Hosting (incl. Content Delivery Network)

Our online offer is hosted by an external service provider. Personal data of the website visitors to our online offer, so-called log files, are stored on the servers of our service provider. This may also be data that is collected during the active use of our website. By using a specialised service provider, we can provide our website securely and efficiently. The hosting provider we use does not process the data for its own purposes.

We also use a so-called Content Delivery Network (CDN) in order to be able to provide the content of our website more quickly. When website visitors access e. g. graphics, scripts, or other content on our website, these are provided quickly and optimally with the help of regionally and internationally distributed servers. When the files are retrieved, a connection is established to the servers of a CDN provider, whereby personal data of the website visitors are processed, e. g. the IP address, browser data or the so-called user agent.

Categories of data subjects:

• Website visitors

Data categories:

• Usage data (e. g. websites visited, interest in content, access times), metadata and communication data (e. g. device information, IP addresses)

Purposes of processing:

• Optimisation and proper presentation of the website

Legal bases:

• Consent (article 6 (1) (a) GDPR), legitimate interest (article 6 (1) (f) GDPR)

Legitimate interests:

• Optimisation and proper presentation of the website, fast website accessibility, avoidance of downtimes, high scalability

Usercentrics

• Recipient of data: Usercentrics GmbH, Sendlinger Straße 7, 80331 München, Germany
• Privacy: https://usercentrics.com/de/datenschutzerklaerung/
• Consent (article 6 (1) (a) GDPR)

Online marketing

We process personal data within the framework of online marketing, particularly regarding potential interests and to measure the effectiveness of our marketing measures, with the aim of continually boosting our reach and the prominence of our online offering.

We store the relevant information in cookies or use similar procedures for the purpose of measuring the effectiveness of our marketing measures and identifying potential interests. The data stored in the cookies could include the content viewed, webpages visited, settings, and the functions and systems used. However, plain data from users is not normally processed for the above purposes. If so, the data is changed so that the actual identity of the user is not known to us, nor the provider of the tool used. The changed data is often stored in user profiles.

In the event that user profiles are stored, the data can be used, read, supplemented, and expanded on the server of the online marketing procedure when other online offerings are visited that use the same online marketing procedure.

We can calculate the success of our adverts using summarised data that is made available to us by the provider of the online marketing procedure (known as ‘conversion measurement’). As part of these conversion measurements, we can trace whether a marketing measure caused a visitor to our online offering to decide to make a purchase. This evaluation serves to analyse the success of our online marketing.

Categories of data subjects:

• Website visitors, users of online services, prospective customers, communication partners, business partners and contractual partners

Data categories:

• Usage data (e. g. websites visited, interest in content, access times), metadata and communication data (e. g. device information, IP addresses), location data, contact data (e. g. email address, telephone number), content data (e. g. text inputs, photographs, videos)

Purposes of processing:

• Marketing (sometimes interest-based and behavioural, as well), conversion measurement, target group formation, click tracking, development of marketing strategies and increase in the efficiency of campaigns

Legal bases:

• Consent (article 6 (1) (a) GDPR), legitimate interest (article 6 (1) (f) GDPR)

Legitimate interests:

• Optimisation and further development of the website, increase in profits, customer loyalty and acquisition

Google Tag Manager

• Recipient of data: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
• Privacy: https://policies.google.com/privacy?hl=en-US
• Opt-out-link: https://tools.google.com/dlpage/gaoptout?hl=de
• Legal base: Consent (article 6 (1) (a) GDPR)

Presence on social media

We maintain online presences on social networks and career platforms so we can exchange information with users registered there and easily contact them.

Sometimes, data belonging to social network users is used for market research and, by extension, for advertising purposes. Users’ usage behaviour, such as their stated interests, can lead to user profiles being created and used in order to adapt adverts to suit the interests of the target group. To this end, cookies are normally stored on users’ end devices, which sometimes occurs regardless of whether you are a registered user of the social network.

Depending on where the social network is operated, the user data can be processed outside the European Union or outside the European Economic Area. This can lead to risks for users because it is more difficult for them to assert their rights, for example.

Categories of data subjects:

• Registered users and non-registered users of the social network

Data categories:

• Master data (e.g. name, address), contact data (e.g. email address, telephone number), content data (e.g. text inputs, photographs, videos), usage data (e.g. websites visited, interest in content, access times), metadata and communication data (e.g. device information, IP addresses)

Purposes of processing:

• Increase in the reach, networking of users

Legal bases:

• Consent (article 6 (1) (a) GDPR), legitimate interest (article 6 (1) (f) GDPR)

Legitimate interests:

• Interaction and communication on social media pages, increase in profits, findings regarding target groups

Facebook

• Recipient of data: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Irland
• Privacy: https://www.facebook.com/privacy/explanation
• Opt-out-link: https://www.facebook.com/policies/cookies

LinkedIn

• Recipient of data: LinkedIn Corporation, 1000 West Maude Avenue, Sunnyvale, CA 94085, USA
• Privacy: https://www.linkedin.com/legal/privacy-policy
• Opt-out-link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Twitter

• Recipient of data: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Irland
• Privacy: https://twitter.com/de/privacy
• Opt-out-link: https://help.twitter.com/de/rules-and-policies/twitter-cookies#privacy-options

Xing

• Recipient of data: New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany
• Privacy: https://privacy.xing.com/de/datenschutzerklaerung

YouTube

• Recipient of data: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
• Privacy: https://policies.google.com/privacy?hl=de&gl=de
• Opt-out-link: https://tools.google.com/dlpage/gaoptout?hl=de

Plug-ins and integrated third-party content

We have integrated functions and content obtained from third-party providers into our online offering. For example, videos, depictions, buttons or contributions (hereinafter termed ‘content’) can be integrated.

To enable visitors to our online offering to be shown content, the third-party provider in question processes the user’s IP address, inter alia, to transmit the content to the browser and display it. It is not possible to integrate third-party content without this processing taking place.

Sometimes, additional information is collected via ‘pixel tags’ or web beacons through which the third-party provider receives information about the use of the content or visitor traffic to our online offering, technical information about the user's browser or operating system, the visit time or referring websites. The data collected in this manner is stored in cookies on the user’s end device. We have taken security precautions to prevent this data from being automatically transferred, with the aim of protecting the personal data of visitors to our online offering. This data is only transferred if the visitor uses the buttons or click on the third-party content. To this end, we use Heise’s Shariff solution/two-click solution.

Categories of data subjects:

• Users of plug-ins or third-party content

Data categories:

• Usage data (e. g. websites visited, interest in content, access times), metadata and communication data (e. g. device information, IP addresses) contact data (e. g. email address, telephone number), Master data (e. g. name, address)

Purposes of processing:

• Design of our online offering, increase in the reach of adverts on social media, sharing of contributions and content, interest-based and behavioural marketing, cross-device tracking

Legal bases:

• Consent (article 6 (1) (a) GDPR)

LinkedIn-Plugins and -Buttons

• Recipient of data: LinkedIn Corporation, 1000 West Maude Avenue, Sunnyvale, CA 94085, USA
• Privacy: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
• Legal base: Consent (article 6 (1) (a) GDPR)

Facebook Social Plugins

• Recipient of data: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Irland
• Privacy: https://www.facebook.com/privacy/explanation
• Legal base: Consent (article 6 (1) (a) GDPR)

Twitter Plugins and -Buttons

• Recipient of data: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Irland
• Privacy: https://twitter.com/de/privacy
• Opt-out-link: https://help.twitter.com/de/rules-and-policies/twitter-cookies#privacy-options
• Legal base: Consent (article 6 (1) (a) GDPR)

XING Plugins and -Buttons

• Recipient of data: New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany
• Privacy: https://privacy.xing.com/de/datenschutzerklaerung
• Legal base: Consent (article 6 (1) (a) GDPR)

YouTube Plugins and -Buttons

• Recipient of data: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland
• Privacy: https://policies.google.com/privacy?hl=de&gl=de
• Legal base: Consent (article 6 (1) (a) GDPR)

WhatsApp Plugins and -Buttons

Advertising communications

We also use data provided to us for advertising purposes, particularly to provide information on various channels about new products from us or in our portfolio of offerings. However, promotional contact from our side is only undertaken within the framework of the statutory requirements, and once consent has been granted, insofar this is necessary.

If the data subjects of our advertising do not want to receive it, they can inform us of this at any time with future effect. We are happy to acquiesce to their request.

Categories of data subjects:

• Communication partners

Data categories:

• Master data (e. g. name, address), contact data (e. g. email address, telephone number)

Purposes of processing:

• Direct marketing

Legal bases:

• Consent (article 6 (1) (a) GDPR), legitimate interest (article 6 (1) (f) GDPR)

Legitimate interests:

• Retention of existing contacts/contractual partners and acquisition of new ones

Contacting us

On our online offering, we offer the option of contacting us directly or requesting information via various contact options.

In the event of contact being made, we process the data of the person making the enquiry to the extent necessary for answering or handling their enquiry. The data processed can vary depending on the method via which contact is made with us.

Categories of data subjects:

• Individuals submitting an enquiry

Data categories:

• Master data (e. g. name, address), contact data (e. g. email address, telephone number), content data (e. g. text inputs, photographs, videos), metadata and communication data (e. g. device information, IP addresses), usage data (e. g. websites visited, interest in content, access times)

Purposes of processing:

• Processing requests

Legal bases:

• Consent (article 6 (1) (a) GDPR), performance of contract (article 6 (1) (b) GDPR)

Online shop

We offer our customers the option of using our online shop and obtaining our products through it. To this end, we collect the data necessary for initiating and executing the contract. In addition, we collect data so that we can send our customers adverts or discounts tailored to their interests.

If necessary, we pass data to third parties that help us to handle orders or if we are legally obliged to provide certain data.

Categories of data subjects:

• Purchasers in our online shop, shop visitors upon registration

Data categories:

• Master data (e. g. name, address), contact data (e. g. email address, telephone number), contract data (e. g. subject of the contract, term, customer category), metadata and communication data (e. g. device information, IP addresses), usage data (e. g. websites visited, interest in content, access times)

Purposes of processing:

• Initiation and execution of contracts, interest-based advertising, if applicable rewards or discounts related to a customer's account, outsourcing

Legal bases:

• Legitimate interest (article 6 (1) (f) GDPR), performance of contract (article 6 (1) (b) GDPR)

Legitimate interests:

• Simplification of work processes, resource-efficient performance, market research, marketing

Registration

We offer the option of setting up a user account on our online offering. As part of the registration process, we collect the necessary data from interested users that we need to provide a user account and the associated functions.

To prevent the internal area from being exploited, we collect IP addresses and the time of access to prevent misuse of a user account and unauthorised usage. We do not pass this data on to third parties unless it is necessary to pursue our claims or we are legally obliged to do so.

To better protect user accounts from unauthorised access, a further measure is required in addition to the password when logging into a user account, such as inputting a code that is sent to a mobile device. This ensures that the user account is protected even if a third party knows the password.

Categories of data subjects:

• Registered users

Data categories:

• Master data (e. g. name, address), contact data (e. g. email address, telephone number), content data (e. g. text inputs, photographs, videos), metadata and communication data (e. g. device information, IP addresses), usage data (e. g. websites visited, interest in content, access times)

Purposes of processing:

• Simplification of the website function, performance of contract, increase in customer loyalty

Legal bases:

• Consent (article 6 (1) (a) GDPR)

Data transfer

Data is not transferred to a third country.

Storage period

In principle, we store the data of visitors to our online offering for as long as needed to render our service or to the extent that the European body issuing directives and regulations or another legislator stipulates in laws and regulations to which we are subject. In all other cases, we delete personal data once the purpose has been fulfilled, with the exception of data that we need to continue to store to comply with legal obligations (e. g. if retention periods under tax law and trade law require us to keep documents such as contracts and invoices for a certain period of time).

Automated decision-making

We do not use automated decision-making or profiling.

Legal bases

The decisive legal bases primarily arise from the GDPR. They are supplemented by national laws from member states and can, if applicable, be applied alongside or in addition to the GDPR.

Consent:

• Article 6 (1) (a) GDPR serves as the legal basis for processing procedures regarding which we have sought consent for a particular purpose of processing.

Performance of a contract:

• Article 6 (1) (b) serves as the legal basis for processing required to perform a contract to which the data subject is a contractual party or for taking steps prior to entering into a contract, at the request of the data subject.

Legal obligation:

• Article 6 (1) (c) GDPR is the legal basis for processing that is required to comply with a legal obligation.

Vital interests:

• Article 6 (1) (d) GDPR serves as the legal basis if the processing is necessary to protect the vital interests of the data subject or another natural person.

Public interest:

• Article 6 (1) (e) GDPR serves as the legal basis for processing that is necessary to perform a task in the public interest or to exercise public force that is transferred to the controller.

Legitimate interest:

• Article 6 (1) (f) GDPR serves as the legal basis for processing that is necessary to protect the legitimate interests of the controller or a third party, provided this is not outweighed by the interests or fundamental rights and fundamental freedoms of the data subject that require personal data to be protected, particularly if the data subject is a child.

Rights of the data subject

Right of access:

• Pursuant to article 15 GDPR, data subjects have the right to request confirmation as to whether we process data relating to them. They can request access to their data, along with the additional information listed in article 15 (1) GDPR and a copy of their data.

Right to rectification:

• Pursuant to article 16 GDPR, data subjects have the right to request that data relating to them, and that we process, be rectified or completed.

Right to erasure:

• Pursuant to article 17 GDPR, data subjects have the right to request that data relating to them be erased without delay. Alternatively, they can request that we restrict the processing of their data, pursuant to article 18 GDPR.

Right to data portability:

• Pursuant to article 20 GDPR, data subjects have the right to request that data made available to us by them be provided and transferred to another controller.

Right to lodge a complaint:

• In addition, data subjects have the right to lodge a complaint with the supervisory authority responsible for them, under article 77 GDPR.

Right to object:

• If personal data is processed on the basis of legitimate interests pursuant to article 6 (1) (1) (f) GDPR, under article 21 GDPR data subjects have the right to object to the processing of their personal data, provided there are reasons for this that arise from their particular situation or the objection relates to direct advertising. In the latter case, data subjects have a general right to object that is to be put into effect by us without a particular situation being stated.

Withdrawal of consent

Some data processing procedures can only be carried out with the express consent of the data subject. Once granted, you are able to withdraw consent at any time. To do so, sending an informal note or email to datenschutz@sabeu.com is sufficient. The consent of data processing operations on our online offer can be directly adjusted in our Usercentrics.

The legality of the data processing carried out up to the point of withdrawal shall remain unaffected by the withdrawal.

External links

Our website includes links to online offerings from other providers. We note that we have no influence over the content of the online offerings linked to and over whether their providers comply with data protection provisions.

Amendments

We reserve the right to amend this information on data protection, in compliance with the applicable data protection provisions, if changes are made to our online offering so that it complies with the legal requirements.

This Privacy Policy was drawn up by the DDSK GmbH