Privacy Settings

Privacy Policy

1. Name and address of the controller

2. Name and address of the data protection officer

3. General information on data processing

4. Provision of the website and creation of log files

5. Use of cookies

6. Newsletter

7. Registration

8. Contact form and e-mail contact

9. Job advertisements / online applications

10. Blog systems, mailing lists and discussion platforms

11. Events: ticket sales and personal schedule

12. Order processing in the online shop and customer account

13. External payment service providers

14. Use of third-party services

15. Rights of the data subject

16. Age of majority and legal capacity

17. Security measures

---

1. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection
laws of the Member States and other data protection provisions is:

Icinga GmbH

Deutschherrnstr. 15-19
90429 Nürnberg
Germany
Phone: +49 911 92885-55
E-mail: info@icinga.com
Website: icinga.com

2. Name and address of the data protection officer

The data protection officer of the responsible company is:

Marius Hein
NETWAYS GmbH
Deutschherrnstr. 15-19
90429 Nürnberg
Germany
Phone: +49 911 92885-0
E-mail: datenschutz@netways.de
Website: netways.de

3. General information on data processing

3.1 Scope of the processing of personal data

As a matter of principle, we process personal data of our users only to the extent necessary to provide a
functional website as well as our content and services. Personal data is only processed if one of the legal bases
listed in section 3.2 applies, in particular on the basis of your consent, for the performance of a contract, due to
a legal obligation or on the basis of a legitimate interest.

3.2 Legal basis for the processing of personal data

Where we obtain the data subject’s consent for processing operations, Art. 6(1)(a) of the EU General Data
Protection Regulation (GDPR) serves as the legal basis. Where the processing of personal data is necessary for the
performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also
applies to processing operations necessary for taking steps prior to entering into a contract. Where processing of
personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR
serves as the legal basis.

Where processing of personal data is necessary to protect the vital interests of the data subject or of another
natural person, Art. 6(1)(d) GDPR serves as the legal basis. Where processing is necessary for the purposes of the
legitimate interests pursued by our company or by a third party, and these interests are not overridden by the
interests or fundamental rights and freedoms of the data subject, Art. 6(1)(f) GDPR serves as the legal basis for the
processing.

3.3 Erasure of data and storage period

The personal data of the data subject is erased or its processing restricted as soon as the purpose of storage no
longer applies. Data may also be stored beyond this if this has been provided for by the European or national
legislator in EU regulations, laws or other provisions to which the controller is subject. Data is also erased or
its processing restricted when a storage period prescribed by these provisions expires, unless further storage of
the data is necessary for the conclusion or performance of a contract.

3.4 Scope of this policy

This privacy policy informs users about the nature, scope and purposes of the collection and use of personal data
by the responsible provider. It applies to our online platforms such as websites, blog, shop and event websites.

4. Provision of the website and creation of log files

4.1 Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system
of the accessing device.

The following data is collected:

• Information about the browser type and version used
• The user’s operating system
• The user’s internet service provider
• The user’s IP address
• Date and time of access
• Websites from which the user’s system reaches our website
• Websites accessed by the user’s system via our website

4.2 Legal basis for data processing

The legal basis for the temporary storage of the data is Art. 6(1)(f) GDPR.

4.3 Purpose of data processing

The data is stored in log files to ensure the functionality of the website. In addition, the data helps us to
optimise the website and to ensure the security of our IT systems. The data is not evaluated for marketing purposes
in this context.

4.4 Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. Where
data is collected to provide the website, this is the case when the respective session has ended.

Where data is stored in log files, this is the case after six months at the latest. Storage beyond this period is
possible. In this case, the users’ IP addresses are deleted or altered so that the accessing client can no
longer be identified.

4.5 Right to object and removal

The collection of data for the provision of the website and the storage of data in log files is essential for
operating the website. You may object to the processing under Art. 21 GDPR (see section 15.7); as a rule, however,
our compelling legitimate grounds for the secure operation of the website prevail in this case.

5. Use of cookies

5.1 Description and scope of data processing

Our website uses cookies. Cookies are text files that are stored in or by the web browser on the user’s
computer system. When a user visits a website, a cookie may be stored on the user’s device. This cookie
contains a characteristic string that allows the browser to be uniquely identified when the website is visited
again.

We use cookies to make our website more user-friendly. Some elements of our website require that the accessing
browser can be identified even after a page change.

The following data is stored and transmitted in the cookies:

• Operating data of the software, e.g. language settings, time zone etc.
• Items in a shopping cart
• Login information

5.2 Legal basis for data processing

For technically necessary cookies, the storage of and access to information on your device is based on Section 25
(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the subsequent processing of
personal data is based on Art. 6(1)(f) GDPR. All other cookies and similar technologies, in particular for analytics
and marketing purposes (see section 14), are only used with your consent pursuant to Section 25 (1) TDDDG in
conjunction with Art. 6(1)(a) GDPR.

5.3 Purpose of data processing

The purpose of using technically necessary cookies is to make websites easier to use. Some functions of our website
cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after
a page change.

The user data collected by technically necessary cookies is not used to create user profiles.

5.4 Storage period, right to object and removal

Cookies are stored on the user’s computer and transmitted from it to our website. As a user, you therefore
have full control over the use of cookies. By changing the settings in your browser, you can disable or restrict the
transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done
automatically. If cookies are disabled for our website, it may no longer be possible to use all functions of the
website to their full extent. You can withdraw any consent you have given at any time with effect for the future via
the cookie settings of the respective website.

6. Newsletter

6.1 Description and scope of data processing

On our website you can subscribe to a free newsletter. When you subscribe, the data from the input form is
transmitted to us.

If you purchase goods or services on our website and provide your e-mail address in the process, we may
subsequently use it to send you a newsletter. In such a case, the newsletter will exclusively contain direct
advertising for our own similar goods or services.

6.2 Legal basis for data processing

The legal basis for processing the data after the user has subscribed to the newsletter is Art. 6(1)(a) GDPR,
provided the user has given consent.

The legal basis for sending the newsletter as a result of the sale of goods or services is Art. 6(1)(f) GDPR in
conjunction with Section 7 (3) of the German Act against Unfair Competition (UWG). You may object to this use of your
e-mail address at any time without incurring any costs other than the transmission costs at the basic rates.

6.3 Purpose of data processing

The user’s e-mail address is collected in order to deliver the newsletter.

Other personal data collected during the subscription process serves to prevent misuse of the services or of the
e-mail address used.

6.4 Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. The
user’s e-mail address is therefore stored for as long as the newsletter subscription is active.

Other personal data collected during the subscription process is generally erased after a period of six months.

6.5 Right to object and removal

The user can cancel the newsletter subscription at any time. For this purpose, every newsletter contains a
corresponding link. This also allows the user to withdraw consent to the storage of the personal data collected
during the subscription process.

7. Registration

7.1 Description and scope of data processing

On our website, we offer users the opportunity to register by providing personal data. The data from the input form
is transmitted to us and stored. Only relevant data is collected, e.g. contact details (surname, first name, e-mail
addresses etc.) or content data.

At the time of registration, the following data is also stored:

• The user’s IP address
• Date and time of registration

The user’s consent to the processing of this data is obtained during the registration process.

7.2 Legal basis for data processing

If the registration serves the performance of a contract to which the user is party, or taking steps prior to
entering into a contract, the additional legal basis for processing the data is Art. 6(1)(b) GDPR. Otherwise, consent
pursuant to Art. 6(1)(a) GDPR is obtained.

7.3 Purpose of data processing

Registration of the user is required for the performance of a contract with the user, for taking steps prior to
entering into a contract, or for providing and reviewing content in blog systems, mailing lists or discussion
platforms.

7.4 Disclosure of data to third parties

An order or a request by the user for a quotation or individual contact may result in the data being forwarded to
a partner company. In this case, the user is explicitly informed of the possible disclosure and the corresponding
consent is obtained. Where necessary, data is disclosed to:

• Affiliated sales partners
• Hotels and restaurants for events and training courses
• Logistics partners

7.5 Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected.

For data collected during the registration process for the performance of a contract or for taking steps prior to
entering into a contract, this is the case when the data is no longer required for the performance of the contract.
Even after the contract has been concluded, it may be necessary to store personal data of the contractual partner in
order to comply with contractual or legal obligations.

7.6 Right to object and removal

As a user, you can cancel your registration at any time. You can have the data stored about you changed at any time.

If the data is required for the performance of a contract or for taking steps prior to entering into a contract,
early erasure of the data is only possible insofar as no contractual or legal obligations prevent erasure.

8. Contact form and e-mail contact

8.1 Description and scope of data processing

Our website contains a contact form that can be used to get in touch with us electronically. If a user makes use of
this option, the data entered in the input form is transmitted to us and stored. Only relevant data is collected,
e.g. contact details (surname, first name, e-mail addresses etc.) or content data.

At the time the message is sent, the following data is also stored:

• The user’s IP address
• Date and time of sending

Your consent to the processing of the data is obtained during the sending process, with reference to this privacy
policy.

Alternatively, you can contact us via the e-mail address provided. In this case, the user’s personal data
transmitted with the e-mail is stored.

Data is only disclosed to third parties in the cases listed in section 8.4. The data is used exclusively for the
purposes stated in section 8.3.

8.2 Legal basis for data processing

The legal basis for processing the data is Art. 6(1)(a) GDPR, provided the user has given consent.

The legal basis for processing data transmitted in the course of sending an e-mail is Art. 6(1)(f) GDPR. If the
e-mail contact aims at the conclusion of a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR.

8.3 Purpose of data processing

We process the personal data from the input form to handle the enquiry as well as for customer care and quality
management. In the case of contact by e-mail, this also constitutes the necessary legitimate interest in processing
the data. Otherwise, the user’s consent is required.

The other personal data processed during the sending process serves to prevent misuse of the contact form and to
ensure the security of our IT systems.

8.4 Disclosure of data to third parties

An order or a request by the user for a quotation or individual contact may result in the data being forwarded to
a partner company. In this case, the user is explicitly informed of the possible disclosure and the corresponding
consent is obtained. Where necessary, data is disclosed to:

• Affiliated sales partners
• Hotels and restaurants for events and training courses
• Logistics partners

8.5 Publication of data

When success stories are submitted, the data collected is published on the website, naming the user. In this
case, the user is explicitly informed of the publication and the corresponding consent (Art. 6(1)(a) GDPR) is
obtained.

8.6 Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected, the
purpose ceases to apply or the user has withdrawn consent.

The additional personal data collected during the sending process is erased after a period of six months at the
latest.

8.7 Right to object and removal

The user may withdraw consent to the processing of personal data at any time. If the user contacts us by e-mail, the
user may object to the storage of their personal data at any time. In such a case, the conversation cannot be
continued.

In this case, all personal data stored in the course of the contact will be erased.

9. Job advertisements / online applications

9.1 Description and scope of data processing

We collect and process application data electronically for the purpose of handling the application process. Various
data is processed in this context, e.g. name, telephone number, e-mail address etc. This data is generally used for
contacting and communicating with you.

Characteristics that must not be taken into account under the German General Equal Treatment Act (AGG) (ethnic
origin, gender, religion or belief, disability, age or sexual identity) are not considered in our selection
decision. Please also do not submit information on illnesses, pregnancy, ethnic origin, political opinions,
philosophical or religious beliefs, trade union membership, physical or mental health or sex life. The same applies
to content that may infringe the rights of third parties (e.g. copyrights, press law or general rights of third
parties).

If an application is followed by the conclusion of an employment contract, the data submitted may be stored by us in
a personnel file for the purpose of the usual organisational and administrative processes, in compliance with the
relevant legal provisions.

9.2 Legal basis for data processing

The legal basis for processing your application data is Art. 6(1)(b) GDPR (taking steps prior to entering into a
possible employment relationship). If you consent to longer storage, for example in our talent pool, the legal basis
is Art. 6(1)(a) GDPR. Retention for the defence against possible legal claims is based on Art. 6(1)(f) GDPR.

9.3 Purpose of data processing

We process your application data solely to carry out the application process and to recruit employees.

9.4 Storage period

If an application is rejected, the data submitted is automatically erased five months after notification of the
decision. This does not apply if longer storage is required due to legal requirements (for example the burden of
proof under the German General Equal Treatment Act) or if you have expressly consented to longer storage in our
talent pool.

9.5 Right to object and removal

The user may withdraw consent to the processing of personal data at any time. Unless legitimate interests of the
controller or the user stand in the way, the data will be erased immediately. In the cases provided for by law,
erasure may be replaced by a restriction of processing.

10. Blog systems, mailing lists and discussion platforms

10.1 Description and scope of data processing

Within these systems, it is possible to post comments, write guest articles or take part in a discussion. Only
relevant data is collected, e.g. contact details (surname, first name, e-mail addresses etc.) or content data.

At the time of registration, the following data is also stored:

• The user’s IP address
• Date and time of registration

If comments are posted, other users can subscribe to them. Other users are notified at the time a comment is posted.
No personal data that allows direct identification is transmitted in the comments.

Furthermore, on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR, we reserve the right to
process users’ details for the purpose of spam detection or to delete posts that infringe the personal rights
of third parties.

The data provided in comments and posts is stored by us permanently until the user objects.

10.2 Legal basis for data processing

The legal basis for processing the data is your consent pursuant to Art. 6(1)(a) GDPR or the legitimate interests of
the controller pursuant to Art. 6(1)(f) GDPR.

10.3 Purpose of data processing

We operate the systems mentioned above for marketing purposes, for recruiting employees and customers and for
providing general information. The focus is on providing relevant user groups with general information from the
controller’s field of business.

10.4 Storage period

The content and communication data provided within the systems is stored by us permanently until the user objects.
Log data is erased after six months at the latest.

10.5 Right to object and removal

The user may withdraw consent to the processing of personal data at any time. We may store unsubscribed e-mail
addresses for up to three years on the basis of our legitimate interests (Art. 6(1)(f) GDPR) before erasing them, in
order to be able to prove that consent was previously given. The processing of this data is limited to the purpose
of a possible defence against claims. An individual request for erasure is possible at any time, provided that the
former existence of consent is confirmed at the same time.

11. Events: ticket sales and personal schedule

11.1 Ticket sales via pretix

11.1.1 Description and scope of data processing

We use the pretix ticketing system to sell tickets for our events. When you place an order, we process the details
from the order form, in particular name, e-mail address, billing address and, where applicable, company, the tickets
selected and the attendee data requested for the respective event. Mandatory fields are marked as such in the order
form. Payment is processed via the payment service providers listed in section 13.

Where we use an external service provider to operate the ticketing system, this provider processes the data
exclusively on our behalf and in accordance with our instructions on the basis of a data processing agreement
(Art. 28 GDPR).

11.1.2 Legal basis for data processing

The legal basis is Art. 6(1)(b) GDPR (performance of the contract for participation in the event) and, for
retention required by law, Art. 6(1)(c) GDPR.

11.1.3 Purpose of data processing

We process the data in order to handle your order, issue invoices and tickets, organise admission to the event and
inform you of organisational changes to the event.

11.1.4 Storage period

The data is erased as soon as it is no longer required for running the event. Data subject to statutory retention
obligations is erased once these have expired (see section 12.4).

11.1.5 Right to object and removal

As the data is required for the performance of the contract, early erasure is only possible insofar as no
contractual or legal obligations prevent it. Your rights under section 15 remain unaffected.

11.2 Personal schedule

11.2.1 Description and scope of data processing

On the websites of our events, you can put together a personal schedule. Using this function is voluntary. If you
use it, we store the following data:

• your e-mail address, which you have to confirm after entering it
• the sessions you have starred
• your feedback on sessions, if you provide any

11.2.2 Legal basis for data processing

The legal basis for processing your e-mail address and starred sessions is Art. 6(1)(b) GDPR, as this allows us to
provide the function you requested. Providing feedback is voluntary; the legal basis for this is your consent
pursuant to Art. 6(1)(a) GDPR.

11.2.3 Purpose of data processing

We process this data to make your personal schedule available on all your devices, to provide your starred sessions
as a calendar feed that you can add to your calendar application, and to pass on your feedback to the organisers.
Confirming your e-mail address ensures that only you can access your schedule.

11.2.4 Storage period

Unconfirmed e-mail addresses are deleted after 48 hours. All other data, i.e. confirmed e-mail addresses, starred
sessions and feedback, is deleted 90 days after the end of the respective event.

11.2.5 Right to object and removal

You can delete all data stored for your personal schedule yourself at any time using the “Delete my
data” button. You can withdraw your consent to the processing of your feedback at any time with effect for the
future. Your rights under section 15 remain unaffected.

12. Order processing in the online shop and customer account

We process our customers’ data in the context of orders placed in our online shop in order to enable them to
select and order the chosen products and services, as well as to pay for them and have them delivered or performed.

12.1 Processing of data

The data processed includes master data, communication data, contract data and payment data; the persons affected
by the processing include our customers, prospective customers and other business partners. Processing is carried
out for the purpose of providing contractual services in the context of operating an online shop, invoicing,
delivery and customer service. We use session cookies to store the contents of the shopping cart and permanent
cookies to store the login status.

12.2 Legal basis for data processing

Processing is based on Art. 6(1)(b) (processing of orders) and (c) (archiving required by law) GDPR. The details
marked as mandatory are required to conclude and perform the contract. We only disclose the data to third parties in
the context of delivery, payment or within the scope of legal permissions and obligations towards legal advisors and
authorities. Data is only processed in third countries if this is necessary for the performance of the contract
(e.g. at the customer’s request for delivery or payment).

12.3 Storage of data

Users can optionally create a user account, in which they can in particular view their orders. During registration,
users are informed of the required mandatory details. User accounts are not public and cannot be indexed by search
engines. If users have terminated their user account, their data relating to the user account is deleted, unless
its retention is necessary for commercial or tax law reasons pursuant to Art. 6(1)(c) GDPR. Details in the customer
account remain until it is deleted, with subsequent archiving in the event of a legal obligation. It is the
users’ responsibility to back up their data before the end of the contract in the event of termination.

In the context of registration, renewed logins and use of our online services, we store the IP address and the time
of the respective user activity. This storage is based on our legitimate interests and those of the users in
protection against misuse and other unauthorised use (Art. 6(1)(f) GDPR). As a matter of principle, this data is not
disclosed to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so
pursuant to Art. 6(1)(c) GDPR.

12.4 Storage period

Data is erased after the expiry of statutory warranty and comparable obligations; the necessity of retaining the
data is reviewed every three years. In the case of statutory archiving obligations, erasure takes place after their
expiry (6, 8 or 10 years depending on the document, pursuant to Section 257 of the German Commercial Code (HGB) and
Section 147 of the German Fiscal Code (AO)).

13. External payment service providers

We use external payment service providers through whose platforms users and we can carry out payment transactions.

In the context of performing contracts, we use the payment service providers on the basis of Art. 6(1)(b) GDPR.
Otherwise, we use external payment service providers on the basis of our legitimate interests pursuant to
Art. 6(1)(f) GDPR in order to offer our users effective and secure payment options.

13.1 Data processed

The data processed by the payment service providers includes master data such as name and address, bank data such
as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract-, amount- and
recipient-related information. This information is required to carry out the transactions. However, the data
entered is only processed and stored by the payment service providers. This means that we do not receive any
account- or credit card-related information, but only confirmation or a negative report on the payment. Under
certain circumstances, the data may be transmitted by the payment service providers to credit agencies. The purpose
of this transmission is to verify identity and creditworthiness. In this regard, please refer to the terms and
conditions and privacy notices of the payment service providers.

The terms and conditions and privacy notices of the respective payment service providers, which can be accessed on
their websites or transaction applications, apply to payment transactions. We also refer to these for further
information and for asserting rights of withdrawal, access and other data subject rights: PayPal and Computop.

14. Use of third-party services

We only use the services described in this section for analytics, marketing and convenience purposes if you have
consented to them via the cookie settings (Section 25 (1) TDDDG in conjunction with Art. 6(1)(a) GDPR). Gravatar and
Akismet are exempt; the legal basis stated for each of them applies. You can withdraw your consent at any time with
effect for the future.

Some providers are based in the USA or process data there. For companies certified under the EU-U.S. Data Privacy
Framework, an adequacy decision of the European Commission applies (Art. 45 GDPR). Otherwise, data is transferred on
the basis of the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

14.1 Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow
Street, Dublin 4, Ireland (“Google”). It is used only with your consent on the basis of Art. 6(1)(a) GDPR
and Section 25 (1) TDDDG. Google Analytics uses cookies, text files that are stored on your computer and enable an
analysis of your use of the website.

14.1.1 Storage of data

The following information generated by the cookie about your use of the website is usually transmitted to a Google
server in the USA and stored there:

• Browser type/version
• Operating system used
• Referrer URL (the previously visited page)
• Host name of the accessing computer (IP address)
• Time of the server request

The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data.
In Google Analytics 4, IP addresses are not logged or stored by Google; they are only used to derive approximate
location data and then discarded. The data collected is therefore pseudonymous, but not anonymous.

14.1.2 Evaluation of data

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to
compile reports on website activity and to provide other services relating to website and internet use to the
website operator. You can prevent cookies from being stored by adjusting your browser software accordingly; however,
please note that in this case you may not be able to use all functions of this website to their full extent.

14.1.3 Prevention of processing

You can also prevent the collection of the data generated by the cookie and relating to your use of the website
(including your IP address) by Google, as well as the processing of this data by Google, by downloading and
installing the browser plug-in available at the following link:

tools.google.com/dlpage/gaoptout

As an alternative to the browser add-on, in particular for browsers on mobile devices, you can prevent collection by
Google Analytics by not giving or by withdrawing your consent in the cookie settings of this website.

We also use Google Analytics to evaluate data from Google advertising cookies and from Google Ads for statistical
purposes. If you do not want this, you can deactivate it via “My Ad Center”

https://myadcenter.google.com/home

Further information on data protection in connection with Google Analytics can be found in Google’s privacy
policy:

https://policies.google.com/privacy

14.2 Google Ads

We also use the Google advertising tool “Google Ads” (formerly Google AdWords) to promote our website.
In this context, we use the analytics service “Conversion Tracking” of Google Ireland Limited, Gordon
House, Barrow Street, Dublin 4, Ireland, hereinafter “Google”, on our website. It is used only with your
consent (Art. 6(1)(a) GDPR, Section 25 (1) TDDDG).

14.2.1 Storage of data

If you have reached our website via a Google ad, a cookie is placed on your computer. Cookies are small text files
that your web browser places and stores on your computer. These “conversion cookies” expire after a
limited period and are not used to identify you personally. If you visit certain pages of our website and the cookie
has not yet expired, we and Google can recognise that you as a user clicked on one of our ads placed with Google and
were redirected to our site.

14.2.2 Processing of data

The information obtained with the help of the “conversion cookies” is used by Google to compile visit
statistics for our website. These statistics tell us the total number of users who clicked on our ad and which pages
of our website were subsequently visited by each user. However, neither we nor other advertisers using Google Ads
receive any information that could be used to identify users personally.

14.2.3 Prevention of processing

You can prevent “conversion cookies” from being installed by adjusting your browser settings
accordingly, e.g. settings that generally deactivate the automatic setting of cookies or specifically block only
cookies from the domain “googleadservices.com”.

Google’s privacy policy in this regard can be found at the following link:

https://policies.google.com/technologies/ads?hl=en

14.3 Google Maps

We use the “Google Maps” component of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4,
Ireland, hereinafter “Google”, on our site.

Each time the “Google Maps” component is called up, Google sets a cookie in order to process user
settings and data when displaying the page on which the “Google Maps” component is integrated.

14.3.1 Processing of data

As a rule, this cookie is not deleted when the browser is closed, but expires after a certain period of time unless
you delete it manually beforehand.

14.3.2 Prevention of processing

If you do not agree to this processing of your data, you can deactivate the “Google Maps” service and
thus prevent data from being transmitted to Google. To do so, you can refuse or withdraw your consent in the cookie
settings or deactivate JavaScript in your browser. Please note, however, that in this case you will not be able to
use “Google Maps” or only to a limited extent.

The use of “Google Maps” and of the information obtained via “Google Maps” is subject to the
Google Terms of Service

https://policies.google.com/terms?hl=en

and the additional terms of service for “Google Maps”

https://www.google.com/intl/en/help/terms_maps.html

14.4 Google Fonts

We use the “Google Fonts” component of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4,
Ireland, hereinafter “Google”, on our site.

14.4.1 Processing of data

Where fonts are not loaded locally from our servers, your browser connects to Google’s servers when a page is
accessed in order to load the required fonts. In the process, in particular your IP address, information about your
browser and the page accessed are transmitted to Google. Google logs these requests and evaluates them in aggregated
form, for example to determine how widely individual font families are used. Further information on collection and
processing can be found in Google’s privacy policy:

https://policies.google.com/privacy?hl=en

14.4.2 Prevention of processing

If you do not agree to this processing of your data, you can refuse or withdraw your consent in the cookie settings.
Your browser will then use a standard font, so the website may look different.

14.5 Reddit

On this website, we use the conversion tracking (“Reddit Pixel”) of Reddit, Inc., USA, for marketing,
market research and optimisation purposes. It is used only with your consent (Art. 6(1)(a) GDPR, Section 25 (1)
TDDDG). This loads JavaScript code from Reddit that records information about your visit, such as pages viewed and
interactions. The information collected is hashed and thus pseudonymised; however, it cannot be ruled out that Reddit
links it to an existing Reddit account.

14.5.1 Processing and storage of data

The data stored in connection with Reddit® is deleted as soon as it is no longer required for its intended
purpose and no statutory retention obligations prevent its deletion.

14.5.2 Prevention of processing

You can prevent the processing by refusing or withdrawing your consent in the cookie settings, by generally
deactivating cookies in your browser or by specifically blocking cookies from Reddit.

14.6 Meta Pixel (Facebook and Instagram)

We use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
(“Meta”) on our website. This allows us to measure the effectiveness of our ads on Facebook and Instagram
and to show ads specifically to people who have shown an interest in our offerings. It is used only with your consent
(Art. 6(1)(a) GDPR, Section 25 (1) TDDDG). We are jointly responsible with Meta for the collection of the data and
its transmission to Meta (Art. 26 GDPR); Meta is solely responsible for any further processing.

14.6.1 Storage of data

When you visit our pages, the Meta Pixel transmits in particular your IP address, information about your browser
and device, the pages visited and certain actions on our website, such as a registration or an order, to Meta. For
this purpose, cookies are stored on your device. If you are logged in to Facebook or Instagram, Meta can link this
information to your account. We ourselves only receive aggregated reports that do not allow conclusions to be drawn
about individual persons. Meta also processes data in the USA; Meta is certified under the EU-U.S. Data Privacy
Framework.

14.6.2 Prevention of processing

You can prevent the processing by refusing or withdrawing your consent in the cookie settings. In your Facebook or
Instagram account, you can also specify whether Meta may use information from other websites for advertising. Further
information on data processing by Meta can be found in Meta’s privacy policy:

https://www.facebook.com/privacy/policy/

14.7 LinkedIn

We use components of the LinkedIn network on our site. LinkedIn is a service of LinkedIn Ireland Unlimited Company,
Wilton Place, Dublin 2, Ireland. Each time one of our web pages equipped with such a component is accessed, this
component causes the browser you are using to download a corresponding representation of the component from
LinkedIn.

14.7.1 Storage of data

Through this process, LinkedIn is informed which specific page of our website is currently being visited. If you
click the LinkedIn “Share” button while logged in to your LinkedIn account, you can link the content of
our pages on your LinkedIn profile. This enables LinkedIn to associate the visit to our pages with your LinkedIn user
account.

14.7.2 Prevention of processing

If you do not want LinkedIn to associate your data with your account, you must log out of LinkedIn before visiting
our website. For information on the purpose and scope of data collection and the further processing and use of data
by LinkedIn, as well as settings to protect your privacy, please refer to the LinkedIn privacy policy.

14.8 Gravatar (profile pictures)

Within our online services, and in particular in the blog, we use the Gravatar service of Automattic Inc., 60 29th
Street #343, San Francisco, CA 94110, USA.

14.8.1 Storage of data

Gravatar is a service where users can register and store profile pictures and their e-mail addresses. If users
leave posts or comments with the respective e-mail address on other online presences (above all in blogs), their
profile pictures can be displayed next to the posts or comments. For this purpose, the e-mail address provided by the
user is transmitted to Gravatar in the form of a hash value to check whether a profile is stored for it. This is the
sole purpose of transmitting the e-mail address; it is not used for any other purpose and is deleted afterwards.

Gravatar is used on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR, as Gravatar
allows us to offer authors of posts and comments the opportunity to personalise their contributions with a profile
picture.

By displaying the images, Gravatar learns the IP address of the users, as this is necessary for communication
between a browser and an online service. Further information on the collection and use of data by Gravatar can be
found in Automattic’s privacy policy:

https://automattic.com/privacy/

14.8.2 Prevention of processing

If users do not want a user picture linked to their e-mail address at Gravatar to appear in the comments, they
should use an e-mail address for commenting that is not registered with Gravatar. We would also like to point out
that it is possible to use an anonymous e-mail address or no e-mail address at all if users do not want their own
e-mail address to be sent to Gravatar. Users can prevent the transmission of data completely by not using our comment
system.

14.9 Akismet (anti-spam check)

Our online services use the Akismet service provided by Automattic Inc., 60 29th Street #343, San Francisco, CA
94110, USA. It is used on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR.

14.9.1 Storage of data

This service distinguishes comments by real people from spam comments. For this purpose, all details of a comment
are sent to a server in the USA, where they are analysed and stored for four days for comparison purposes. If a
comment has been classified as spam, the data is stored beyond this period. These details include the name entered,
the e-mail address, the IP address, the content of the comment, the referrer, information about the browser and
computer system used and the time of the entry.

Further information on the collection and use of data by Akismet can be found in Automattic’s privacy policy:

https://automattic.com/privacy/

14.9.2 Prevention of processing

Users are welcome to use pseudonyms or to refrain from entering their name or e-mail address. Users can prevent the
transmission of data completely by not using our comment system.

15. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following
rights vis-à-vis the controller:

15.1 Right of access

You can request confirmation from the controller as to whether personal data concerning you is being processed. If
such processing takes place, you can request the following information from the controller:

• the purposes for which the personal data is processed
• the categories of personal data being processed
• the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed
• the planned period for which the personal data concerning you will be stored or, if specific information on this
  is not possible, the criteria used to determine the storage period
• the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction
  of processing by the controller or a right to object to such processing
• the existence of a right to lodge a complaint with a supervisory authority
• all available information on the source of the data if the personal data is not collected from the data subject
• the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and –
  at least in these cases – meaningful information about the logic involved and the significance and envisaged
  consequences of such processing for the data subject

You have the right to request information as to whether the personal data concerning you is transferred to a third
country or to an international organisation. In this context, you can request to be informed of the appropriate
safeguards pursuant to Art. 46 GDPR in connection with the transfer.

15.2 Right to rectification

You have a right to rectification and/or completion vis-à-vis the controller if the personal data processed
concerning you is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

15.3 Right to restriction of processing

You can request the restriction of the processing of personal data concerning you under the following conditions:

• if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify
  the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use
  instead;
• the controller no longer needs the personal data for the purposes of the processing, but you require it for the
  establishment, exercise or defence of legal claims, or
• if you have objected to processing pursuant to Art. 21(1) GDPR, pending verification whether the legitimate
  grounds of the controller override your grounds.

Where processing of the personal data concerning you has been restricted, such data may – with the exception of
storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or
for the protection of the rights of another natural or legal person or for reasons of important public interest of
the Union or of a Member State.

If processing has been restricted under the above conditions, you will be informed by the controller before the
restriction is lifted.

15.4 Right to erasure

15.4.1 Obligation to erase

You can request the controller to erase the personal data concerning you without undue delay, and the controller is
obliged to erase this data without undue delay if one of the following grounds applies:

• The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise
  processed.
• You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and
  there is no other legal ground for the processing.
• You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the
  processing, or you object to the processing pursuant to Art. 21(2) GDPR.
• The personal data concerning you has been processed unlawfully.
• The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or
  Member State law to which the controller is subject.
• The personal data concerning you has been collected in relation to the offer of information society services
  referred to in Art. 8(1) GDPR.

15.4.2 Information to third parties

If the controller has made the personal data concerning you public and is obliged to erase it pursuant to Art. 17(1)
GDPR, the controller shall, taking account of available technology and the cost of implementation, take reasonable
steps, including technical measures, to inform controllers processing the personal data that you as the data subject
have requested the erasure by them of any links to, or copies or replications of, this personal data.

15.4.3 Exceptions

The right to erasure does not apply to the extent that processing is necessary:

• for exercising the right of freedom of expression and information
• for compliance with a legal obligation which requires processing under Union or Member State law to which the
  controller is subject, or for the performance of a task carried out in the public interest or in the exercise of
  official authority vested in the controller
• for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3)
  GDPR
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
  in accordance with Art. 89(1) GDPR, insofar as the right referred to in section 15.4.1 is likely to render impossible
  or seriously impair the achievement of the objectives of that processing
• for the establishment, exercise or defence of legal claims

15.5 Right to notification

If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the
controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of
processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves
impossible or involves disproportionate effort.

You have the right vis-à-vis the controller to be informed about these recipients.

15.6 Right to data portability

You have the right to receive the personal data concerning you that you have provided to the controller in a
structured, commonly used and machine-readable format. You also have the right to transmit this data to another
controller without hindrance from the controller to which the personal data was provided, where

• the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant
  to Art. 6(1)(b) GDPR and
• the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly
from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of
others.

The right to data portability does not apply to processing of personal data necessary for the performance of a task
carried out in the public interest or in the exercise of official authority vested in the controller.

15.7 Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of
personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on
these provisions.

The controller will no longer process the personal data concerning you unless it can demonstrate compelling
legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves
the establishment, exercise or defence of legal claims.

If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any
time to the processing of personal data concerning you for such marketing; this also applies to profiling to the
extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be
processed for these purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may
exercise your right to object by automated means using technical specifications.

15.8 Right to withdraw consent under data protection law

You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not
affect the lawfulness of processing based on consent before its withdrawal.

15.9 Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing – including profiling
– which produces legal effects concerning you or similarly significantly affects you. This does not apply if
the decision

• is necessary for entering into, or performance of, a contract between you and the controller,
• is authorised by Union or Member State law to which the controller is subject and which also lays down suitable
  measures to safeguard your rights and freedoms and legitimate interests, or
• is based on your explicit consent.

However, these decisions must not be based on special categories of personal data referred to in Art. 9(1) GDPR,
unless Art. 9(2)(a) or (g) GDPR applies and suitable measures to safeguard the rights and freedoms and your
legitimate interests are in place.

In the cases referred to above, the controller shall implement suitable measures to safeguard the rights and
freedoms and your legitimate interests, at least the right to obtain human intervention on the part of the
controller, to express your point of view and to contest the decision.

15.10 Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a
supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the
alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and
the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision
(Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

16. Age of majority and legal capacity

Our online services are not intended for persons under the age of 16. Pursuant to Art. 8 GDPR, you can only give
valid consent yourself to the processing of your data in connection with information society services once you have
reached the age of 16; before that, the consent of your parent or guardian is required. Concluding contracts, such
as orders in the online shop or ticket purchases, generally requires you to be of legal age and to have full legal
capacity.

If you are not yet 16 years old, we cannot store your data in our online systems. However, we do not want to miss
out on you as an applicant and will be happy to welcome you at our office to receive your application in person.

17. Security measures

During your visit to the website, we use the widespread TLS (Transport Layer Security) protocol in conjunction with
the highest level of encryption supported by your browser. As a rule, this is 256-bit encryption.

We also use suitable technical and organisational security measures to protect your data against accidental or
intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security
measures are continuously improved in line with technological developments.