Privacy Policy

Thank you for your visit and your interest in our website. In the following, we would like to inform you about how we process your personal data. This website and all services associated with it are an offering of Driventic GmbH.


Controller for the processing of data is:

Driventic GmbH
Erchenstraße 58
89522 Heidenheim an der Brenz
Deutschland
E-mail: info@driventic.com

You can contact our Data Protection Officer directly via DSB-driventic@intersoft-consulting.de.

1. Purposes of Data Processing and Legal Bases

We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the applicable national data protection laws for the following general purposes:

• For the performance of contractual obligations (Art. 6(1)(b) GDPR): Personal data is processed for the implementation of pre-contractual measures and the performance of contractual obligations, particularly in connection with orders, inquiries, or the use of our services.

• For compliance with legal obligations (Art. 6(1)(c) GDPR): Processing may be necessary to comply with legal obligations, such as commercial or tax-related retention requirements.

• For the purposes of legitimate interests (Art. 6(1)(f) GDPR): Processing may be carried out to safeguard our legitimate interests or those of third parties. Our legitimate interests may include ensuring IT security, pursuing marketing interests, or optimizing our services.

• Based on your consent (Art. 6(1)(a) GDPR): If you have given us your consent to process your personal data for specific purposes (e.g., to send newsletters or analyze your user behavior), the processing will be carried out on this basis. You may withdraw your consent at any time with effect for the future.

The specific purposes of processing and the applicable legal bases in each individual case can be found in the following sections of this Privacy Policy.

External service providers and partner companies receive data only to the extent strictly necessary for the respective service. Where service providers process personal data on our behalf and under our instructions, we conclude data processing agreements pursuant to Art. 28 GDPR and require them to implement appropriate technical and organizational measures to protect your data.

2. Data We Process Through Your Use of the Website

When you access our website, your browser automatically transmits technical information to our website server, where it is processed in log files. This processing is necessary to provide the website, ensure its stability and security, and detect technical errors or unauthorized access attempts.

• The IP address of the requesting device

• Date and time of access

• Name and URL of the requested file

• Website from which access originated (referrer URL)

• Browser used and, where applicable, the operating system of your device, as well as the name of your internet service provider

We process the aforementioned data for the following purposes:

• Ensuring a smooth connection to the website,

• Ensuring convenient use of our website,

• Evaluating system security and stability.

Processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and user-friendly provision of the website. Log data is stored only for as long as necessary to fulfill these purposes and is subsequently deleted or anonymized unless legal obligations or the investigation of a security incident require longer retention. Further information on cookies and comparable technologies can be found in Section 5.

3. Contact and Inquiry Forms

We provide comprehensive personal support. If you contact us via a contact form, we process the data required to handle your inquiry. This includes, in particular, your name, information about your company, your email address, your country, the content of your message, and the technical data generated during transmission. Mandatory fields are marked accordingly; all other information is provided voluntarily.

We process this data to handle and document your inquiry and to communicate with you regarding your request. We do not use your data for additional marketing purposes solely because you contacted us. Marketing communications will only take place where an appropriate legal basis exists and, where required, your separate consent has been obtained.

Your inquiry is generally processed on the basis of our legitimate interest in efficient customer communication (Art. 6(1)(f) GDPR). Any additional information you voluntarily provide, as well as the use of specific communication channels (e.g., a telephone callback), is processed based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future. Depending on the specific nature of your inquiry and our customer relationship, communication may also take place within the framework of a (pre-)contractual relationship between us (Art. 6(1)(b) GDPR).

We delete contact inquiries as soon as the matter has been completed, provided that no statutory retention obligations (e.g., under commercial or tax law for contract-related correspondence) or legitimate interests (e.g., for evidentiary or defense purposes, generally until the expiry of the applicable statutory limitation period) require longer retention.

To protect against spam and misuse, we may use security services (e.g., reCAPTCHA).

3.1 Aladin Beyond Product Registration

If you use the form to register an Aladin Beyond product, we process, in addition to your contact and company details, in particular the vehicle identification number (VIN), bus number, information about the bus depot, the Driventic serial number, and the commissioning date. The data is processed to review and complete the product registration, to enable contact by our sales team, and to prepare the further use and support of the product.

Processing is carried out on the basis of Art. 6(1)(b) GDPR insofar as it is necessary for the initiation or performance of a contractual or registration relationship and otherwise on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in processing the registration and assigning the product to the responsible contact person. The data is forwarded to the sales organization responsible for processing and stored in accordance with the retention periods applicable to the registration and contractual relationship.

3.2 Google reCAPTCHA

We use reCAPTCHA v2 on our websites. reCAPTCHA is a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For users in the EU, the EEA, and Switzerland, the responsible entity is Google Ireland Limited, Google Building, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

reCAPTCHA is used to prevent abusive automated entries in web forms and thereby protect our technical systems.

When you access one of our web pages that includes reCAPTCHA, a connection to Google's servers is established. A reCAPTCHA cookie is set, and your IP address is transmitted to Google.

In addition, reCAPTCHA collects the following data using "fingerprinting":

• browser plugins used,

• cookies set by Google within the last six months,

• the number of mouse clicks and touches you have made on this screen,

• CSS information for the accessed page,

• JavaScript objects,

• the date, and

• the browser language.

You can prevent the storage of cookies and fingerprinting by selecting the appropriate technical settings in your browser software. However, please note that in this case you may not be able to use all functions of this website to their full extent.

Where data is processed outside the EU/EEA, Google has certified under the EU-U.S. Data Privacy Framework (DPF). Data transfers to the United States are therefore legitimized on the basis of the European Commission's adequacy decision pursuant to Art. 45 GDPR. Further information about the EU-U.S. Data Privacy Framework program can be found on the official ITA website: https://www.dataprivacyframework.gov/s/

Google's Privacy Policy and Terms of Service can be found here: https://www.google.com/policies/privacy/ and here: https://policies.google.com/terms.

The legal basis for this data processing is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by opening the privacy settings in the lower left corner ("shield" icon) and adjusting the corresponding setting.

4. Career Portal and Applications

This section applies to applications submitted via our application portal (https://career.driventic.com/), by email, by post, through job boards and career networks, via recruitment agencies/headhunters, referrals, recruiting events/job fairs, telephone/video interviews, and any scheduling or recruiting tools used.

As part of the application process, we generally process the following data about you:

• Master data (name, contact details, address), application documents (cover letter, CV, certificates, qualifications), communication/process data (correspondence, interview and appointment data, notes), and, where applicable, publicly available professional profiles.

• Special categories of personal data (e.g., health data/disability status) or other information you provide are processed only where legally required or with your explicit consent.

We generally receive the data directly from you. Additional data may originate from recruitment agencies, publicly accessible professional profiles, or referrals.

Internally, access is granted only to the departments involved in the recruitment process (HR, the relevant specialist department, and, where applicable, management or employee representative bodies). External IT/HR service providers (e.g., hosting providers for the application portal, video interview, or scheduling tools) process your data as processors acting on our behalf pursuant to Art. 28 GDPR. Where service providers are located outside the EU/EEA, data transfers take place only in accordance with the requirements of Art. 44 et seq. GDPR.

We use the softgarden recruiting platform to display individual job vacancies and provide the related application functions. The platform is operated by softgarden e-recruiting GmbH, Tauentzienstraße 14, 10789 Berlin, Germany. We have concluded a data processing agreement with softgarden pursuant to Art. 28 GDPR.

Your information is used to process your application and to decide on the establishment of an employment relationship. The legal basis is Section 26(1) in conjunction with Section 26(8) sentence 2 of the German Federal Data Protection Act (BDSG). Furthermore, your personal data may be processed where necessary to defend against legal claims arising from the application process. The legal basis for this is Art. 6(1)(f) GDPR. The stated purposes also constitute our legitimate interest in the processing.

Your personal data will be deleted no later than six months after completion of the application process unless other legitimate interests prevent deletion or you have given us your consent for longer storage.

5. Webshop and DriveTechnology Academy

The use of certain functions of the Driventic Webshop and the DriveTechnology Academy may require the creation of a user account. During registration, we process, in particular, your email address, first and last name, as well as the login credentials required to create and manage your user account.

Where confirmation of your email address is required during registration, we will send you a confirmation message. This serves to verify that the email address provided can be assigned to you.

We process your data to create, provide, and manage your user account and to authenticate you during future logins. Where you order or book goods, services, or training courses through the respective portal, we also process the data required for the initiation and performance of the respective contract.

The legal basis for creating and using the user account and for processing orders or bookings is Art. 6(1)(b) GDPR. Where we store data to comply with statutory retention or documentation obligations, processing is carried out on the basis of Art. 6(1)(c) GDPR in conjunction with the applicable legal provisions.

The data processed for the user account is generally stored for the duration of the user account. After the account has been deleted, the data will be deleted unless it is still required for the performance of existing contractual relationships, compliance with statutory retention obligations, or the establishment, exercise, or defense of legal claims.

6. Use of Cookies

6.1 Definition / General Information

"Cookies" are small files that are automatically created by your browser and stored on your device (laptop, tablet, smartphone, etc.). Cookies do not contain viruses, Trojans, or any other malicious software.

Cookies contain information that is associated with the specific device being used. However, this does not mean that we obtain direct knowledge of your identity. The following types of cookies can be distinguished.

1. Strictly necessary cookies (technical cookies) are required for the operation of a website and are essential for navigating the website and using its functions. These cookies are not stored permanently on your computer or device and are deleted when you close your browser (session cookies).

2. Preference cookies, which enhance the usability of the website by, for example, remembering your preferred language.

3. Statistical cookies enable us to collect and count the number of visitors and traffic sources in order to measure and improve the performance of the website. They also help identify whether certain pages have problems or errors, determine which pages are the most popular, and understand how visitors navigate the website.

4. Advertising cookies are used to present targeted advertising to you and to better understand your interests.

6.2 Cookies Used

Where cookies or similar technologies are strictly necessary to provide the website or function expressly requested by you, access to or storage of information on your device is based on Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The associated processing of personal data is based, depending on the respective function, on Art. 6(1)(b) or Art. 6(1)(f) GDPR. We use non-essential cookies and similar technologies only with your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

When you first visit the website, a consent banner is displayed. There, you can individually select non-essential categories or services, reject all non-essential services, or consent to their use. Technologies requiring consent are only activated after you have actively given your consent. The consent management tool stores your selection so that it can be taken into account during future visits and documented as proof of your consent.

You may change or withdraw your consent at any time with effect for the future via the permanently accessible privacy settings. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.

Under the following link, you can view the consent you have currently given, as well as which cookies are set by us or our third-party providers in each category. You can withdraw your consent at any time via this link:

7. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). For users in the European Union, the European Economic Area, and Switzerland, the service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies and similar technologies to analyze your use of our website. The information generated about your use of this website may be transmitted to and processed on Google's servers, including servers located in the United States.

As part of the use of Google Analytics, your IP address is generally shortened within the Member States of the European Union or in other states party to the Agreement on the European Economic Area before any further processing takes place. Only in exceptional cases will the full IP address be transmitted to a Google server and shortened there.

During your visit to our website, the following data may be processed in particular:

• the pages you visit and your click path;

• the achievement of specific website goals, such as downloads or contact requests;

• information about your user behavior, such as clicks, time spent on pages, and bounce rates;

• your approximate regional location;

• your anonymized IP address;

• technical information about your browser and the device you use, such as language settings, operating system, and screen resolution;

• information about your internet service provider;

• the referrer URL from which you accessed our website; and

• the date and time of your visit to our website.

On our behalf, Google uses this information to evaluate your use of the website, compile reports on website activity, and provide us with other services related to website and internet usage. The reports provided by Google Analytics are used in particular to analyze and improve the performance and usability of our website and to evaluate our marketing activities.

The recipient of the data is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data on our behalf. For this purpose, we have concluded a data processing agreement with Google.

As part of providing the service, Google LLC, based in the United States, may also access the data. Furthermore, it cannot be ruled out that U.S. authorities may access data stored by Google in accordance with applicable legal requirements.

Where personal data is processed in the United States, the transfer is based on the European Commission's adequacy decision regarding the EU-U.S. Data Privacy Framework, provided that the respective recipient is appropriately certified. Google LLC is certified under the EU-U.S. Data Privacy Framework. Further information about the Data Privacy Framework is available on the website of the U.S. Department of Commerce: https://www.dataprivacyframework.gov/

Data associated with cookies or similar identifiers is automatically deleted after [storage period to be added]. Data whose specified retention period has expired is deleted automatically.

The legal basis for the use of Google Analytics and the associated processing of personal data is your consent pursuant to Art. 6(1)(a) GDPR. Where information is stored on or accessed from your device, this is carried out on the basis of your consent pursuant to Section 25(1) TDDDG.

You may withdraw your consent at any time with effect for the future by changing your selection via the cookie settings available on our website. The lawfulness of the processing carried out before the withdrawal remains unaffected.

In addition, you can delete cookies that have already been stored via your browser settings. If you delete or block cookies, you may not be able to use all the functions of our website without restriction.

Further information about data protection at Google and the options available for managing your privacy settings can be found at: https://safety.google/privacy/privacy-controls/

8. Externe Verlinkungen

Um Ihnen einen umfangreichen Service bieten zu können, weisen wir auf unserer Seite auf andere Webseiten oder deren Angebote hin. Wir betonen ausdrücklich, dass unsere Mitarbeiter bzw. andere an dieser Webseite beteiligte Personen keinerlei Einfluss auf die Gestaltung und die Inhalte der verlinkten Seiten haben.

Für fremde Inhalte, die über Links zur Nutzung bereitgestellt werden, übernehmen wir keine Verantwortung und machen uns deren Inhalt nicht zu Eigen. Für illegale, fehlerhafte oder unvollständige Inhalte sowie für Schäden, die durch die Nutzung oder Nichtnutzung der Informationen entstehen, haftet allein der Anbieter der Webseite, auf die verwiesen wurde. Unser Datenschutzhinweis gilt nur für unsere Webseiten. Bitte beachten Sie die Datenschutzbestimmungen und Hinweise der verlinkten Seiten.

Für das Netzwerk von LinkedIn. Diese werden von LinkedIn Inc., 1000 W. Maude Avenue Sunnyvale, CA 94085, USA, angeboten und betrieben. Die Inhalte des Widgets werden von LinkedIn direkt an Ihren Browser übermittelt und entsprechend in unserem Umfeld angezeigt, ohne dass wir einen Einfluss auf die Inhalte haben.

Für das Netzwerk von YouTube. Diese werden von der YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA angeboten und betrieben. Die Inhalte des Widgets werden von YouTube direkt an Ihren Browser übermittelt und entsprechend in unserem Umfeld angezeigt, ohne dass wir einen Einfluss auf die Inhalte haben.

Genauere Informationen zu Art, Zweck und Umfang sowie der weiteren Verarbeitung und Nutzung Ihrer Daten durch den jeweiligen Social Media Anbieter entnehmen Sie bitte deren Datenschutzhinweise. Dort erfahren Sie auch mehr über Ihre diesbezüglichen Rechte und die Einstellungsmöglichkeiten zum Schutz Ihrer Privatsphäre.

9. Social Media

Driventic GmbH offers you the option to recommend parts of this website via various external social media platforms (e.g., LinkedIn, Instagram, Facebook, X, and YouTube). By clicking the respective button, the internet address of the page on which the button was clicked is transmitted to the provider of the respective social media platform. No further data is transferred by Driventic GmbH. The operator of the external social media platform may collect additional data from you (e.g., by setting cookies or requiring you to log in). Please refer to the privacy policy of the respective provider for further information.

9.1 Facebook Fan Page

(1) General Information

Driventic GmbH operates Facebook fan pages. Facebook is a service provided by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA (hereinafter referred to as "Facebook").

We expressly point out that Facebook stores user data (e.g., IP address, preferences and personal interests, behavior on Facebook pages, personal information stored on Facebook, etc.) and uses this data for its own business purposes.

We have no influence over the processing or further use of this data, as Facebook alone determines how it is processed. We are currently unable to determine the extent, location, and duration of data storage, how the data is linked and analyzed, or to whom the data is disclosed. We also have no insight into or influence over deletion periods or whether such periods are observed.

Information provided by Facebook itself regarding the data it collects can be found in Facebook's Privacy Policy, available here: https://www.facebook.com/about/privacy/

If you are a Facebook member and logged into your Facebook account, Facebook may associate your visit to our page with your user account. If you wish to prevent Facebook from linking data about your visit to our fan page with your stored membership data, you must:

• log out of Facebook before each visit to our fan page;

• delete the cookies stored on your device;

• close your browser and restart it.

According to Facebook, this will delete all information through which you can be identified by Facebook.

(2) Scope of Data Collection and Storage

You do not need to be a Facebook member to view the content of our Facebook fan page. However, each time you visit our page, Facebook collects, stores, and uses data. As soon as you access our fan page, your browser establishes a connection with a Facebook server. In doing so, data may be transferred to countries outside the European Union. In any case, regardless of whether you are registered with Facebook, your IP address is transmitted and cookies are set. If you are a Facebook member and logged into your Facebook account, Facebook may associate your visit to our page with your user account.

The cookies used include session cookies, which are deleted when the browser is closed, and persistent cookies, which remain on your device until they expire or are deleted by the user. A cookie is a small text file that enables a website to recognize a browser. Cookies are stored on your computer when you visit a website and are retrieved and read again the next time the web server is accessed. Through your browser settings, you can decide whether and which cookies you wish to allow, block, or delete. Instructions for various browsers are available for Internet Explorer, Firefox, Google Chrome, Google Chrome Mobile, Microsoft Edge, Safari, and Safari Mobile. Alternatively, you can install so-called ad blockers such as Ghostery.

According to Facebook, the cookies it uses serve purposes such as authentication, security, website and product integrity, advertising and measurement, website features and services, performance, analysis, and research. Details about the cookies used by Facebook (e.g., cookie names, storage duration, collected content, and purpose) can be found here: https://www.facebook.com/policies/cookies/ by following the links provided there. You can manage your preferences regarding which advertisements Facebook displays to you at https://www.facebook.com/about/basics/advertising and at http://www.youronlinechoices.com.

Using the above-mentioned link, you can manage your preferences regarding interest-based online advertising. If you opt out of interest-based online advertising for a specific provider using the preference manager, this applies only to the collection of business-related data by that provider through the web browser you are currently using. Preference management is cookie-based. Deleting all browser cookies will also remove the preferences you have set using the preference manager.

Automated decision-making, including profiling pursuant to Art. 22 GDPR, does not take place.

As a general rule, we store personal data only for as long as the respective purpose for which the data was collected continues to exist. Within the framework of a business relationship with you, we store your personal data for the duration of the business relationship, including the initiation and performance of a contract as well as the applicable statutory limitation periods. In addition, we store the data where and to the extent that we are subject to statutory retention obligations. Such obligations may arise, for example, under the German Commercial Code (HGB) or the German Fiscal Code (AO).

If you have given us your consent for a specific processing activity, the data associated with that consent will be stored until you withdraw your consent or, at the latest, for the duration of the processing activity and, following its completion, for the applicable statutory limitation period.

(3) Facebook Insights

For statistical analysis purposes, we use the Facebook Insights feature. In this context, we receive anonymized data about the users of our Facebook Fan Page. It is not possible for us to identify you personally based on this data. For further information, please refer to Facebook's Cookie Policy.

(4) Disclosure and Use of Personal Data

If you interact with us via Facebook, Facebook naturally also has access to your data. Meta has certified under the EU-U.S. Data Privacy Framework (DPF). Data transfers to the United States are therefore legitimized on the basis of the European Commission's adequacy decision pursuant to Art. 45 GDPR. Further information about the EU-U.S. Data Privacy Framework program can be found on the official ITA website: https://www.dataprivacyframework.gov/s/

(5) Legal Bases

Where processing is necessary for the purposes of the legitimate interests pursued by our company or a third party, and such interests are not overridden by the interests, fundamental rights, or fundamental freedoms of the data subject, the legal basis for the processing is Art. 6(1)(f) GDPR. We consider our legitimate interest in processing the data to be the presentation of our company, our products, and our services for your information, and in particular the provision of modern communication channels for and with you.

(6) Joint Controllers

Driventic GmbH
Erchenstraße 58
89522 Heidenheim an der Brenz
Germany

And

Meta Platforms Ireland Limited
Merrion Road,
Dublin 4, D04 X2K5
Ireland

According to the European Court of Justice (ECJ), we and Facebook are joint controllers for the processing of your personal data. The ECJ's judgment of 5 June 2018 can be found here.

In accordance with Art. 26 GDPR, we hereby inform you of the essential terms of the agreement on joint controllership concluded between us and Facebook: https://www.facebook.com/legal/terms/page_controller_addendum

9.2 YouTube

We embed videos on our website via the YouTube video platform. For users in the European Economic Area and Switzerland, the service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. YouTube is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google").

The integration of the videos serves to provide audiovisual content directly on our website.

To protect your personal data, we use YouTube's enhanced privacy mode together with a two-click solution for embedded YouTube videos. When you visit a page containing an embedded YouTube video, only an inactive preview of the video is initially displayed. At this stage, no connection is established to YouTube's or Google's servers.

The YouTube video will only be loaded once you click on the preview and thereby consent to the data transfer. At that point, a connection is established to Google's servers. In particular, the following data may be transmitted to or processed by Google:

• your IP address;

• information about your browser and the device you use;

• the date and time of access;

• the page you visited;

• the referrer URL;

• information about the playback of the video and your interaction with the video player; and

• where applicable, cookies, online identifiers, or information from your device's local storage.

If you are logged into your YouTube or Google account when accessing the video, Google may associate your access to and interaction with the video with your user account. You can prevent this by logging out of your Google account before activating the video. Even if you are not logged in, Google may process the above-mentioned information and associate it with your browser or device.

The embedding and loading of YouTube videos are carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR. Where information is stored on or accessed from your device, this is likewise carried out on the basis of your consent pursuant to Section 25(1) TDDDG.

You may withdraw your consent at any time with effect for the future by changing your selection via the cookie settings available on our website. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.

The recipient of the data transmitted after activation of the video is, in particular, Google Ireland Limited. As part of providing the service, Google LLC in the United States may also access or process the data. We have only limited influence over Google's further processing of the data, particularly with regard to any linking with other Google services.

Google LLC is certified under the EU-U.S. Data Privacy Framework. Where the applicable requirements are met, the transfer of personal data to the United States is based on the European Commission's adequacy decision pursuant to Art. 45 GDPR. Further information about the EU-U.S. Data Privacy Framework program can be found on the official ITA website: https://www.dataprivacyframework.gov/s/

As a rule, we do not store any additional usage data in connection with the embedding of YouTube videos. The further storage and deletion of data processed by Google are governed by Google's privacy and data retention policies.

Further information about the processing of personal data by Google and YouTube, as well as the options available for managing your privacy settings, can be found in Google's Privacy Policy: www.google.de/intl/de/policies/privacy/.

10 Data Transfers to Third Countries / International Organizations

We process your personal data primarily within the EU/EEA. Where, in individual cases, it is necessary to transfer data to recipients outside the EU/EEA (e.g., service providers we engage), we ensure in advance that all legal requirements of Art. 44 et seq. GDPR are complied with. Unless an adequacy decision by the European Commission exists pursuant to Art. 45 GDPR, this is achieved by concluding the EU Standard Contractual Clauses. In individual cases, a transfer may also be based on the exceptions set out in Art. 49 GDPR (e.g., your explicit consent or where necessary for the performance of a contract); in such cases, we will inform you separately. Upon request, we will provide information about the specific recipients/countries and copies of the relevant safeguards. Further details can also be found in the relevant sections of this Privacy Policy (e.g., regarding individual services).

11 Your Rights

11.1 General

You have the following rights with regard to your personal data processed by us. To exercise your rights, you may contact us at any time using the contact details provided in this Privacy Policy (e.g., by email or post).

General Data Subject Rights:

• Right of access (Art. 15 GDPR): You are entitled to receive information about, among other things, the purposes of processing, categories of data, recipients, storage periods, the origin of the data, and your rights.

• Right to rectification (Art. 16 GDPR): Inaccurate or incomplete personal data will be corrected.

• Right to erasure (Art. 17 GDPR): Personal data will be deleted unless statutory retention obligations or other overriding reasons prevent deletion.

• Right to restriction of processing (Art. 18 GDPR): For example, during the period in which the accuracy of the data is being verified.

• Right to data portability (Art. 20 GDPR): Provision of the data you have provided to us in a structured, commonly used, and machine-readable format and, where technically feasible, transmission to another controller.

• Withdrawal of consent (Art. 7(3) GDPR): You may withdraw any consent you have given at any time with effect for the future, without affecting the lawfulness of the processing carried out before the withdrawal.

11.2 Right to Object to Processing Based on Art. 6(1)(e) or Art. 6(1)(f) GDPR

Pursuant to Art. 21(1) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where such processing is based on Art. 6(1)(e) GDPR (processing in the public interest) or Art. 6(1)(f) GDPR (legitimate interests). This also applies to profiling based on these provisions. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defense of legal claims.

11.3 Right to Object to Direct Marketing

If we process personal data for direct marketing purposes, you have the right, pursuant to Art. 21(2) GDPR, to object at any time to the processing of your personal data for such marketing purposes. This also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will no longer be processed for direct marketing purposes.

Right not to be subject to automated decision-making: You have the rights provided for in Art. 22 GDPR with regard to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

11.4 Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR).

12. Data Retention Period

Unless a more specific retention period is stated in the individual sections, we store personal data only for as long as necessary to fulfill the respective purpose. Thereafter, the data will be deleted or anonymized unless statutory retention obligations, contractual warranty periods, or legitimate interests in the establishment, exercise, or defense of legal claims require further storage.

13. Data Security

We use the widely adopted SSL (Secure Socket Layer) protocol in conjunction with the highest level of encryption supported by your browser. You can recognize whether an individual page of our website is transmitted in encrypted form by the closed key or padlock symbol displayed in your browser's status bar.

We also implement appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.