Privacy policy

We process the personal data of our users only to the extent necessary to provide a functional website and to deliver our content and services. As a rule, processing takes place on the basis of consent, except where the law permits processing without it.

Lawful bases

• Art. 6(1)(a) GDPR — consent
• Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR — legal obligation
• Art. 6(1)(f) GDPR — legitimate interest

Erasure & retention periods

Personal data is erased or blocked as soon as the purpose for which it was collected no longer applies. Longer retention takes place only where required by law (e. g. § 257 HGB, § 147 AO — typically between six and ten years).

Each time the site is accessed, our systems automatically record the following data from the requesting device:

• IP address (anonymised after 7 days)
• Date & time of access
• URL or content requested
• HTTP status code & volume of data transferred
• Referrer URL
• Browser, version, operating system and language

This log data is processed to ensure the functionality and security of our systems (Art. 6(1)(f) GDPR). Log files are deleted no later than 30 days after collection.

Hosting

Our website is hosted on servers within the EU by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement under Art. 28 GDPR is in place with the hosting provider.

Our website uses strictly necessary cookies required for operation (e. g. session cookie, CSRF token, cookie-consent preference). Lawful basis: § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

We also use cookies and tracking technologies for analytics and marketing purposes. These are set only with your explicit consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw your consent at any time, with effect for the future, via the cookie banner.

Contact form & email

We process the following data: name, email address, telephone number (optional), company / role (optional), the content of your message, IP address and timestamp of submission. Lawful basis: Art. 6(1)(b) GDPR (contractual) or Art. 6(1)(f) GDPR. Data is erased as soon as it is no longer required. Statutory retention obligations remain unaffected.

Telephone contact

Information you provide by phone (name, number, nature of your enquiry) is processed solely to handle your request. Calls are not recorded.

Newsletter

We use your email address to send our newsletter at regular intervals. Sign-up follows the double opt-in procedure. You may unsubscribe at any time via the link included in every newsletter.

Job applications

Application data is processed for the purpose of the recruitment procedure (§ 26 BDSG, Art. 6(1)(b) GDPR). Data relating to unsuccessful applicants is erased no later than six months after the end of the process.

Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4. IP anonymisation is enabled. Lawful basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) granted via the cookie banner. A data processing agreement is in place with Google.

Transfers to third countries: Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); EU Standard Contractual Clauses apply as an additional safeguard.

Retention: Cookies for a maximum of 14 months; user and event data is anonymised or deleted after 14 months.

Opt-out: Via the cookie banner, the Google browser add-on, or by blocking cookies in your browser.

Google Fonts (self-hosted)

Web fonts are hosted locally on our own servers. No connection to Google is established.

Google reCAPTCHA

Used to protect our forms against spam (Art. 6(1)(f) GDPR). reCAPTCHA evaluates data including IP address, time spent on the page and mouse movements.

Google Maps

Loaded only with your consent. When the map is loaded, your IP address is transmitted to Google.

We disclose your data to third parties only where this is permitted by law, where you have given consent, or where we are legally required to do so. Service providers we engage (for hosting, email delivery and IT maintenance) act exclusively on the basis of a data processing agreement under Art. 28 GDPR.

Any transfer to a third country outside the EU/EEA takes place only where an adequate level of data protection in accordance with Art. 44 et seq. GDPR is ensured.

We use TLS/SSL encryption at the highest level supported by your browser, together with appropriate technical and organisational measures to protect your data.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

You are only required to provide the data necessary to establish, perform or terminate a business relationship, or that we are legally obliged to collect. Without this data, we are generally unable to enter into or continue a contract.

This privacy policy was last updated in May 2026. We may revise it at any time to reflect changes in the law or in regulatory requirements. The current version is always available on this page.