Privacy policy

1. Privacy at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website or get in touch with us. Personal data is any data that can be used to identify you personally. Detailed information can be found in the following sections of this privacy policy.

We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR) and the supplementary national data protection provisions.

This English version is provided for convenience. In case of doubt or discrepancies, the German version of this privacy policy shall prevail.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. Its contact details can be found in section “2. Controller”.

How do we collect your data?

Some of your data is collected because you provide it to us, for example when you send us an email, call us or take part in a video conference with us.

Other data is collected automatically by our host’s IT systems when you visit the website. This is mainly technical data, e.g. browser, operating system and time of the page view.

What do we use your data for?

Some of the data is collected to ensure that the website is provided without errors and securely. Other data is used to handle your enquiries.

This website does not set any cookies and does not use any analytics or tracking tools. No social media plugins, no embedded third-party content (e.g. videos or maps) and no contact forms are included.

What rights do you have regarding your data?

You have the right at any time to obtain information about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification, erasure or restriction of processing of this data, to object to the processing and – where processing is based on your consent – to withdraw that consent with effect for the future. In addition, you have the right to lodge a complaint with a data protection supervisory authority. Details can be found in section “12. Your rights as a data subject”.

2. Controller

The controller responsible for the processing of personal data on this website within the meaning of Art. 4(7) GDPR is:

3. Competent supervisory authority

As our company has its registered office in Poland, the following data protection supervisory authority is competent for us:

Prezes Urzędu Ochrony Danych Osobowych (UODO – President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl

Irrespective of this, pursuant to Art. 77 GDPR you may also contact any other data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

4. Hosting

This website is hosted by an external service provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). We use the Cloudflare Pages service: the pages of this website are stored there as static files and transmitted to your browser via Cloudflare’s global content delivery network (CDN). Cloudflare also protects the website against attacks, in particular against overload attacks (DDoS).

For details on data processing by Cloudflare, please refer to Cloudflare’s privacy policy: www.cloudflare.com/privacypolicy/

Server log data

When you visit the website, Cloudflare automatically processes information transmitted by your browser (server log data). This includes in particular:

• IP address of the requesting device
• date and time of access
• requested page or file (URL) and amount of data transferred
• HTTP status code
• referrer URL (previously visited page), if transmitted
• user agent, i.e. browser type and version as well as operating system

This data is not combined with other data sources. The processing is carried out to provide the website technically and to ensure its stability and security, for example to detect and prevent attacks (DDoS protection) and to analyse errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing the website in a technically error-free, secure and fast manner.

We do not access individual log data ourselves; no retention of access logs for us (log retention) has been set up. Cloudflare processes this data only to the extent and for as long as necessary to provide and secure the website; according to Cloudflare, HTTP request logs are not permanently stored for us by default.

Data processing agreement

A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare: the Cloudflare Data Processing Addendum forms part of Cloudflare’s terms of use (Self-Serve Subscription Agreement) and applies upon their acceptance. In it, Cloudflare undertakes to process the personal data of our website visitors only on our instructions and in compliance with the GDPR. The Data Processing Addendum is publicly available on Cloudflare’s website.

Transfers to third countries

Cloudflare is based in the USA; in addition, data may be processed in data centres outside the EU. Cloudflare is certified under the EU-US Data Privacy Framework (DPF); transfers are based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, the Data Processing Addendum incorporates the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which apply in particular if the certification lapses. Information on the certification is available at www.dataprivacyframework.gov

5. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the browser’s address bar begins with “https” and a lock symbol is displayed. When encryption is active, the data you transmit to us cannot be read by third parties.

6. Cookies, analytics and tracking

This website does not set any cookies and does not store any information in your browser (e.g. in local storage). No third-party cookies are used either.

We do not use any analytics or tracking tools: there is no web analytics or reach measurement, no tracking pixels or scripts from analytics or advertising providers are loaded, and no usage profiles are created. A cookie banner is therefore not required.

7. Contacting us by email or phone

If you contact us by email or phone, we process your enquiry including the personal data resulting from it (e.g. name, email address, phone number, company, content and time of the enquiry) in order to handle your request. We do not pass on this data to third parties, with the exception of the email service provider named below, which acts as our processor.

The legal basis is Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR).

For email communication we use Microsoft 365 (Exchange Online) provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Emails sent to us are received, stored and processed on Microsoft’s servers. We have concluded a data processing agreement with Microsoft pursuant to Art. 28 GDPR (Microsoft Products and Services Data Protection Addendum). A transfer of data to Microsoft Corporation in the USA cannot be ruled out. Microsoft is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission’s adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46(2)(c) GDPR).

The data you send us remains with us until you ask us to delete it or the purpose for storing the data no longer applies, e.g. after your request has been dealt with. Mandatory statutory provisions, in particular retention periods under commercial and tax law, remain unaffected; in this case the data is retained until the end of the period and restricted from other uses.

8. Video conferences with Microsoft Teams

We use Microsoft Teams for meetings and video conferences with clients, prospective clients and business partners. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”).

When you take part in a video conference with us, the following data in particular is processed:

• personal details: name, email address, possibly profile picture and company
• meeting metadata: topic, date, time, duration, participants, IP address as well as device and connection information
• audio and video data, if you activate your microphone or camera
• chat messages and shared files
• content of a screen share, if used

We do not record video conferences.

The legal basis is Art. 6(1)(b) GDPR insofar as the conference serves the performance of a contract or pre-contractual measures. Otherwise, the processing is based on our legitimate interest in effective communication independent of location (Art. 6(1)(f) GDPR).

We have concluded a data processing agreement with Microsoft pursuant to Art. 28 GDPR (Microsoft Products and Services Data Protection Addendum). A transfer of data to Microsoft Corporation in the USA cannot be ruled out. Microsoft is certified under the EU-US Data Privacy Framework; transfers are based on the European Commission’s adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46(2)(c) GDPR).

We delete the data processed in the context of video conferences as soon as it is no longer required for the respective purpose and no statutory retention obligations apply. Further information on data processing by Microsoft is available at privacy.microsoft.com

9. Links to external websites

This website contains links to external websites, in particular to our company page on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). These are simple links and not embedded plugins: merely visiting our website does not transmit any data to LinkedIn or other linked providers.

Only when you click on such a link are you redirected to the website of the respective provider. From that point on, only its privacy provisions apply, over which we have no influence. Information on data protection at LinkedIn is available at www.linkedin.com/legal/privacy-policy

10. Fonts

The fonts used on this website are embedded locally and delivered from the server of this website. When the pages are accessed, no connection is made to servers of Google or other font providers.

11. Storage period

Unless a more specific storage period has been stated in this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for erasure or validly object to the processing, your data will be deleted unless we have other legally permissible reasons for storing it, e.g. retention periods under tax or commercial law. In the latter case, the data will be deleted once these reasons no longer apply.

12. Your rights as a data subject

Subject to the statutory requirements, you have the following rights at any time:

• right of access to your personal data stored by us (Art. 15 GDPR)
• right to rectification of inaccurate or completion of incomplete data (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing (Art. 21 GDPR, see below)
• right to withdraw consent given (Art. 7(3) GDPR)
• right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, an informal message to the contact details given in section “2. Controller” is sufficient.

Withdrawal of your consent to data processing

This website does not obtain any consent; at present, none of the processing operations described in this privacy policy is based on consent. Where processing is based on your consent in the future (Art. 6(1)(a) GDPR), you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to lodge a complaint with a supervisory authority

In the event of infringements of the GDPR, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), without prejudice to any other administrative or judicial remedy, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority competent for us is named in section “3. Competent supervisory authority”.

13. Provision of data and automated decision-making

You are neither legally nor contractually obliged to provide us with personal data. However, this website cannot be accessed without the technically necessary connection data (see section “4. Hosting”), and we cannot answer your enquiry without your contact details.

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

14. Updates to this privacy policy

We will adapt this privacy policy as soon as the services used, our data processing or the legal requirements change. The version published on this website applies in each case.