organization. In this context, you can
require appropriate safeguards within the meaning of Article 46 of the GDPR in connection with the transfer
to be taught.

15.2 Right to Rectification

You have the right to request that the data controller correct and/or complete your personal data, provided that the
the personal data processed about you is inaccurate or incomplete. The Person in Charge
must make the correction immediately.

15.3 Right to Restriction of Processing

Under the following conditions, you may request that the processing of your personal data be restricted:
request personal data:

• if you dispute the accuracy of the personal data concerning you, for a period that
  enables the data controller to verify the accuracy of the personal data;
• the processing is unlawful and you object to the erasure of the personal data, and
  instead, request that the use of personal data be restricted;
• the data controller no longer needs the personal data for the purposes of processing
  are required, but you may use them to assert, exercise, or defend legal claims
  need, or
• If you object to the processing pursuant to Art. 21, para. 1. have filed a request under the GDPR and have not yet
  It remains to be determined whether the controller’s legitimate interests outweigh your interests.

If the processing of your personal data has been restricted, such data may
– apart from their storage – only with your consent or for the purpose of asserting, exercising, or
To defend legal claims or to protect the rights of another natural or legal person
a person, or for reasons of an important public interest of the Union or a Member State
be processed.

If processing has been restricted in accordance with the above conditions, you will be notified by the
Notify the responsible parties before the restriction is lifted.

15.4 Right to Erasure

15.4.1 Obligation to Delete

You may request that the controller process the personal data concerning you
be deleted immediately, and the controller is required to delete this data immediately
Delete it if any of the following reasons apply:

• The personal data concerning you is processed for the purposes for which it was collected or otherwise
  It is no longer necessary to process them in this way.
• You are withdrawing your consent, on which the processing is based pursuant to Art. 6, para. 1(a). a or Art. 9, para. 2 lit.
  is based on the GDPR, and there is no other legal basis for the processing.
• You set, in accordance with Art. 21, para. 1. Under the GDPR, an objection to processing has been filed, and there are no overriding
  provide legitimate grounds for the processing, or you provide, in accordance with Art. 21, para. 2 GDPR Objection to
  the processing.
• The personal data concerning you was processed unlawfully.
• The deletion of your personal data is necessary to comply with a legal
  An obligation under Union law or the law of the Member States to which the controller is subject
  is subject to.
• The personal data concerning you was collected in connection with the information society services offered
  pursuant to Art. 8, para. Collected in accordance with Article 1 of the GDPR.

15.4.2 Disclosure to Third Parties

If the controller has made your personal data public and, in accordance with Art. 17
Par. 1 If the controller is required by the GDPR to erase such data, it shall, taking into account the available
Measures, including technical measures, that are appropriate given the technology and the costs of implementation, to ensure the
To inform data controllers who process personal data that you
As the data subject, you may request that they delete all links to this personal data or any copies of it, or
have requested copies of this personal data.

15.4.3 Exceptions

The right to erasure does not apply if the processing is necessary for the following reasons:

• on the exercise of the right to freedom of expression and information
• to comply with a legal obligation that requires processing under Union law or the
  Member State to which the controller is subject, or for the performance of a task set forth in the
  is in the public interest or is carried out in the exercise of official authority vested in the controller
  was transferred
• for reasons of public interest in the area of public health, pursuant to
  Art. 9, para. 2 lit. h and i, as well as Art. 9, para. 3 GDPR
• for archival purposes in the public interest, or for scientific or historical research purposes
  or for statistical purposes in accordance with Art. 89, para. 1 GDPR, to the extent that the right referred to in Section 15.4.1
  is likely to make it impossible to achieve the purposes of this processing or seriously
  impairs
• to assert, exercise, or defend legal claims

15.5 Right to Information

Do you have the right to request correction, deletion, or restriction of processing from the
If you make such a request to the controller, the controller is required to notify all recipients to whom the data concerning you has been disclosed
personal data has been disclosed, you have the right to request the correction or deletion of the data or the restriction
to be notified of the processing, unless this proves impossible or involves a
involves a disproportionate amount of effort.

You have the right to request that the data controller inform you of these recipients.

15.6 Right to Data Portability

You have the right to access the personal data concerning you that you have provided to the data controller,
to receive it in a structured, commonly used, and machine-readable format. In addition, you have the right to
this data to another controller without hindrance from the controller to whom the personal data
to transmit the data that has been provided, provided that

• processing based on consent pursuant to Art. 6, para. 1(a). a GDPR or Art. 9, para. 2 lit. a GDPR or on
  a contract pursuant to Art. 6, para. 1(a). is based on Article 6 of the GDPR and
• the processing is carried out using automated means.

In exercising this right, you also have the right to request that the personal data concerning you
Data is transferred directly from one controller to another, provided that this is technically
is feasible. This must not infringe upon the freedoms and rights of others.

The right to data portability does not apply to the processing of personal data that is necessary for
is necessary for the performance of a duty that is in the public interest or in the exercise of
is carried out by a public authority to which the controller has been entrusted.

15.7 Right to Object

You have the right, for reasons related to your specific situation, to object at any time to the
Processing of your personal data based on Article 6, paragraph 1(a). is carried out pursuant to Article 5(e) or (f) of the GDPR,
To file an objection; this also applies to profiling based on these provisions.

The data controller will no longer process your personal data unless it can
demonstrate compelling legitimate grounds for the processing that override your interests, rights, and
Freedoms take precedence, or the processing is necessary for the assertion, exercise, or defense of
Legal claims.

If your personal data is processed for the purpose of direct marketing, you have the right to
You have the right to object at any time to the processing of your personal data for the purposes of such
To include advertising; this also applies to profiling, to the extent that it is related to such direct marketing.

If you object to the processing of your personal data for direct marketing purposes, the personal data concerning you will be
Personal data will no longer be processed for these purposes.

You have the option, in connection with the use of information society services—
notwithstanding Directive 2002/58/EC—to exercise your right to object through automated means,
in which technical specifications are used.

15.8 Right to Withdraw Consent Under Data Protection Law

You have the right to revoke your consent under data protection law at any time. Due to the
Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to such withdrawal
Does not affect processing.

15.9 Automated Decision-Making in Individual Cases, Including Profiling

You have the right not to be subject to a decision based solely on automated processing—
to be subject to a decision—including one based on profiling—that affects you
has legal consequences or significantly affects you in a similar way. This does not apply if the
Decision

• necessary for the conclusion or performance of a contract between you and the data controller
  is,
• pursuant to Union or Member State laws to which the controller is subject,
  is permitted, and that these legal provisions provide for appropriate measures to safeguard your rights and freedoms
  or your legitimate interests, or
• is done with your express consent.

However, these decisions may not be based on specific categories of personal data as defined in Article 9(
1 GDPR, unless otherwise provided in Art. 9( 2 lit. Article 5(a) or (g) of the GDPR applies, and appropriate measures have been taken to protect the
that were taken in relation to their rights and freedoms as well as their legitimate interests.

With regard to the cases mentioned above, the controller shall take appropriate measures to protect the rights and
To protect your freedoms and legitimate interests, which includes, at a minimum, the right to seek intervention
a person’s right, on the part of the responsible party, to present their own point of view and to challenge the decision
belongs to.

15.10 Right to File a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to
Filing a complaint with a supervisory authority, in particular in the Member State where you reside, or
workplace or the location of the alleged violation, if you believe that the
The processing of your personal data violates the GDPR.

The supervisory authority to which the complaint was filed shall inform the complainant of
the status and outcome of the appeal, including the possibility of legal action
Right to appeal under Article 78 of the GDPR.

The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision
(BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

16. Legal Age and Legal Capacity

Our online services are not intended for individuals under the age of 16. Consent to the processing of your
Under Article 8 of the GDPR, you may only access data related to information society services starting from
You may grant consent on your own once you turn 16; prior to that, consent from your legal guardian is required
required. Contracts, such as orders placed in the online store or ticket purchases, generally require
The individual must be of legal age and have legal capacity.

If you are not yet 16 years old, we cannot store your information in our online systems. We
However, we don’t want to lose you as a candidate and look forward to welcoming you to our office
to meet with you in person and accept your application.

17. Safety Measures

During your visit to our website, we use the widely adopted TLS (Transport Layer Security) protocol in conjunction with the
the highest encryption level supported by your browser in each case. As a rule, it is
This involves 256-bit encryption.

We also use appropriate technical and organizational security measures to protect your
Data against accidental or intentional manipulation, partial or complete loss,
Destruction or to protect against unauthorized access by third parties. Our security measures will be
continuously improved in line with technological developments.