Privacy Policy

1. Introduction

Below we inform you about the collection of personal data when using

Personal data is any data that can be related to a specific natural person, such as name or IP address.

1.1. Contact details

The controller within the meaning of Art. 4 (7) of the EU General Data Protection Regulation (GDPR) is R3 Solutions GmbH, Kurfürstendamm 194, 10707 Berlin, DE, e-mail . Legally represented by Dr. Mathias Bohge, Florian Bonanati.

You can reach our data protection officer at heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, e-mail: datenschutz@heydata.eu.

1.2. Scope of data processing, processing purposes and legal bases

Below we explain the scope of data processing, the processing purposes, and the legal bases. In principle, the following may serve as the legal basis for data processing:

  • Art. 6 (1) sentence 1 (a) GDPR serves as our legal basis for processing operations for which we obtain consent.
  • Art. 6 (1) sentence 1 (b) GDPR is the legal basis to the extent that the processing of personal data is necessary for the performance of a contract, e.g. when a website visitor purchases a product from us or we provide a service for them. This legal basis also applies to processing operations required to carry out pre-contractual measures, such as inquiries about our products or services.
  • Art. 6 (1) sentence 1 (c) GDPR applies when we fulfill a legal obligation by processing personal data, as may be the case, for example, in tax law.
  • Art. 6 (1) sentence 1 (f) GDPR serves as the legal basis when we can rely on legitimate interests for processing personal data, e.g. for cookies that are necessary for the technical operation of our website.

1.3. Data processing outside the EEA

Insofar as we transfer data to service providers or other third parties outside the EEA, the security of the data during transmission is ensured by adequacy decisions of the EU Commission, where available (e.g. for the United Kingdom, Canada, and Israel) (Art. 45 (3) GDPR).

Where no adequacy decision exists (e.g. for the USA), the legal basis for the data transfer is generally, i.e. unless stated otherwise, Standard Contractual Clauses. These are a set of rules established by the EU Commission and form part of the contract with the respective third party. Pursuant to Art. 46 (2)(b) GDPR, they ensure the security of the data transfer. Many providers have given contractual guarantees that go beyond the Standard Contractual Clauses to protect the data. These include, for example, guarantees regarding the encryption of the data or regarding an obligation of the third party to notify the data subjects if law enforcement authorities wish to access the respective data.

1.4. Storage period

Unless expressly stated in this privacy policy, the data we store is deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent deletion. If the data is not deleted because it is required for other legally permissible purposes, its processing is restricted, i.e. the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

1.5. Rights of data subjects

Rights of data subjects:

  • Right of access,
  • Right to rectification or erasure,
  • Right to restriction of processing,
  • Right to object to processing,
  • Right to data portability,
  • Right to withdraw consent given at any time.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of their personal data. Contact details of the data protection supervisory authorities can be found at https://www.bfdi.bund.de/DE/­Service/Anschriften/Laender/­Laender-node.html

1.6. Obligation to provide data

Within the scope of the business or other relationship, customers, prospective customers, or third parties must provide us with the personal data required to establish, perform, and terminate a business or other legal relationship, or which we are legally obligated to collect. Without this data, we will generally have to decline the conclusion of a contract or the provision of a service, or will no longer be able to carry out an existing contract or other legal relationship.

Mandatory information is marked as such.

1.7. No automated decision-making in individual cases

In principle, we do not use a fully automated decision-making process pursuant to Art. 22 GDPR to establish and carry out the business or other legal relationship. Should we use such procedures in individual cases, we will inform you separately if this is legally required.

1.8. Contacting us

When contacting us, e.g. by e-mail or telephone, the data you provide (e.g. name and e-mail address) is stored by us in order to answer questions. The legal basis for the processing is our legitimate interest (Art. 6 (1) sentence 1 (f) GDPR) in answering inquiries addressed to us. We delete the data arising in this context once storage is no longer necessary, or restrict processing if statutory retention obligations exist.

1.9. Customer surveys

We occasionally conduct customer surveys in order to get to know our customers and their wishes better. In doing so, we collect the data requested in each case. It is our legitimate interest to get to know our customers and their wishes better, so that the legal basis for the associated data processing is Art. 6 (1) sentence 1 (f) GDPR. We delete the data once the results of the surveys have been evaluated.

2. Newsletter

Interested parties have the option of subscribing to a free newsletter. The data provided during registration is processed exclusively for sending the newsletter. Registration takes place by checking the corresponding box on our website, by checking the corresponding box on a paper document, or through another clear action by which interested parties declare their consent to the processing of their data. The legal basis is therefore Art. 6 (1)(a) GDPR. Consent can be withdrawn at any time, e.g. by clicking the corresponding link in the newsletter or by notifying us at the e-mail address given above. The processing of the data up until the withdrawal remains lawful even after withdrawal.

Based on the consent of the recipient (Art. 6 (1) sentence 1 (a) GDPR), we also measure the open and click rates of our newsletters in order to understand what is relevant to our audience.

We send newsletters using the HubSpot tool provided by HubSpot, Inc., 25 1st Street Cambridge, MA 02141, USA (privacy policy: https://legal.hubspot.com/privacy-policy). The provider processes content, usage, meta/communication, and contact data within the EU.

3. Data processing on our website

3.1. Notice for website visitors from Germany

Our website stores information on the end device of website visitors (e.g. cookies) or accesses information already stored on the end device (e.g. IP addresses). You can find out exactly what information this involves in the following sections.

This storage and access is based on the following provisions:

  • Insofar as this storage or access is absolutely necessary to provide the service of our website expressly requested by the website visitor (e.g. to operate a chatbot used by the website visitor or to ensure the IT security of our website), it takes place on the basis of § 25 (2) No. 2 of the German Telecommunications-Telemedia Data Protection Act ("TTDSG").
  • Otherwise, this storage or access takes place on the basis of the website visitor's consent (§ 25 (1) TTDSG).

The following data processing takes place in accordance with the following sections and on the basis of the provisions of the GDPR.

3.2. Informational use of our website

When using the website for informational purposes only, i.e. when website visitors do not otherwise transmit information to us, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This is our legitimate interest, so the legal basis is Art. 6 (1) sentence 1 (f) GDPR.

This data includes:

  • IP address
  • Date and time of the request
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request (specific page)
  • Access status/HTTP status code
  • Amount of data transferred
  • Website from which the request originates
  • Browser
  • Operating system and its interface
  • Language and version of the browser software.

This data is also stored in log files. It is deleted once its storage is no longer necessary, but at the latest after 14 days.

3.3. Web hosting and provision of the website

We host the content of our website with the following provider:

Digitale Dinge GmbH
Johann-Gottlieb-Fichte-Str. 7
16540 Hohen Neuendorf

3.3.1 External hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the hosting provider(s). This may primarily include IP addresses, contact requests, meta and communication data, contract data, contact data, names, website visits, and other data generated via a website.

The external hosting takes place for the purpose of fulfilling contracts with our prospective and existing customers (Art. 6 (1)(b) GDPR) and in the interest of a secure, fast, and efficient provision of our online offering by a professional provider (Art. 6 (1)(f) GDPR).

Insofar as corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6 (1)(a) GDPR and § 25 (1) TDDDG, to the extent that the consent covers the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

Our hosting provider(s) will process your data only to the extent necessary to fulfill its performance obligations and will follow our instructions with regard to this data.

3.3.2 Data processing agreement

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract required under data protection law that ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

3.4. Contact form

When contacting us via the contact form on our website, we store the data requested there and the content of the message. The legal basis for the processing is our legitimate interest in responding to inquiries addressed to us. The legal basis for the processing is therefore Art. 6 (1) sentence 1 (f) GDPR. The data is deleted once storage is no longer necessary, or we restrict processing if statutory retention obligations exist.

3.5. Job vacancies

We publish positions vacant within our company on our website, on pages linked to the website, or on third-party websites.

The data provided as part of the application process is processed for the purpose of carrying out the application procedure. Insofar as this is necessary for our decision to establish an employment relationship, the legal basis is Art. 88 GDPR in conjunction with § 26 (1) of the German Federal Data Protection Act. We have marked or indicated which data is required for the application process. If applicants do not provide this data, we cannot process the application. Additional data is voluntary and not required for an application. If applicants provide additional information, the basis is their consent (Art. 6 (1) sentence 1 (a) GDPR).

We ask applicants not to provide information about political opinions, religious beliefs, and similarly sensitive data in their CV and cover letter. This is not required for an application. If applicants nevertheless provide such information, we cannot prevent its processing as part of the processing of the CV or cover letter. Its processing is then also based on the applicant's consent (Art. 9 (2)(a) GDPR).

Finally, we process applicants' data for further application procedures if they have given us their consent to do so. In this case, the legal basis is Art. 6 (1) sentence 1 (a) GDPR.

We pass on applicants' data to the responsible employees in the HR department, to our processors in the field of recruiting, and to other employees involved in the application process.

If we enter into an employment relationship with the person after the application process, we do not delete the data until the employment relationship has ended. Otherwise, we delete the data no later than six months after an application has been rejected.

If applicants have given us their consent to use their data for further application procedures, we do not delete their data before one year has passed since receipt of the application.

3.6. Technically necessary cookies

Our website uses cookies. Cookies are small text files that are stored in the web browser on a website visitor's end device. Cookies help make the offering more user-friendly, effective, and secure. Insofar as these cookies are necessary for the operation of our website or its functions (hereinafter "technically necessary cookies"), the legal basis for the associated data processing is Art. 6 (1) sentence 1 (f) GDPR. We have a legitimate interest in providing customers and other website visitors with a functioning website. In particular, we use technically necessary cookies for the following purposes:

  • Contao HTTPS CSRF Token – Protects against cross-site request forgery attacks. This cookie only persists for the current browser session.
  • PHP SESSION ID – Stores the current PHP session. This cookie only persists for the current browser session.

3.7. Third parties

3.7.1. HubSpot

We use HubSpot for customer relationship management. The provider is HubSpot, Inc., 25 1st Street Cambridge, MA 02141, USA. The provider processes usage data (e.g. websites visited, interest in content, access times), content data (e.g. entries in online forms), and meta/communication data (e.g. device information, IP addresses) within the EU.

The legal basis for the processing is Art. 6 (1) sentence 1 (f) GDPR. We have a legitimate interest in managing data in a simple and cost-effective manner.

The data is deleted once the purpose for which it was collected no longer applies and no retention obligation exists. Further information can be found in the provider's privacy policy at https://legal.hubspot.com/de/privacy-policy.

3.7.2. etracker Web Analytics

The provider of this website uses the JustRelate etracker service (www.etracker.com) to analyze usage data. The etracker consent manager module is used for consent management. The etracker tag manager module can be used to embed script codes from other tools. In combination, and with appropriate consent, the etracker tag manager and consent manager enable the controlled deployment of certain cookies and services. Even if statistical cookies are declined, usage data is collected in accordance with the legal requirements of the EU General Data Protection Regulation (EU GDPR) and the German Telecommunications-Digital Services Data Protection Act (TDDDG). Data processing is based on the legal provisions of Art. 6 (1)(f) (legitimate interest) of the EU GDPR. Our interest within the meaning of the EU GDPR (legitimate interest) is the optimization of our online offering as well as the legally compliant integration and management of other services on our website. Insofar as corresponding consent has been given, other technologies are deployed on the basis of Art. 6 (1)(a) of the EU GDPR. Consent can be withdrawn at any time.

The web analytics data generated with etracker is processed and stored on behalf of the provider of this website by JustRelate exclusively in Germany, and is therefore subject to strict German and European data protection laws and standards. In this regard, etracker has been independently audited, certified, and awarded the ePrivacyseal data protection seal. Because we value the privacy of our visitors, data that may allow a connection to be made to an individual person, such as the IP address, login, or device identifiers, is anonymized or pseudonymized as early as possible. No other use, merging with other data, or disclosure to third parties takes place.

You can object to the data processing described above at any time by clicking the slider control. The objection has no adverse consequences. If no slider control is displayed, data collection is already prevented by other blocking measures.

Further information on data protection at JustRelate etracker can be found here.

3.7.3. YouTube videos

We use YouTube videos for videos on the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. websites visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses) in the USA.

The legal basis for the processing is Art. 6 (1) sentence 1 (a) GDPR. The processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example via the contact details provided in our privacy policy. Withdrawal does not affect the lawfulness of processing carried out up until the withdrawal.

The legal basis for the transfer to a country outside the EEA is consent.

Further information can be found in the provider's privacy policy at https://policies.google.com/privacy.

4. Data processing on social media platforms

We maintain a presence on social media in order to present our organization and services. The operators of these networks regularly process user data for advertising purposes and create user profiles based on online behavior. These profiles are used for targeted advertising. The operators store information about user behavior in cookies. It is possible that this information is combined with other data. Users can find out about their rights via the operators' privacy policies and can object. Processing in non-EU countries may carry risks.

If users contact us via social media, we process the data provided in order to respond to inquiries. This is based on our legitimate interest pursuant to Art. 6 (1) sentence 1 (f) GDPR.

4.1. Facebook

We maintain a profile on Facebook. The operator is Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy is available here: https://www.facebook.com/policy.php. One way to object to the data processing is via the ad settings: https://www.facebook.com/settings?tab=ads. We are joint controllers for the processing of data of visitors to our profile on the basis of an agreement within the meaning of Art. 26 GDPR with Facebook. Facebook explains exactly which data is processed at https://www.facebook.com/legal­/terms/information_about_page_­insights_data. Data subjects can exercise their rights both against us and against Facebook. However, under our agreement with Facebook, we are obligated to forward inquiries to Facebook. Data subjects will therefore receive a faster response if they contact Facebook directly.

4.2. YouTube

We are active on YouTube. The operator is Google Ireland Limited, Dublin, Ireland. The privacy policy can be found at https://policies.google.com/privacy?hl=de.

4.3. Twitter

We use Twitter. The operator is Twitter Inc, USA. The privacy policy is available at https://twitter.com/de/privacy. Objection is possible via the ad settings: https://twitter.com/personalization.

4.4. LinkedIn

We have a profile on LinkedIn. The operator is LinkedIn Ireland Unlimited Company, Dublin, Ireland. The privacy policy is available at https://www.linkedin.com/legal/privacy-policy?_l=de_DE. Objection is possible via the ad settings: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

5. Changes to this privacy policy

We reserve the right to amend this privacy policy. A current version is always available on our website.

6. Questions and comments

If you have any questions or comments about this privacy policy, please contact us using the contact information provided.