Empalis Consulting GmbHPrivacy policy

1. Subject of this Privacy Policy

We appreciate your interest in our website and our offers displayed on our websites.
The protection of your personal data (hereinafter referred to as "data") is a great and very important concern for us. In the following, we would like to inform you in detail in the following, which data was collected during your visit to our website and use of our local offers and how these are processed or used by us, as well as which accompanying protective measures we have additionally taken in technical and organizational terms.

2. Responsible body / service provider

Responsible body in the sense of the data protection right and at the same time service provider within the meaning of the Telemedia Act (TMG) is the Empalis Consulting GmbH, cf. our imprint.
If you have any questions or comments about this privacy policy or general data protection, please contact the following e-mail address: dsb@empalis.de

3. Contact details of the data protection officer

Harald Kressler
External Data Protection Officer, Data Protection Auditor, and Member
of DSB-Group e.V., GDD e.V., and BvD e.V.

MediaCom-Services GmbH
Rudolf-Diesel-Str. 32
73760 Ostfildern

Kontakt: dsb@empalis.de

4. Collection and use of your data

The extent and nature of the collection and use of your data differs depending on whether you visit our website only to retrieve information or in order to use the services offered by us:

a) Informational use

For the purely informative use of our website, it is generally not necessary for you to provide personal data. Rather, in this case, we only collect and use data that your internet browser automatically transmits to us, such as:

• date and time of retrieval of one of our websites
• your browser type
• the browser settings
• the operating system used
• the page you visited last
• the transferred amount of data and the access status (file transfer, file not found etc.)
• the loading times of our website as well
• Your IP address

We collect and use this data during an informative visit exclusively in non-personal form. This is done in order to enable the use of the websites you have retrieved for statistical purposes and to improve our internet presence.
The IP address is only stored for the duration of your visit, a personal evaluation does not take place.

The collection of this data is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free and optimal presentation of his website - for this purpose, the server log files must be recorded.

b) Contact form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you provided there, will be stored in order to process the request and in case of follow-up questions. We will not share
this information without your consent.
The processing of the data entered into the contact form takes place exclusively on the basis of your consent (Art. 6 (1) lit. GDPR). You can revoke this consent at any time. An informal message by e-mail to us is sufficient.
The legality of the data processing operations carried out until the revocation remains unaffected by the revocation.
The information you provide in the contact form will remain with us until you ask us to delete it, revoke your consent to storage, or delete the purpose for data storage (for example, after your request has been processed). Mandatory legal provisions - especially retention periods - remain unaffected.

c) Newsletter data

If you would like to receive the newsletter offered on the website, we would need an e-mail address from you which allows us to check that you are the owner of the e-mail address provided and that you agree to receive the newsletter, as well as your first and last name. We use this data exclusively for sending the requested information and, with the exception of our dispatch service provider, do not pass it on to third parties. We use rapidmail for sending the newsletter. This service is provided by rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg im Breisgau, Germany.

Rapidmail is used for the organisation and analysis of the dispatch of newsletters, among other things. The details you enter for the purpose of receiving the newsletter will be stored on rapidmail's servers in Germany. If you do not wish to have your data analysed by rapidmail, you will have to unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message. For the purpose of analysis, the e-mails sent with rapidmail contain a so-called tracking pixel, which connects to the servers of rapidmail when the e-mail is opened. In this way, it can be determined whether a newsletter message has been opened. Furthermore, with the help of rapidmail we can determine whether and which links are clicked on in the newsletter message. All links in the e-mail are so-called tracking links, which enable us to count your clicks.

The processing of the data entered in the newsletter registration form is based exclusively on your consent (Art. 6 para. 1 lit. a DSGVO). You can revoke your consent to the storage of the data, the e-mail address and their use for sending and analysing the newsletter at any time, for example via the unsubscribe link contained in every newsletter. The legality of the data processing operations already carried out remains unaffected by the revocation.

The details you provide us with for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from our servers as well as from the servers of rapidmail after you unsubscribe from the newsletter. Data stored by us for other purposes (e.g. e-mail addresses for business communication) remain unaffected by this. You can find more information about rapidmail's data security instructions at: https://www.rapidmail.de/datensicherheit.

d) Online appointment booking

If you make use of the feature to book an appointment with us online (e.g. for an online consultation), your data that you enter there will be processed for this purpose, i.e. stored and used for the preparation and follow-up of the appointment. For booking and managing the appointment, the tool eTermin is used. Therefore, the data entered by you will also be processed by the company eTermin Ltd, Ipeirou 10A, 8010 Paphos, Cyprus as the operator of the tool accordingly on our behalf within the framework of an order processing agreement.
Beyond that, this data will not be processed without your consent.
 
The processing of the data entered in the appointment booking form is based on Art. 6 (1) lit. b DSGVO, which permits the processing of data for the performance of a contract or pre-contractual measures. 
 
The data entered by you in the appointment booking form and thus transmitted to us will remain with us until you request us to delete it or the purpose for storing the data no longer applies (e.g. after processing your request has been completed). Mandatory legal provisions - in particular retention periods - remain unaffected.

e) Participation in surveys via anonymous links (e.g. Remote Work Check)

We conduct surveys ourselves or with the help of selected processors to continually improve and evaluate our offers. You will receive an invitation to these surveys by e-mail. The survey is carried out by clicking on the link provided in the invitation. The survey is conducted with the help of Microsoft Forms, a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA. The survey collects, among other things, the following personal data:

Information provided voluntarily by survey participants.

The survey consciously refrains from collecting personal data or only does so when respondents voluntarily provide personal data via free-text questions. We therefore explicitly ask respondents to refrain from providing personal data in free-text questions. However, we cannot rule out the possibility that in individual cases, apart from the data collected in the survey, other personal data may be transferred to MICROSOFT and then processed there, which we have not commissioned to process, such as the IP address and location data of the survey participant. The Microsoft Corporation was previously effectively certified under the EU-US Privacy Shield ( ECJ, 16.7.2020 - C-311/18). The data transfer with MICROSOFT is further based on the Standard Contractual Clauses (SCC). More information on Microsoft Forms is available on https://support.office.com/de-de/forms and further information on the processing of personal data by Microsoft is available here: https://privacy.microsoft.com/de-DE/privacystatement. Participation in the survey is voluntary. The processing of this data is exclusively based on your consent (Art. 6 para. 1 lit. a DSGVO). You can withdraw this consent at any time. For this purpose, an informal communication by e-mail to us is sufficient. The legitimacy of the data processing procedures carried out until revocation remains unaffected by the revocation. The information you provide in the survey will be used only for the purpose stated therein and deleted as soon as we no longer need it for this purpose.

f) Participation in surveys via personalized questionnaires (e.g. Quick Check)

For the purposes of providing you with individualized offers and to continuously improve and evaluate our offers, we conduct surveys ourselves or with selected processors. The invitation to these surveys will be sent to you by e-mail. The data you enter in the form included in the invitation will be processed and evaluated by us for the purposes described in the invitation e-mail.
The survey is conducted using Microsoft Forms, a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA. The survey linked in the invitation e-mail collects, among other things, the following personal data:

• Last name, first name, company, position, telephone number, e-mail address.
• Responses in the course of the survey in Microsoft Forms.
• Voluntary information provided by survey participants.

We cannot rule out the possibility that in individual cases, in addition to the data collected with the survey, other personal data may be transmitted to MICROSOFT and processed there, the processing of which we have not commissioned, such as the IP address and location data of the survey participant. Microsoft Corporation was previously effectively certified under the EU-US Privacy Shield (ECJ, 16.7.2020 - C-311/18).

The data transfer with MICROSOFT is furthermore based on the Standard Contractual Clauses (SCC).
Further information on Microsoft Forms can be found at https://support.office.com/de-de/forms and further information on the processing of personal data by Microsoft can be found at https://privacy.microsoft.com/de-DE/privacystatement.

g) Participation in online events

g)1. Contact and Registration Forms using Gravity Forms

We use Gravity Forms on our website to provide contact, inquiry, and registration forms.

When you fill out and submit a form, we process the personal data you have entered in order to handle your inquiry, register you for an event or webinar, or provide the service you have requested.

In this context, the following data may be processed:

• First and last name
• Company
• Job title or position
• Address (if requested)
• Email address
• Telephone number
• Content of your inquiry
• Details regarding the event or service you selected
• Other information you voluntarily submit via the respective form
• Technical data generated in connection with the form submission

Gravity Forms is an extension of our WordPress website. Form entries are initially processed within our website and may subsequently be transmitted to our customer management system, HubSpot, and—in the case of webinar registrations—to WebinarGeek, depending on the specific purpose.

Gravity Forms itself generally does not set its own tracking cookies on the public-facing areas of the website. However, form data does leave the website if this is required by interfaces or integrations we have set up.

g) 1.1 Legal bases

If your inquiry relates to an existing contractual relationship or serves to implement pre-contractual measures, processing is based on Art. 6(1)(b) GDPR.

In other cases, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper and efficient handling of inquiries and in the organization of our business and customer contacts.

Where processing is based on your consent, the legal basis is Art. 6(1)(a) GDPR.

g)2. Customer and Prospect Management with HubSpot CRM

We use HubSpot CRM to manage customers, prospects, and business contacts.

HubSpot assists us in processing contact inquiries in a structured manner, managing existing and potential customer contacts, and mapping communication, marketing, and sales processes.

Data collected via our online forms can be transferred to HubSpot and assigned to an existing or newly created contact record.

Depending on usage, the following personal data, in particular, may be processed in HubSpot:

• Master data and contact details
• Company and professional role
• Content of inquiries
• Communication history
• Event and webinar registrations
• Participation and activity information
• Email communication
• Information regarding email delivery, opens, and usage
• Website and usage data
• Interest and segmentation attributes

We have entered into a data processing agreement with HubSpot in accordance with Art. 28 GDPR, insofar as HubSpot processes personal data on our behalf within the scope of the services we utilize.

g) 2.1 Legal bases

Where processing is necessary for the performance of a contract or to handle pre-contractual inquiries, it is carried out on the basis of Art. 6(1)(b) GDPR.

Otherwise, the general management of customers, prospective customers, and contacts is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the efficient management of our business relationships and the structured handling of customer and prospective customer contacts.

Where we process personal data based on your consent—particularly for specific marketing or tracking measures—the legal basis is Art. 6(1)(a) GDPR.

g) 3. Website and usage analysis using HubSpot

Provided you have consented to this, we use the HubSpot tracking code and associated cookies or similar technologies on our website.

This allows visits to our website to be recorded and analyzed.

For this purpose, HubSpot may, among other things, assign a visitor identifier and process the following information:

• IP ​​address
• Date and time of access
• Pages and content accessed
• Number and duration of sessions
• Origin of the visit
• Browser used
• Operating system
• Device information
• Interactions with our website
• Clicks on specific content
• Form submissions
• Pseudonymous visitor identifiers
• Company domain (where applicable)

HubSpot may initially record visitors pseudonymously or via a visitor identifier.

If you subsequently submit a form, register for a webinar, or click on a tracked link in a HubSpot email, HubSpot may—under certain conditions—link the previously recorded usage information to your existing contact record.

This makes it possible, in particular, to associate past and future website activities with you personally or with your contact record.

We use the information obtained in this way to analyze website usage, optimize content, and better tailor our communications, events, and marketing activities to the interests of our visitors and contacts.

g) 3.1 Cookies and similar technologies

For tracking purposes, HubSpot may use cookies and similar technologies that enable the recognition of visitors, sessions, and individual page views.

Where information is stored on or retrieved from your device for this purpose, this occurs only with your prior consent pursuant to Section 25 (1) TDDDG, unless a statutory exception applies for strictly necessary technologies.

The associated processing of personal data is based on your consent pursuant to Art. 6 (1) (a) GDPR.

You may revoke or change your consent at any time with future effect via the settings of our consent or cookie banner.

g) 4. Email marketing and usage analysis with HubSpot

If you have consented to this or there is another legal basis for the respective communication, we also use HubSpot to send emails, for example:

• Information about our services
• Invitations to events or webinars
• Confirmation and reminder emails
• Follow-up emails after events
• newsletter
• References to further content or offers
• When sending emails, we can evaluate whether an email was delivered or opened and whether links contained therein were clicked on.
• In particular, tracking pixels and individualized or trackable links can be used for this purpose.
• The following information, among others, can be processed:
• Recipient of the email
• Time of dispatch
• Time of an opening
• Number of openings
• links clicked
• Time of a click
• technical information about the device used
• other related interaction information

The data obtained from this can be assigned to your HubSpot contact record and evaluated there together with further information about your previous contacts, website visits and webinar activities.

As far as the evaluation of opens, clicks or comparable individual usage information is carried out, this is done on the basis of your consent in accordance with Art. 6 Para. 1 lit. a GDPR.

If information is stored or read on your device for this purpose, Section 25 Paragraph 1 TDDDG also applies.

You can revoke your consent at any time with future effect. You can unsubscribe from marketing emails using the unsubscribe link contained in the respective emails.

g) 5. Participation in live webinars, replays, and on-demand webinars via WebinarGeek

We use WebinarGeek—a service provided by WebinarGeek B.V., Chroomstraat 12, 2718 RR Zoetermeer, Netherlands—to host our webinars.

We use WebinarGeek for live webinars as well as for replays and on-demand webinars (where offered).

When you register for a webinar, the personal data required for registration is processed.

This may include, in particular:

• First name
• Last name
• Email address
• Company
• Role or job title
• Address (if requested)
• Telephone number (if provided)
• Country
• Date and time of registration
• The webinar booked
• Individual access link

In addition, WebinarGeek processes technical and usage-related information regarding your participation.

This may include, in particular:

• IP ​​address
• Device used
• Technical connection information
• Time of access
• Live participation
• Participation in a replay or on-demand webinar
• Start and end of a usage session
• Viewing or playback duration
• Participation or non-participation
• Number or type of views (where applicable)

If you use interactive features offered during a webinar, the following data may also be processed:

• Chat messages
• Questions
• Survey responses
• Quiz answers
• Responses to calls to action
• Information provided in evaluation or feedback forms
• Other inputs submitted during the webinar

This data is used to technically conduct the webinar, enable your participation, process questions or interactions, and evaluate the success and usage of our events.

A data processing agreement is in place with WebinarGeek.

g) 5.1 Legal bases

Where participation in a webinar forms part of a contract or a pre-contractual measure, the processing required for registration and conduct of the webinar is based on Art. 6(1)(b) GDPR.

In other cases, the conduct and organization of the webinar may be based on Art. 6(1)(f) GDPR. Our legitimate interest lies in conducting and organizing informational and professional events, as well as in communicating with participants.

Furthermore, to the extent that personal data regarding your usage and interaction behavior is analyzed for marketing, analytical, or sales purposes, such processing is carried out—where required—based on your consent pursuant to Art. 6(1)(a) GDPR.

g) 6. Integration of WebinarGeek with HubSpot

WebinarGeek is integrated with our HubSpot system.

This integration enables the exchange of data between WebinarGeek and HubSpot, associating it with either an existing or a newly created HubSpot contact record.

In particular, this allows webinar registrations and information regarding a participant's usage and interaction behavior to be transmitted to HubSpot.

Depending on the specific feature used, the following events and information, among others, may be transmitted to HubSpot:

• Webinar registration
• Cancellation
• Attendance
• Non-attendance
• Live attendance
• Attendance at replays or on-demand webinars
• Playback start
• Playback or viewing duration
• Timestamp of the last webinar viewed
• Timestamp of the last webinar booked
• Webinar name
• Unique access link
• Poll responses
• Quiz answers
• Questions
• Chat messages
• Interaction with calls-to-action (CTAs)
• Ratings and feedback
• Other webinar interactions

WebinarGeek can transmit this information as events to the timeline of the respective HubSpot contact.

This allows webinar information to be linked with other data present in the HubSpot CRM.

g) 7. Segmentation, interest profiles, and sales analysis

We may use the information stored in HubSpot to segment contacts and better tailor our communications to specific interests.

In particular, this may involve using information regarding:

• which websites you have visited
• which forms you have filled out
• which webinars you have registered for
• whether you attended a webinar
• how long you watched a webinar
• whether you watched a replay or an on-demand webinar
• which questions or surveys you answered
• whether you engaged with calls to action
• which emails you opened
• which links you clicked

This information allows us to create target groups or interest groups.

This process may constitute profiling within the meaning of Art. 4 No. 4 of the GDPR, insofar as personal data is processed automatically to analyze or predict specific personal aspects—particularly interests or usage and communication behavior.

Where such profiling based on personal data relies on tracking or marketing data that requires consent, the processing is carried out based on your consent pursuant to Art. 6(1)(a) of the GDPR.

Based on our current use of these systems, no solely automated decision-making within the meaning of Art. 22 of the GDPR takes place that would produce legal effects concerning you or similarly significantly affect you.

g) 8. Recording of Webinars

Individual webinars may be recorded.

If a recording is planned, we will inform you of this before the recording begins.

Insofar as your own personal contributions—specifically your image, voice, chat messages, or questions—may become part of a published or shared recording, and consent is required for this, we will obtain such consent prior to the relevant processing.

The legal basis in this case is Art. 6(1)(a) of the GDPR.

You may withdraw any consent given at any time, with effect for the future.

If a recording covers only the speakers' presentation and participants do not appear in the published recording—whether via image, sound, or other personal content—separate consent from the participants may not be required.

The specific arrangements depend on the individual webinar and will be communicated separately if necessary.

g) 9. Disclosure and Recipients

Recipients of personal data may include, in particular:

• HubSpot
• WebinarGeek
• our hosting and IT service providers
• other technical service providers, insofar as they are engaged to provide the respective systems

Under the currently planned processing model, there is no intention to disclose data collected via HubSpot or WebinarGeek to partner companies for their own marketing purposes.

Joint controllership with such partner companies pursuant to Art. 26 GDPR is therefore not envisaged for the processing operations described here

g) 10. Transfer to third countries (HubSpot)

In connection with the use of HubSpot, personal data may also be processed in the USA.

An adequacy decision by the European Commission exists for the USA regarding companies certified under the EU-U.S. Data Privacy Framework.

HubSpot states that it is certified under the EU-U.S. Data Privacy Framework.

In cases where the adequacy decision does not apply to a specific processing activity or recipient, the data processing agreement concluded with HubSpot provides for additional appropriate safeguards—specifically, the European Commission’s Standard Contractual Clauses pursuant to Art. 46(2)(c) of the GDPR.

Further information can be found at:

https://legal.hubspot.com/de/privacy-policy

https://legal.hubspot.com/de/dpa

g) 11. Data processing by WebinarGeek

WebinarGeek B.V. is based in the Netherlands.

According to the information available to us, the processing carried out by WebinarGeek on our behalf is based on a data processing agreement.

Further information regarding the processing of personal data by WebinarGeek can be found at:

https://www.webinargeek.com/de/datenschutzerklarung

g) 12. Storage Period

In principle, we store personal data only for as long as is necessary for the respective processing purpose.

The specific storage period depends in particular on:

• the duration of the business or customer relationship
• the processing of an inquiry
• the conduct of an event
• existing statutory retention obligations
• consent provided
• a declared withdrawal of consent or objection
• our established deletion and review policies

Data processed solely on the basis of consent will no longer be used for the relevant purpose if you withdraw your consent.

Where statutory retention obligations exist or data is required for the establishment, exercise, or defense of legal claims, specific data may be stored for a correspondingly longer period.

Data in HubSpot and WebinarGeek is deleted or anonymized in accordance with our internal deletion and retention policies, provided there is no further legal basis for its storage.

g) 13. Revocation and Objection

You may revoke any consent you have given at any time, with effect for the future.

Where processing is based on Art. 6(1)(f) GDPR, you have the right to object to the processing under the conditions set out in Art. 21 GDPR.

You can change your settings regarding consent-based cookies and tracking technologies at any time via our consent or cookie banner.

You can unsubscribe from marketing emails using the unsubscribe link contained in the respective emails.

The revocation of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to the revocation.

h)Contract Initiation and Execution for Customers

If you wish to use the services we offer on our website, however, you will need to provide additional information. This includes the data necessary to process your request, such as your contact information when we send you a quote or when you register for an event.
We collect or use your data for the purpose of providing the service you have requested, such as processing an order, sending you the requested quote, or organizing your participation in an event.
We collect, process, and use personal data only to the extent necessary for the establishment, content, or modification of the legal relationship. This is done on the basis of Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

We use the Customer Relationship Management (CRM) platform HubSpot to record, sort, and analyze customer interactions via email, social media, chat, and telephone across various channels. We evaluate the collected personal data and use it for communication with (potential) customers or for marketing activities, such as mailings. In addition, HubSpot enables us—provided you have given us your consent—to optimize our marketing activities by tracking and analyzing your interaction with our media content (e.g., open rates, click-through rates, etc., for mailings, websites, etc.).

We only transfer personal data to third parties if this is necessary for the fulfillment of the contract, such as to the financial institution responsible for payment processing.

Your personal data is also processed by the provider of our CRM-system under a data processing agreement. The provider is HubSpot Inc., 25 Street, Cambridge, MA 02141, USA. The transfer of your data to the USA is based on the European Commission’s Adequacy Decision and the company’s corresponding certification.

Data is not transferred to other third parties, or only if you have expressly consented to such transfer.

The legal basis for data processing is Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures. Processing in our CRM system is based on our legitimate interest in the most efficient customer management and communication possible (Article 6(1)(f) of the GDPR). If you have consented to the processing of your data, the sole legal basis is Article 6(1)(a) of the GDPR. In this case, you may revoke your consent at any time with future effect.

The collected customer data will be deleted upon completion of the order or termination of the business relationship, but not before the expiration of the statutory retention periods (usually 10 years). If you withdraw your consent, the relevant data will be deleted unless statutory retention periods prevent this.

i) Contract initiation and execution Suppliers

We collect, process and use personal data only to the extent that they are necessary for the establishment, content or amendment of the legal relationship (inventory data). This is done on the basis of Art. 6 (1) lit. b DSGVO, which permits the processing of data for the performance of a contract or pre-contractual measures. We collect, process and use personal data about the use of our websites (usage data) only to the extent necessary to enable the user to use the service or to bill the user. 

The collected supplier data will be deleted after completion of the order or termination of the business relationship, but not before the expiry of the statutory retention periods. 

We transmit personal data to third parties only if this is necessary in the context of contract processing; for example, to a company entrusted with the delivery of goods or the credit institution entrusted with payment processing. A further transmission of the data does not take place or only if you have expressly agreed to the transmission. Your data will not be passed on to third parties without your express consent, for example for advertising purposes.

The basis for data processing is Art. 6 para. 1 lit. b DSGVO, which permits the processing of data for the fulfillment of a contract or pre-contractual measures.

j) Applications

In the following, we inform you about the scope, purpose and use of the personal data transmitted and collected by you as part of an application. We assure you that the collection, processing and use of your data will be in accordance with applicable data protection law and all other legal provisions and will be treated in strict confidence.

Application by e-mail/mail/social media or similar:

As part of your application, we will collect in particular your first and last name, contact information (cell phone number and / or e-mail), address, CV and relevant certificates / training certificates and other information on qualifications or work experience.
The data collection takes place when you send us the data and your application. This personal data is used exclusively for the processing and implementation of your application procedure. Your personal data will only be passed on within our company to persons who are involved in processing your application. Beyond this, your personal data will not be passed on to third parties unless you have given us your express consent to do so.

By submitting this data, you also give your consent regarding the described use of your data (Art. 6 para. 1 lit. a DSGVO). You can revoke this consent at any time for the future.You have the right to request information about your data stored by us at any time.
If the application is successful, the data submitted by you will be stored in our data processing systems for the purpose of implementing the employment relationship.If we are unable to make you a job offer, if you reject a job offer or withdraw your application, we reserve the right to retain the data you have submitted for up to 6 months from the termination of the application process (rejection or withdrawal of the application). After this period, the data will be deleted and the physical application documents destroyed.This storage serves in particular as evidence in the event of a legal dispute.If it is apparent that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), the data will not be deleted until it has become irrelevant.Other statutory retention obligations remain unaffected.

5. Use of cookies

Our websites use so-called cookies. Cookies do not harm your computer and do not contain viruses. Cookies are used to make our offer more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and stored by your browser.
You can set your browser so that you are informed about the setting of cookies and decide on a case-by-case basis whether to accept them or decide to exclude the acceptance of cookies in certain cases or generally and activate the automatic deletion of cookies when closing the browser. Disabling cookies may limit the functionality of this website.
Cookies that are required to carry out the electronic communication process are based on Art. 6 para. 1 lit. f GDPR saved. The website operator has a legitimate interest in the storage of cookies for the technically correct and optimal provision of its services. If other cookies (such as cookies for analyzing your browsing behavior) are stored, they will be treated separately in this privacy policy.

On our websites we use the following cookies:

• borlabs-cookie saves the settings of the visitors selected in the cookie box of Borlabs Cookie. The storage period lasts for one year.
• _icl_*, wpml_*, wp-wpml_*, stores the current language. The storage period is one day.

These cookies serve users who have user access to our website in order to facilitate their browsing:

• wordpress_[hash] saves login details.
• wordpress_logged_in_[hash] saves the user's username and displays that the user is logged in.
• wp-settings-{time}-[UID] saves the individual user settings (e.g. page views) saves the individual user settings (e.g. page settings).
• wordpress_test_cookie verifies whether the browser settings enable cookies to be set. 

The duration of storage lasts one month.

6. Website analysis

6.1 Matomo

We are always interested in optimising our website for users and placing advertising in the best possible way. Matomo Analytics, an open source tool that analyses user behaviour and thus provides us with the necessary database for adjustments, helps us to do this.
We do not use any personal data for the analysis with Matomo, as the IP addresses are anonymised within Matomo before they are used and no other personally identifiable information is used. Likewise, no information is stored on or read from your end devices.
The anonymous data is used to measure page views and certain actions performed on the website (e.g. clicking on links or making purchases). However, this information is never linked to you. After anonymisation of your IP address, the data collected is stored exclusively on our server.
As the website operator, we have a legitimate interest in the anonymised analysis of user behaviour for the purpose of optimising our website and the advertising placed on it. Data processing is therefore lawful in accordance with Art. 6 para. 1 lit. f) GDPR.

6.2 WebLeads

Our website uses the pixel-code technology of unn | UNITED NEWS NETWORK GmbH, Lorenzstraße 29, D-76135 Karlsruhe (https://www.unn-online.de) to recognise company-relevant website visitors.
This involves processing the IP address of a website visitor. The processing is carried out exclusively for the purpose of collecting company-relevant information such as the company name. For this purpose, IP addresses are compared with databases and, if they cannot be assigned to a company (e.g. because they are not known or belong to natural persons), they are immediately excluded from further use (whitelist procedure). The IP address is never stored in WebLeads.
If the IP address can be assigned to a company, we receive from our contractor UNN, with whom a contract for order processing has been concluded, the information that is available about the website visit and, if necessary, information about the company that is available from public sources (possibly also about persons in the company).
The processing of data from companies without personal reference is not personal data. Insofar as personal data is processed, this is based on your consent to the transfer and analysis. The data processing is therefore lawful in accordance with Art. 6 para. 1 lit. a) GDPR. You can revoke your consent at any time with effect for the future.

Further information on data protection with WebLeads by unn | UNITED NEWS NETWORK GmbH, Lorenzstraße 29, D-76135 Karlsruhe, https://www.unn-online.de/ can be found at https://info.pressebox.de/datenschutz/

7. Social Media Pages

We currently do not use social media plugins. The social media buttons used on our website lead via a link to our respective social media pages. For these, in addition to our privacy policy, the privacy policy of the respective provider applies.

7.1 LinkedIn

When you visit our LinkedIn page, we connect to LinkedIn servers. LinkedIn is informed that you have visited our pages with your IP address. If you're logged in to LinkedIn, LinkedIn will be able to associate your visit with you and your user account. We point out that we as the provider of the pages have no knowledge of the content of the transmitted data and their use by LinkedIn.
For more information, see the LinkedIn privacy statement at: https://www.linkedin.com/legal/privacy-policy
Providers of this service are LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, United States.

7.2 Instagram

When you visit our Instagram page, you will be connected to Instagram servers. Instagram is informed that you have visited our pages with your IP address. If you are logged in to Instagram, Instagram will be able to associate your visit with you and your user account. We point out that we as the provider of the pages have no knowledge of the content of the transmitted data and their use by Instagram.
For more information, see the Instagram Privacy Policy: http://instagram.com/about/legal/privacy/
Provider of the service is Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA.

7.3 XING 

When you visit our pages of the network XING, a connection is established to servers of XING SE. XING SE will be informed that you have visited our pages with your IP address. If you are logged into your account with a service of XING SE, it is possible for XING SE to assign your visit to you and your user account. We point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data and their use by XING SE.
Provider of these services is XING SE, Dammtorstraße 30, 20354 Hamburg, Germany.
Further information on data protection can be found in the data protection declaration of XING under: https://privacy.xing.com/de/datenschutzerklaerung

7.5 YouTube

On our website we offer links to videos on YouTube.

When you click on the button to load and play the YouTube video, a connection to YouTube servers is established. The legal basis is your consent in accordance with Art. 6 Para. 1 a) DSGVO. YouTube is notified that you have visited our pages with your IP address. If you are logged in to your YouTube account, it is possible for YouTube to associate your visit with you and your user account. We would like to point out that we, as the provider of our website, have no control over the content of the transferred data or its use by YouTube.

For more information, please see YouTube's privacy policy: https://www.google.de/intl/de/policies/privacy. The provider of the service is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA, a subsidiary of Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

8. Use of third-party tools

8.1 Video offer of Empalis via the video portal Vimeo

We use the video portal Vimeo to provide videos for a restricted group of users. The provider is Vimeo Inc, 555 West 18th Street, New York, New York 10011, USA. When you call up a video via the hyperlink we provide, a connection is established to the Vimeo servers. In the process, the Vimeo server receives information about which of our pages you have visited. In addition, Vimeo collects your IP address, technical information about your browser type, your operating system or very basic device information. You decide yourself whether further information is stored by selecting the option in Vimeo's cookie policy, which you can access via the cookie notice. If you give your consent to the use of non-essential cookies here, Vimeo will store information about what actions (web activities) you perform on the website. These web activities include, for example, session duration, bounce rate or which button you clicked on the website with a built-in Vimeo function. These actions are analysed and stored by Vimeo using cookies and similar technologies. If you are logged in to Vimeo as a registered member, your actions on our website will be directly linked to your Vimeo account. To prevent this, you must log out of Vimeo before accessing our website. We use Vimeo in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 Para. 1 lit. f DSGVO. Insofar as a consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a DSGVO; the consent can be revoked at any time. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://vimeo.com/privacy. Further information on the handling of user data is provided in Vimeo's privacy policy at: https://vimeo.com/privacy.

9. Involvement of service providers and transfer to third parties

Your data will be forwarded to the provision of this website and for the purposes mentioned above, if necessary, to our supporting technical service providers (e.g. website hosting, support, quality assurance or mailing service), which we have of course carefully selected and commissioned in writing.
These service providers are bound by our instructions and are regularly monitored by us.
Otherwise, the transfer of your data to other third parties is only as far as explicitly stated in this privacy policy or in case we are legally obliged to do so.

10. Data security

We also use technical and organizational security measures to protect personal data arising or collected, in particular against accidental or intentional manipulation, loss, destruction or against the attack of unauthorized persons. Our security measures are continuously improved in line with technological developments.
Your personal data is also encrypted using SSL / TLS technology to prevent access by unauthorized third parties.

11. Your rights as a victim

11.1 Right to information

You have the right, at any time upon request, to obtain information from us about your personal data concerning you in the scope of Art. 15 GDPR. You can submit an application by post or e-mail to the above address.

11.2 Right to correct incorrect data

You have the right to request immediate correction of personal data concerning you if it is incorrect. Please contact the above mentioned contact addresses.

11.3 Right to cancellation

You have the right to demand the deletion of your personal data under the conditions described in Art. 17 GDPR. Those conditions provide, inter alia, for a right of deletion where the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, as well as in cases of unlawful processing, the existence of an opposition or the existence of an erasure obligation under Union law or the law of the Member State to which we are subject. To claim your right to cancel, please contact the above mentioned contact addresses.

11.4 Right to restriction of processing

You have the right to demand that we restrict processing in accordance with Art. 18 GDPR. This right applies in particular if the accuracy of the personal data between the user and us is controversial for the period of time required to verify correctness, and if the user requires limited processing for an existing right to delete instead of deletion; and in the event that the data is no longer required for our intended purposes, but the user requires it to assert, exercise or defend legal claims, and if the successful exercise of an objection between us and the user is still controversial. To exercise your right to restriction of processing, please contact the above contact addresses.

11.5 The right to data portability

You have the right to receive from us the personal data relating to you which you have provided to us in a structured, common, machine-readable format in accordance with Art. 20 GDPR. In order to assert your right to data portability, please contact the above mentioned contact addresses.

11.6 Right to object

You have the right at any time, for reasons arising out of your particular situation, against the processing of personal data relating to you, including but not limited to: based on Art. 6 para. 1 lit. e) or f) GDPR, to submit an objection pursuant to Art. 21 GDPR. We will cease the processing of your personal data unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights and freedoms, or if the processing is for the purposes of asserting, exercising or defending legal claims.

11.7 Withdrawal

We would like to point out that you can revoke any data protection consent that we have been granted at any time with effect for the future. For this you should contact us informally by e-mail: dsb@empalis.de

11.8 Right to complain

You also have the right to contact the competent supervisory authority for complaints. The supervisory authority responsible for us is:
The State Commissioner for Data Protection and Freedom of Information
Lautenschlagerstraße 20
70173 Stuttgart

12. Changes to this Privacy Policy

We constantly keep this privacy policy up to date. Therefore, we reserve the right to change it from time to time and to make changes in the collection, processing or use of your data. The current version of the privacy policy is available at any time on our website at www.empalis.de/privacy-policy.

13. List of Abbreviations

AVV: order processing agreement

CRM: Customer Relationship Management

GDPR: General Data Protection Regulation

DPF: EU-U.S. Data Privacy Framework

SCC: Standard Contractual Clauses

TDDDG: Telecommunications Digital Services Data Protection Act