Privacy Policy

We are very pleased that you are interested in our organisation. The protection of your personal data is particularly important to our management. You can use our websites without disclosing any personal data to us. However, if you wish to make use of more specific services via our websites, including our other internet presences, applications and social media pages, we may need to process your personal data. If we wish to process data about you and cannot rely on any other legal basis, we will always ask for your consent first (e.g. via a cookie banner).

When handling your personal data (such as name, address, e-mail or telephone number), we always comply with the applicable data protection laws. With this Privacy Policy, we inform you about which data we process. In addition, this Privacy Policy tells you which data subject rights you have.

We have implemented various technical and organisational measures to protect your data on our websites as well as possible. Nevertheless, there are always risks on the internet, and complete protection is not possible. You may therefore also transmit your personal data to us by other means, for example by telephone, if you prefer.

This Privacy Policy serves not only to fulfil the obligations under the GDPR and to comply with the law of the Member States of the European Union (EU) and the European Economic Area (EEA). This Privacy Policy is also intended to ensure compliance with legal provisions such as those of the United Kingdom (UK GDPR), the Swiss Federal Act on Data Protection and the Swiss Data Protection Ordinance (FADP, DPO), the California Consumer Privacy Act (CCPA/CPRA), China's Personal Information Protection Law (PIPL), the Delaware Personal Data Privacy Act (DPDPA), the Tennessee Information Protection Act (TIPA), the Minnesota Consumer Data Privacy Act (MCDPA), the Iowa Act Relating to Consumer Data Protection (ICDPA), the Maryland Online Data Privacy Act (MODPA), the Nebraska Data Privacy Act (NDPA), the New Hampshire Consumer Data Privacy Law (SB255), the New Jersey Data Privacy Law (SB332), the South Carolina Consumer Privacy Bill (House Bill 4696) and other global data protection regulations, and is to be interpreted accordingly. For each country, state or federal state, the following Privacy Policy is to be interpreted in such a way that the terms and legal bases used correspond to the terms and legal bases used in the respective country or state.

For reasons of better readability, the simultaneous use of the male, female, diverse and other gender identity forms (m/f/d/other) is dispensed with on our websites, in publications, in communication and in our Privacy Policy. All wording used applies equally to all genders.

1. Definitions

In our Privacy Policy, we use specific terms from various data protection laws. We want our policy to be easy to understand and therefore explain these terms in advance.

The following definitions are, where applicable, to be interpreted or extended on the basis of the case law of the General Court of the European Union (EGC), the Court of Justice of the European Union (CJEU), the Swiss Federal Supreme Court (BGE), the Supreme Court of the United Kingdom (UKSC), or on the basis of national data protection laws or national case law of a country or state, including but not limited to California, including judge-made law, also under common law, if this is necessary for the application of the law in the individual case.

In this Privacy Policy, we use, among others, the following terms:

a) Personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter “data subject” where applicable). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, or who must be regarded as such under national data protection laws or the national case law of a country or state, including judge-made law, also under common law.

b) Data subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller, a processor, an international organisation or another data recipient, as well as persons who must be regarded as such under national data protection laws or the national case law of a country or state, including judge-made law, also under common law.

c) Processing

Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

d) Restriction of processing

Restriction of processing means the marking of stored personal data with the aim of limiting its processing in the future.

e) Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

g) Controller

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

h) Processor

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

i) Recipient

Recipient means a natural or legal person, public authority, agency or other body to which the personal data is disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients.

j) Third party

Third party means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or the processor, are authorised to process personal data.

k) Consent

Consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to them.

2. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the Member States of the European Union and in the European Economic Area, the UK data protection laws, the Swiss data protection laws (FADP, DPO), the Californian data protection laws (CCPA/CPRA), Chinese data protection law (PIPL), as well as international laws and other provisions of a data protection nature is:

Stephan Andreas

Lindenstr. 16

35619 Braunfels

Germany

Phone: +4915738326372

E-mail: stephan.andreas@battojutsu.de

Website: battojutsu.de

3. Collection of general data and information

Each time our websites are accessed by a data subject or an automated system, they collect a range of general data and information. This general data and information is stored in the log files of the respective server. The following may be collected, among other things: (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our websites (so-called referrer), (4) the sub-pages which are accessed on our websites via an accessing system, (5) the date and time of access to the website, (6) an Internet Protocol address (IP address), (7) the Internet service provider of the accessing system and (8) other similar data and information which serve to avert danger in the event of attacks on our information technology systems.

When using this general data and information, we do not draw any conclusions about the data subject. Rather, this information is needed to (1) deliver the content of our websites correctly, (2) optimise the content of our websites and the advertising for them, (3) ensure the long-term functionality of our information technology systems and the technology of our websites, and (4) provide law enforcement authorities with the information necessary for prosecution in the event of a cyber attack. This anonymously collected data and information is therefore evaluated by us statistically on the one hand and, furthermore, with the aim of increasing data protection and data security in our company, in order ultimately to ensure an optimal level of protection for the personal data we process. The data of the server log files is stored separately from all personal data provided by a data subject.

The purpose of the processing is the averting of danger and the safeguarding of IT security, as well as the aforementioned purposes. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is, in particular, the protection of our information technology systems. The log files are deleted once the stated purposes have been achieved.

4. Contact option via the website and other data transmissions, and your consent

Our websites contain information that enables quick electronic contact with our company as well as direct communication with us, which also includes a general address for so-called electronic mail (e-mail address) and, where applicable, a telephone number. If a data subject contacts us by e-mail, via a contact form, via an input form or otherwise, the personal data transmitted by the data subject is stored automatically. Such personal data transmitted to us by a data subject on a voluntary basis is processed for the purposes of handling the request or contacting the data subject.

For the transmission, storage and processing of your contact data and enquiries and for contacting you, we obtain your consent pursuant to Art. 6 (1) (a) GDPR and Art. 49 (1) (1) (a) GDPR as follows:

By transmitting your personal data, you voluntarily consent to the processing of the personal data you have entered or transmitted for the purposes of handling the enquiry and to being contacted. By transmitting your data to us, you also voluntarily give your explicit consent pursuant to Art. 49 (1) (1) (a) GDPR to data transfers to third countries to and by the companies named in this Privacy Policy and for the purposes stated, in particular for such transfers to third countries for which an adequacy decision of the EU/EEA does or does not exist, as well as to companies or other bodies that are not covered by an existing adequacy decision on the basis of self-certification or other accession criteria, and in which or for which there are significant risks and no appropriate safeguards for the protection of your personal data (e.g. due to Section 702 FISA, Executive Order EO12333 and the CLOUD Act in the USA). When giving your voluntary and explicit consent, you were aware that an adequate level of data protection may not exist in third countries and that your data subject rights may not be enforceable. You may withdraw your consent under data protection law at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. With a single action (the entry and transmission), you give several consents. These are consents under EU/EEA data protection law as well as those under the CCPA/CPRA, ePrivacy and telemedia law, and other international legal provisions, which are required, among other things, as the legal basis for any planned further processing of your personal data. By your action, you also confirm that you have read and taken note of this Privacy Policy.

5. Routine erasure and restriction of personal data

We process and store personal data for the period necessary to achieve the purpose of the processing, or insofar as this has been provided for by the European legislator of directives and regulations or another legislator in laws or regulations to which we are subject, or for as long as a legal basis for the processing exists.

If the purpose of the processing ceases to apply, or if a storage period prescribed by the European legislator of directives and regulations or another competent legislator expires, or if the legal basis for the processing ceases to apply, the personal data is routinely restricted or erased in accordance with the statutory provisions.

6. Rights of the data subject under the GDPR

a) Right to confirmation

Every data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed.

If a data subject wishes to exercise this right, they may contact us at any time.

b) Right of access

Every data subject has the right to obtain from the controller, at any time and free of charge, information about the personal data stored about them and a copy of that data. Furthermore, the European legislator of directives and regulations has granted the data subject access to the following information:

• the purposes of the processing,

• the categories of personal data being processed,

• the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations,

• where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period,

• the existence of a right to rectification or erasure of the personal data concerning them, or to restriction of processing by the controller, or of a right to object to such processing,

• the existence of a right to lodge a complaint with a supervisory authority,

• where the personal data is not collected from the data subject: any available information as to its source,

• the existence of automated decision-making, including profiling, pursuant to Art. 22 (1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Furthermore, the data subject has a right to be informed as to whether personal data has been transferred to a third country or to an international organisation. Where this is the case, the data subject also has the right to be informed of the appropriate safeguards relating to the transfer.

If a data subject wishes to exercise this right, they may contact us at any time.

c) Right to rectification

Every data subject has the right to obtain without undue delay the rectification of inaccurate personal data concerning them. Furthermore, taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.

If a data subject wishes to exercise this right, they may contact us at any time.

d) Right to erasure (right to be forgotten)

Every data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, where one of the following grounds applies and insofar as the processing is not necessary:

• The personal data was collected or otherwise processed for purposes for which it is no longer necessary.

• The data subject withdraws the consent on which the processing was based pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing.

• The data subject objects to the processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 (2) GDPR.

• The personal data has been unlawfully processed.

• The erasure of the personal data is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject.

• The personal data was collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.

If one of the above grounds applies and a data subject wishes to arrange for the erasure of personal data stored by us, they may contact us at any time.

Where we have made the personal data public and our organisation, as controller, is obliged pursuant to Art. 17 (1) GDPR to erase the personal data, we shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing the published personal data that the data subject has requested the erasure by those other controllers of all links to, or copies or replications of, that personal data, insofar as the processing is not necessary.

e) Right to restriction of processing

Every data subject has the right to obtain from the controller restriction of processing where one of the following conditions is met:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.

• The processing is unlawful, the data subject opposes the erasure of the personal data and requests the restriction of its use instead.

• The controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise or defence of legal claims.

• The data subject has objected to the processing pursuant to Art. 21 (1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override those of the data subject.

If one of the above conditions is met and a data subject wishes to request the restriction of personal data stored by us, they may contact us at any time.

f) Right to data portability

Every data subject has the right to receive the personal data concerning them, which the data subject has provided to a controller, in a structured, commonly used and machine-readable format. They also have the right to transmit that data to another controller without hindrance from the controller to which the personal data was provided, where the processing is based on consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising their right to data portability pursuant to Art. 20 (1) GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

If a data subject wishes to exercise this right, they may contact us at any time.

g) Right to object

Every data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them which is based on Art. 6 (1) (e) or (f) GDPR. This also applies to profiling based on those provisions.

In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

If we process personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data for the purposes of such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If the data subject objects to us to the processing for direct marketing purposes, we will no longer process the personal data for those purposes.

In addition, the data subject has the right, on grounds relating to their particular situation, to object to the processing of personal data concerning them which is carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR, unless such processing is necessary for the performance of a task carried out for reasons of public interest.

If a data subject wishes to exercise this right, they may contact us at any time. Furthermore, in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject is free to exercise their right to object by automated means using technical specifications.

h) Automated individual decision-making, including profiling

Every data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, provided that the decision (1) is not necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is not authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) is not based on the data subject's explicit consent.

If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and the controller, or (2) is based on the data subject's explicit consent, we implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.

If a data subject wishes to exercise this right, they may contact us at any time.

i) Right to withdraw consent under data protection law

Every data subject has the right to withdraw consent to the processing of personal data at any time.

If a data subject wishes to exercise this right, they may contact us at any time.

7. General purpose of the processing, categories of data processed and categories of recipients

The general purpose of the processing of personal data is the handling of all matters concerning the controller, customers, prospective customers, business partners or other contractual or pre-contractual relationships between the groups mentioned (in the broadest sense), or legal obligations of the controller. This general purpose applies where no more specific purposes are stated for a particular processing operation.

The categories of personal data we process are customer data, prospective customer data, employee data (including applicant data) and supplier data. The categories of recipients of the personal data are public bodies, external bodies, internal processing, intra-group processing and other bodies.

A list of our processors and of the data recipients in third countries and, where applicable, of the international organisations is either published on our website or can be requested from us free of charge.

8. Legal bases for the processing

Art. 6 (1) (a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, with processing operations that are necessary for the supply of goods or the provision of any other service or consideration, the processing is based on Art. 6 (1) (b) GDPR. The same applies to processing operations that are necessary for carrying out pre-contractual measures, for example in the case of enquiries about our products or services. If we are subject to a legal obligation which requires the processing of personal data, for example for the fulfilment of tax obligations, the processing is based on Art. 6 (1) (c) GDPR.

In rare cases, the processing of personal data may become necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance data or other vital information had to be passed on to a doctor, a hospital or other third parties. The processing would then be based on Art. 6 (1) (d) GDPR.

If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, the legal basis is Art. 6 (1) (e) GDPR.

Finally, processing operations could be based on Art. 6 (1) (f) GDPR. This legal basis is used for processing operations that are not covered by any of the aforementioned legal bases, where the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Such processing operations are permitted to us in particular because they have been specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed, for example, where the data subject is a client of the controller (Recital 47, sentence 2 GDPR).

9. Legitimate interests in the processing pursued by the controller or a third party, and direct marketing

If the processing of personal data is based on Art. 6 (1) (f) GDPR and no more specific legitimate interests are stated, our legitimate interest is the conduct of our business for the benefit of the well-being of our staff and our shareholders.

We may send you direct marketing about our own goods or services that are similar to the goods or services you have enquired about, commissioned or purchased. You may object to direct marketing at any time (e.g. by e-mail). You will not incur any costs for this other than the transmission costs according to the basic rates. The processing of personal data for direct marketing purposes is based on Art. 6 (1) (f) GDPR. The legitimate interest is direct marketing.

Our messages and newsletters may also constitute communication for direct marketing purposes within the meaning of Art. 13 (2) of EU Directive 2002/58 (Directive on privacy and electronic communications) and the national law resulting from that Directive, provided that we obtained your electronic and other contact details in the context of the sale of a service or a product, which includes the creation of a free user account that, among other things, allows you to access free content on our websites and publications (newsletters etc.), and provided that we use the direct marketing to advertise similar products or services, so that the direct marketing is permissible even without consent (cf. CJEU, judgment of 13 November 2025, Case C-654/23). In such cases, you may refuse the use of your contact details at any time free of charge.

10. Period for which the personal data will be stored

The criterion for the period of storage of personal data is the respective statutory retention period. Where no statutory retention period exists, the criterion is the contractual or internal retention period. After expiry of the period, the corresponding data is routinely erased, provided that it is no longer required for the performance of a contract or the initiation of a contract. This applies in particular to all processing operations for which no more specific criteria have been defined.

11. Statutory or contractual requirements to provide the personal data; necessity for the conclusion of a contract; obligation of the data subject to provide the personal data; possible consequences of failure to provide such data

We inform you that the provision of personal data is partly required by law (e.g. tax regulations) or may also result from contractual provisions (e.g. information on the contractual partner). Sometimes it may be necessary for the conclusion of a contract that a data subject provides us with personal data which must subsequently be processed by us. The data subject is, for example, obliged to provide us with personal data when our organisation concludes a contract with them. Failure to provide the personal data would mean that the contract with the data subject could not be concluded. Before personal data is provided by the data subject, the data subject must contact us. We will clarify to the data subject, on a case-by-case basis, whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data, and what the consequences of failure to provide the personal data would be.

12. Existence of automated decision-making

As a responsible company, we normally refrain from automated decision-making or profiling. If, in exceptional cases, we carry out automated decision-making or profiling, we will inform the data subject either separately or via a sub-section in our Privacy Policy (here on our website). In this case, the following applies:

Automated decision-making, including profiling, may take place if (1) this is necessary for entering into, or the performance of, a contract between the data subject and us, or (2) this is authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or (3) this is based on the data subject's explicit consent.

In the cases referred to in Art. 22 (2) (a) and (c) GDPR, we implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests. In these cases, you have the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

Meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject, is set out in this Privacy Policy where applicable.

13. Recipients in a third country and appropriate or suitable safeguards, and the means by which to obtain a copy of them or where they have been made available.

Pursuant to Art. 46 (1) GDPR, the controller or a processor may transfer personal data to a third country only if the controller or processor has provided appropriate safeguards, and on condition that enforceable rights and effective legal remedies are available to the data subjects. Appropriate safeguards may be provided for, without requiring any specific authorisation from a supervisory authority, by standard data protection clauses, Art. 46 (2) (c) GDPR.

The EU standard data protection clauses or other appropriate safeguards are agreed with all recipients from third countries prior to the first transfer of personal data, or the transfers are based on adequacy decisions. Consequently, it is ensured that appropriate safeguards, enforceable rights and effective legal remedies are guaranteed for all processing of personal data. Every data subject can obtain a copy of the standard data protection clauses or adequacy decisions from us. In addition, the standard data protection clauses and adequacy decisions are available in the Official Journal of the European Union.

Art. 45 (3) GDPR empowers the European Commission to decide, by means of an implementing act, that a non-EU country ensures an adequate level of protection. This means a level of protection for personal data that is essentially equivalent to the level of protection within the EU. The effect of adequacy decisions is that personal data can flow from the EU (and from Norway, Liechtenstein and Iceland) to a third country without any further obstacles. Similar rules apply to the United Kingdom, Switzerland and some other countries.

In all cases in which the European Commission, or a government or competent authority of another country, has decided that a third country ensures an adequate level of protection and/or a valid framework exists (e.g. EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Framework, UK Extension to the EU-U.S. Data Privacy Framework), all transfers by us to the members of such frameworks (e.g. self-certified entities) are based exclusively on that entity's membership of the respective framework or on the respective adequacy decisions. If we or one of our group companies are a member of such a framework, all transfers to us or our group company are based exclusively on the membership of the respective company in that framework. If we or one of our group companies are established in a third country with an adequate level of protection, all transfers to us or our group company are based exclusively on the respective adequacy decisions.

Every data subject can obtain a copy of the frameworks from us. In addition, the frameworks are also available in the Official Journal of the European Union, in the published legislative materials, or on the websites of data protection supervisory authorities or other authorities or institutions.

14. Right to lodge a complaint with a data protection supervisory authority

As the controller, we are obliged to inform the data subject of the existence of a right to lodge a complaint with a supervisory authority. The right to lodge a complaint is governed by Art. 77 (1) GDPR. Under this provision, without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to them infringes the General Data Protection Regulation. The right to lodge a complaint has been restricted by the Union legislator solely to the effect that it can only be exercised before a single supervisory authority (Recital 141, sentence 1 GDPR). This rule is intended to avoid duplicate complaints in the same matter by the same data subject. If a data subject wishes to complain about us, we therefore ask that only a single supervisory authority be contacted.

15. Data protection provisions on the deployment and use of Nextcloud

We use Nextcloud as a cloud solution for storing, synchronising and sharing files, calendars, contacts and other information within our company. Nextcloud enables us to operate a self-hosted cloud infrastructure in which all data is stored on servers controlled by us or by commissioned hosting providers. In the course of use, personal data may be processed, in particular when creating and managing user accounts, sharing files, managing calendars and contacts, and when using integrated functions such as comments, tasks or video conferences. The data processed includes, among other things, names, user names, e-mail addresses, profile pictures, IP addresses, timestamps, uploaded or synchronised files, calendar events, contacts and communication content.

In addition, Nextcloud processes technical information about the end devices used, the browsers and operating systems employed and the way in which the service is used. The data is processed in order to manage user access, to secure the transmitted content, to version files and to enable real-time collaboration on shared content. Depending on the configuration of the Nextcloud instance, logs of user activity, file changes or error reports may also be stored. The processing takes place entirely within the environment controlled by us or by a commissioned hosting partner.

The operating company of the service and thus the recipient of the personal data is: Nextcloud GmbH, Albrechtstraße 14b, 10117 Berlin, Germany.

Purposes for which the personal data is to be processed and the legal basis for the processing: The purpose of the processing is the secure storage, synchronisation and sharing of files and information, collaboration within the team and the central management of digital work resources. The processing is carried out on the basis of Art. 6 (1) (b) GDPR, i.e. for the performance of a contract to which the data subject is party, and Art. 6 (1) (f) GDPR. The legitimate interest lies in secure and efficient collaboration, self-determination over the data infrastructure and control over stored and processed content.

The criteria for determining the period for which the personal data is processed are the contractual relationship between us and the operating company of the service, or statutory or contractual retention periods. The provision of the personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide personal data to us or to the operating company of the service. If you do not provide it, however, it may not be possible to use our services or those of the operating company of the service.

Further information and the applicable data protection provisions of Nextcloud can be found at https://nextcloud.com/privacy/.

16. Data protection provisions on the deployment and use of Hetzner

Hetzner Online GmbH is a provider of hosting services and data centre infrastructure offering a broad range of products, from web hosting and managed hosting to dedicated servers and cloud solutions. With powerful and reliable technology, Hetzner supports companies and private individuals in building and scaling their online presence. Customers benefit from state-of-the-art data centres, comprehensive security and data protection, and dedicated customer service.

When Hetzner services are used, personal data such as names, addresses, contact details, payment information and usage data of the services provided is processed. This information is necessary to manage user accounts, provide services, offer support and ensure the security of the systems.

The operating company of the service and thus the recipient of the personal data is: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The representative under national law in the United Kingdom is: Hetzner Ltd., 7 Coronation Road, Dephna House, Launchese 105, London, NW10 7PQ, United Kingdom.

Purposes for which the personal data is to be processed and the legal basis for the processing: The purpose of the processing lies in the use and optimisation of hosting services and data centre infrastructure. The processing is based on Art. 6 (1) (b) GDPR for the performance of a contract to which the data subject is party, and on Art. 6 (1) (f) GDPR, the legitimate interest being the provision and use of secure, reliable and efficient hosting solutions.

Further information and the applicable data protection provisions of Hetzner can be found at https://www.hetzner.com.

17. Data protection provisions on the deployment and use of netcup

netcup GmbH is a German provider of web hosting, servers, domains and other internet services. The company is characterised by high-quality products, comprehensive services and a strong focus on IT security.

When netcup services are used, personal data such as names, e-mail addresses, physical addresses, telephone numbers, payment information and technical data such as IP addresses or log files is processed. This information is necessary to provide the requested services, manage customer accounts, submit support requests and ensure the security of the systems.

The operating company of the service and thus the recipient of the personal data is: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany.

Purposes for which the personal data is to be processed and the legal basis for the processing: The purpose of the processing lies in the use and administration of the hosting and internet services. The processing is based on the performance of a contract (Art. 6 (1) (b) GDPR) to which the data subject is party, and on legitimate interests (Art. 6 (1) (f) GDPR), such as the improvement of our services, ensuring network and information security and the use of external hosting providers.

Further information and the applicable data protection provisions of netcup can be found at https://www.netcup.de.

18. Data protection provisions on the deployment and use of Matomo

Matomo is an open-source web analytics platform that enables website operators to understand the behaviour of their visitors without impairing users' privacy beyond what is necessary. Unlike other analytics tools, Matomo places particular emphasis on data protection and is a privacy-friendly alternative in which control over the data remains entirely with the website operator. Matomo provides detailed insights into website visits, including page views, time spent on the site, devices used, search terms and the geographical origin of visitors, without collecting or storing personally identifiable information unless this has been expressly permitted.

When Matomo is used, personal data such as IP addresses (which can be anonymised), individual user IDs (to distinguish between visitors), pages visited, times of page views and browser information may be processed. This data is used to compile usage statistics for websites in order to improve the user experience and analyse the effectiveness of web content. Matomo offers extensive configuration options to ensure compliance with the GDPR.

The application is installed on our own IT infrastructure. We are the operating company of the service.

The processing of the personal data is based on our legitimate interest in analysing user behaviour (Art. 6 (1) (f) GDPR) in order to optimise the offering and presentation of the website, and on ensuring IT security. In cases in which we obtain explicit consent from visitors (e.g. for the setting of cookies), the processing is additionally based on the users' consent (Art. 6 (1) (a) GDPR).

The criteria for determining the period for which the personal data is processed are the statutory or contractual retention periods. The provision of the personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide us with personal data. If you do not provide it, however, it may not be possible to use the services.

Further information on data collection and data processing by Matomo, as well as on the privacy settings and privacy options, can be found directly on the Matomo website at https://matomo.org.

This Privacy Policy was created using a specialised generator developed by lawyers specialising in data protection law, certified data protection auditors and the ISO 27701 certification body in order to ensure legally sound wording.