Privacy Policy

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to simply as "data") that we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the "online offer").

The terms used are not gender-specific.

Responsible

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:

• Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw consent given at any time.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed, and to obtain access to this data, as well as further information and a copy of the data in accordance with the legal requirements.
• Right to rectification: In accordance with the legal requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
• Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to request that data concerning you be erased without delay, or alternatively, in accordance with the legal requirements, to request a restriction of the processing of the data.
• Right to data portability: You have the right to receive data concerning you that you have provided to us, in accordance with the legal requirements, in a structured, commonly used and machine-readable format, or to request its transmission to another controller.
• Complaint to a supervisory authority: In accordance with the legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State of your habitual residence, the supervisory authority of your place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Overview of Processing Operations

The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of Data Processed

• Master data
• Contact data
• Contract data
• Content data
• Usage data
• Meta, communication and procedural data
• Log data
• Image and/or video recordings
• Audio recordings
• Payment data
• Employee data

Categories of Data Subjects

• Service recipients and clients
• Prospective customers
• Communication partners
• Users
• Business and contractual partners
• Third parties
• Participants
• Customers
• Depicted persons
• Employees

Purposes of Processing

• Provision of contractual services and fulfillment of contractual obligations
• Communication
• Security measures
• Office and organizational procedures
• Remarketing
• Affiliate tracking
• A/B testing
• Organizational and administrative procedures
• Feedback
• Surveys and questionnaires
• Profiles with user-related information
• Provision of our online offer and user-friendliness
• Information technology infrastructure
• Public relations
• Sales promotion
• Business processes and economic procedures
• Artificial intelligence (AI)

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or establishment. Furthermore, should more specific legal bases be relevant in individual cases, we will inform you of these in this privacy policy.

• Consent (Art. 6 (1) (1) (a) GDPR) — The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual inquiries (Art. 6 (1) (1) (b) GDPR) — Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6 (1) (1) (c) GDPR) — Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 (1) (1) (f) GDPR) — Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that the interests, fundamental rights and freedoms of the data subject which require the protection of personal data are not overridden.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection rules apply in Germany. These include in particular the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains, in particular, special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission as well as automated decision-making in individual cases, including profiling. Furthermore, the data protection laws of the individual federal states (Länder) may apply.

Notice on the applicability of the GDPR and the Swiss FADP: This privacy notice serves both to provide information pursuant to the Swiss Federal Act on Data Protection (FADP) and pursuant to the General Data Protection Regulation (GDPR). For this reason, please note that, due to the broader territorial scope and greater comprehensibility, the terms of the GDPR are used. In particular, instead of the terms used in the Swiss FADP — "processing" of "personal data", "overriding interest", and "particularly sensitive personal data" — the terms used in the GDPR are applied, namely "processing" of "personal data" as well as "legitimate interest" and "special categories of data". However, the legal meaning of these terms continues to be determined in accordance with the Swiss FADP where the Swiss FADP applies.

General Information on Data Retention and Erasure

We erase personal data that we process in accordance with the statutory provisions as soon as the underlying consents are withdrawn or there are no further legal bases for the processing. This concerns cases in which the original purpose of the processing no longer applies or the data is no longer required. Exceptions to this rule apply where statutory obligations or legitimate interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax-law reasons, or whose storage is necessary for the prosecution of legal claims or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and erasure of data that applies specifically to certain processing operations.

Where multiple statements regarding the retention period or erasure deadlines of a piece of data exist, the longest period is always decisive. Data that is no longer retained for the originally intended purpose but on the basis of legal requirements or other grounds is processed exclusively for the reasons that justify its retention.

Retention and erasure of data: The following general periods apply to retention and archiving under German law:

Security Measures

In accordance with the legal requirements and taking into account the state of the art, the costs of implementation, and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as the access, input, disclosure, availability and segregation relating to it. Furthermore, we have established procedures that ensure the exercise of data subject rights, the erasure of data, and responses to threats to the data. Moreover, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

Securing online connections using TLS/SSL encryption technology (HTTPS): To protect the data of users transmitted via our online services against unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user's browser (or between two servers), thereby protecting the data against unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is signaled by the display of HTTPS in the URL. This serves as an indicator to users that their data is being transmitted securely and in encrypted form.

Provision of the Online Offer and Web Hosting

We process the data of users in order to be able to provide our online services to them. For this purpose, we process the user's IP address, which is necessary in order to transmit the content and functions of our online services to the user's browser or device.

Further information on processing operations, procedures and services:

Cloud Services

We use software services accessible via the internet and executed on the servers of their providers (so-called "cloud services", also referred to as "Software as a Service") for the storage and management of content (e.g., document storage and management, exchange of documents, content and information with specific recipients, or publication of content and information).

In this context, personal data may be processed and stored on the servers of the providers, insofar as this data is part of communication processes with us or is otherwise processed by us as set out in this privacy policy. This data may include in particular master data and contact data of users, data on transactions, contracts, other processes and their content. The providers of the cloud services furthermore process usage data and metadata, which they use for security purposes and service optimization.

Further information on processing operations, procedures and services:

Management, Organization and Tools

We use services, platforms and software of other providers (hereinafter referred to as "third-party providers") for the purposes of organizing, administering, planning and providing our services. When selecting the third-party providers and their services, we observe the legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. This may concern various data that we process in accordance with this privacy policy. This data may include in particular master data and contact data of users, data on transactions, contracts, other processes and their content.

Insofar as users are referred to the third-party providers or their software or platforms in the context of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, for service optimization or for marketing purposes. We therefore ask that you observe the privacy notices of the respective third-party providers.

Further information on processing operations, procedures and services:

Contact and Inquiry Management

When contacting us (e.g., by post, contact form, email, telephone or via social media) as well as in the context of existing user and business relationships, the information of the inquiring persons is processed insofar as this is necessary to respond to the contact inquiries and any requested measures.

Further information on processing operations, procedures and services:

Business Services

We process personal data of our contractual and business partners, such as customers, clients, prospective customers, suppliers and other cooperation partners (collectively "contractual partners"), for the purpose of initiating, performing and processing contractual relationships and comparable legal relationships. This also includes pre-contractual measures taken upon request, as well as communication in connection with the respective contractual relationship.

The processing serves in particular to fulfill our principal and ancillary contractual obligations. This includes the provision of the agreed services, any update and information obligations, the handling of warranty and other performance disruptions, the processing of withdrawals, terminations of continuing obligations, reversals, refunds, as well as the handling of other contract-related declarations and inquiries. This covers both one-off contracts and ongoing contractual relationships.

We process in particular master data such as name, address and, where applicable, company; contact data such as email address and telephone number; contract and performance data such as the subject matter of the contract, contract term, order or transaction number; usage and performance data; payment and billing data; as well as communication content and histories. Where necessary, we also process data disclosed or transmitted to us in the course of carrying out an order.

In addition, we process the data to safeguard our rights and to fulfill legal obligations. This includes in particular commercial and tax-law retention obligations, documentation obligations, and, where applicable, verification and accountability obligations. Furthermore, processing takes place on the basis of our legitimate interests in proper business management, internal administration, risk management and IT security, as well as in protecting our business operations and our contractual partners from misuse, endangerment of data, trade secrets and other legal assets. This may also include the involvement of external service providers such as IT and telecommunications providers, transport and logistics companies, payment service providers, banks, tax and legal advisors, or other vicarious agents, insofar as this is necessary for the performance of the contract or for the fulfillment of legal obligations.

Personal data is disclosed to third parties only insofar as this is necessary for the performance of the contract, for carrying out pre-contractual measures, for safeguarding legitimate interests, or for fulfilling legal obligations. We provide separate information on any processing beyond this, in particular for marketing purposes, within this privacy policy.

We inform contractual partners of which data is required in the individual case at the time of data collection, for example in online forms by means of corresponding labeling, or in personal contact.

The data is erased as soon as it is no longer required for the aforementioned purposes and no statutory retention obligations stand in the way. Statutory retention periods, in particular under commercial and tax law, may require longer storage. Data transmitted in the context of a specific order is erased by us after completion of the order and expiry of any retention periods, provided that no further legal or contractual storage obligations exist.

The legal basis for the processing is Art. 6 (1) (b) GDPR for carrying out pre-contractual measures and for fulfilling the respective contractual relationship, as well as Art. 6 (1) (c) GDPR for fulfilling legal obligations. Where processing is based on legitimate interests, it takes place on the basis of Art. 6 (1) (f) GDPR.

Further information on processing operations, procedures and services:

Business Processes and Procedures

Personal data of service recipients and clients – including customers, clients or, in special cases, mandates, patients or business partners as well as other third parties – is processed in the context of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates economic processes in areas such as customer management, sales, payment transactions, accounting and project management.

The collected data serves to fulfill contractual obligations and to design operational processes efficiently. This includes the handling of business transactions, the management of customer relationships, the optimization of sales strategies, and ensuring internal accounting and financial processes. In addition, the data supports the safeguarding of the controller's rights and promotes administrative tasks as well as the organization of the company.

Personal data may be disclosed to third parties insofar as this is necessary for the fulfillment of the stated purposes or legal obligations. After expiry of statutory retention periods, or when the purpose of processing no longer applies, the data is erased. This also includes data that must be stored for longer due to tax-law and statutory verification obligations.

Further information on processing operations, procedures and services:

Video Conferences, Online Meetings, Webinars and Screen Sharing

We use platforms and applications of other providers (hereinafter referred to as "conference platforms") for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as "conference"). When selecting the conference platforms and their services, we observe the legal requirements.

Data processed by conference platforms: In the context of participation in a conference, the conference platforms process the personal data of the participants listed below. The scope of the processing depends, on the one hand, on which data is required in the context of a specific conference (e.g., provision of access data or real names) and which optional information is provided by the participants. In addition to processing for the purpose of conducting the conference, the participants' data may also be processed by the conference platforms for security purposes or service optimization. The processed data includes personal details (first name, surname), contact information (email address, telephone number), access data (access codes or passwords), profile pictures, information on professional position/function, the IP address of the internet access, information on the participants' devices, their operating system, the browser and its technical and language settings, information on the content-related communication processes, i.e., entries in chats as well as audio and video data, as well as the use of other available functions (e.g., surveys). The contents of communications are encrypted to the extent technically provided by the conference providers. If the participants are registered as users with the conference platforms, further data may be processed in accordance with the agreement with the respective conference provider.

Logging and recordings: If text entries, participation results (e.g., from surveys) as well as video or audio recordings are logged, this is communicated transparently to the participants in advance and they are – where necessary – asked for their consent.

Data protection measures of the participants: Please refer to the privacy notices of the conference platforms for details of the processing of your data by them, and select the security and data protection settings that are optimal for you within the settings of the conference platforms. Furthermore, please ensure data and privacy protection in the background of your recording for the duration of a video conference (e.g., by giving notice to fellow residents, locking doors, and, where technically possible, using the function to blur the background). Links to the conference rooms and access data must not be passed on to unauthorized third parties.

Further information on processing operations, procedures and services:

Newsletter and Electronic Notifications

We send newsletters, emails and other electronic notifications (hereinafter "newsletter") exclusively with the consent of the recipients or on the basis of a legal authorization. Insofar as the contents of a newsletter are named in the context of a registration for it, these contents are decisive for the consent of the users. As a rule, providing your email address is sufficient to register for our newsletter. However, in order to be able to offer you a personalized service, we may ask you to provide your name for personal address in the newsletter, or for further information if this is necessary for the purpose of the newsletter.

Erasure and restriction of processing: We may store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before erasing them, in order to be able to provide evidence of consent previously given. The processing of this data is limited to the purpose of a potential defense against claims. An individual erasure request is possible at any time, provided that the former existence of consent is confirmed at the same time. In the case of obligations to permanently observe objections, we reserve the right to store the email address solely for this purpose in a block list (so-called "blocklist").

The logging of the registration procedure takes place on the basis of our legitimate interests for the purpose of providing evidence of its proper course. Insofar as we commission a service provider with the sending of emails, this takes place on the basis of our legitimate interests in an efficient and secure dispatch system.

Contents: Information about us, our services, promotions and offers.

Further information on processing operations, procedures and services:

Promotional Communication via Email, Post, Fax or Telephone

We process personal data for the purposes of promotional communication, which may take place via various channels, such as email, telephone, post or fax, in accordance with the legal requirements.

Recipients have the right to withdraw consent given at any time, or to object to promotional communication at any time free of charge via the contact option given above.

After withdrawal or objection, we store the data required to provide evidence of the previous authorization to contact you or send you mailings for up to three years after the end of the year of the withdrawal or objection, on the basis of our legitimate interests. The processing of this data is limited to the purpose of a possible defense against claims. On the basis of the legitimate interest in permanently observing the withdrawal or objection of the users, we furthermore store the data required to avoid renewed contact (e.g., depending on the communication channel, the email address, telephone number, name).

Surveys and Questionnaires

We conduct surveys and questionnaires in order to collect information for the respectively communicated survey or questionnaire purpose. The surveys and questionnaires we conduct (hereinafter "surveys") are evaluated anonymously. Personal data is processed only insofar as this is necessary for the provision and technical implementation of the surveys (e.g., processing of the IP address in order to display the survey in the user's browser, or to enable a resumption of the survey with the help of a cookie).

Further information on processing operations, procedures and services:

Customer Reviews and Rating Procedures

We participate in review and rating procedures in order to evaluate, optimize and promote our services. When users rate us or otherwise provide feedback via the participating rating platforms or procedures, the general terms and conditions of business or use and the privacy notices of the providers additionally apply. As a rule, the rating also requires registration with the respective providers.

In order to ensure that the rating persons have actually used our services, we transmit the data required for this purpose with regard to the customer and the service used to the respective rating platform (including name, email address and order number or item number), with the consent of the customers. This data is used solely to verify the authenticity of the user.

Further information on processing operations, procedures and services:

Presence in Social Networks (Social Media)

We maintain online presences within social networks and, in this context, process user data in order to communicate with the users active there or to offer information about us.

We point out that user data may be processed outside the area of the European Union in this context. This may give rise to risks for the users, because, for example, the enforcement of user rights could be made more difficult.

Furthermore, the data of the users within social networks is, as a rule, processed for market research and advertising purposes. For example, usage profiles can be created based on the usage behavior and the resulting interests of the users. The latter may in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For this reason, cookies are, as a rule, stored on the computers of the users, in which the usage behavior and the interests of the users are stored. In addition, data may also be stored in the usage profiles independently of the devices used by the users (in particular if they are members of the respective platforms and logged in there).

For a detailed presentation of the respective forms of processing and the possibilities to object (opt-out), we refer to the privacy policies and information of the operators of the respective networks.

Also in the case of requests for access and the assertion of data subject rights, we point out that these can be asserted most effectively with the providers. Only the latter have access to the user data in each case and can directly take appropriate measures and provide information. Should you nevertheless require assistance, you can contact us.

Further information on processing operations, procedures and services:

Transmission of Personal Data

In the course of our processing of personal data, it may occur that this data is transmitted to, or disclosed to, other entities, companies, legally independent organizational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks, or providers of services and content embedded in a website. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements that serve to protect your data with the recipients of your data.

Data transmission within the organization: We may transmit personal data to other departments or units within our organization or grant them access to it. Where such data sharing takes place for administrative purposes, it is based on our legitimate business and economic interests, or it takes place where it is necessary for the fulfillment of our contract-related obligations, or where consent of the data subjects or a statutory permission exists.

International Data Transfers

Data processing in third countries: Where we transmit data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or where this occurs in the context of using third-party services or disclosing or transmitting data to other persons, entities or companies (which becomes apparent from the postal address of the respective provider or where a data transfer to third countries is expressly indicated in the privacy policy), this is always done in accordance with the legal requirements.

For data transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by an adequacy decision of the EU Commission dated 10 July 2023. In addition, we have concluded Standard Contractual Clauses with the respective providers that comply with the requirements of the EU Commission and establish contractual obligations to protect your data.

This twofold safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the Standard Contractual Clauses serve as additional security. Should changes occur within the framework of the DPF, the Standard Contractual Clauses act as a reliable fallback option. In this way, we ensure that your data remains adequately protected at all times, even in the event of any political or legal changes.

For each individual service provider, we inform you whether they are certified under the DPF and whether Standard Contractual Clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/.

For data transfers to other third countries, corresponding safeguards apply, in particular Standard Contractual Clauses, explicit consents, or transfers required by law. Information on third-country transfers and applicable adequacy decisions can be found in the information provided by the EU Commission: commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en.

Amendment and Update

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as the changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g., consent) or other individual notification.

Insofar as we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time, and we ask you to check the information before making contact.

Supervisory authority responsible for us:

Contact Option

If you have any further questions, please feel free to contact us at hello@cyber-fidelity.com or use our contact form.