Data protection

Data Protection

§ 1 Information Regarding the Collection of Personal Data

We appreciate your visit to our website www.roma.de and your interest in our company.

The protection of your personal data—such as your date of birth, name, phone number, address, etc.—is very important to us.

The purpose of this Data Protection Policy is to inform you about the processing of your personal data that we collect when you visit our website. Our data protection practices comply with the legal provisions of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The following Data Protection Policy serves to fulfill the information obligations arising from the GDPR. These can be found, for example, in Art. 13 and Art. 14 et seq. of the GDPR.

(1) The data controller pursuant to Article 4(7) of the GDPR is

ROMA KG

Ostpreußenstraße 9
89331 Burgau

Email: info@roma.de
Phone: +49 822240000
Fax: +49 8222400050

(2) We have appointed a data protection officer. You can reach him using the following contact information:

Tobias Marx
dsg Datenschutz GmbH
Zeppelinstraße 9
89231 Neu-Ulm
datenschutz@dsg-ulm.de

(3) When you contact us via email or through a contact form, we will store and process the data you provide (your email address, and, if applicable, your name and phone number) in order to answer your questions. We will delete the data collected in this context—if the inquiry is associated with a contract—after the contract term has expired; otherwise, we will delete it once storage is no longer necessary, or restrict processing if statutory retention obligations apply. The legal basis for the processing is Article 6(1)(a) of the GDPR—that is, your explicit consent. If you submit your inquiry for the purpose of fulfilling a contract or taking precontractual measures, or if it relates to such matters, processing is carried out pursuant to Article 6(1)(b) of the GDPR. In all other cases, the legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in processing and responding to the inquiry you have directed to us. If you wish to apply for a position with us, please use our career portal to ensure the secure transmission of your data. If you apply via email, please ensure that your data is transmitted securely.

(4) If we use contracted service providers for specific functions of our services or wish to use your data for marketing purposes, we will always carefully select and monitor these service providers and provide you with detailed information below regarding the respective processes. We will also specify the established criteria for the retention period as well as the respective legal basis.

§ 2 External Hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the host(s). This may primarily include IP addresses, contact requests, metadata and communication data, contractual data, contact information, names, website visits, and other data generated through a website.

External hosting is carried out in our legitimate interest in ensuring the secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR). If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

Our hosting provider(s) will process your data only to the extent necessary to fulfill its service obligations and will follow our instructions regarding this data.

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

We have entered into a Data Processing Agreement (DPA) for the use of the above-mentioned service. This is a contract required under data protection law that ensures the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

§ 3 Your Rights

(1) You have the following rights with respect to a data controller regarding your personal data:

Right of Access:
In particular, you have the right to obtain information about the personal data we process about you, the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned retention period or the criteria for determining the retention period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, to lodge a complaint with a supervisory authority, the origin of your data if it was not collected from you by us, the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved, the significance for you, and the intended effects of such processing, as well as your right to be informed of the safeguards in place pursuant to Article 46 of the GDPR when your data is transferred to third countries;
Right to rectification or erasure:
You have the right to have inaccurate data concerning you rectified without delay and/or to have incomplete data stored by us completed; you have the right to request the erasure of your personal data if the conditions of Article 17(1) of the GDPR are met. However, this right does not apply, in particular, if the processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims;
Right to Restriction of Processing:
You have the right to request the restriction of the processing of your personal data, as long as the accuracy of your data, which you have contested, is being verified; if you object to the erasure of your data due to unlawful processing and instead request the restriction of processing; if you need your data to assert, exercise, or defend legal claims, after we no longer need this data once the purpose has been fulfilled, or if you have objected on grounds related to your particular situation, as long as it has not yet been determined whether our legitimate grounds override yours;
Right to Withdraw Consent:
If you have given consent to the processing of your data, you may revoke it at any time. Such revocation affects the lawfulness of the processing of your personal data after you have notified us of it. The lawfulness of the processing of your data up to the time of your revocation remains unaffected.
Right to data portability:
You have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another data controller, to the extent that this is technically feasible;

(2) You also have the right to lodge a complaint with the competent data protection supervisory authority regarding our processing of your personal data.

§ 4 Processing of Personal Data When Visiting Our Website

When you use the website for informational purposes—that is, simply browsing without registering or otherwise providing us with information—we process the personal data that your browser transmits to our server. The data described below is technically necessary for us to display our website to you and to ensure its stability and security, and must therefore be processed by us. The legal basis is Art. 6(1), sentence 1, lit. f of the GDPR, namely our legitimate interest in the secure and proper provision of our website:

IP address
Date and time of the request
Time zone difference from Greenwich Mean Time (GMT)
Content of the request (page visited)
Access status/HTTP status code
Amount of data transferred in each case
Previously visited page
Browser
Operating system and device type
Language and version of the browser software.

The data is generally deleted as soon as the need for processing no longer exists. IP addresses in the logs are anonymized. The data is typically deleted within 7 days, but no later than 2 months.

§ 5 Additional Features and Services on Our Website

(1) In addition to the purely informational use of our website, we offer various services that you may use if interested, which are described in more detail below. To do so, you generally must provide additional personal data, or we process such additional data that we use to perform the respective services. The data processing principles mentioned above apply to all data processing purposes described here.

(2) In some cases, we use external service providers to process your data. These providers are carefully selected by us, are bound by our instructions, and are regularly monitored.

(3) Your personal data will not be disclosed to third parties—other than the service providers we use and have named.

In certain circumstances, we may also process your personal data to assert and enforce our rights or claims, or to defend ourselves against legal claims brought against us. The same applies if the disclosure is necessary and required by law to prevent or prosecute criminal offenses.

The legal basis for this processing is Article 17(3)(e) of the GDPR and Article 6(1), first sentence, (f) of the GDPR. Our overriding legitimate interest lies in the enforcement of our legal rights and our defense against legal claims.

(4) Below, we list the categories of recipients of your data, provided that such data may be disclosed in accordance with the aforementioned provisions. These include, in particular:

IT service providers who assist us in providing our services and in the administration and maintenance of our IT systems
Payment service providers/banks
Debt collection agencies and legal advisors in the event of asserting or defending claims
Public authorities and institutions, to the extent that we are legally obligated to do so or you have instructed us to do so.

(5) If personal data is transferred to external servers in a third country, we have entered into data processing agreements with the respective data processors that provide guarantees that the requirements of data protection law are met.

Processing of your data in a third country will then only take place if the requirements of Art. 44 et seq. of the GDPR are met. In the event of explicit consent to the transfer of personal data to third countries, data processing is based on Art. 49(1)(a) of the GDPR. Alternatively, the processing of your data may be based on specific safeguards or an EU adequacy decision, such as the Data Privacy Framework (DPF) or, if no adequacy decision exists for the third country, through the adoption of EU Standard Data Protection Clauses, possibly in conjunction with additional safeguards to ensure compliance with the European Union’s level of data protection.

§ 6 Objection to the Processing of Your Data

(1) To the extent that we base the processing of your personal data on a balancing of interests, you may object to such processing. This is the case, in particular, if the processing is not necessary for the performance of a contract with you, as we will explain in the following description of each function. If you exercise such an objection, we ask that you explain the reasons why we should not process your personal data in the manner we have been doing. If you object, we will review the situation and either cease or adjust the data processing, or explain to you our compelling legitimate grounds on the basis of which we will continue the processing.

(2) Of course, you may object at any time to the processing of your personal data for the purposes of advertising and data analysis. The best way to exercise your right to object to advertising is by contacting us using the contact information provided above.

§ 7 Profiling/Automated Decision-Making

We do not create a profile of you. No purely automated decision-making process within the meaning of Art. 22 of the GDPR takes place as part of our data processing activities.

§ 8 Processing of Data from Your Devices (“Cookie Policy”)

(1) In addition to the data mentioned above, when you use our website, we employ technical tools for various functions—in particular, cookies—which may be stored on your device. When you visit our website and at any time thereafter, you have the option to either generally allow cookies or to select which individual additional functions you wish to enable. You can make changes in your browser settings. Below, we first describe cookies from a technical perspective (2) before discussing the technically necessary cookies we use (3).

(2) Cookies are text files or information stored in a database on your hard drive and associated with the browser you are using, so that certain information can be transmitted to the entity that sets the cookie. Cookies cannot run programs or transmit viruses to your computer; rather, they primarily serve to make the website faster and more user-friendly. This website uses the following types of cookies, the functionality and legal basis of which we will explain below:

Transient cookies: These, particularly session cookies, are automatically deleted when you close your browser or log out. They contain a so-called session ID. This allows various requests from your browser to be associated with the same session, and your computer can be recognized when you return to our website.
Persistent cookies: These are automatically deleted after a specified period, which varies depending on the cookie. You can view the cookies that have been set and their expiration dates at any time in your browser settings and delete the cookies manually.

(3) Essential functions technically necessary for displaying the website: The technical structure of the website requires us to use certain technologies, in particular cookies. Without these technologies, our website cannot be displayed (correctly) or support functions may not be available. These are generally transient cookies that are deleted at the end of your visit to the website, or at the latest when you close your browser. You cannot opt out of these cookies if you wish to use our website. The legal basis for this processing is Article 6(1)(f) of the GDPR.

You can find a detailed list of the cookies used, their purpose and retention period, as well as your options, in our consent tool:

Cookie Consent Dialog

Consent Management with Cookiebot

We use the “Cookiebot” consent management tool on our website. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark (hereinafter “Cookiebot”).

Cookiebot enables us to obtain, manage, and document valid consent from website visitors—in accordance with data protection laws—for specific data processing activities, particularly the use of cookies and similar technologies. In this way, we comply with our legal obligations under Section 25 of the TDDDG (formerly TTDSG) and the GDPR to obtain consent before using technologies that are not strictly necessary.

For this purpose, when you visit our website, a cookie (“CookieConsent”) is stored in your browser, which records the consents you have granted or any revocations thereof. The collected data is stored until you request that we delete it, delete the CookieConsent cookie yourself, or the purpose for storing the data no longer applies. Mandatory statutory retention requirements remain unaffected by this. The CookieConsent cookie remains on your device for a period of twelve months.

To verify consent, Cookiebot processes the following data in particular:

Your IP address in anonymized form
Date and time of consent
Information about your browser (user agent)
The URL from which consent was submitted
An anonymous, random, and encrypted key value
The status of your consent (proof of consent)

The legal basis for the use of Cookiebot is Article 6(1)(c) of the GDPR, as we are legally obligated to be able to provide evidence of consent given (duty to provide evidence pursuant to Article 7(1) of the GDPR). In addition, there is a legitimate interest pursuant to Article 6(1)(f) of the GDPR in ensuring that consent management is legally compliant and verifiable. The storage of the CookieConsent cookie is absolutely necessary pursuant to § 25(2)(2) TDDDG to provide the service you have expressly requested (management of your consents). To the extent that consent for further processing is obtained via Cookiebot, this is done exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG; consent may be revoked at any time with future effect.

We have entered into a data processing agreement with the provider in accordance with Article 28 of the GDPR. This agreement, which is required under data protection law, ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Usercentrics A/S is headquartered in Denmark and is therefore located within the European Union. According to the provider, data is generally not transferred to a third country.

You can revoke or modify your consent at any time with future effect. To do so, open the cookie settings via the Cookiebot icon at the edge of the screen / click here: Cookie Settings. Alternatively, you can delete the CookieConsent cookie from your browser.

For more information on Cookiebot’s privacy policy, visit: https://www.cookiebot.com/de/privacy-policy/

§ 9 Embedding of YouTube Videos

(1) We have embedded YouTube videos in our online content that are stored on YouTube.com and can be played directly from our website. The videos are embedded in “enhanced privacy mode,” meaning that no data about you as a user is transmitted to YouTube unless you play the videos. Only when you play the videos is the data specified in paragraph 2 transmitted. We have no control over this data transmission. The legal basis for displaying the videos is Article 6(1)(a) of the GDPR, meaning that the integration takes place only with your explicit consent.

(2) When you visit the website, YouTube receives the information that you have accessed the corresponding page of our website. In addition, the basic data mentioned above, such as your IP address and timestamp, are transmitted. This occurs regardless of whether you are logged in to a YouTube user account or do not have a user account. If you are logged in to Google, your data will be directly associated with your account. If you do not wish for this data to be associated with your YouTube profile, you must log out before clicking the button. YouTube processes your data (even for users who are not logged in) as usage profiles and uses it for market research, targeted advertising, designing its website, and/or to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact YouTube.

(3) The information collected is processed on Google’s servers, including those in the U.S. In such cases, the provider has submitted to the EU-U.S. Privacy Framework.

(4) For more information on the purpose and scope of data collection and its processing by YouTube, please refer to the Data Protection policy. There you will also find further information about your rights and settings options for protecting your privacy: www.google.de/intl/de/policies/privacy. This link also provides information on additional tools loaded by YouTube itself, such as gstatic, YouTube Image CDN, Google APIs, and Google Web Fonts.

§ 10 Integration of the BITE Applicant Management System

Our website integrates the “BITE” applicant platform provided by BITE GmbH (hereinafter “BITE”), Magirus-Deutz-Straße 12, 89077 Ulm, to manage our application process. As soon as you click on a job posting on our website, you will be redirected via your browser to the BITE platform, through which we publish our job postings and through which your personal data will be processed if you submit an application. From a data protection perspective, we remain responsible to you. The job openings on our website are embedded in the form of an iFrame. The legal basis for embedding them on our website is Article 6(1)(f) of the GDPR, based on our legitimate interest in providing a simple, technically sound, consistently up-to-date, and easily accessible presentation and overview of the open positions at our company. We have entered into a data processing agreement with BITE GmbH in accordance with Article 28 of the GDPR.

In the respective job posting on the BITE platform, you have the option to upload your application documents as part of the online application process. As a result, you will be registered with us (in BITE) as an applicant, and your application documents will be stored and further processed there. If you apply to us in paper form, we will scan your application documents and likewise register you as an applicant in BITE, where your application documents will be stored and processed further.

For more information about BITE, please visit: https://www.b-ite.de/legal-notice.html.

Internal Processing

Upon receipt of your application, your applicant data will be reviewed by the Human Resources department. Suitable applications will then be forwarded internally to the business unit managers responsible for the respective open position. The next steps will then be coordinated. Within the company, access to your data is generally limited to those individuals who require it for the proper conduct of our application process. Further details regarding the processing of your personal data during the application process can be found in the Data Protection Policy, which is available in our applicant tracking system.

§ 11 Newsletter Distribution via CleverReach

(1) You can subscribe to our newsletter, through which we inform you about our current offers of interest, by providing your consent. The advertised goods and services are specified in the consent form.

(2) We use the so-called double opt-in procedure for subscribing to our newsletter. This means that after you sign up, we will send an email to the email address you provided, asking you to confirm that you are the owner of that email address and that you wish to receive the notifications. If you do not confirm your registration within 7 days, your information will be blocked and automatically deleted after one month. In addition, we store the IP addresses you use as well as the times of your registration and confirmation. The purpose of this process is to verify your registration and, if necessary, to investigate any potential misuse of your personal data.

(3) The only required information for receiving the newsletter is your email address. [Providing additional, separately marked data is voluntary and is used to address you personally.]

After your confirmation, we store your email address for the purpose of sending you the newsletter. The legal basis is Art. 6(1)(a) of the GDPR.

(4) We use CleverReach to send our newsletter. The provider is CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany (“CleverReach”). CleverReach is a service that enables the organization and analysis of newsletter distribution.

In particular, the following data is processed: your email address and—if provided by you—additional registration data (e.g., name/title), the time of registration and confirmation, the IP address you used at the time of registration to verify your consent, as well as usage data generated in connection with the distribution (see “Performance Measurement”).

This processing is used to send our newsletter containing information and advertising about our offers, to verifiably manage your consent, and to analyze and optimize the newsletter.

(5) Our newsletters sent via CleverReach contain a so-called tracking pixel (web beacon) that establishes a connection to CleverReach’s servers when the newsletter is opened. This allows us to determine whether and when a newsletter message was opened and which links were clicked. We link this information to your email address or a unique identifier in order to tailor the newsletter to the interests of our recipients. Links included in the newsletter also contain this ID. Information about your user behavior is collected exclusively in pseudonymized form; thus, the ID is not linked to your other personal data, and direct identification of individuals is ruled out.

Subscription to the newsletter, its distribution, and statistical analysis are based on your explicit consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 7(2) of the UWG. To the extent that information is stored on or read from your device for this purpose (e.g., via the tracking pixel or cookies in the subscription form), this is done on the basis of your consent pursuant to § 25(1) of the German Teleservices Data Protection Act (TDDDG).

(6) You may revoke your consent to receive the newsletter at any time and unsubscribe from it. You may revoke your consent by clicking the link provided in every newsletter email, by sending an email to info@roma.de, or by sending a message using the contact information provided in the legal notice. You may object to the aforementioned tracking at any time by clicking the separate link provided in each email or by notifying us via another contact method as described above. The information will be stored for as long as you remain subscribed to the newsletter. After you unsubscribe, we will store the data for purely statistical and anonymous purposes.

(7) The data stored by us or by CleverReach for the purpose of receiving the newsletter will be retained until you unsubscribe from the newsletter and will be deleted from the distribution list after you unsubscribe. Data stored by us for other purposes remains unaffected by this. To provide proof of the consent originally given, we may retain the registration data (in particular, the IP address and time stamp) until any applicable statute of limitations expires.

(8) We have entered into a data processing agreement with CleverReach in accordance with Article 28 of the GDPR. This is a contract required under data protection law that ensures CleverReach processes the personal data of our newsletter recipients only in accordance with our instructions and in compliance with the GDPR.

CleverReach is headquartered in Germany and stores the data on servers in Germany or Ireland within the European Union. No data is transferred to a third country outside the EU/EEA as part of this service.

For more information on data processing by CleverReach, please visit: https://www.cleverreach.com/de/datenschutz/; for information on analytics, please visit: https://www.cleverreach.com/de/funktionen/reporting-und-tracking/.

§ 12 Our Social Media Presence

(1) We maintain accounts on various social media platforms. We operate these accounts with the following providers; you can view their respective privacy policies via the corresponding links:

Instagram

Link to our page: https://www.instagram.com/roma.sonnenschutz/

Platform operator: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland

Platform’s privacy policy: https://privacycenter.instagram.com/policy/

Facebook

Link to our page: https://www.facebook.com/Roma.Sonnenschutz

Platform operator: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland Platform privacy policy: https://www.facebook.com/privacy/policy/

YouTube

Link to our page: https://www.youtube.com/ @ROMAKG

Platform operator: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland Platform privacy policy: https://policies.google.com/privacy?hl=de

LinkedIn

Link to our page: https://www.linkedin.com/company/romakg/
Platform operator: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

Platform privacy policy: https://de.linkedin.com/legal/privacy/eu

TikTok

Link to our page: https://www.tiktok.com/@roma.sonnenschutz

Platform operator: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

and

TikTok Information Technologies UK Limited, One London Wall, 6th Floor, London, EC2y 5EB, United Kingdom

Platform privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de#section-1

Pinterest

Link to our page: https://de.pinterest.com/romakg/

Platform operator: Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland.

Platform Privacy Policy: https://policy.pinterest.com/de/privacy-policy

(2) We rely on the technical platform and services of the providers for these information services. Please note that you use our social media profiles and their features at your own risk. This applies in particular to the use of interactive features (e.g., commenting, sharing, rating). When you visit our social media profiles, the providers of the social media platforms collect, among other things, your IP address and other information stored on your device in the form of cookies. This information is used to provide us, as the operators of the accounts, with statistical data regarding your interaction with us.

(3) The data processed about you in this context is processed by the platforms and may be transferred to countries outside the European Union, in particular the United States. The information collected is stored on the providers’ servers, including those outside Europe. In such cases, the provider has submitted to the EU-U.S. Privacy Framework. If the provider is not certified, we have agreed to so-called standard data protection clauses, the purpose of which is to ensure an adequate level of data protection in the third country. We do not know how the social media platforms use the data from your visit to our account and your interaction with our posts for their own purposes, how long this data is stored, or whether data is disclosed to third parties. Data processing may vary depending on whether you are registered and logged in to the social network or are visiting the site as an unregistered and/or logged-out user. When you access a post or the account, the IP address assigned to your device is transmitted to the social media platform provider. If you are currently logged in as a user, a cookie on your device can track your activity on the network. Through buttons embedded in websites, the platforms can record your visits to these websites and associate them with your respective profile. Based on this data, content or advertising can be tailored to you. If you wish to avoid this, you should log out or disable the “stay logged in” feature, delete the cookies stored on your device, and restart your browser.

(4) As the provider of this information service, we also process only the data resulting from your use of our service that you provide to us and that requires interaction. For example, if you ask a question that we can only answer via email, we will store your information in accordance with the general principles of our data processing, which we describe in this Data Protection document. The legal basis for processing your data on the social media platform is Article 6(1)(f) of the GDPR.

(5) To exercise your data subject rights, you may contact either us or the social media platform provider. If one party is not responsible for responding or must obtain the information from the other party, we or the provider will forward your request to the respective partner. Please contact the operator of the social media platform directly with any questions regarding profiling or the processing of your data when using the website. If you have questions about the processing of your interactions with us on our site, please write to us using the contact information provided above.

(6) The providers describe in their Data Protection policies (see the link in the table above) what information the social media platform receives and how it is used. There you will also find information on how to contact them and on settings for advertisements. For more information about social networks and how you can protect your data, please visit www.youngdata.de.

§ 13 Google Tag Manager

(1) We use the Google Tag Manager service provided by Google. “Google” is a group of companies consisting of Google Ireland Ltd. (the service provider), Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, as well as other affiliates of Google LLC. Google Tag Manager is a support service and processes personal data itself only for technically necessary purposes. Google Tag Manager ensures that other components are loaded, which may in turn collect data. Google Tag Manager does not access this data. For more information about Google Tag Manager, please see Google’s Privacy Policy at https://www.google.com/intl/de/policies/privacy/.

(2) The purpose of the processing is to trigger, control, and manage additional services on our website. The legal basis for the processing is our overriding legitimate interest, namely Article 6(1)(f) of the GDPR. Our legitimate interest lies in the uniform and proper integration of cookies and similar technologies, as well as in legally compliant consent management. In the course of use, it cannot be ruled out that data may be transferred to a country outside the European Union (specifically, the United States). The transfer of data to the United States is based on Article 45 of the GDPR in conjunction with the European Commission’s Adequacy Decision C(2023) 4745 of the European Commission, as the data recipient has committed to complying with the data processing principles of the Data Privacy Framework (DPF) and is also certified in accordance with the DPF. We have entered into a data processing agreement with the provider.

§ 14 Google Analytics

(1) This website uses Google Analytics, a web tracking service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The purpose of using this tool is to enable the analysis of your user interactions on websites and in apps and, through the statistics and reports obtained in this way, to improve our offerings and make them more interesting and appealing to you as a user.

(2) We track interactions between you, as a user of the website, and our website using cookies, device/browser data, IP addresses, and website or app activity. Furthermore, Google Analytics also collects your anonymized IP addresses to ensure the security of the service and to provide information about the region of the respective user (so-called “IP geolocation”). Using the anonymization feature (“IP masking”), Google truncates IP addresses by the last octet within the EU/EEA. This further protects your personal data.

(3) We use the User ID feature. With the help of the User ID, we can assign a unique, persistent ID to one or more sessions (and the activities within those sessions) and analyze user behavior across devices. For more information, please visit the following link: https://support.google.com/analytics/answer/3123662/. You can revoke your consent to the use of this feature via the links described above or through our Consent Manager.

(4) We also use Google Signals. To this end, we collect additional information in Google Analytics about users who have enabled personalized ads. This provides us with expanded reports on demographic characteristics and interests, and also allows ads to be delivered to you in cross-device remarketing campaigns. If you do not want your data to be processed in this way, you can opt out of personalized ads.

(5) Google acts as a data processor in connection with our use of the service. We have therefore entered into a corresponding data processing agreement with Google pursuant to Article 28 of the GDPR. The information collected about your use of this website and the anonymized IP addresses is generally transferred to a Google server in the United States and processed there. In such cases, Google has submitted to the EU-U.S. Data Privacy Framework. The provider is certified under the DPF.

(6) The legal basis for processing the information (which takes place for a maximum of 14 months) is your explicit consent, i.e., Article 6(1), sentence 1, letter a of the GDPR. You may withdraw your consent at any time without affecting the lawfulness of the processing that took place prior to the withdrawal. The easiest way to withdraw your consent is through our Consent Manager or by installing Google’s browser add-on, which is available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de/.

(7) For more information on the scope of services provided by Google Analytics, please visit https://marketingplatform.google.com/about/analytics/terms/de/. Google provides information on data processing when using Google Analytics at the following link: https://support.google.com/analytics/answer/6004245?hl=de/. General information on data processing—which, according to Google, also applies to Google Analytics—can be found in Google’s Data Protection Policy at https://www.google.de/intl/de/policies/privacy/.

§ 15 Google Ads

(1) We also use the Google Ads service provided by Google to draw attention to our offerings through advertisements. If you access our website via a Google ad, Google Ads will store a cookie on your device. The legal basis for the processing of your data is Art. 6(1)(a) of the GDPR; therefore, this integration takes place only with your express consent.

(2) The advertisements are delivered by Google via so-called “ad servers.” To this end, we and other websites use so-called ad server cookies, which allow us to measure certain performance metrics, such as the number of times ads are displayed or the number of clicks by users. Through the Google Ads cookies stored on our website, we can obtain information about the success of our advertising campaigns. These cookies are not intended to identify you personally. For this cookie, the following metrics are typically stored: the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions), and opt-out information (an indicator that a user no longer wishes to be targeted).

(3) The cookies set by Google enable Google to recognize your web browser. If a user visits specific pages on an Ads customer’s website and the cookie stored on their computer has not yet expired, Google and the customer can recognize that the user clicked on the ad and was redirected to that page. Each Ads customer is assigned a different cookie, so the cookies cannot be tracked across the websites of other Ads customers. By integrating Google Ads, Google receives the information that you have accessed the corresponding part of our website or clicked on one of our ads. If you are registered with a Google service, Google can associate the visit with your account. Even if you are not registered with Google or are not logged in, it is possible that the provider may obtain and store your IP address.

(4) Due to the marketing tools used, your browser automatically establishes a direct connection to Google’s server. We do not independently collect personal data through the aforementioned advertising measures; rather, we merely provide Google with the means to collect such data. We receive only statistical reports from Google that show us which ads were clicked, how often, and at what prices. We do not receive any further data resulting from the use of these advertising materials; in particular, we cannot identify users based on this information.

(5) You may withdraw your consent at any time without affecting the lawfulness of the processing that took place prior to the withdrawal. The easiest way to withdraw your consent is through our Consent Manager or via the following options: a) by adjusting your browser settings accordingly; in particular, blocking third-party cookies will prevent you from receiving ads from third-party providers; b) by configuring your browser to block cookies from the domain“www.googleadservices.com”( https://www.google.de/settings/ads), although this setting will be deleted when you clear your cookies; c) by disabling interest-based ads from providers participating in the “About Ads” self-regulatory campaign via the link https://www.aboutads.info/choices, although this setting will be deleted when you clear your cookies; d) by permanently disabling it in your Firefox, Internet Explorer, or Google Chrome browsers via the link https://www.google.com/settings/ads/plugin.

(6) For more information on data protection at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, please visit: https://www.google.com/intl/de/policies/privacy and https://services.google.com/sitestats/de.html.

§ 16 Google Conversion Tracking

(1) We use Google Ads with the additional “Google Conversion Tracking” feature. This is a method that allows us to evaluate and measure the success of our advertising campaigns. To do this, the ads are tagged with a technical identifier—such as an ID—that allows us to determine how a user interacts with the ad after clicking on it and whether one of our services is actually used. This provides us with statistical information about the total number of viewers of our ads, which ads are particularly popular, and, where applicable, further information about the results of the ad.

(2) The legal basis for the processing of your data in this regard is also Article 6(1)(a) of the GDPR; integration occurs only with your express consent. You can disable the conversion tracking feature or stop using it in the same way as described earlier for Google Ads.

§ 17 Use of Google Ads Enhanced Conversions (Advanced Conversion Tracking)

As part of Google Ads, this website uses the “Enhanced Conversions” feature (enhanced conversion tracking) to more accurately measure the success of our advertising campaigns. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”); data processing may also be carried out by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Enhanced Conversions supplements the conventional conversion tracking explained above: When you perform an action defined as a conversion on our website (e.g., complete a purchase, submit a contactform or order form, or subscribe to a newsletter) and enter personal data in the process, this information is collected, encrypted (hashed) using a secure one-way algorithm (SHA-256), and transmitted to Google in this hashed form. Google matches the hashed data with registered Google accounts to attribute the conversion to a previous click on one of our ads.

In particular, the first-party data you provide as part of the conversion—email addresses, names, cities, phone numbers—each in hashed form—as well as conversion- and click-related data, cookie information, your IP address, and device and browser information. The hashed data is therefore pseudonymous.

The processing serves to measure and track conversions more accurately, to monitor the success and optimize our Google Ads campaigns, and to improve bid management.

The storage and retrieval of information on your device, as well as the subsequent processing of your data—including its transmission to Google—are carried out exclusively on the basis of your prior consent in accordance with Section 25(1) of the German Telemedia Act (TDDDG) in conjunction with Article 6(1)(a) of the General Data Protection Regulation (GDPR).

You may revoke your consent at any time by adjusting your cookie settings via the cookie settings page. The revocation takes effect for the future and does not affect the lawfulness of the processing that took place up to that point.

Google determines the duration of storage; please refer to Google’s Data Protection Policy for details. The conversion cookies we set have varying expiration periods. The data is deleted as soon as it is no longer necessary for the stated purposes or you withdraw your consent. In general, the data is deleted by Google after it has been processed.

As part of this feature, personal data is transferred to Google LLC in the United States. The transfer is based on the European Commission’s Adequacy Decision regarding the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified; in addition, Google has entered into the EU Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). Please note that when data is transferred to the United States, access by U.S. authorities cannot be completely ruled out.

For more information on data processing by Google, please see Google’s Data Protection Policy at: https://policies.google.com/privacy.

§ 18 Google Remarketing

(1) We use Google Ads with the additional “Google Remarketing” feature. This feature allows us to create advertisements based on existing information about you and to target you again as you continue to browse the internet. This is done using cookies set when you visit our websites, through which Google tracks your usage behavior when visiting various websites and evaluates it in a pseudonymized form. According to Google, the data collected as part of remarketing is not combined with your personal data, which may be stored by Google.

(2) The legal basis for the processing of your data is Art. 6(1)(a) of the GDPR; this feature is enabled only with your express consent. You can disable the remarketing feature or opt out of it in the same manner as described above for Google Ads.

§ 19 Microsoft Advertising

We use the “Microsoft Advertising” service on our website, provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA (hereinafter referred to as “Microsoft”).

The legal basis for the use of this service is Art. 6(1)(a) of the GDPR as well as § 25(1) of the TDDDG, i.e., your explicit consent.

The Microsoft Advertising service collects and stores data and uses it to create pseudonymous user profiles. With the help of the BingAds service—a service that is part of Microsoft Advertising—we are able to track whether a user visits our website by clicking on a BingAds ad. If you reach our website via such an ad, a cookie is set on your device. If you have reached our website by clicking on a BingAds ad, a corresponding cookie is set on your device.

The so-called Microsoft Advertising UET tag is also implemented on our website. The Microsoft Advertising UET tag is a piece of code integrated into our website that, in conjunction with the cookie set when you visit our site via a Bing Ads ad, stores additional non-personally identifiable data about the use of our website. Among other things, this allows us to measure the time spent on our website and the pages visited. It also enables us to identify which Bing Ads ad directed users to our website. Your IP address is collected in encrypted form. The cookie also collects a so-called Global UID (Globally Unique Identifier), which is assigned to your browser. Alternatively or in addition, the cookie collects a user ID that can be linked to your Microsoft account, if you have one.

The information collected as described above is transmitted to Microsoft servers, which may be located in the United States, among other places. It is stored there for a maximum of 180 days. By disabling cookies through the appropriate settings in your web browser, you can prevent the cookie from being set and from collecting data. If you disable cookies in your web browser altogether, you may not be able to use our site with its full range of features.

In addition, Microsoft can use cross-device tracking to monitor your usage behavior across multiple devices you use. This enables Microsoft to display personalized ads on or within Microsoft websites and/or apps. You can disable cross-device tracking for Microsoft at http://choice.microsoft.com/de-de/opt-out.

You can revoke your consent at any time for the future via our consent tool.

For more information on data processing by Microsoft and the provider’s privacy policy, please visit: https://www.microsoft.com/de-de/privacy/privacystatement

§ 20 LinkedIn Insight Tag

(1) Furthermore, the website uses the so-called LinkedIn Insight Tag (or LinkedIn Pixel) provided by LinkedIn Ireland Unlimited Company (“LinkedIn”). By integrating this JavaScript tag, we can display interest-based and relevant advertisements (“Ads”) to you, as a user of our website, when you visit the LinkedIn social network or other websites that also use this technology, and we receive statistics about website visitors and demographics. Furthermore, we can analyze your use of our LinkedIn ads and your interest in our offers using a conversion tracking feature, and display LinkedIn ads to you on other websites via retargeting. Our goal is to improve the effectiveness of LinkedIn ads and make our website more interesting for you.

(2) By integrating the LinkedIn Insight Tag, your browser automatically establishes a direct connection to LinkedIn’s server, both when you visit the LinkedIn website and when you visit websites that have integrated the LinkedIn Insight Tag. LinkedIn and we are jointly responsible for collecting your usage data when you visit our website and for transmitting it to the provider; however, LinkedIn is solely responsible for the processing necessary to achieve the described objectives once the data has been transmitted. We have no influence over the scope and nature of LinkedIn’s use of the data; therefore, we are informing you based on the information currently available to us: By integrating the LinkedIn Insight Tag, LinkedIn receives information that you have visited the corresponding page on our website or clicked on an ad from us. If you are registered with a LinkedIn service, LinkedIn can associate the visit with your account. Even if you are not registered with LinkedIn or are not logged in, it is possible that LinkedIn may obtain your IP address, time window, and other identifying characteristics and link them to the actions associated with you.

(3) You can disable the LinkedIn Insight Tag and opt out of other advertising in the ad settings at https://www.linkedin.com/help/linkedin/answer/62931?trk=microsites-frontend_legal_privacy-policy&lang=de-DE and, additionally, at https://www.linkedin.com/psettings/guest-controls/retargetingopt-out. For additional settings and information, please visit the LinkedIn Privacy Center: https://privacy.linkedin.com/de-de?lr=1/.

(4) The legal basis for the processing of your data is Art. 6(1)(a) of the GDPR; therefore, this processing takes place only with your consent. You may withdraw your consent at any time, most easily via our Cookie Manager. LinkedIn also processes your personal data in the United States and has adhered to the EU-U.S. Privacy Framework.

(5) For more information on data processing by LinkedIn, please contact the provider, LinkedIn Ireland Unlimited Company, Attn: Legal Dept. (Privacy Policy and User Agreement), Wilton Plaza, Wilton Place, Dublin 2, Ireland; information on the LinkedIn Insight Tag: https://business.linkedin.com/de-de/marketing-solutions/insight-tag?lr=1/; privacy information: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy/.

§ 21 Advertising with Meta (Pixels and Conversion Tracking)

(1) Furthermore, the website uses advertising services provided by Meta Inc. (“Meta”). By integrating the so-called “Meta Pixel” into our website, we can display our advertising (“Meta Ads”) to users of our website and Meta’s social networks, and measure and evaluate their effectiveness (“Conversion Tracking”). This connection between Meta and our website is established technically via the “Meta Pixel.” The legal basis for the processing of your data is Art. 6(1)(a) of the GDPR; therefore, the integration takes place only with your consent.

(2) Due to the marketing tools used, your browser automatically establishes a direct connection to Meta’s server when you visit our website. We have no influence over the scope and further use of the data collected by Meta through the use of this tool and therefore provide you with the information known to us regarding these processes: Through the integration of the Meta Pixel, Meta receives the information that you have visited the corresponding page on our website or clicked on one of our ads. If you are registered with a Meta service, Meta can associate the visit with your account. Even if you are not registered with Meta or are not logged in, it is possible that the provider may obtain your IP address and other identifying characteristics and use them for profiling.

(3) The information collected is stored on Meta’s servers, including those in the U.S. In such cases, the provider has submitted to the EU-U.S. Privacy Framework and has committed to complying with applicable data protection laws regarding international data transfers.

(4) You may withdraw your consent at any time without affecting the lawfulness of the processing that took place prior to the withdrawal. The easiest way to withdraw your consent is through our Consent Manager or by clicking here. In addition, logged-in users can opt out using the provider’s feature on the respective social network.

(5) For more information on data processing by Meta, please contact Meta Inc., 1601 S California Ave, Palo Alto, California 94304, USA; Data Protection: https://www.facebook.com/privacy/policy/?entry_point=about_fb.

(6) We also use the “Custom Audiences” remarketing feature, which also utilizes the Meta Pixel, to display interest-based advertisements when you visit our website or other websites that have also integrated the Meta Pixel. This allows us to show you ads that are of interest to you, to make our website more engaging for you, and to promote our offerings.

§ 22 Use of Meta Advanced Matching

This website uses the Meta Pixel with the “Advanced Matching” feature to measure the success of our advertising campaigns on Meta’s platforms (e.g., Facebook and Instagram). The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”); data processing may also be carried out by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.

Advanced Matching supplements conventional tracking via the Meta Pixel: When you enter personal data on our website (e.g., during a purchase, registration, or when submitting a form), this information is collected, encrypted (hashed) using a secure one-way process (SHA-256) and transmitted to Meta in this hashed form. Meta matches the hashed data with the accounts of registered users on Meta platforms to associate actions on our website with your click on one of our ads and to optimize the reach of our advertising.

In particular, the first-party data you provide is processed—email addresses, names, locations, phone numbers—in hashed form in each case—as well as data collected via the pixel, such as cookie identifiers (e.g. , fbp, fbc ), your IP address, device and browser information, pages visited, and information about the triggered events. Hashing pseudonymizes the personal data.

The processing serves to more accurately track and measure conversions, monitor the success and optimize our advertising campaigns, create Custom Audiences, and serve interest-based ads on Meta platforms.

For the collection and transmission of data via the Meta Pixel, we and Meta are joint controllers within the meaning of Article 26 of the GDPR. We have entered into a corresponding agreement with Meta regarding joint controllership, which sets forth the respective obligations. Meta is solely responsible for the subsequent processing of the data under its own responsibility. Information on this can be found at https://www.facebook.com/legal/controller_addendum.

The storage and retrieval of information on your device, as well as the subsequent processing of your data—including its transmission to Meta—take place exclusively on the basis of your prior consent pursuant to § 25(1) TDDDG in conjunction with Article 6(1)(a) of the GDPR.

Meta, as the data controller, determines the duration of storage; please refer to Meta’s Data Protection Policy for details. The cookies set via the pixel have varying expiration periods. The data will be deleted as soon as it is no longer necessary for the stated purposes or you revoke your consent.

As part of this feature, personal data is transferred to Meta Platforms, Inc. in the United States. The transfer is based on the European Commission’s Adequacy Decision regarding the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Meta Platforms, Inc. is certified; in addition, Meta has entered into the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). Please note that when data is transferred to the United States, access by U.S. authorities cannot be completely ruled out.

For more information on data processing by Meta, please see Meta’s Data Protection at: https://www.facebook.com/privacy/policy.

§ 23 Use of the Meta Conversions API

In addition to the Meta technologies mentioned above, this website also uses the Meta Conversions API to measure the success of our advertising campaigns on Meta’s platforms (e.g., Facebook and Instagram) and to optimize ad delivery. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”); data processing may also be carried out by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.

The Conversions API (“CAPI”) is a supplement to the Meta Pixel and Advanced Matching, through which these events are additionally transmitted on the server side—that is, directly from our server to Meta’s servers. Server-side transmission serves to attribute conversions even when browser-based tracking is limited (e.g., due to cookie restrictions);

When you enter personal data on our website (e.g., during a purchase, registration, or when submitting a form), this information is collected, encrypted (hashed) using a secure one-way algorithm (SHA-256), and transmitted to Meta in this form. Meta matches the data with the accounts of registered users of Meta platforms to attribute actions on our website to your click on one of our ads.

The following personal data about you is processed in connection with these tools:

the first-party data you provide—email addresses, names, locations, phone numbers—in hashed form;
online identifiers for matching with Meta accounts, in particular the Facebook Browser ID (cookie fbp), the Facebook Click ID (cookie fbc ), and a user ID/Meta User ID or an external ID (external_id) transmitted to Meta;
technical data such as your IP address, browser and device information (user agent), as well as information about the triggered events (event type, time, and, if applicable, shopping cart/order data).

With the Conversions API, this data is transmitted to Meta, in whole or in part, on the server side. Hashing is used to pseudonymize your personal data.

The processing serves to more accurately attribute and measure conversions, monitor the success and optimize our advertising campaigns, create Custom Audiences, and serve interest-based advertising on Meta platforms.

For the collection and transmission of data via the Conversions API, we and Meta are joint controllers within the meaning of Article 26 of the GDPR. We have entered into a corresponding agreement with Meta regarding joint controllership, which sets forth the respective obligations. Meta is solely responsible for the subsequent processing of the data under its own responsibility. You can find more information on this at https://www.facebook.com/legal/controller_addendum.

The storage and retrieval of information on your device, as well as the subsequent processing of your data—including its transmission to Meta via the server-side Conversions API—are carried out exclusively on the basis of your prior consent in accordance with Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) GDPR.

Meta, as the data controller, determines the duration of data storage; please refer to Meta’s Data Protection Policy for details. The data will be deleted as soon as it is no longer necessary for the stated purposes or you withdraw your consent.

As part of these features, personal data is transferred to Meta Platforms, Inc. in the United States. The transfer is based on the European Commission’s Adequacy Decision regarding the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Meta Platforms, Inc. is certified; In addition, Meta has entered into the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). Please note that when data is transferred to the United States, access by U.S. authorities cannot be completely ruled out.

For more information on data processing by Meta, please see Meta’s Data Protection at: https://www.facebook.com/privacy/policy.

§ 24 Use of Meta Lookalike Audiences

This website uses the “Lookalike Audiences” feature as part of its advertising on Meta’s platforms (e.g., Facebook and Instagram). The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”); data processing may also be carried out by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.

With Lookalike Audiences, we provide Meta with a so-called source audience—for example, people who have performed specific actions on our website (tracked via the Meta Conversions API). Meta analyzes the common characteristics of this source audience and identifies other individuals within its own user base who share similar characteristics in order to serve them our advertisements. You may be part of a source audience we have created, or—due to similarities to a source audience—you may be reached with ads as a “statistical twin.”

The following data, in particular, is processed for the creation and transmission of the initial target group: the first-party data you provide—email addresses, names, locations, phone numbers in hashed form, identifiers for matching with Meta accounts (e.g., a user/Meta user ID or external_id, and, if applicable, the Facebook Click ID), your IP address, and information about the events you triggered on our website. We do not receive any personal data from Meta regarding the individuals newly reached through the lookalike process. Hashing pseudonymizes the personal data.

The purpose of this processing is to reach new potential customers who share similar characteristics with our existing contacts or website visitors, as well as to optimize and evaluate the success of our advertising campaigns.

For the collection and transfer of the data used to create the initial target group, we and Meta are joint controllers within the meaning of Article 26 of the GDPR. We have entered into a corresponding agreement with Meta regarding joint controllership. Meta is solely responsible for creating the similar target group based on its user base and for any further processing under its own responsibility. You can find more information on this at https://www.facebook.com/legal/controller_addendum.

The storage and retrieval of information on your device, as well as the subsequent processing and transmission of your data to Meta, are carried out exclusively on the basis of your prior consent in accordance with Section 25(1) of the German Telemedia Act (TDDDG) in conjunction with Article 6(1)(a) of the GDPR.

Meta, as the data controller, determines the duration of storage; please refer to Meta’s Data Protection policy for details. The data will be deleted as soon as it is no longer necessary for the stated purposes or you revoke your consent.

For more information on data processing by Meta, please see Meta’s Data Protection at: https://www.facebook.com/privacy/policy.

§ 25 Pinterest Pixel

We have integrated the so-called “Pinterest Pixel” from the social network “Pinterest” into our website. The provider of this tool is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. This technology enables us to track certain actions you take on our website. This data may subsequently be used to display interest-based ads to you on our website or on other websites of participants in the Pinterest Tag advertising network, and to target you with interest-based ads on the social network “Pinterest” for remarketing purposes within 180 days.

If you have consented to the use of this technology and the placement of the Pinterest cookie via the consent tool, or have provided your explicit consent, your browser will automatically establish a direct connection to Pinterest’s server. Through the integration of the Pinterest pixel, Pinterest receives the information that you have visited the corresponding page on our website or clicked on one of our ads. If you are registered with Pinterest, Pinterest can associate the visit with your account.

In addition to your IP address and marketing identifier, Pinterest also receives information about the device you are using, the website you visited, and the time of your visit, and can associate this data with your Pinterest account, if you have one. Furthermore, campaign-specific data—such as order value, order quantity, order number, category of purchased items, and video views—may be collected.

The Pinterest tag uses technologies that enable cross-page recognition of the user to analyze user behavior (e.g., cookies or device fingerprinting).

Pinterest processes this data on its own responsibility. We have no influence over the data collection or further processing by Pinterest.

For more information about the Pinterest Tag, please visit: help.pinterest.com/de/business/article/track-conversions-with-pinterest-tag

To the extent that consent has been obtained, the use of the aforementioned service is based exclusively on Article 6(1)(a) of the GDPR and Section 25 of the TDDDG. You may revoke the consent you have provided at any time. If consent has not been obtained, the use of this service is based on Article 6(1)(f) of the GDPR; the website operator has an overriding legitimate interest in implementing marketing measures that are as effective as possible.

Pinterest is an internationally active company, so data transfers to the United States may occur or cannot be ruled out. As appropriate safeguards, so-called standard contractual clauses have been agreed upon, and any data transfer that may occur is based on the European Commission’s standard contractual clauses in accordance with Article 46 of the GDPR. Further information and details can be found here: policy.pinterest.com/de/privacy-policy.

§ 26 TikTok Pixel

We use the so-called TikTok Pixel from the social network TikTok on our website; for users from the European Economic Area and Switzerland: TikTok Technology Limited, The Sorting Office, Ropemaker Place, Dublin 2, Dublin, D02 HD23, Ireland; and for users from the United Kingdom: TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London, EC1A 9HP, United Kingdom (hereinafter referred to simply as “TikTok”). This service enables us to retarget users of our website when they visit the “TikTok” social network. The purpose of this processing is to display interest-based advertising to you, as a TikTok user, on the platform, as well as to evaluate and improve the effectiveness of our advertising efforts.

If you have given your explicit consent to the use of the relevant cookie requiring consent, your browser will establish a connection with TikTok’s servers using the TikTok pixel once consent has been granted. Through the TikTok pixel, information is transmitted indicating that you have visited a specific subpage of our website or that you have interacted with one of our ads.

TikTok uses this information to display targeted and personalized advertisements to users of the social network and, where applicable, to create interest-based user profiles. We do not have access to the data collected from users; rather, we receive only an anonymous analysis of performance and statistics. We use this to measure the effectiveness and reach of our advertisements.

In addition, your IP address and other information about the device you are using—such as the marketing identifier, the device you are using, the website you visited, and the time of your visit—are also transmitted to TikTok. TikTok uses this data to identify users of our website and to link the interactions of those users to a TikTok user account. Once this data has been transmitted to TikTok, the provider processes it under its own responsibility.

For more information on data processing by TikTok in connection with the TikTok Pixel, please see TikTok’s Data Protection at https://www.tiktok.com/legal/page/eea/privacy-policy/de

Depending on the specific nature of the processing, we may be a joint controller with TikTok within the meaning of the GDPR.

We are jointly responsible with TikTok for the collection and transmission of data in connection with this processing. This applies to the following purposes:

Metrics and Insight Reporting
Collection and transmission of developer data and/or event data

The following processing activities are carried out independently by TikTok, each under its own responsibility:

Audience creation and ad targeting
Improvement, optimization, and personalization of ads
Improvement of security, fraud prevention, and development

In the event that we are joint controllers with TikTok under the GDPR, we have entered into a joint controller agreement with TikTok, which you can view here: https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms.

This agreement sets forth the respective responsibilities for fulfilling the obligations under the GDPR with regard to joint responsibility.

Under the joint controller agreement, we have agreed with TikTok that TikTok is responsible for fulfilling data subjects’ rights under Articles 15–20 of the GDPR, to the extent that this relates to storage or other processing by TikTok pursuant to this agreement. In all other cases, you may contact us to exercise your data subject rights.

Further information on how TikTok processes your personal data, as well as the contact details for TikTok and TikTok’s Data Protection Officer, is available at the following link: https://www.tiktok.com/legal/page/eea/privacy-policy/de

The data processed about you in this context is processed by the platform and may be transferred to countries outside the European Union, in particular the United States. The information collected may also be stored on the provider’s servers, including those located outside Europe. In such cases, the provider has entered into so-called standard data protection clauses, the purpose of which is to ensure an adequate level of data protection in the third country. For data transfers to the United States, TikTok also uses providers that have joined the EU-U.S. Data Privacy Framework as active participants, which, based on an adequacy decision by the European Commission, ensures that European data protection standards are maintained. The subcontractors used by TikTok in connection with the processing described here are certified under the Data Privacy Framework. We do not know how the social media platform uses the data from your visit to our account and your interaction with our posts for its own purposes, how long this data is stored, or whether data is shared with third parties.

Withdrawal of Your Consent

You can deactivate the TikTok Pixel feature by selecting the appropriate option in our consent tool, or you can withdraw your consent there. The lawfulness of the processing up to the time of withdrawal remains unaffected.

The legal basis for the processing described here is Art. 6(1)(a) of the GDPR and § 25(1) of the TDDDG, i.e., your explicit consent

§ 27 Use of AdRoll (Retargeting / Remarketing)

This website uses AdRoll, a service for delivering interest-based advertising (retargeting/remarketing) and for measuring the effectiveness of advertising campaigns. The provider is NextRoll, Inc., 2300 Harrison Street, 2nd Floor, San Francisco, CA 94110, USA (“NextRoll”).

AdRoll uses cookies and similar technologies (e.g., tracking pixels) to track your usage behavior on this website and on other websites. Based on this information, you will then be shown advertisements on third-party websites and social media platforms that are tailored to your presumed interests.

In connection with the use of AdRoll, the following data in particular may be processed:

truncated or pseudonymized IP address,
device and browser information (e.g., browser type, operating system),
cookie IDs and online identifiers,
pages visited and content accessed,
time of access, and interactions with advertisements.

According to the provider, the intention is not to directly identify you personally.

The processing is used to display interest-based advertising, measure the success of advertising campaigns (conversion tracking), and optimize our marketing efforts.

The use of AdRoll, as well as the storage and retrieval of information on your device, is based exclusively on your prior consent in accordance with Section 25(1) of the German Telemedia Act (TDDDG) in conjunction with Article 6(1)(a) of the GDPR. We obtain your consent via our cookie consent banner. This consent is voluntary, not required for the use of the website, and may be revoked at any time with future effect (Article 7(3) of the GDPR).

You can revoke your consent at any time by adjusting your cookie settings via the cookie settings page. In addition, you can opt out of interest-based advertising using the provider’s opt-out function (see NextRoll’s Data Protection Policy).

The cookies set by AdRoll have varying expiration periods; please refer to NextRoll’s Data Protection Policy for details. The data will be deleted as soon as it is no longer necessary for the stated purposes or you withdraw your consent.

When using AdRoll, personal data is transferred to NextRoll in the United States. Unless an adequacy decision applies, the transfer is based on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR). Please note that when data is transferred to the United States, access by U.S. authorities cannot be completely ruled out, and the level of data protection there may not correspond to European standards in every respect.

Further information: Details regarding data processing by NextRoll can be found in its Data Protection policy at: https://www.nextroll.com/privacy.

§ 28 Use of Contentsquare (Experience Analytics)

On our website, we use Contentsquare, an analytics tool designed to evaluate user behavior and optimize user-friendliness. The provider is Contentsquare SAS, 7 Rue de Madrid, 75008 Paris, France (“Contentsquare”). We use Contentsquare to analyze how visitors interact with our website in order to improve its structure and content. This involves collecting interaction and usage data such as mouse movements, clicks, scrolling behavior, time spent on the site, pages visited, and navigation paths. This data can be used to generate aggregated reports such as heat maps and analyses of typical usage patterns.

In particular, the following data about you is processed: interaction data (mouse movements, clicks, scrolling and typing behavior on control elements, time spent on the site), information about your device and browser (e.g., browser type, operating system, screen resolution, approximate location based on region), a pseudonymous identifier, and cookie information (Contentsquare cookie ID), your truncated IP address, the referrer, and the date and time of access. Entries in form fields and other sensitive content are masked by default and are not collected; direct identification of you as an individual is not intended.

This processing is used to analyze and optimize user-friendliness, to design and further develop our website, and to identify and resolve barriers to use (e.g., malfunctioning features or unclear controls).

The storage and retrieval of information on your device, as well as the subsequent processing of your data, are carried out exclusively on the basis of your prior consent in accordance with Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) of the GDPR. We obtain your consent via our consent tool. It is voluntary, not required for the use of the website, and may be revoked at any time with future effect (Article 7(3) of the GDPR).

You may revoke your consent at any time by adjusting your consent settings. The revocation takes effect for the future and does not affect the lawfulness of data processing up to the time of revocation. The cookies set by Contentsquare have varying durations; please refer to our Cookie Policy for details. The data will be deleted as soon as it is no longer necessary for the stated purposes or you withdraw your consent, but generally no later than 13 months.

We have entered into a data processing agreement with Contentsquare in accordance with Article 28 of the GDPR. This agreement ensures that Contentsquare processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

In connection with the use of Contentsquare, personal data may also be processed by subprocessors in third countries outside the EU/EEA, particularly in the United States. To the extent that a recipient is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Article 45 of the GDPR); otherwise, it is based on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). Contentsquare provides an up-to-date overview of its subprocessors and processing locations.

For more information about Contentsquare, visit: https://contentsquare.com/de-de/privacy-policy/.

§ 29 Dealer Search, Contact Requests, and Lead Analysis

Through our website, we offer you the ability to search for a suitable sales partner or retailer for our products. The purpose of the processing is to establish contact between you and a suitable Distributor of your choice (“lead”) and to statistically analyze the lead-generated revenue by the Distributor. In this context, we collect the following data from you:

• First name

• Last name

• Email address

• Phone number

• Additional voluntary information (free-text field)

• Revenue generated by the lead

We will forward the data you provide to the respective ROMA specialist partner so they can contact you. The specialist partner is selected based on your ZIP code. If the originally selected or designated specialist partner is unable to process your request, we also reserve the right—based on your consent—to forward your data to another suitable specialist partner from our regional partner network so that your request can be processed without unnecessary delay. In doing so, we will select the nearest partners from the regional network whenever possible. You can view these by entering your address—or at least your ZIP code—in the search field.

We are subsequently informed of the revenue generated from each lead. We analyze these revenue figures for statistical purposes. The legal basis for this processing is Article 6(1)(a) of the GDPR, namely your explicit and voluntary consent. We store your data until the purpose for which it was collected no longer applies, but no longer than the statutory retention periods. You can obtain further information regarding the processing of your data by the specific ROMA specialist partner you have selected directly from that ROMA specialist partner.

§ 30 Use of Klick-Tipp

In our online communication with you, we use the services of KLICK-TIPP LIMITED, 15 Cambridge Court, 210 Shepherd’s Bush Road, London W6 7NJ, United Kingdom. The representative of KLICK-TIPP LIMITED within the meaning of Article 27 of the GDPR is Waterton Knowledge Center WKC UG, Friedrichstr. 53a, 15537 Erkner, represented by Ulf Castelle, DSGVO-Vertreter@klicktipp.com. We obtain these services through a master agreement with Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim. Digistore24 is a reseller that procures products or services, such as Klick-Tipp, and sells them to buyers without significant further processing. We have also entered into a data processing agreement with Klick-Tipp itself in accordance with Article 28 of the GDPR. This ensures that we have full control over the personal data processed there and that Klick-Tipp strictly follows our instructions.

We store your contact information with Klick-Tipp and, where applicable, process the data we collect via the online marketing tools described in more detail in the Data Protection policy. This is because these providers are fully integrated with Klick-Tipp via a secure interface. Consequently, it is possible that Klick-Tipp may become aware of this data; however—as mentioned above—Klick-Tipp has no independent right to use this data and is fully subject to our instructions.

Furthermore, at Klick-Tipp, we have the option to link your personal data to so-called tags. Klick-Tipp distinguishes between two types of tags:

SmartTags: When a contact signs up via a registration form, they automatically receive a tag with the name of the respective registration form. In addition, Klick-Tipp automatically sets the tags “Email received,” “Email opened,” “Email clicked,” and “Email viewed in browser.”

Manual Tags: In addition to SmartTags, you can create manual tags. For example, you can assign contacts the tag “Customer” or—even more specifically—the tag “Purchased Product B.”

Details about these and other features we use at Klick-Tipp can be found in the Klick-Tipp Manual. The legal basis for the processing of your personal data in this context is Article 6(1)(a) of the GDPR, namely your voluntary and explicit consent. To the extent that information is stored on or read from your device for this purpose (e.g., via tracking pixels in the newsletter), this is done on the basis of your consent pursuant to Section 25(1) of the German Telecommunications Data Protection Act (TDDDG).

Your data will be stored until you unsubscribe from the newsletter and will be deleted from the distribution list after unsubscription, or until the purpose no longer applies insofar as other applications are concerned. To provide evidence of the consent originally granted, we may retain the registration data (in particular, the IP address and time of registration) until the expiration of any applicable statutes of limitations.

Since KlickTipp is headquartered in the United Kingdom, your data will be transferred to a third country outside the EU/EEA. For the United Kingdom, there is an adequacy decision by the European Commission (Art. 45 GDPR) certifying an adequate level of data protection; the transfer is permitted on this basis. To the extent that KlickTipp engages subprocessors in other third countries in individual cases, this is done only under appropriate safeguards (adequacy decision pursuant to Art. 45 GDPR or standard contractual clauses pursuant to Art. 46 GDPR).

You can find Klick-Tipp’s Data Protection Policy here; you can find Klick-Tipp’s Anti-Spam Policy here.

§ 31 ChatGPT Ads and Conversion Tracking

We display advertisements within the ChatGPT service. The provider is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (“OpenAI”). OpenAI is solely responsible for displaying the ads within ChatGPT and for the processing of ChatGPT users’ data that takes place in connection therewith. We therefore have no influence over OpenAI’s processing of your personal data in this regard.

To measure the effectiveness of our campaigns and attribute conversions—that is, events defined by us such as your page view, the submission of the contact form in our dealer search, and customer conversion —to the displayed ads, we also use the pixel provided by OpenAI and the Conversion API on our website. In addition, we receive reporting data from OpenAI, specifically reports, analyses, metrics, and insights related to the conversion tools, which we use to measure, analyze, optimize, and report on the conversion tools and services.

The OpenAI pixel and the OpenAI Conversion API are only loaded and executed if and after you have given your consent via our consent management system (Cookiebot by Usercentrics). Until then, and in the event that you do not give your consent, they remain blocked.

The legal basis for storing information on your end device and for accessing information already stored there is your consent pursuant to Section 25(1) of the TDDDG. The legal basis for the subsequent processing of your personal data, including its transfer to OpenAI, is your consent pursuant to Article 6(1)(a) of the GDPR. Consent is voluntary; if you do not provide it, you will not face any disadvantages when using our website, and the processing described here will not take place.

The following data is processed as part of this processing:

the name of the triggered conversion event,
the time of the event (timestamp),
the URL of the page on which the event was triggered, as well as the previously visited page (referrer),
the campaign or click ID that was passed from the ad when our website was accessed,
the conversion value and currency,
an order or transaction ID, as well as an event ID to prevent double-counting,
your IP address,
information about your browser and device (including user agent, language setting, screen resolution),
the identifier assigned as part of the conversion tag.

If you have given your consent, we will also transmit the following information or events—which you provided during the order process or in the inquiry form—to OpenAI:

Event type,
timestamp,
hashed contact information
an order value, if applicable.

This information is converted into checksums (“hash values”) using the SHA-256 algorithm in your browser before it is transmitted. We do not transmit the underlying plaintext data to OpenAI. OpenAI compares the hash values with the corresponding values from user accounts registered with OpenAI in order to attribute a conversion to a previously displayed ad.

We process the data to attribute conversions to our ChatGPT advertising campaigns, measure the effectiveness of our ads, and evaluate and optimize our campaigns. OpenAI also processes the transmitted data for its own purposes in accordance with the terms and conditions applicable to its advertising services, in particular to provide reports and to measure, optimize, and improve its advertising services.

No automated decision-making in individual cases—including profiling—with legal effects or similarly significant adverse effects within the meaning of Article 22(1) of the GDPR takes place.

For information on data transfers to third countries in the course of processing carried out by OpenAI under its own responsibility, please refer to the provider’s privacy policy linked at the end of this section.

We retain the conversion data stored by us only as long as necessary for the purposes stated or as required by statutory retention obligations; thereafter, it is deleted or anonymized. The retention period at OpenAI is based on OpenAI’s specifications and is determined by the purpose of the processing, the nature and sensitivity of the data, the existing risk, and legal obligations.

You may revoke your consent at any time with future effect. The lawfulness of the processing carried out prior to the revocation remains unaffected; data already transmitted to OpenAI is not affected by the revocation. You can revoke your consent via the settings of our consent management system: Cookie Settings

For more information on processing by OpenAI and on exercising your rights with respect to OpenAI, please visit https://openai.com/de-DE/policies/eu-privacy-policy/ and https://help.openai.com/de-de/articles/20001047-ads-in-chatgpt

§ 32 Changes to This Data Protection Policy

We keep this Data Protection up to date, which is why we may need to adapt it from time to time to reflect the current legal situation. You can always find the latest version of this Data Protection at https://www.roma.de/datenschutz.

To the top