Data Protection

We are very pleased about your interest in our company. Data protection is of particularly high importance to the management of Schaller Digital GmbH. Use of the websites of Schaller Digital GmbH is generally possible without providing any personal data. However, if a data subject wishes to use special services of our company via our website, processing of personal data may become necessary. If processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the data subject.

The processing of personal data, such as the name, address, email address or telephone number of a data subject, is always carried out in accordance with the General Data Protection Regulation and in compliance with the country-specific data protection regulations applicable to Schaller Digital GmbH. By means of this privacy policy, our company would like to inform the public about the nature, scope and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed of the rights to which they are entitled by means of this privacy policy.

As the controller, Schaller Digital GmbH has implemented numerous technical and organizational measures to ensure the most complete protection possible of the personal data processed via this website. Nevertheless, internet-based data transmissions can in principle have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us by alternative means, for example by telephone.

The privacy policy of Schaller Digital GmbH is based on the terms used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our privacy policy should be easy to read and understand for the public as well as for our customers and business partners. To ensure this, we would like to explain the terms used in advance.

In this privacy policy, we use the following terms, among others:

Personal data means any information relating to an identified or identifiable natural person (hereinafter "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data subject is any identified or identifiable natural person whose personal data is processed by the controller.

Processing is any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Restriction of processing is the marking of stored personal data with the aim of limiting its future processing.

Profiling is any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

Pseudonymization is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

Controller or controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

Third party is a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

Consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to them.

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and other provisions of a data protection nature is:

Schaller Digital GmbH

Luzenbergstraße 54-56
68305 Mannheim
Germany

Dieter Schaller
Phone: +49 (0) 621 / 7 62 71-76
Email: dieter.schaller@schaller-digital.de
Web: www.schaller-digital.de

The data protection officer of the controller is:

Schaller Verwaltungs GmbH

Luzenbergstraße 54-56
68305 Mannheim
Germany

Phone: +49 (0) 621 / 7 62 71-0
Email: datenschutz@schaller-werbung.de

The websites of Schaller Digital GmbH use cookies. Cookies are text files that are placed and stored on a computer system via an internet browser.

Numerous websites and servers use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a character string by which websites and servers can be assigned to the specific internet browser in which the cookie was stored. This enables the visited websites and servers to distinguish the individual browser of the data subject from other internet browsers containing other cookies. A specific internet browser can be recognized and identified via the unique cookie ID.

Through the use of cookies, Schaller Digital GmbH can provide the users of this website with more user-friendly services that would not be possible without the setting of cookies.

By means of a cookie, the information and offers on our website can be optimized for the benefit of the user. As already mentioned, cookies enable us to recognize the users of our website. The purpose of this recognition is to make it easier for users to use our website. For example, the user of a website that uses cookies does not have to re-enter their access data each time they visit the website, because this is handled by the website and the cookie stored on the user's computer system. Another example is the cookie for a shopping cart in an online shop. The online shop remembers the items a customer has placed in the virtual shopping cart via a cookie.

The data subject can prevent the setting of cookies by our website at any time by means of a corresponding setting in the internet browser used, and thus permanently object to the setting of cookies. Furthermore, cookies that have already been set can be deleted at any time via an internet browser or other software programs. This is possible in all common internet browsers. If the data subject deactivates the setting of cookies in the internet browser used, not all functions of our website may be fully usable.

The website of Schaller Digital GmbH collects a series of general data and information each time the website is accessed by a data subject or an automated system. This general data and information is stored in the server log files. The following may be collected: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrer), (4) the sub-pages accessed via an accessing system on our website, (5) the date and time of access to the website, (6) an internet protocol address (IP address), (7) the internet service provider of the accessing system and (8) other similar data and information used to avert danger in the event of attacks on our information technology systems.

When using this general data and information, Schaller Digital GmbH does not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our website correctly, (2) optimize the content of our website and the advertising for it, (3) ensure the long-term functionality of our information technology systems and the technology of our website, and (4) provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack. This anonymously collected data and information is therefore evaluated by Schaller Digital GmbH both statistically and with the aim of increasing data protection and data security in our company, in order to ultimately ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files is stored separately from all personal data provided by a data subject.

Due to legal requirements, the website of Schaller Digital GmbH contains information that enables quick electronic contact with our company and direct communication with us, which also includes a general address for so-called electronic mail (email address). If a data subject contacts the controller by email or via a contact form, the personal data transmitted by the data subject is automatically stored. Such personal data transmitted on a voluntary basis by a data subject to the controller is stored for the purposes of processing or contacting the data subject. This personal data is not passed on to third parties.

The controller processes and stores personal data of the data subject only for the period necessary to achieve the purpose of storage, or where provided for by the European legislator or another legislator in laws or regulations to which the controller is subject.

If the purpose of storage no longer applies or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data is routinely blocked or erased in accordance with the statutory provisions.

After registering for the newsletter, you will be asked by email to confirm your registration (double opt-in procedure). Only when you activate the link in this email will you be added to the mailing list and receive the monthly newsletter. If you do not click the link, your data will be automatically deleted after 30 days.

You can unsubscribe from the newsletter at any time. Simply click on the unsubscribe link contained in every newsletter or send us an email at datenschutz@schaller-werbung.de.

So that we can prove, in accordance with the statutory documentation obligations under the General Data Protection Regulation applicable from May 25, 2018, that we send you our newsletters lawfully, we store your opt-in data (mandatory fields: email address, IP, date, time / voluntary information: last name, first name). The handling of your personal data described below takes place with your express consent: you consent to Schaller Digital GmbH processing your email address and, where applicable, your first and last name in mailing software in order to send you information on the topics mentioned above. We use this data exclusively for sending the newsletters. To continuously improve our newsletter offering, we keep statistics on which content is clicked most.

You can withdraw your consent at any time. Your data will be deleted immediately after withdrawal. Your data will neither be used commercially nor passed on to third parties. This declaration of consent is voluntary and can be withdrawn at any time with effect for the future. A withdrawal can be made, for example, by email to datenschutz@schaller-werbung.de or by post to the address stated in the imprint.

We operate online presences within the social networks listed below. If you visit one of these presences, the data detailed below is collected and processed by the respective provider. As a rule, this data is collected for advertising and market research purposes and usage profiles are created from it. Data can be stored in the usage profiles regardless of the device you use. This is particularly the case if you are a member of the respective platform and logged in to it. The usage profiles can be used by the providers to show you interest-based advertising. You have a right of objection to the creation of user profiles. To exercise this right, you must contact the respective provider.

If you have an account with one of the providers listed below and are logged in there when visiting our website, the respective provider can collect data about your usage behavior on our website. To prevent such linking of your data, you can log out of the provider's service before visiting our site.

The purpose and scope of data collection by the provider can be found in the respective privacy policies of the providers, which are provided below.

We would like to point out that, depending on the country in which the provider listed below is based, the data collected via its platform may be transferred and processed outside the European Union. In this case, there is a risk that the level of data protection required by the GDPR is not observed and that the enforcement of your rights is not possible or only possible with difficulty.

• Inventory and contact data (e.g. name, address, telephone number, email address)
• Content data (e.g. posts, photos, videos)
• Usage data (e.g. access times, clicked websites)
• Communication data (e.g. information about the device used, IP address)

Communication and marketing, tracking and analysis of user behavior

Consent, Art. 6(1)(a) GDPR, legitimate interest, Art. 6(1)(f) GDPR

For the respective objection options (opt-out), we refer to the providers' information linked below.

We maintain online presences on the following social networks:

Service provider: Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA
Registered office in the EU: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Website: https://www.facebook.com/
Privacy policy: https://www.facebook.com/about/privacy/
Privacy policy for Facebook pages: https://www.facebook.com/legal/terms/information_about_page_insights_data

Service provider: Instagram Inc., 1601 Willow Road, Menlo Park CA 94025, USA Parent company: Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA Registered office in the EU: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
Website: https://www.instagram.com/
Privacy policy: https://www.facebook.com/help/instagram/155833707900388

Service provider: LinkedIn Corporation, 1000 W Maude, Sunnyvale, CA 94085, USA Registered office in Germany: LinkedIn, Hofstatt 4th Floor, Sendlinger Str. 12, 80331 Munich
Website: https://www.linkedin.com/?trk=nav_logo
Privacy policy: https://www.linkedin.com/legal/privacy-policy?trk=uno-reg-guest-home-privacy-policy

We use third-party services to enable online meetings, video and/or audio conference calls and online seminars among employees as well as with prospective customers or clients. If you communicate with us via such a service, the data collected in this communication process is processed both by us and by the third-party provider. The data that can arise in such a communication process includes in particular your registration and contact data, contributions in the chat window, your video and audio contributions and shared screen content. The data processed by the third-party provider we use primarily includes user data and metadata (e.g. IP address, computer system information). As a rule, the third-party providers process this data to check and ensure the security of the service. In addition, findings from the data processing are to be used to optimize the third-party provider's offering and to carry out corresponding marketing measures. In this regard, please note the privacy information of the third-party provider.

We would like to point out that, depending on the country in which the service provider listed below is based, the data collected via the service may be transferred and processed outside the European Union. In this case, there is a risk that the level of data protection required by the GDPR is not observed and that the enforcement of your rights is not possible or only possible with difficulty.

• Inventory data (e.g. names, addresses)
• Contact details (e.g. email address, telephone number)
• Shared content (e.g. photos, videos, texts, audio recordings)
• User data (e.g. access times, websites visited, interest in content)
• Meta and communication data (e.g. IP address, computer system information)

Prospective customers, clients, communication partners

Processing of contact inquiries, internal and external communication with employees as well as prospective customers and clients, fulfillment of our contractual services, service offering

Consent, Art. 6(1)(a) GDPR, performance of a contract and pre-contractual inquiries, Art. 6(1)(b) GDPR, legitimate interest, Art. 6(1)(f) GDPR

Consent, Art. 6(1)(a) GDPR, performance of a contract and pre-contractual inquiries, Art. 6(1)(b) GDPR, legitimate interest, Art. 6(1)(f) GDPR

Services offered: video conferences, chats, instant messaging
Service provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
Parent company: Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Website: https://gsuite.google.com/intl/de/
Privacy policy: https://policies.google.com/privacy?hl=de

Services offered: video conferences, chats, voice conferences
Service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA
Website: https://www.microsoft.com/de-de/microsoft-teams/group-chat-software
Privacy policy: https://privacy.microsoft.com/de-de/privacystatement

Services offered: video conferences, chats, voice conferences
Service provider: Webex Communications Deutschland GmbH, Hansaallee 249, c/o Cisco Systems GmbH, 40549 Düsseldorf, parent company: Cisco Systems, Inc. 170 West Tasman Dr., San Jose, CA 95134, USA; Website: https://www.webex.com/de/
Privacy policy: https://www.cisco.com/c/de_de/about/legal/privacy-full.html.

Services offered: video conferences, chats, voice conferences
Service provider: open-source software Jitsi Meet; Website: https://jitsi.org/; Privacy policy: https://jitsi.org/news/security/.

Every data subject has the right, granted by the European legislator, to obtain confirmation from the controller as to whether or not personal data concerning them is being processed. If a data subject wishes to exercise this right to confirmation, they may contact an employee of the controller at any time.

Every person affected by the processing of personal data has the right, granted by the European legislator, to obtain from the controller, free of charge and at any time, information about the personal data stored about them and a copy of this information. Furthermore, the European legislator has granted the data subject access to the following information:

• the purposes of processing
• the categories of personal data being processed
• the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organizations
• where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• the existence of a right to rectification or erasure of the personal data concerning them, or to restriction of processing by the controller, or a right to object to such processing
• the existence of a right to lodge a complaint with a supervisory authority
• where the personal data is not collected from the data subject: any available information as to its source
• the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. Furthermore, the data subject has a right of access as to whether personal data has been transferred to a third country or to an international organization. Where this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to the transfer.

If a data subject wishes to exercise this right of access, they may contact an employee of the controller at any time.

Every person affected by the processing of personal data has the right, granted by the European legislator, to obtain without undue delay the rectification of inaccurate personal data concerning them. Furthermore, the data subject has the right, taking into account the purposes of the processing, to have incomplete personal data completed - including by means of providing a supplementary statement.

If a data subject wishes to exercise this right to rectification, they may contact an employee of the controller at any time.

Every person affected by the processing of personal data has the right, granted by the European legislator, to obtain from the controller the erasure of personal data concerning them without undue delay, where one of the following grounds applies and insofar as the processing is not necessary:

The personal data was collected or otherwise processed for purposes for which it is no longer necessary.

The data subject withdraws the consent on which the processing was based pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.

The data subject objects to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21(2) GDPR.

The personal data was processed unlawfully.

The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.

The personal data was collected in relation to the offer of information society services referred to in Art. 8(1) GDPR. If one of the above grounds applies and a data subject wishes to arrange for the erasure of personal data stored by Schaller Digital GmbH, they may contact an employee of the controller at any time. The employee of Schaller Digital GmbH will arrange for the erasure request to be complied with without undue delay.

Where Schaller Digital GmbH has made personal data public and our company as controller is obliged pursuant to Art. 17(1) GDPR to erase the personal data, Schaller Digital GmbH, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the published personal data that the data subject has requested the erasure by such other controllers of any links to, or copies or replications of, that personal data, insofar as the processing is not necessary. The employee of Schaller Digital GmbH will arrange the necessary steps in individual cases.

Every person affected by the processing of personal data has the right, granted by the European legislator, to obtain from the controller restriction of processing where one of the following applies:

The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.

The processing is unlawful, the data subject opposes the erasure of the personal data and requests the restriction of its use instead.

The controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defense of legal claims.

The data subject has objected to processing pursuant to Art. 21(1) GDPR and it is not yet clear whether the legitimate grounds of the controller override those of the data subject. If one of the above conditions applies and a data subject wishes to request the restriction of personal data stored by Schaller Digital GmbH, they may contact an employee of the controller at any time. The employee of Schaller Digital GmbH will arrange the restriction of processing.

Every person affected by the processing of personal data has the right, granted by the European legislator, to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format. They also have the right to transmit this data to another controller without hindrance from the controller to which the personal data was provided, where the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising their right to data portability pursuant to Art. 20(1) GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

To assert the right to data portability, the data subject may contact an employee of Schaller Digital GmbH at any time.

Every person affected by the processing of personal data has the right, granted by the European legislator, to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them which is based on Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on those provisions.

In the event of an objection, Schaller Digital GmbH will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defense of legal claims.

If Schaller Digital GmbH processes personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to Schaller Digital GmbH processing data for direct marketing purposes, Schaller Digital GmbH will no longer process the personal data for these purposes.

In addition, the data subject has the right, on grounds relating to their particular situation, to object to the processing of personal data concerning them carried out by Schaller Digital GmbH for scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.

To exercise the right to object, the data subject may directly contact any employee of Schaller Digital GmbH or another employee. The data subject is also free, in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to exercise their right to object by automated means using technical specifications.

Every person affected by the processing of personal data has the right, granted by the European legislator, not to be subject to a decision based solely on automated processing - including profiling - which produces legal effects concerning them or similarly significantly affects them, unless the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) is based on the data subject's explicit consent.

If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is based on the data subject's explicit consent, Schaller Digital GmbH shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.

If the data subject wishes to assert rights relating to automated decisions, they may contact an employee of the controller at any time.

Every person affected by the processing of personal data has the right, granted by the European legislator, to withdraw consent to the processing of personal data at any time.

If the data subject wishes to assert their right to withdraw consent, they may contact an employee of the controller at any time.

The controller collects and processes the personal data of applicants for the purpose of handling the application process. The processing may also be carried out electronically. This is particularly the case if an applicant submits the relevant application documents to the controller by electronic means, for example by email or via a web form on the website. If the controller concludes an employment contract with an applicant, the transmitted data is stored for the purpose of handling the employment relationship in compliance with the statutory provisions. If the controller does not conclude an employment contract with the applicant, the application documents are automatically deleted two months after notification of the rejection decision, provided that no other legitimate interests of the controller stand in the way of such deletion. Another legitimate interest in this sense is, for example, a duty to provide evidence in proceedings under the German General Equal Treatment Act (AGG).

The controller has integrated the Google Analytics component (with anonymization function) on this website. Google Analytics is a web analytics service. Web analytics is the collection, gathering and evaluation of data about the behavior of visitors to websites. Among other things, a web analytics service collects data on the website from which a data subject came to a website (so-called referrer), which sub-pages of the website were accessed, or how often and for what duration a sub-page was viewed. Web analytics is mainly used to optimize a website and for the cost-benefit analysis of internet advertising.

The operating company of the Google Analytics component is Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

The controller uses the addition "_gat._anonymizeIp" for web analytics via Google Analytics. By means of this addition, the IP address of the data subject's internet connection is shortened and anonymized by Google if access to our websites is from a Member State of the European Union or from another state party to the Agreement on the European Economic Area.

The purpose of the Google Analytics component is to analyze visitor flows on our website. Google uses the data and information obtained, among other things, to evaluate the use of our website, to compile online reports for us showing the activities on our websites, and to provide other services related to the use of our website.

Google Analytics places a cookie on the information technology system of the data subject. What cookies are has already been explained above. By setting the cookie, Google is enabled to analyze the use of our website. Each time one of the individual pages of this website operated by the controller is accessed and on which a Google Analytics component has been integrated, the internet browser on the data subject's information technology system is automatically prompted by the respective Google Analytics component to transmit data to Google for the purpose of online analysis. As part of this technical procedure, Google gains knowledge of personal data, such as the IP address of the data subject, which serves Google, among other things, to trace the origin of visitors and clicks and subsequently to enable commission settlements.

By means of the cookie, personal information, for example the access time, the location from which an access originated and the frequency of visits to our website by the data subject, is stored. Each time our websites are visited, this personal data, including the IP address of the internet connection used by the data subject, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may pass on this personal data collected via the technical procedure to third parties.

The data subject can, as described above, prevent the setting of cookies by our website at any time by means of a corresponding setting in the internet browser used, and thus permanently object to the setting of cookies. Such a setting of the internet browser used would also prevent Google from placing a cookie on the data subject's information technology system. In addition, a cookie already set by Google Analytics can be deleted at any time via the internet browser or other software programs.

Furthermore, the data subject has the option of objecting to and preventing the collection of data generated by Google Analytics relating to the use of this website and the processing of this data by Google. To do this, the data subject must download and install a browser add-on at the link https://tools.google.com/dlpage/gaoptout. This browser add-on tells Google Analytics via JavaScript that no data and information about visits to websites may be transmitted to Google Analytics. The installation of the browser add-on is regarded by Google as an objection. If the data subject's information technology system is later deleted, formatted or reinstalled, the data subject must reinstall the browser add-on to deactivate Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or another person attributable to their sphere of control, it is possible to reinstall or reactivate the browser add-on.

Further information and Google's applicable privacy provisions can be accessed at https://www.google.de/intl/de/policies/privacy/ and at http://www.google.com/analytics/terms/de.html. Google Analytics is explained in more detail at this link https://www.google.com/intl/de_de/analytics/.

The controller has integrated the Dealfront component (Liidio Oy as part of Dealfront Group GmbH) on this website to analyze visitor behavior.

In this process, the IP address of a visitor is processed. This serves the purpose of tracing which companies (B2B) visit our website. As part of the processing, the IP address is enriched with associated information such as the company name or industry code. For this purpose, the IP address of the website visitor and the corresponding session data are compared against an extensive whitelist of known companies at the beginning of the session.

To increase the data protection of our visitors, we have activated "IP address anonymization" so that only shortened values are stored and shared with Dealfront instead of the actual IP addresses. We do not store the actual IP address anywhere in our systems, not even in the logs. This anonymization makes it impossible to later establish a connection to external IP address information, thereby preventing the identification of an individual person.

Insofar as we process personal data in this context, this is done on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in optimizing our products, services, sales and marketing.

To prevent this processing, website visitors can install and configure appropriate ad blockers or use no-script plugins in their browser.

The data is deleted as soon as it is no longer required for the intended purposes. However, statutory retention obligations may lead to a longer retention period for the data concerned.

The controller has concluded a data processing agreement with Dealfront to ensure compliance with the applicable data protection standards.

Scope of the processing of personal data

We use functionalities of the chatbot software HubSpot Chatbot of HubSpot Inc., 2nd Floor, 25 First Street, Cambridge, MA 02141, USA (hereinafter: HubSpot). With the help of the HubSpot Chatbot, we can process user inquiries in an automated manner / the HubSpot Chatbot serves us as a contact form to record user inquiries. Cookies from HubSpot are stored on your device in the process.

The following personal data may be processed by HubSpot as a result:

• the user's activity (such as information on pages visited and which elements were clicked)
• device and browser information (such as a globally unique identifier, user token, IP address and operating system)
• data about the ads displayed (such as ads shown and information on whether the user clicked on them)
• data from advertising partners (such as pseudonymized user IDs)
• content of voluntarily submitted chat messages

Other recipients of the data processed by HubSpot include in particular:

• Amazon Web Services, Inc.
• Google, Inc.
• Cloudflare, Inc.
• Twilio, Inc.
• Message Systems, Inc.
• SendGrid, Inc.
• Snowflake, Inc.
• HubSpot, Inc.
• HubSpot Ireland, Ltd.
• HubSpot Germany GmbH
• HubSpot Australia Pty. Ltd.
• HubSpot Asia Pte. Ltd.
• HubSpot Japan KK
• HubSpot Latin America, S.A.S.
• HubSpot Sweden

Further information on the processing of data by HubSpot can be found here: https://legal.hubspot.com/de/privacy-policy

Further information on the cookies used can be found here: https://knowledge.hubspot.com/reports/what-cookies-does-hubspot-set-in-a-visitor-s-browser

The use of the HubSpot Chatbot serves us to optimize our user interactions through the automated processing of inquiries and by providing the chatbot as a contact form.

Legal basis for the processing of personal data

The legal basis for the processing of users' personal data is generally the user's consent pursuant to Art. 6(1) sentence 1 (a) GDPR.

Your personal information is stored for as long as necessary to fulfill the purposes described in this privacy policy or as required by law, e.g. for tax and accounting purposes.

Information on the lifespan of the cookies set by HubSpot can be found here: https://knowledge.hubspot.com/reports/what-cookies-does-hubspot-set-in-a-visitor-s-browser

You can withdraw your consent at any time by clicking on the button in the lower left corner of the website.

You can prevent the collection and processing of your personal data by HubSpot by preventing the storage of third-party cookies on your computer, using the "Do Not Track" function of a supporting browser, deactivating the execution of script code in your browser, or installing a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser.

Further information on objection and removal options vis-a-vis HubSpot can be found at: https://legal.hubspot.com/de/privacy-policy

We use HubSpot to send newsletters. The provider is HubSpot Ireland Ltd., 2nd Floor 30 North Wall Quay, Dublin 1, Ireland, parent company: HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141 USA, www.hubspot.de. HubSpot is a service that can be used to organize and analyze the sending of newsletters. We have concluded a data processing agreement with HubSpot. The data you enter for the purpose of subscribing to the newsletter is stored on HubSpot's EU servers and used to send and personalize the newsletter.

When registering for one of our newsletters or our information offerings, you provide us with your contact details (name, email address, company).

We use these contact details exclusively to send you our email newsletter on a regular basis.

The legal basis for the processing of users' personal data is generally the user's consent pursuant to Art. 6(1) sentence 1 (a) GDPR.

Your personal information is stored for as long as necessary to fulfill the purposes described in this privacy policy or as required by law.

You can object to the use of your contact details at any time without incurring any costs other than the transmission costs according to the basic rates. Your objection (and thus the cancellation of our newsletter) can be made at any time via the link provided in the newsletter or by a corresponding message to datenschutz@schaller-werbung.de. By unsubscribing, you object to the use of your contact details.

This website uses Hotjar. The provider is Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe (website: https://www.hotjar.com).

Hotjar is a tool for analyzing your user behavior on this website. With Hotjar, we can record, among other things, your mouse and scroll movements and clicks. Hotjar can also determine how long you remained with the mouse pointer on a certain spot. Hotjar uses this information to create so-called heatmaps, which can be used to determine which areas of the website are viewed preferentially by website visitors.

We can also determine how long you stayed on a page and when you left it. We can also determine at which point you abandoned your entries in a contact form (so-called conversion funnels).

In addition, Hotjar can be used to obtain direct feedback from website visitors. This function serves to improve the web offerings of the website operator.

Hotjar uses cookies. Cookies are small text files that are placed on your computer and stored by your browser. They serve to make our offering more user-friendly, effective and secure. In particular, these cookies can be used to determine whether this website was visited with a specific device or whether the Hotjar functions were deactivated for the browser in question. Hotjar cookies remain on your device until you delete them.

You can set your browser so that you are informed about the setting of cookies and allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when the browser is closed. If cookies are deactivated, the functionality of this website may be limited.

The use of Hotjar and the storage of Hotjar cookies is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its web offering and its advertising. If corresponding consent was requested (e.g. consent to the storage of cookies), the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; consent can be withdrawn at any time.

If you would like to deactivate data collection by Hotjar, click on the following link and follow the instructions there: https://www.hotjar.com/opt-out

Please note that Hotjar must be deactivated separately for each browser and each device.

For more information about Hotjar and the data collected, please refer to Hotjar's privacy policy at the following link: https://www.hotjar.com/privacy

Art. 6(1)(a) GDPR serves our company as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, as is the case, for example, with processing operations necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Art. 6(1)(b) GDPR. The same applies to processing operations that are necessary for the implementation of pre-contractual measures, for example in the case of inquiries about our products or services. If our company is subject to a legal obligation which requires the processing of personal data, for example for the fulfillment of tax obligations, the processing is based on Art. 6(1)(c) GDPR. In rare cases, the processing of personal data may become necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance data or other vital information had to be passed on to a doctor, hospital or other third party. In that case, the processing would be based on Art. 6(1)(d) GDPR. Finally, processing operations could be based on Art. 6(1)(f) GDPR. Processing operations that are not covered by any of the aforementioned legal bases are based on this legal basis if the processing is necessary to safeguard a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject do not prevail. Such processing operations are permitted to us in particular because they were specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (Recital 47 sentence 2 GDPR).

If the processing of personal data is based on Article 6(1)(f) GDPR, our legitimate interest is the conduct of our business activities for the benefit of the well-being of all our employees and our shareholders.

The criterion for the duration of the storage of personal data is the respective statutory retention period. After expiry of the period, the corresponding data is routinely deleted, provided it is no longer required for the performance or initiation of a contract.

We would like to inform you that the provision of personal data is in part required by law (e.g. tax regulations) or may also result from contractual provisions (e.g. information on the contractual partner). In some cases, it may be necessary for the conclusion of a contract that a data subject provides us with personal data which must subsequently be processed by us. For example, the data subject is obliged to provide us with personal data if our company concludes a contract with them. Failure to provide the personal data would mean that the contract with the data subject could not be concluded. Before providing personal data, the data subject must contact one of our employees. Our employee will inform the data subject on a case-by-case basis whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data, and what the consequences of not providing the personal data would be.

As a responsible company, we do not use automated decision-making or profiling.