This Privacy Notice fulfills the obligation to provide information pursuant to Article 13 et seq. of the General Data Protection Regulation (GDPR) where personal data is collected on our website.
CARFAX Europe GmbH Barthstraße 2-10 80339 Munich Email: info@carfax.eu (hereinafter referred to as "CARFAX", “we", "us").
Martin Holzhofer Holzhofer Consulting GmbH Lochhamer Str. 31 82152 Planegg, Germany Tel.: +49 89 125 01 56 00 Email: privacy@carfax.eu Website: https://www.holzhofer-consulting.de
3.1. Collection of access data / server log files
For technical reasons, we process a limited amount of data (known as connection data) each time you access our website. This data is technically necessary to establish and maintain a connection between your device and our servers. The following data or data categories may be collected:
IP address
MAC address
Source port of the calling device or a gateway (e.g., firewall or proxy)
Width and height of the display screen
Language settings of your browser
Name of the file accessed
Date and time of access (time stamp)
Amount of data transferred
Notification of whether the access was successful (via HTTP error code)
Notification of why an access may have failed (via HTTP error code)
Name of your Internet service provider
If applicable, operating system and browser software of your computer
The website from which you are visiting us
Device name
This log data is only processed for statistical analysis for the purpose of operating, securing, and optimizing the website. However, we reserve the right to review the log data retrospectively if there are concrete indications that there is a justified suspicion of illegal use.
This data is therefore not used to create user profiles.
The storage of information in the end user's user device or access to information is carried out in accordance with § 25 para. 2 no. 2 TDDDG. The processing of personal data is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.
A balancing of interests has been carried out and concluded that the processing is necessary to safeguard our legitimate interests and that these interests outweigh your interests, fundamental rights, and freedoms that require the protection of personal data. We have a legitimate interest in making this website and the services offered on it available to users.
3.2. Cookies and related technologies
3.2.1. General
This website uses some cookies and related technologies (e.g., scripts). Cookies do not harm your computer and do not contain viruses. Cookies serve to make our offer more user-friendly, effective, and secure. These are small text files that are stored on your device and saved by your browser, for example to “remember” information about you, such as your language settings or login information. Some of these cookies are set by us and are referred to as first-party cookies. We also use third-party cookies and related technologies that originate from a domain other than the website you are visiting.
By selecting the appropriate technical settings in your Internet browser, you can be notified before cookies are set and decide individually whether to accept them, as well as prevent the storage of cookies and the transmission of the data they contain. Cookies that have already been stored can be deleted at any time. However, we would like to point out that you may not be able to use all the functions of this website to their full extent.
The following links provide information on how to manage (e.g. deactivate) cookies in the most popular browsers:
Chrome Browser: https://support.google.com/accounts/answer/61416?hl=en
Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Safari: https://support.apple.com/de-de/guide/safari/manage-cookies-and-website-data-sfri11471/mac
We generally distinguish between the following categories:
Technically necessary cookies and related technologies
Performance
Cookies and related technologies
Functional cookies and related technologies
Targeting cookies and related technologies
Further information on the individual categories and the option to reject each category (with the exception of those that are technically necessary) can also be found under Cookie Settings in the footer of our website.
3.2.2. Technically necessary cookies and related technologies
Most of the cookies we use are so-called “session cookies.” They are automatically deleted at the end of your visit. Such cookies are technically necessary for the operation of the website and to provide the service requested by the user and therefore cannot be deactivated.
The storage of information in the end user's user device or access to information is carried out in accordance with Section 25 (2) No. 2 TDDDG. The processing of personal data is based on our legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our offer in accordance with Art. 6 (1) lit. f GDPR. A balancing of interests has been carried out and concluded that the processing is necessary to safeguard our legitimate interests and that these interests outweigh your interests, fundamental rights, and freedoms that require the protection of personal data.
3.2.3. Cookies requiring consent, such as analysis and tracking cookies and related technologies (e.g., tracking scripts)
Third-party advertising, marketing, and analysis tools are also integrated into our website. These are not technically necessary for the operation of the website, but serve, for example, to record the behavior of the user, to display advertising tailored to the user, or to enable an analysis of the use of our website (e.g., Google Analytics, Google Ads/DoubleClick, and Microsoft Bing Ads).
An overview of all third-party services integrated into the website, as well as detailed information on each of these services, can be found in section 10.
3.3. Processing in connection with the use of the contact form
When you use the contact form, we only collect personal data to the extent that you provide it to us. We use your name and email address only to process your request and for possible follow-up inquiries. In addition, we collect and process the subject of your inquiry and your individual message (description).The legal basis for the processing of your data is our legitimate interest pursuant to Art. 6 para. 1 lit. f DSGVO.
A data protection impact assessment has been carried out and has concluded that the interests of the individuals concerned do not outweigh our interests in processing. In the present case, we have a legitimate interest in responding to your inquiry and, if necessary, in carrying out pre-contractual measures (e.g., advising you if you are interested in purchasing, preparing an offer) with business customers, for which the processing of the data and data categories mentioned here is necessary.
If the purpose of contacting you is to carry out pre-contractual measures or if it relates to a contract already concluded between the data subject and us, this data processing is carried out on the basis of Art. 6 para. 1 lit. b DSGVO.
3.4. Data processing after entering a chassis number
By entering a chassis number or license plate number on our website, you can check in advance, free of charge and without purchasing a used car history report, whether CARFAX has any information about a specific vehicle. The legal basis is the necessity to carry out pre-contractual measures in accordance with Art. 6 para. 1 lit. B GDPR (for contracts with end customers/consumers) or Art. 6 para. 1 lit. f GDPR (for contracts with business customers).
CARFAX Europe GmbH does not employ automated individual decision-making, including profiling, pursuant to Article 22(1) and (4) GDPR.
Data is transferred to countries outside the EU and the European Economic Area ("third countries") as part of administering, developing and operating IT systems. Data shall only be transferred on the basis of:
an adequate decision of the European Commission under Article 45 GDPR;
an approved certification mechanism pursuant to Article 42 GDPR together with legally binding and enforceable obligations on the part of the controller or the processor in the third country;
standard data protection clauses issued by the Commission in accordance with the examination procedure referred to in Article 93(2) GDPR.
Personal data is currently transferred to the United States through the use of analysis and tracking tools (such as Google Analytics, DoubleClick or Microsoft Bing Ads) in the following cases:
Data Transfer to Google Inc., 1600 Amphitheater Parkway Mountain View, CA 94043, USA.
Data Transfer to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.
Data Transfer to Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.
Data Transfer to LinkedIn Corp., 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.
Data Transfer to OneTrust Technology Limited, Green, 82 St John St, London EC1M 4NJ, UK.
Data Transfer to TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
Data Transfer to Akamai Technologies Inc., 145 Broadway, Cambridge, MA 02142, USA.
In the event that you order a search for information by entering a valid vehicle identification number, we will transmit the VIN to our parent company CARFAX Inc., 5860 Trinity Parkway, Suite 600, Centreville, VA 20120 in the USA, only in cases where there is no data available in our own database and to therefore allow you full access to the global database.
To the extent permitted by law, we share personal data with external service providers:
IT service providers to maintain our IT infrastructure.
Providers of servers for the confidential storage and processing of data.
Server providers to store and process the data in a confidential manner.
Your data will also be shared as far as we are legally obliged to do so.
Personal data will only be retained for as long as is necessary in order to fulfill the purposes mentioned here or as stipulated by the statutory retention periods. The data will be deleted in accordance with the statutory regulations once the relevant purpose ceases to apply or after the retention periods have expired.
We will store your data for advertising purposes until you object to such use or we are no longer permitted by law to send promotional material to you.
CARFAX Europe GmbH, Barthstraße 2-10, 80339 Munich, Germany, is responsible for processing your data, unless otherwise stated.
You can obtain information from us at any time (Article 15 GDPR) about the data stored about you and request that it be rectified (Article 16 GDPR) where there are errors. You can also request that processing be restricted (Article 18 GDPR), request that data you give us be provided (Article 20 GDPR) in a machine-readable format (data portability) or that your data be erased (Article 17 GDPR) provided it is no longer required.
Furthermore, you have the right to object to the use of your data, which is based on public or legitimate interests (Article 21 GDPR), at any time.
If we process your data on the basis of your consent, you can revoke this consent at any time with effect for the future (Art. 7 para. 3 GDPR). Upon receipt of your withdrawal, we will no longer process your data for the purposes specified in the consent.
If you wish to exercise your rights as a data subject, please contact: CARFAX Europe GmbH Barthstraße 2-10 80339 Munich, Germany privacy@carfax.eu
In addition, you can contact a supervisory authority at any time to lodge a complaint. The Bayerisches Landesamt für Datenschutzaufsicht (Bavarian State Office for Data Protection Supervision), P.O. Box 1349, 91504 Ansbach, Germany, is the competent authority for us. Alternatively, you can contact your local supervisory authority.
10.1. Data protection notice on the use of Google Analytics
This website uses Google Analytics, a web analysis service of Google Inc. LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). Google Analytics uses technologies such as cookies, web storage in the browser and tracking pixels that enable your use of the website to be analyzed.
Additional Google Analytics functions, such as Google Looker Studio, are also used. With the help of Google Looker Studio, we manage and visualize your data in dashboards and reports to analyze results and make decisions for our website. Google Looker Studio enables us to display data from a wide range of different sources and link them together.
Among other things, the following information can be collected
Host name of the accessing computer (IP address),
Browser type/version,
Operating system used,
Referrer URL (the previously visited page),
Date and time of the server request,
Measurement of user behavior (e.g. views of individual pages / content, views of content from different areas, session duration / dwell time, bounce rate, click path, mouse and scroll movements),
Language / location data,
eCommerce activity (e.g. products purchased, sales),
Customer satisfaction.
Your data may be linked by Google with other data, such as your search history, your personal accounts, your usage data from other devices and all other data that Google has about you.
The data generated by Google Analytics is stored for 14 months. After this period, all data is automatically deleted. We have also added the code "anonymizeIP" to Google Analytics on this website.
The data generated about your use of this website is generally transferred to a Google server in the USA and stored there. For the USA, there is an adequacy decision of the EU Commission within the meaning of Art. 45 para. 3 GDPR, which extends to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified in accordance with the DPF, the level of data protection is therefore considered adequate. Google has certified itself in accordance with the DPF and has therefore undertaken to comply with European data protection principles.
The data processing serves the purpose of analyzing this website and its visitors as well as for marketing and advertising purposes. On behalf of CARFAX Europe GmbH, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. You can prevent the storage of cookies by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent.
You can also prevent Google from collecting the data generated by the cookie and related to how you use the website (including your IP address) and from processing this data by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?hl=en.
Information in the end user's terminal is stored and accessed in accordance with Article 25(1) TDDDG (Telekommunikation-Telemedien-Datenschutzgesetz — German Telecommunications and Telemedia Data Protection Act). The legal basis for your personal data being further processed is the informed consent that you have freely given pursuant to Article 6(1)(a) GDPR. You give your corresponding consent via the consent banner.
For more information on how Google Analytics handles user data, please refer to Google's privacy policy at: https://business.safety.google/privacy/ and https://www.google.de/policies/privacy/.
10.2. Privacy notice about the use of Google Tag Manager
This website uses Google Tag Manager provided by Google Inc. LLC (1600 Amphitheater Parkway, Mountain View, CA 94043, USA; "Google"). This service allows website tags to be managed via an interface. This application manages JavaScript tags and HTML tags that are used to implement tracking and analysis tools in particular. Data is processed for the purposes of designing and optimizing our website on a needs-oriented basis. Google Tool Manager only implements tags. This means: No cookies are used and no personal data is collected. Google Tag Manager triggers other tags, which in turn may collect data. However, Google Tag Manager does not access this data. If disabled at domain or cookie level, this setting remains in place for all tracking tags, insofar as these are implemented with Google Tag Manager.
However, Google Tag Manager records your IP address, which may be transmitted to a Google server in the USA and stored there. For the USA, the European Commission has issued an adequacy decision according to Article 45(3) GDPR, which applies to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified according to the DPF, the level of data protection is thus considered adequate. Google is certified under the DPF and thus committed to complying with European data protection principles.
Information in the end user's terminal is stored and accessed in accordance with Article 25(1) TDDDG (Telekommunikation-Telemedien-Datenschutzgesetz — German Telecommunications and Telemedia Data Protection Act). The legal basis for your personal data being further processed is the informed consent that you have freely given pursuant to Article 6(1)(a) GDPR. You give your corresponding consent via the consent banner.
For more information about Google Tag Manager, visit: https://www.google.com/analytics/terms/tag-manager/
10.3. Privacy notice about the use of Doubleclick.net by Google
This website uses the online marketing tool DoubleClick by Google. DoubleClick uses cookies to run ads that are relevant to users, improve campaign performance reports or to prevent a user from seeing the same ads more than once. Google uses a cookie ID to record which ads are placed in which browser and can thus prevent them from being shown more than once. In addition, DoubleClick can use cookie IDs to capture conversions related to ad requests. This is the case, for example, when a user sees a DoubleClick ad and later uses the same browser to visit the advertiser's website and buys something from it. According to Google, DoubleClick cookies do not contain any personal data.
Due to the marketing tools used, your browser automatically establishes a direct connection to the Google server. We have no influence on the scope and further use of the data collected by Google as a result of this tool being used and we are therefore providing you with the following information to the best of our knowledge: By integrating DoubleClick, Google receives the information that you have accessed the corresponding part of our website or clicked on one of our ads. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, the provider may learn of and store your IP address.
In addition, the DoubleClick Floodlight cookies used enable us to understand whether you perform certain actions on our website after you have accessed or clicked on one of our display/video ads on Google or on another platform via DoubleClick (conversion tracking). DoubleClick uses this cookie to understand the content that you have interacted with on our website so that targeted ads can subsequently be sent to you.
Your data is generally transmitted to Google LLC servers in the USA. For the USA, the European Commission has issued an adequacy decision according to Article 45(3) GDPR, which applies to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified according to the DPF, the level of data protection is thus considered adequate. Google is certified under the DPF and thus committed to complying with European data protection principles.
Information in the end user's terminal is stored and accessed in accordance with Article 25(1) TDDDG (Telekommunikation-Telemedien-Datenschutzgesetz — German Telecommunications and Telemedia Data Protection Act). The legal basis for your personal data being further processed is the informed consent that you have freely given pursuant to Article 6(1)(a) GDPR. You give your corresponding consent via the consent banner.
For more information about DoubleClick by Google, visit https://marketingplatform.google.com/about/enterprise/
10.4. Privacy notice about the use of Google Fonts API/gStatic API
This website uses external fonts from Google Inc. such as Google Fonts and gStatic. These are services provided by Google Inc., 1600 Amphitheater Parkway, Mountain View, California 94043, USA. ("Google"). These web fonts are embedded via a call to a server, usually a Google server in the USA. This will tell the server which of our websites you have visited. The IP address of the browser on the device of the visitor to these Internet pages is also stored by Google.
Your data can be transferred to the USA, if applicable. For the USA, the European Commission has issued an adequacy decision according to Article 45(3) GDPR, which applies to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified according to the DPF, the level of data protection is thus considered adequate. Google is certified under the DPF and thus committed to complying with European data protection principles.
Information in the end user's terminal is stored and accessed in accordance with Article 25(1) TDDDG (Telekommunikation-Telemedien-Datenschutzgesetz — German Telecommunications and Telemedia Data Protection Act). The legal basis for your personal data being further processed is the informed consent that you have freely given pursuant to Article 6(1)(a) GDPR. You give your corresponding consent via the consent banner.
For more information, visit https://developers.google.com/fonts/faq?tid=331597391040
10.5. Privacy notice about the use of Google Dynamic Remarketing
On our website, we use the remarketing or "similar audiences" function from Google LLC (1600 Amphitheater Parkway, Mountain View, CA 94043, USA; "Google"). The purpose of the application is to analyze visitor behavior and visitor interests. Google uses cookies to carry out analysis of website usage, which forms the basis for creating interest-based ads. The cookies are used to record the visits to the website as well as anonymous data about how the website is used. No personal data about visitors to the website is stored. If you subsequently visit another website in the Google Display Network, you will see advertisements that are likely to take into account products and information previously viewed.
Your data is generally transmitted to Google LLC servers in the USA. For the USA, the European Commission has issued an adequacy decision according to Article 45(3) GDPR, which applies to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified according to the DPF, the level of data protection is thus considered adequate. Google is certified under the DPF and thus committed to complying with European data protection principles.
Information in the end user's terminal is stored and accessed in accordance with Article 25(1) TDDDG (Telekommunikation-Telemedien-Datenschutzgesetz — German Telecommunications and Telemedia Data Protection Act). The legal basis for your personal data being further processed is the informed consent that you have freely given pursuant to Article 6(1)(a) GDPR. You give your corresponding consent via the consent banner.
For more information about Google Remarketing and its privacy policy, please visit: https://www.google.com/privacy/ads/
10.6. Privacy notice about the use of Google Audiences
We also use Google Audiences ("GA Audience") from Google LLC (1600 Amphitheater Parkway, Mountain View, CA 94043, USA; "Google"), another web analytics service from Google. This service collects and stores data from which pseudonymized usage profiles are created. This technology allows users who have visited our websites to see targeted advertising from us on other external sites in the Google Partner Network.
Among other things, GA Audience uses cookies, which are stored on your computer and other mobile devices (such as smartphones, tablets etc.) and enables how the respective devices are used to be analyzed. In this respect, the data is, in part, analyzed across devices. GA Audience will have access to the cookies created in the context of Google Analytics being used.
In the context of such use, data such as, in particular, the IP address and activities of the users, can be transferred to a Google LLC server in the USA, where it will be stored. For the USA, the European Commission has issued an adequacy decision according to Article 45(3) GDPR, which applies to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified according to the DPF, the level of data protection is thus considered adequate. Google is certified under the DPF and thus committed to complying with European data protection principles.
Google LLC may transfer this information to third parties if required by law or if such data is processed by third parties.
Information in the end user's terminal is stored and accessed in accordance with Article 25(1) TDDDG (Telekommunikation-Telemedien-Datenschutzgesetz — German Telecommunications and Telemedia Data Protection Act). The legal basis for your personal data being further processed is the informed consent that you have freely given pursuant to Article 6(1)(a) GDPR. You give your corresponding consent via the consent banner.
For more information about privacy when GA Audience is being used, please visit: https://support.google.com/analytics/answer/2700409?hl=en&ref_topic=2611283.
10.7. Privacy notice on the use of Adform
We use advertising and tracking cookies as well as similar technologies from Adform A/S, Wildersgade 10B, 1st floor, 1408 Copenhagen, Denmark. Adform is a platform for digital media advertising, primarily used for analytical purposes as well as for the optimization and personalization of advertising campaigns.
Adform generates a unique device ID for each new device and also creates or acquires cross-device IDs from third parties in order to link devices and identifiers belonging to the same user. In addition, the following data is collected and processed:
Information about the device’s operating system
Type of browser used and its settings
IP addresses
Information regarding user interaction and activity on websites and mobile apps, including the time of the interaction or activity, the associated internet addresses, and search terms entered into a search engine
Information about the approximate geographic location (city, region, postal code) of the device when accessing a website or mobile app, derived from truncated IP address data or truncated GPS data
This serves the purpose of displaying targeted, personalized advertisements to users of our website that align with their individual interests on websites and in mobile applications, as well as measuring the effectiveness of advertisements and making predictions about their reach. For this purpose, Adform may also receive information from third parties. Adform is affiliated with a wide range of partners, such as Google, Adobe, Oracle, Amazon, and many others.
Data centers serving EU customers are located in Europe. The collected data is physically stored on high-end servers operated by Adform in European data centers. However, information may also be transferred to and processed in countries outside the European Union.
To enable the provision of Adform services within the cookie-based advertising ecosystem, Adform automatically exchanges pseudonymous IDs with such partners and synchronizes these IDs. The IDs are pseudonymized, as Adform cannot associate them with a natural person without the use of additional data linked to the cookie. However, since the Adform client may possess additional data that enables the association of the cookie ID with a natural person, the data is not fully anonymized. Cookies stored in the browser by Adform expire 60 days after the last interaction. Adform does not retain cookie-based information for more than 13 months. The cookies are therefore deleted no later than the end of this period.
It is possible to object to the use of Adform cookies directly with Adform. You can find more information at https://site.adform.com/privacy-center/platform-privacy/opt-out/.
The storage of and access to information on the end user’s terminal device is carried out in accordance with § 25 (1) of the German Telecommunications-Telemedia Data Protection Act (TDDDG). The legal basis for the further processing of your personal data is your voluntary and informed consent pursuant to Article 6 (1) sentence 1 (a) of the General Data Protection Regulation (GDPR). You provide the relevant consent via the consent banner.
More information on how Adform processes your data can be found at https://site.adform.com/privacy-center/platform-privacy/product-and-services-privacy-policy.
10.8. Privacy notice on the use of Google Enhanced Conversions
On our website, we have additionally activated in Google Ads the “Enhanced Conversions/Customer Match” function (enhanced matching). This is a service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
Enhanced matching enables us to send hashed customer information to Google together with our Google Ads events in order to optimize our Google ads. In this way, we can improve the accuracy of conversion tracking, attribute more conversions and thus better understand and optimize the performance of our advertising campaigns.
For this purpose, we collect the names, email addresses and telephone numbers you enter on our pages. To protect your data, hash values are generated from the information provided on the website before transmission to Google. Hashing is carried out using the SHA-256 method.
The data collected are generally transmitted to Google servers in the USA. For the USA, an adequacy decision of the EU Commission within the meaning of Art. 45(3) GDPR exists, which extends to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified under the DPF, the level of data protection is therefore considered adequate. Google is certified under the DPF and has thereby undertaken to comply with European data protection principles.
The storage of and access to information in the end user’s terminal equipment take place pursuant to Section 25(1) TDDDG. The legal basis for the further processing of your personal data is your voluntary and informed consent pursuant to Art. 6(1) sentence 1 (a) GDPR. You provide the corresponding consents via the consent banner.
Further information on Google Enhanced Conversions can be found at: https://support.google.com/google-ads/answer/9888656?hl=en
Further information on data protection at Google can be found at: https://business.safety.google/privacy/ and https://www.google.de/policies/privacy/
10.9. Privacy policy notice for the use of Google reCaptcha
In addition to the conventional function of Google reCaptcha (for example, within an ordering process to be able to differentiate between input by a natural person or misuse by a bot or other spam software), we are also using the new reCAPTCHA v3 on our website (called the invisible reCAPTCHA). This is a function of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google) to detect abusive traffic—especially spam—on a website without user interaction. By spam, we mean any unsolicited, unwanted information sent electronically. The reCAPTCHA is therefore used to secure our website and ultimately also for your security.
The reCAPTCHA service is a JavaScript element integrated into the source text and the application runs in the background and analyzes your user behavior.
The invisible reCAPTCHA does not conduct any classic CAPTCHA test, but rather makes an assessment to allow us to select the most suitable action for our website ourselves. Google does not disclose exactly which data it collects and stores in this process. In addition, we also use the classic CAPTCHAS, in which you generally have to solve a text or image puzzle or check a box to confirm that you are not a bot. The classic reCAPTCHA is only used as a fallback solution if the invisible reCAPTCHA identifies a user as a bot in order to still give real users the opportunity to access the website.
According to our information, the following information is collected in relation to your terminal and your browser and transmitted to Google:
Referrer URL (the address of the site from which the visitor is coming)
User’s IP address
User’s operating system
Mouse and keyboard behavior
Language set in the browser
Screen and window resolution
Timezone
Installation of browser plugins
Limited location and usage data
Furthermore, Google reCAPTCHA also uses cookies (small text files in which your data is stored in your browser).
The Captcha window uses "Google Fonts" for the visual display, i.e. the fonts loaded from the Internet by Google. There is no processing of information other than that mentioned above, which is already transmitted to Google via the functionality of reCAPTCHA.
The use of Google reCAPTCHA occurs in accordance with Article 6(1)(f) of the GDPR based on our legitimate interest in establishing individual ownership on the Internet and preventing misuse and spam, and thereby ensuring the security of our website. Information is stored and accessed in accordance with Article 25 (1 and 2) TDDDG (Telekommunikation-Telemedien-Datenschutzgesetz — German Telecommunications and Telemedia Data Protection Act).
As part of this use of Google reCAPTCHA, personal data may be transmitted to the server at Google LLC. in the USA. For the USA, the European Commission has issued an adequacy decision according to Article 45(3) GDPR, which applies to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified according to the DPF, the level of data protection is thus considered adequate. The service provider Google is certified under the DPF and thus committed to complying with European data protection principles.
For further information on data privacy at Google, please visit: https://www.google.com/intl/de/policies/privacy/
For further information on Google reCAPTCHA Version 3 can be found at https://developers.google.com/recaptcha?hl=de
10.10. Privacy notice about the use of Microsoft Bing Ads
On our website we use conversion tracking by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. In this respect, Microsoft Bing Ads will store a cookie on your computer if you have accessed our website via a Microsoft Bing advertisement. In this way, we and Microsoft Bing can see that someone clicked on an ad, was redirected to our website and arrived at a previously designated landing page (conversion page). We are told the total number of users who clicked on a Bing ad and were then redirected to the conversion page.
In addition, Microsoft may be able to track your usage behaviour across several of your electronic devices through cross-device tracking, which allows Microsoft to display personalized advertising on or in Microsoft websites and apps. You can disable such tracking of your behaviour via https://account.microsoft.com/privacy/ad-settings/signedout. If you do not want information about your behaviour to be used by Microsoft as explained above, you may opt out of a cookie being set, for example by using a browser setting that generally disables cookies being set automatically.
When using Microsoft Bing Ads, personal data may also be transmitted to Microsoft's servers in the USA. For the USA, the European Commission has issued an adequacy decision according to Article 45(3) GDPR, which applies to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified according to the DPF, the level of data protection is thus considered adequate. Microsoft is certified under the DPF and thus committed to complying with European data protection principles.
Information in the end user's terminal is stored and accessed in accordance with Article 25(1) TDDDG (Telekommunikation-Telemedien-Datenschutzgesetz — German Telecommunications and Telemedia Data Protection Act). The legal basis for your personal data being further processed is the informed consent that you have freely given pursuant to Article 6(1)(a) GDPR. You give your corresponding consent via the consent banner.
For more information about Microsoft's privacy policy and the cookies used by Microsoft and Bing Ads, please visit the Microsoft website at https://privacy.microsoft.com/en-gb/privacystatement.
10.11. Privacy notice about the use of Hotjar
Our website uses Hotjar, analysis software from Hotjar Ltd. ("Hotjar"), 3 Lyons Range, 20 Bisazza Street, Sliema SLM 1640, Malta, Europe. Hotjar can be used to measure and analyze usage behavior on our website in the form of clicks, mouse movements, scroll depths, etc. The information generated by the "tracking code" and the "cookie" is transmitted to and stored on the Hotjar servers in Ireland. The following information is collected:
The IP address of your device (collected and stored in an anonymized format)
Screen size of your device
Device type and browser information
Geographical location (country only)
The preferred language for displaying our website
In addition, the following data will be logged on our server when Hotjar is used:
Referring domain
Pages visited
Geographical location (country only)
The preferred language for displaying our website
Date and time website accessed
Hotjar will use this information to analyze how you use our website, to create reports as well as other services concerning website use and Internet analysis of the website. Hotjar also uses third-party services such as Google Analytics to provide services. These third-party companies may store information that your browser sends during the visit to the site, such as cookies or IP requests. For more information about how Google Analytics stores and uses data, please refer to their respective privacy notices.
Information in the end user's terminal is stored and accessed in accordance with Article 25(1) TDDDG (Telekommunikation-Telemedien-Datenschutzgesetz — German Telecommunications and Telemedia Data Protection Act). The legal basis for your personal data being further processed is the informed consent that you have freely given pursuant to Article 6(1)(a) GDPR. You give corresponding consent via the consent banner.
For more information about privacy when using Hotjar, please visit www.hotjar.com/privacy and www.hotjar.com/legal/policies/privacy
10.12. Privacy policy on the use of Meta Pixel and Meta Custom Audience
Our website uses a "Meta pixel" created by the social network Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA ("Meta"). The Meta pixel makes it possible to track users' behavior after they click on a Meta ad. Using this Meta pixel helps us to understand how our marketing campaigns are received by users on Meta's platforms, such as Facebook and Instagram, and enables us to devise action improvement plans, if necessary. While visiting one of Meta's social networks or any other website that also utilizes this tool, users of our website are shown targeted ads ("Meta ads" or "Facebook ads" and "Instagram ads"). Accordingly, we also use the Meta pixel to display Meta ads placed by us only to those Meta users who have also shown an interest in our online offering or to those who have certain characteristics (e.g. interest in certain topics or products determined on the basis of the web pages they have visited), which we share with Meta (Meta "Custom Audiences" or "Lookalike Audiences").
Your browser uses the Meta pixel to automatically establish a direct connection to the Meta server. We have no influence on the scope and further use of the data collected by Meta, as a result of this tool being used, and we are therefore providing you with the following information to the best of our knowledge:
The integrated Meta Pixel notifies Meta that you have clicked on an ad from us or called up the corresponding page of our website. If you are registered with a Meta service, Meta can assign the visit to your account. Even if you are not registered with Meta or you have not logged in, the provider may learn a store your IP address and other identifying information.
Your data is generally transmitted to the Meta Platforms Inc. servers in the USA. For the USA, the European Commission has issued an adequacy decision according to Article 45(3) GDPR, which applies to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified according to the DPF, the level of data protection is thus considered adequate. Meta is certified under the DPF and thus committed to complying with European data protection principles.
Information in the end user's terminal is stored and accessed in accordance with Article 25(1) TDDDG (Telekommunikation-Telemedien-Datenschutzgesetz — German Telecommunications and Telemedia Data Protection Act). The legal basis for your personal data being further processed is the informed consent that you have freely given pursuant to Article 6(1)(a) GDPR. You give your corresponding consent via the consent banner.
Meta processes data in line with Meta's Privacy Policy. You can also find specific information and details about Meta pixel and how it works in the Meta Business Help Centre.
10.13 Privacy Notice on the Use of the Meta Conversions API
We use the Meta Conversions API provided by the social network Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (“Meta”) on our website. This is a server-side event tracking tool that enables us to measure the performance of our advertising campaigns in real time. The API is an interface that connects our website to Meta and thereby measures certain actions performed on our website. A conversion occurs when you, as a website visitor, perform a desired action. This may include, for example, clicking a button or completing an online form. This conversion-tracking method is an alternative to the Meta Pixel and is intended to optimise conversion tracking by improving its accuracy and reliability. Ultimately, this allows us to improve the quality of our website, our services and our advertising campaigns.
The Meta Conversions API enables us to collect various data relating to events on our website and transmit this data to Meta. The specific data stored and processed depends on the individual settings and the particular events and parameters involved. The following data may be collected and processed:
Email address
IP address
Client user agent, meaning the browser and operating system you use
Click IDs
Browser ID
To protect your data, particularly personal data such as email addresses and telephone numbers, the information generated on the website is hashed before it is transmitted to Meta. The data is hashed using the SHA-256 hashing algorithm.
As a general rule, Meta stores the data until it is no longer required for Meta’s own services and products. Customer data is, however, deleted within 48 hours after it has been matched against Meta’s own user data.
Your data is generally transferred to the servers of Meta Platforms, Inc. in the United States. The European Commission has adopted an adequacy decision for the United States pursuant to Article 45(3) of the GDPR, which applies to the EU-US Data Privacy Framework (“DPF”). Accordingly, the level of data protection is considered adequate where data is exported to recipients in the United States that are certified under the DPF. Meta is certified under the DPF and has therefore committed to complying with European data protection principles.
The storage of information on, and access to information stored in, the end user’s terminal equipment is carried out in accordance with Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The legal basis for the subsequent processing of your personal data is your freely given and informed consent pursuant to Article 6(1), sentence 1, point (a) of the GDPR. You provide the relevant consent through the consent banner.
Meta processes the data in accordance with Meta’s Privacy Policy. Further information and details about the Meta Conversions API and how it works are also available in Meta’s Help Centre.
10.14. Privacy notice regarding the use of Optimizely
Our website uses the web analysis and optimization service "Optimizely," which is provided by Optimizely Inc., 119 Fifth Avenue, 7th Floor, New York, NY 10003, USA. We use Optimizely to enhance the appeal, content and functionality of our website by using the service to publish new functions and content and by using the service to display these functions and content to a percentage of our users and then perform statistical analysis of the differences in website use. This is known as A/B testing.
Optimizely uses tools such as cookies, which you can enable to help optimize and analyze the use of our website. The information generated by these cookies about how you use our website is usually transferred to an Optimizely server in the USA, where it will be stored.
The following data may be collected and processed as part of optimization tests:
IP address (the user's IP address is automatically anonymized)
Any specific identifiers such as cookie IDs or similar identifiers, as well as event data connected to these identifiers (such as device type, browser and operating system, time of access and the characteristics of the website tested)
Optimizely uses this information on our behalf to evaluate your usage of our website, to compile reports regarding optimization tests and the associated website activities and to provide us with additional services related to the use of the website and the Internet.
The storage of and access to information on the end user's device is carried out on the basis of informed consent, in accordance with Article 25(1) TDDDG (Telekommunikation-Telemedien-Datenschutzgesetz — German Telecommunications and Telemedia Data Protection Act). The legal basis for any further processing of your personal data is the informed consent that you have freely given pursuant to Article 6(1)(a) GDPR. You give your corresponding consent via the consent banner.
We have concluded a data processing agreement (DPA) and additional standard contractual clauses (SCC) with the service provider Optimizely.
Additional information regarding data protection can be found in Optimizely's privacy policy
10.15. Data protection notice on the use of OneTrust (including cookie law)
This website uses the OneTrust consent management platform to obtain your consent to the storage of certain cookies and related technologies on your end device and to document this in compliance with data protection regulations. The provider of this technology is OneTrust Technology Limited, 82 St John St, London EC1M 4NJ, United Kingdom (hereinafter referred to as "OneTrust").
OneTrust is used to consent to the storage of cookies and related technologies in a legally compliant manner and to ensure the revocation of this consent. Furthermore, the consent is documented for legal proof and the setting of cookies and related technologies is technically controlled. For this purpose, OneTrust stores information about the categories of cookies and related technologies used by the website and whether users have given or withdrawn their consent to the use of the individual categories. Among other things, this enables us to prevent cookies and related technologies from being set in each category in the user's browser even though consent has not been given.
OneTrust itself uses cookies for information storage, which have a normal lifespan of one year, so that the preferences of returning visitors can be stored. The following information is collected and stored in connection with this
Your consent(s) or the withdrawal of your consent(s)
pseudonymous browser ID: Retention of the given/withdrawn consents according to groups/solutions with indication of the time of change in order to be able to provide legal proof of the consent given
IP address (is not stored)
If consent is given, information on browser, country, device type is also stored
The data collected is generally stored for one year or until you delete the OneTrust cookie yourself or the purpose for data storage no longer applies. Mandatory statutory retention obligations remain unaffected.
The provider Cookie Law is part of OneTrust Technology Limited and is therefore also used in connection with the consent management tool OneTrust. Cookie Law is used by OneTrust in particular as a CDN for hosting the script for the Consent Management Tool.
Since the cookies used by OneTrust serve the sole purpose of managing your consent and are therefore technically necessary so that the telemedia service expressly requested by you can be provided, no consent is required for this (see Section 25 (2) No. 2 TDDDG). OneTrust is generally used to obtain the legally required consent for the use of cookies and related technologies. The legal basis for this is Art. 6 para. 1 sentence 1 lit. c GDPR.
You can find further information on data protection at OneTrust at
https://www.onetrust.com/privacy/
10.16. Data protection notice on the use of LinkedIn Analytics and LinkedIn Ads
On this website, we use "LinkedIn Analytics" and "LinkedIn Ads", services provided by LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA. ("LinkedIn"). LinkedIn Ireland Unlimited, Wilton Plaza, Wilton Place, Dublin 2, Ireland, is responsible for data protection aspects in the EU and the European Economic Area (EEA).
Both services store and process information about your user behavior on our website. Among other things, cookies are used for this purpose, which are stored locally in the cache of your web browser on your end device and which enable an analysis of your use of our website.
We use LinkedIn Analytics for marketing and optimization purposes, in particular to analyze the use of our website and to continuously improve individual functions and offers as well as the user experience. By statistically evaluating user behavior, we can improve our offer and make it more interesting for you as a user.
We use LinkedIn Ads so that visitors to this website who are also members of LinkedIn can be shown personalized ads on LinkedIn (retargeting). Furthermore, it is possible to create anonymous reports on the performance of the advertisements and information on website interaction. For this purpose, the LinkedIn Insight tag is integrated on this website, which establishes a connection to the LinkedIn server if you visit this website and are logged into your LinkedIn account at the same time. The Insight Tag can also measure across devices whether visitors to our websites make a purchase or other action (conversion measurement).
The LinkedIn Insight Tag sets a cookie in the user's browser. LinkedIn uses this to collect data such as
URL
Referrer URL
Device properties
Browser properties
IP address (is shortened or - if it is used to reach members across devices - hashed)
Timestamp
Page views
URL of the page or name of the application, if applicable
LinkedIn anonymizes the direct identifier of members within 7 days LinkedIn deletes probilistic identity references of non-members within 90 days. Anonymized data is deleted after 180 days.
The data collected by LinkedIn cannot be assigned to a natural person by us as the website operator. We only receive aggregated reports on the demographic composition of our target audience and the efficiency of our ads. Retargeting also only uses data that does not identify members in order to improve the relevance of ads and reach members across devices.
In connection with these processes, we also receive information about criteria such as
industry
Job title
Size of the company
Career stage
Location of the website visitors
You can prevent the installation of cookies by deleting existing cookies and deactivating the storage of cookies in the settings of your web browser. We would like to point out that in this case you may not be able to use all functions on our website to their full extent. LinkedIn members can also control the use of their personal data for advertising purposes in their account settings. To deactivate the Insight tag on our website, you can click here.
LinkedIn also processes your data in the USA. For the USA, there is an adequacy decision of the EU Commission within the meaning of Art. 45 para. 3 GDPR, which extends to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA that are certified under the DPF, the level of data protection is therefore considered adequate. LinkedIn has certified itself in accordance with the DPF and is therefore committed to complying with European data protection principles.
The storage of and access to information in the end user's terminal equipment is based on informed consent in accordance with Section 25 (1) TDDDG. The legal basis for the further processing of your personal data is your voluntary and informed consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. You give the corresponding consent via the consent banner.
Further information on data protection at LinkedIn can be found in the LinkedIn privacy policy: https://www.linkedin.com/legal/privacy-policy
10.17. Data protection notice on the use of TikTok Pixel (TikTok Ads)
This website uses the so-called "TikTok pixel" of the social network TikTok, which is operated by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland ("TikTok").
This is a code that we have implemented on our website. With the help of this code, a connection is established with the TikTok servers when you visit our website in order to track and evaluate your behaviour on our website and then enable the display of interest-based and personalized product recommendations on TikTok. The information collected and processed pseudonymously in this way generally includes the device ID, device type, timestamp, operating system used and IP address. The information can be assigned to the person of the user with the help of further information that TikTok has stored about the user, e.g. due to the ownership of an account on the social network "TikTok". TikTok may also combine the information collected via the pixel with other information that TikTok has collected via other websites and/or in connection with the use of the social network "TikTok" and thus create pseudonymized user profiles. Under no circumstances can the information collected be used to personally identify visitors to this website. The TikTok pixel also enables us to track the effectiveness of advertisements on TikTok. If the user is redirected from an advertisement on TikTok to pages on this website and the cookies have not yet expired, the pixel records certain user actions predefined by us and can track these (e.g. completed transactions, leads, search queries on the website, views of product pages). When such an action is carried out, your browser sends an HTTP request from the cookie via the TikTok pixel to the TikTok server, with which certain information about the action is transmitted. Through this transmission, TikTok can compile statistics about the usage behavior on our website after forwarding a TikTok ad, which we use to optimize our offer. The storage of and access to information in the end user's terminal equipment is based on informed consent in accordance with Section 25 (1) TDDDG. The legal basis for the further processing of your personal data is your voluntary and informed consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR. You give the corresponding consent via the consent banner. You can find further information on TikTok's privacy policy at https://www.tiktok.com/legal/page/eea/privacy-policy/en
10.18. Privacy protection notice on the use of HubSpot
In connection with the use of our website, we use the HubSpot marketing automation tool, for example, for analytical and communication purposes (in particular, sending emails) and to personalize your experience.
HubSpot Inc. is a software company headquartered at 25 First Street, 2nd Floor, Cambridge, MA 02141, USA. HubSpot is an integrated software solution that we use to cover various aspects of our digital communication and marketing. These include, among others: email marketing, reporting, contact management (e.g., user segmentation and CRM), landing pages, website analytics, and contact forms.
HubSpot uses web beacons and cookies to help us analyze how our website is used. When you contact us (e.g., via contact forms or newsletter sign-up), submit another form integrated by HubSpot, or in the event of other defined triggers (such as downloading a product guide or adding items to the cart), your activities on this website are associated with a cookie, thus enabling in-depth analysis of your website usage (e.g., pages visited, duration of visit, completed forms, downloaded documents). We may also use this data to send you personalized email communications, provided you have given your consent.
This helps us tailor both your on-site experience and our external communication more closely to your preferences and interests.
To improve and optimize our digital marketing activities, HubSpot may collect and process the following data: geographic location, browser type, browsing behavior, referring URL, performance metrics, usage frequency, mobile app data, registration data, accessed files, domain names, pages viewed, operating system version, Internet service provider, IP address, device ID, visit duration, source of app download, in-app events, access times, clickstream data, device model and version.
This information and the content of our website are generally hosted in AWS data centers within the EU, the primary ones being located in Frankfurt (Germany) and Dublin (Ireland). However, it is possible that personal data may also be stored outside the EU, particularly by HubSpot in the United States. For the U.S., there is an adequacy decision by the European Commission under Article 45(3) of the GDPR, which extends to the EU-U.S. Data Privacy Framework (DPF). For data transfers to recipients in the U.S. certified under the DPF, the level of data protection is therefore considered adequate. HubSpot Inc. has certified its compliance with the DPF and thus commits to adhering to European data protection principles.
The storage of and access to data on your device are carried out in accordance with § 25(1) of the German Telecommunications-Telemedia Data Protection Act (TDDDG). The legal basis for the further processing of your personal data is your voluntary and informed consent pursuant to Article 6(1)(a) of the GDPR. This consent is given via our Consent Banner upon visiting the website.
For more information on how HubSpot handles the data collected and how it is protected, please refer to HubSpot’s Privacy Policy.
10.19. Data protection notice regarding the use of Akamai
We use the Content Delivery Network (CDN) provided by Akamai Technologies Inc., 145 Broadway, Cambridge, Massachusetts, MA 02142, USA (Akamai), to increase security (in particular to prevent misuse and fraud via a web application firewall) and to improve the delivery speed of our website.
A CDN is a network of servers distributed worldwide that is capable of delivering optimized content to website users. For this purpose, the following personal data may be processed in Akamai's server log files:
Your IP address
User agent
URLs of visited pages
Location based on your IP address and the location of the Akamai server
Telemetry data (e.g., mouse clicks, movement patterns, and associated browser data)
Your personal data will be stored by Akamai for as long as necessary for the purposes described. The IP address will be stored by us for a maximum period of 12 months and then deleted in accordance with data protection regulations.
Akamai is used in accordance with Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in using a CDN to improve delivery speed and prevent misuse and fraud, thereby ensuring the security of our website. A balancing of interests has been carried out and concluded that the processing is necessary to safeguard our legitimate interests and that these interests outweigh your interests, fundamental rights, and freedoms that require the protection of personal data. The storage of and access to information in the end user's terminal equipment is carried out in accordance with Section 25 (2) No. 2 TDDDG.
When using Akamai, personal data may also be transferred to the servers of Akamai Inc. in the USA. For the USA, there is an adequacy decision by the EU Commission within the meaning of Art. 45 (3) GDPR, which extends to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA who are certified under the DPF, the level of data protection is therefore considered adequate. The service provider Akamai has certified itself under the DPF and is therefore committed to complying with European data protection principles.
Further information on data protection at Akamai can be found at: https://www.akamai.com/legal/compliance/privacy-trust-center
10.20. Data protection notice for the use of Microsoft Clarity
We also use Microsoft Clarity on our websites. This is a web analysis service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA.
Microsoft Clarity is a tool that companies can use to check the usability of their website. To do this, Microsoft Clarity records selected sessions of users. Companies can then evaluate the sessions. The tool provides measured values that indicate possible usability problems. Microsoft Clarity also uses cookies for this purpose, as well as a so-called tracking code, which is executed when this service is accessed.
Microsoft Clarity collects user data such as:
IP address
Access times
Time zone setting
Operating system and platform
Geographical origin of the page view
Duration of visits to certain pages
Information about website interaction (e.g., scrolling, clicks, and mouse-overs)
We use Microsoft Clarity with the so-called anonymization function. With this function, Microsoft shortens the IP address even within the EU or EEA. Microsoft Clarity itself states that it masks or anonymizes sensitive data before forwarding it to Microsoft.
The data collected is, in turn, used by Microsoft to provide us with an evaluation of the visit to our websites and the usage activities there. This data may also be used to provide other services related to the use of our websites and the use of the Internet.
As part of the use of Microsoft Clarity, personal data may also be transmitted to Microsoft's servers in the USA. For the USA, the EU Commission has issued an adequacy decision within the meaning of Art. 45 (3) GDPR, which extends to the EU-US Data Privacy Framework (DPF). For data exports to recipients in the USA who are certified according to the DPF, the level of data protection is therefore considered appropriate. Microsoft has certified itself according to the DPF and thus committed itself to complying with European data protection principles.
The storage of and access to information in the end user's terminal equipment is based on informed consent in accordance with Section 25 (1) TDDDG. The legal basis for the further processing of your personal data is your voluntary and informed consent in accordance with Art. 6 (1) sentence 1 (a) GDPR. You can give the corresponding consents via the consent banner.
For more information about data protection at Microsoft and Clarity, please visit the Microsoft website under https://privacy.microsoft.com/ or under https://clarity.microsoft.com
Munich, August 2026