View this page in: German | English

Introduction

With this Privacy Policy, we aim to inform you about the nature, scope, and purpose of the processing of personal data (hereinafter also referred to as "data") on our online presence (specifically this website). Personal data includes all data that has a personal reference to you, e.g., name, address, email address, or user behavior. This Privacy Policy applies to all data processing operations carried out by us, both within the scope of our core activities and for the online media we maintain.

1. Your Rights Under the GDPR

According to the GDPR, you are entitled to the rights listed below, which you can assert at any time with the controller named in Section 11 of this Privacy Policy:

• Right of access (Art. 15 GDPR): You have the right to request confirmation as to whether and which data concerning you we process.
• Right to rectification (Art. 16 GDPR): You have the right to request the correction of inaccurate data or the completion of incomplete data concerning you.
• Right to erasure ('right to be forgotten') (Art. 17 GDPR): You have the right to request the deletion of your data, provided there is no legal basis or statutory obligation for further storage.
• Right to restriction of processing (Art. 18 GDPR): In certain cases, you have the right to request that we only process your data in a restricted manner.
• Right to data portability (Art. 20 GDPR): You have the right to request that we transmit your data to you or another controller in a structured, commonly used, and machine-readable format.
• Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority. The competent authority is the supervisory authority of your habitual residence, your place of work, or our company headquarters. You can find a list of German supervisory authorities here (as an example): BfDI Addresses (Germany). Please find the relevant authority for your country if you are outside Germany.

Right to Withdraw Consent (Art. 7(3) GDPR)

If data processing is based on your consent (e.g., for cookies or embedded content), you have the right to withdraw this consent at any time with effect for the future. You can usually withdraw your consent via the settings of the cookie consent banner or by contacting us.

Right to Object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your data which is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR (e.g., server log files, technically necessary cookies). We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

Please direct your withdrawal, objection, or the assertion of your other rights to the contact address of the controller mentioned in Section 11 below.

2. Data Transfers to Third Countries (e.g., USA)

When using services on this website (particularly hosting by Netlify, YouTube), personal data may be transferred to recipients in countries outside the EU/EEA, especially the USA. The fonts used on this page (Google Fonts via next/font) are hosted locally and do not lead to data transfer to Google.

For the USA, there is an adequacy decision by the EU Commission for the **EU-US Data Privacy Framework (DPF)** (Art. 45 GDPR). If providers such as Netlify or Google LLC are certified under the DPF (which they state they are - status as per respective sections), the transfer is permissible on this basis. The current status can be checked on the official DPF website: DPF Participant Search. Information about the DPF can be found here: EU Commission on DPF

For transfers to third countries for which no adequacy decision exists, or to US companies that are not (or no longer) certified under the DPF, we generally ensure an adequate level of data protection by concluding **Standard Contractual Clauses (SCCs)** of the EU Commission (Art. 46(2)(c) GDPR), possibly supplemented by further technical and organizational measures.

However, we point out that despite these measures (DPF, SCCs), risks may exist for data transfers to certain third countries (especially the USA). For example, authorities there (e.g., intelligence services) might gain access to your data without effective legal remedies being available to you. We explicitly point out these risks for the respective services where a third-country transfer occurs. If your consent is required for the transfer (Art. 49(1)(a) GDPR), we obtain it separately (e.g., via the consent banner).

3. Data Processing When Visiting This Website (Server Log Files)

Each time you access our website, our host Netlify automatically collects data transmitted by your browser (server log files): IP address, date/time, requested URL, referrer URL, browser/OS.

Purpose: Provision of the website, ensuring stability and security (e.g., defense against attacks). Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and functional website). This data is not merged with other data sources or used for personal identification.

**Storage duration:** Server log files are stored by the host according to its security policies **online for 90 days and offline for 1 year** and then deleted, unless longer retention is required for evidentiary purposes or due to legal obligations. (Source: Netlify DPA, Exhibit II, as of Nov 2023).

4. Hosting and Sub-processors

We host our website with **Netlify, Inc.** (44 Montgomery Street, Suite 300, San Francisco, California 94104, USA). As our data processor, Netlify processes the server log files mentioned in Section 3 and provides the technical infrastructure.

The legal basis for hosting is Art. 6(1)(f) GDPR (legitimate interest in professional and secure website provision). We have concluded a **Data Processing Agreement (DPA)** with Netlify pursuant to Art. 28 GDPR, **which became effective by accepting Netlify's terms of service.**

Netlify uses further **sub-processors** to provide its services (e.g., for cloud infrastructure). An up-to-date list of these sub-processors can be found here: Netlify Sub-processor List. Netlify has also concluded corresponding agreements with these sub-processors.

**Data transfer to the USA:** Netlify processes data in the USA. As explained in Section 2, **this transfer is primarily based on the DPF certification of Netlify, Inc.** (Status see Netlify Privacy Policy / DPA), which constitutes a suitable guarantee according to Art. 45 GDPR. Risks may still exist. Details can also be found in the Netlify Privacy Policy.

5. Cookies

Our website uses cookies. Cookies are small text files stored on your end device. We distinguish between technically necessary cookies and those requiring your consent (e.g., for analytics, marketing, external content).

• Necessary Cookies: Strictly necessary for the basic functions and security of the website. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) or § 25(2) TTDSG (if applicable in Germany, check local equivalents). You cannot refuse these cookies via a consent banner, but you can generally block them in your browser (this may impair functionality). It is possible that our host Netlify sets such cookies for its services.
• Consent-requiring Cookies/Storage Access: For all other purposes (e.g., embedding YouTube videos), we require your prior consent according to Art. 6(1)(a) GDPR and § 25(1) TTDSG (if applicable). We obtain this via our cookie consent banner when you first visit our website.You can withdraw your consent at any time via the settings in the consent banner or your browser settings with effect for the future. Without your consent, these cookies/technologies will not be used.

Data concerned may include:

• Usage data (access times, visited pages, interactions), communication data (device information, IP address - often anonymized).

Data subjects: Users of our online offers.

Purpose of processing: Provision and optimization of the website, ensuring functionality and security, provision of external content (with consent).

Legal basis: For necessary cookies: Legitimate interest (Art. 6(1)(f) GDPR) / § 25(2) TTDSG. For all others: Consent (Art. 6(1)(a) GDPR) / § 25(1) TTDSG. (Adapt TTDSG reference based on jurisdiction if needed).

You can generally prevent or restrict the storage of cookies via your browser settings. Already stored cookies can be deleted at any time.

6. Plugins and Embedded Content from Third Parties

We embed functions and content from third-party providers on our website to provide additional content or functionalities (e.g., videos). The fonts used (Google Fonts) are hosted locally via the Next.js framework and do not require a connection to Google servers by your browser.

If you access a page containing consent-requiring content (like YouTube videos) and have previously consented, your browser establishes a direct connection to the third-party provider's servers. Your IP address and the information that you visited our page are transmitted to the provider.

Data transfer to third countries (especially the USA) is possible (see Section 2 and notes on the respective service).

Data concerned may include: Usage data, communication data (IP), possibly account data.

Data subjects: Users of our website.

Purpose of processing: Provision of additional content (videos).

**Legal basis:** For embedding YouTube videos, we require your **consent** (Art. 6(1)(a) GDPR / § 25(1) TTDSG), obtained via the cookie consent banner. **Without your consent, this content will not be loaded, and no connection to the third-party provider will be established.**

We use the following services:

Google Web Fonts (via Next.js Font Optimization)

Purpose: Uniform and performant display of fonts. We use Next.js font optimization (`next/font`). Google Fonts are downloaded during the build process and **served from our own webspace (or that of our host Netlify).** Your browser **does not establish a connection to Google servers** to load the fonts. Therefore, no data transmission to Google occurs through the mere use of the font on this website.
Legal basis: Processing is technically necessary for the provision of the website or is based on legitimate interest (Art. 6(1)(f) GDPR) in an appealing presentation. Consent is not required for self-hosted fonts.

YouTube

Purpose: Embedding videos. After your consent, a connection to Google is established, data is transmitted (IP, visited page), and cookies may be set. We aim to use the 'privacy-enhanced mode' (youtube-nocookie.com), which should delay cookie setting until a click, but does not completely prevent data transmission upon loading.
Service provider: Google Ireland Limited / Google LLC (USA).
Privacy Policy: Google Privacy Policy.
Third-country transfer: USA (DPF-certified, see Section 2). Risks may exist.
**Legal basis: Your consent** (Art. 6(1)(a) GDPR / § 25(1) TTDSG).
Opt-Out/Settings: Google Privacy Settings.

7. Data Controller Responsible for Processing

The controller responsible for data processing is:

Germany

8. No Further Active Data Collection by Us

Beyond the data processing described in the previous sections (server logs by host, cookies, and data transfer when using embedded content after consent), we do not actively collect any further personal data from you on this landing page (e.g., no contact forms, no user accounts).

Recipients of your data are primarily our hosting provider (Netlify) and its sub-processors, as well as the providers of embedded content (Google for YouTube), provided you have consented to their use. We do not pass on data to other third parties unless we are legally obliged to do so.

9. No Automated Decision-Making / No Profiling by Us

Automated individual decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place by us on this website. (Note: Third-party providers like Google might conduct their own profiling, see their privacy policies).

10. Security Measures

We implement state-of-the-art technical and organizational security measures (e.g., SSL/TLS encryption of our website via HTTPS) to comply with data protection laws and protect the processed data. Our host Netlify also implements extensive security measures according to industry standards such as SOC2 and ISO 27001 (Details see Netlify DPA, Exhibit II). More information can be found on the Netlify security page: Netlify Security.

11. Up-to-dateness and Amendment of this Privacy Policy

This Privacy Policy is currently valid and has the status April 2025.

Due to the further development of our website, the technologies used, or changes in legal or official requirements, it may become necessary to amend this Privacy Policy. The currently valid Privacy Policy can be accessed and printed by you at any time on this website.