Data processing and cookies

We use cookies to personalize content and ads, to provide social media features and to analyze traffic to our website. We also share information about your use of our website with our social media, advertising and analytics partners. Our partners may combine this information with other data that you have provided to them or that they have collected as part of your use of the services. To the privacy policy

Skip to content

Privacy policy

This privacy policy informs users about the processing of personal data when using our website. It also explains your rights with regard to personal data. The privacy policy for our social media channels can be found here Social Media Privacy Policy.

Responsible within the meaning of the GDPR

Holisticon AG
Jürgen-Töpfer-Straße 44
22763 Hamburg
Germany

Phone +49 40 6094 430-0
Email info@holisticon.de

Management Board Roman Schlömmer, Björn Serving

Data Protection Officer

If you have any questions about the processing of your personal data, please contact our data protection officer using the following contact details:

Holisticon AG
Der Datenschutzbeauftragte
Jürgen-Töpfer-Straße 44
22763 Hamburg
Germany

Phone +49 40 6094 430-0
Email datenschutz@holisticon.de

Your rights as a user

When processing your personal data, you (the data subject) have the following rights as a user of our website:

  • Right to information (Art. 15 GDPR)
  • Right to rectification of inaccurate data (Art. 16 GDPR)
  • Right to erasure or a right to be "forgotten" (Art. 17 GDPR)
  • Right to restriction of processing of personal data (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR).

You can object to the processing of personal data for advertising purposes, including the analysis of customer data for advertising purposes, at any time without giving reasons.

In addition, you also have a general right to object (see Art. 21 (1) GDPR). In this case, the objection to data processing must be justified. If the data processing is based on consent, your consent can be revoked at any time with effect for the future.

To exercise your rights as a data subject, please contact datenschutz@holisticon.de.

Furthermore, in accordance with Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of the data concerning you violates data protection regulations.

Data protection supervisory authority responsible for Holisticon AG

The Hamburg Commissioner for Data Protection and Freedom of Information

Ludwig-Erhard-Str 22
7th floor
20459 Hamburg

Phone: +49 40 428 54-40 40
Fax: +49 40 428 54-40 00
Email: mailbox(at)datenschutz.hamburg.de
Homepage: http://www.datenschutz-hamburg.de

External hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the hoster(s). This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated via a website.

External hosting is carried out for the purpose of contract fulfilment vis-à-vis our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR).

If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Our host(s) will only process your data to the extent necessary to fulfil its performance obligations and follow our instructions with regard to this data.

We use the following hoster(s):

SiteGround Spain S.L.
Calle de Prim 19,
28004 Madrid,
Spain

Order processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract prescribed by data protection law, which guarantees that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Note on the transfer of data to third countries that are not secure under data protection law and the transfer to US companies that are not DPF-certified

Among other things, we use tools from companies based in third countries that are not secure under data protection law and US tools whose providers are not certified under the EU-US Data Privacy Framework (DPF). If these tools are active, your personal data may be transferred to these countries and processed there. We would like to point out that a level of data protection comparable to that in the EU cannot be guaranteed in third countries that are not secure under data protection law.

We would like to point out that the USA, as a safe third country, generally has a level of data protection comparable to that of the EU. Data transfer to the USA is therefore permitted if the recipient is certified under the "EU-US Data Privacy Framework" (DPF) or has suitable additional guarantees. Information on transfers to third countries, including the data recipients, can be found in this privacy policy.

Recipients of personal data

As part of our business activities, we work together with various external organisations. In some cases, it is also necessary to transfer personal data to these external organisations.

We only pass on personal data to external bodies if this is necessary in the context of a

is necessary for the fulfilment of the contract, if we are legally obliged to do so (e.g. transfer of data to tax authorities), if we have a legitimate interest in the transfer in accordance with Art. 6 para. 1 lit. f GDPR or if another legal basis permits the transfer of data. When using processors, we only pass on our customers' personal data on the basis of a valid contract for order processing. In the case of joint processing, a joint processing agreement is concluded.

SSL or TLS encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Objection to advertising emails

We hereby object to the use of contact data published as part of our obligation to provide a legal notice for the purpose of sending unsolicited advertising and information material. The operators of this website expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, such as spam emails.

Data collection on this website

Cookies

Our Internet pages use so-called "cookies". Cookies are small data packets and do not cause any damage to your end device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your end device until you delete them yourself or they are automatically deleted by your web browser.

Cookies may originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services from third-party companies within websites (e.g. cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. displaying videos). Other cookies can be used to analyse user behaviour or for advertising purposes.

Cookies that are required to carry out the electronic communication process, to provide certain functions that you have requested (e.g. for the shopping basket function) or to optimise the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in the storage of necessary cookies for the technically error-free and optimised provision of its services. If consent to the storage of cookies and comparable recognition technologies has been requested, the processing is carried out exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG); the consent can be revoked at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.

You can find out which cookies and services are used on this website in this privacy policy.

Contradiction

Any user of this website can object to the future collection and storage of data by cookies at any time here:

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request
  • IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website - the server log files must be recorded for this purpose.

Contact details

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in the event of follow-up questions. We will not pass on this data without your consent.

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested; consent can be revoked at any time.

We will retain the data you provide on the contact form until you request its deletion, revoke your consent for its storage, or the purpose for its storage no longer pertains (e.g. after fulfilling your request). Mandatory statutory provisions - in particular retention periods - remain unaffected.

Enquiry by email, telephone or fax

If you contact us by email, telephone or fax, your enquiry including all personal data (name, enquiry) will be stored and processed by us for the purpose of processing your request. We will not pass on this data without your consent.

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your enquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested; consent can be revoked at any time.

The data you send to us via contact requests will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.

Microsoft Bookings

We use Microsoft Bookings for online appointment scheduling. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, https://learn.microsoft.com/de-de/microsoft-365/bookings/?view=o365-worldwide

To book an appointment, you will be redirected to the Microsoft Bookings page. There you must enter your name and e-mail address for further appointment planning. Optionally, you can also enter your telephone number, address and notes. Use of the service is voluntary and is based on the user's consent within the meaning of Article 6(1)(a) GDPR.

When the appointment request is "booked", the data is transferred to the Microsoft cloud. The data is thus processed in Microsoft's data centres in the EU as part of the Microsoft 365 cloud service. It has been contractually agreed with Microsoft that the data will not leave the EU and will not be analysed, read or processed in any other way by Microsoft. You can view the privacy policy here:

https://privacy.microsoft.com/de-de/privacystatement

The data you enter will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Mandatory statutory provisions - in particular retention periods - remain unaffected.

The legal basis for data processing is Art. 6 para. 1 lit. f GDPR. The website operator has a

legitimate interest in making appointments with interested parties and customers as uncomplicated as possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. for device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here:

https://learn.microsoft.com/de-de/compliance/regulatory/offering-eu-model-clauses.

The company is certified in accordance with the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified in accordance with the DPF undertakes to comply with these data protection standards. Further

Information on this can be obtained from the provider under the following link:

https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000KzNaAAK&status=Active.

Eventbrite

You can book tickets for various events on our website. Tickets are booked via the Eventbrite ticket booking system. The provider is Eventbrite, Inc, Delaware, 155, 5th Street, Floor 7, San Francisco, CA 94103, USA.

When you book a ticket with us, Eventbrite collects all the data you provide when booking (name, email address, etc.). In addition, your payment data, your IP address and other metadata (browser, operating system, version, end device) are also collected. You can view Eventbrite's privacy policy here:

https://www.eventbrite.de/support/articles/de/Troubleshooting/datenschutzrichtlinie-von-eventbrite?lg=de

The data you enter will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Mandatory statutory provisions - in particular retention periods - remain unaffected.

The legal basis for data processing is Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in making ticket booking as straightforward as possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.eventbrite.de/support/articles/de/Troubleshooting/datenschutzrichtlinie-von-eventbrite?lg=de

The company is certified in accordance with the "EU-US Data Privacy Framework" (DPF).

Information on this can be obtained from the provider under the following link:

https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000TNl5AAG&status=Active

Social media

Facebook

Elements of the social network Facebook are integrated on this website. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. However, according to Facebook, the data collected is also transferred to the USA and other third countries.

You can find an overview of the Facebook social media elements here:

https://developers.facebook.com/docs/plugins/?locale=de_DE

When the social media element is active, a direct connection is established between your end device and the Facebook server. Facebook receives the information that you have visited this website with your IP address. If you click on the Facebook "Like" button while you are logged into your Facebook account, you can link the content of this website to your Facebook profile.

This allows Facebook to associate your visit to this website with your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by Facebook. Further information on this can be found in Facebook's privacy policy at

https://de-de.facebook.com/privacy/explanation

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. Consent can be revoked at any time.

Insofar as personal data is collected on our website with the help of the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook. The processing carried out by Facebook after forwarding is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in an agreement on joint processing. You can find the wording of the agreement at

https://www.facebook.com/legal/controller_addendum.

According to this agreement, we are responsible for providing data protection information when using the Facebook tool and for the secure implementation of the tool on our website in accordance with data protection law. Facebook is responsible for the data security of Facebook products. You can assert data subject rights (e.g. requests for information) regarding the data processed by Facebook directly with Facebook. If you assert your data subject rights with us, we are obliged to forward them to Facebook.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.facebook.com/legal/EU_data_transfer_addendum

https://de-de.facebook.com/help/566994660333381

https://www.facebook.com/policy.php

The company is certified in accordance with the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link:

https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000GnywAAC&status=Active

X (formerly Twitter)

Functions of the X service (formerly Twitter) are integrated on this website. These functions are offered by the parent company X Corp, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. The Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland, is responsible for the data processing of persons living outside the USA.

When the social media element is active, a direct connection is established between your end device and the X server. X (formerly Twitter) thereby receives information about your visit to this website. By using X (formerly Twitter) and the "Re-Tweet" or "Repost" function, the websites you visit are linked to your X (formerly Twitter) account and made known to other users. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by X (formerly Twitter). Further information on this can be found in the privacy policy of X (formerly Twitter) at

https://x.com/de/privacy

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://gdpr.x.com/en/controller-to-controller-transfers.html

You can change your data protection settings for X (formerly Twitter) in the account settings under:

https://x.com/settings/account

Instagram

Functions of the Instagram service are integrated on this website. These functions are offered by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland

When the social media element is active, a direct connection is established between your device and the Instagram server. Instagram thereby receives information about your visit to this website.

If you are logged into your Instagram account, you can link the content of this website to your Instagram profile by clicking on the Instagram button. This allows Instagram to associate your visit to this website with your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by Instagram.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. Consent can be revoked at any time.

Insofar as personal data is collected on our website using the tool described here and forwarded to Facebook or Instagram, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its transfer to Facebook or Instagram. The processing carried out by Facebook or Instagram after forwarding is not part of the joint responsibility.

The obligations incumbent on us jointly were set out in an agreement on joint processing. You can find the wording of the agreement at

https://www.facebook.com/legal/controller_addendum

According to this agreement, we are responsible for providing data protection information when using the Facebook or Instagram tool and for the secure implementation of the tool on our website in accordance with data protection law. Facebook is responsible for the data security of Facebook and Instagram products. You can assert data subject rights (e.g. requests for information) regarding the data processed by Facebook or Instagram directly with Facebook. If you assert your data subject rights with us, we are obliged to forward them to Facebook.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.facebook.com/legal/EU_data_transfer_addendum

https://privacycenter.instagram.com/policy/

https://de-de.facebook.com/help/566994660333381

Further information on this can be found in Instagram's privacy policy:

https://privacycenter.instagram.com/policy/

The company is certified in accordance with the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link:

https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000GnywAAC&status=Active

Linkedin

This website uses elements of the LinkedIn network. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Each time you access a page on this website that contains elements from LinkedIn, a connection to LinkedIn servers is established. LinkedIn is informed that you have visited this website with your IP address. If you click on the LinkedIn "Recommend" button and are logged into your LinkedIn account, LinkedIn will be able to associate your visit to this website with you and your user account. We would like to point out that, as the provider of the pages, we have no knowledge of the content of the transmitted data or its use by LinkedIn.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:

https://www.linkedin.com/help/linkedin/answer/a1343190/datenubertragung-aus-der-eu-dem-ewr-und-der-schweiz?lang=de

Further information on this can be found in LinkedIn's privacy policy at:

https://www.linkedin.com/legal/privacy-policy

The company is certified in accordance with the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link:

https://www.dataprivacyframework.gov/participant/5448

Use of the LinkedIn Insight Tag

Our website uses the conversion tracking tool “LinkedIn Insight Tag” from LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

The LinkedIn Insight Tag enables us to analyze the effectiveness of our LinkedIn advertising campaigns, track visitor interactions on our website, and deliver targeted advertising on LinkedIn.

When you visit our website, a cookie is set—after you have given your consent via our consent management tool—which establishes a connection to the LinkedIn servers. Among other things, the following data is processed:

  • IP address (abbreviated or anonymized),
  • device information and browser data,
  • time and URL of the page view,
  • referrer URL.

This data is processed pseudonymously and deleted after 90 days.

Processing is based on your consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with future effect via our consent banner.

Note on the use of artificial intelligence (AI)

LinkedIn's analytics and advertising technologies, including Insight Tags, may use automated processes to evaluate user behavior and deliver personalized content. According to publicly available information from LinkedIn, AI-supported algorithms are also used for this purpose, which, among other things, segment user profiles and make predictions about interests or interactions.

In accordance with the requirements of the EU AI Act (Regulation on Artificial Intelligence), systems of this type are classified as limited risk systems, which must meet specific requirements for transparency, traceability, and accountability. In this regard, we refer to LinkedIn's responsibility as an independent controller for the legally compliant operation of the systems used.

For more information about the use of AI at LinkedIn, please refer to their privacy and transparency documentation at:

https://www.linkedin.com/help/linkedin/answer/a547077

Data transfer to third countries

Where personal data is transferred to LinkedIn Corporation in the USA, this is done on the basis of LinkedIn's certification under the EU-US Data Privacy Framework (DPF) in accordance with Art. 45 GDPR.

Further information

Further information on data processing by LinkedIn can be found at:

https://www.linkedin.com/legal/privacy-policy

Xing

This website uses elements of the XING network. The provider is New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.

Each time one of our pages containing XING elements is accessed, a connection to XING servers is established. To the best of our knowledge, no personal data is stored in the process. In particular, no IP addresses are stored and usage behaviour is not evaluated.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. Consent can be revoked at any time.

Further information on data protection and the XING Share button can be found in XING's privacy policy at:

https://privacy.xing.com/de/datenschutzerklaerung

GitHub

Our website contains links to our GitHub profile, which is operated by GitHub, Inc, 88 Colin P Kelly Jr St, San Francisco, CA 94107, USA.

GitHub is a platform for version management and collaboration on software projects. When visiting our GitHub profile at https://github.com/holisticon, the GitHub privacy policy applies.

Information on the processing of personal data by GitHub can be found in their privacy policy at https://docs.github.com/en/github/site-policy/github-privacy-statement.

GitHub is a participant in the EU-U.S. Data Privacy Framework (DPF), which ensures the protection of personal data in accordance with EU data protection requirements. Further information can be found at https://www.dataprivacyframework.gov/

Medium

We use the buttons of the Medium service. These buttons are offered by Medium, 799 Market St, San Francisco, California 94102, USA. They are recognisable by terms such as "Medium" or "Follow", combined with a stylised letter M. With the help of the buttons it is possible to follow us on Medium.

When a user accesses our website that contains such a button, their browser establishes a direct connection with Medium's servers. The content of the Medium buttons is transmitted by Medium directly to the user's browser. We therefore have no influence on the scope of the data that Medium collects with the help of this plugin and inform users according to our level of knowledge. According to this, only the user's IP address and the URL of the respective website are transmitted when the button is accessed, but are not used for purposes other than displaying the button.

The legal basis for the use of the plug-ins is Art. 6 para. 1 lit. f GDPR. The purpose, duration and scope of the data collection and the further processing and use of your data as well as your rights in this regard and setting options to protect your privacy can be found in Medium's data protection information:

https://policy.medium.com/medium-privacy-policy-f03bf92035c9

Analysis tools and advertising

Matomo

This website uses the open source web analysis service Matomo.

With the help of Matomo, we are able to collect and analyse data about the use of our website by website visitors. This enables us to find out, among other things, when which pages were accessed and from which region. We also record various log files (e.g. IP address, referrer, browser and operating system used) and can measure whether our website visitors perform certain actions (e.g. clicks, purchases, etc.).

This analysis tool is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and its advertising. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

IP anonymisation

We use IP anonymisation for the analysis with Matomo. This means that your IP address is shortened before it is analysed so that it can no longer be clearly assigned to you.

Hosting

We host Matomo with the following third-party provider:

SiteGround Spain S.L.
Calle de Prim 19,
28004 Madrid,
Spain

Order processing

We have concluded a data processing agreement (DPA) for the use of the above-mentioned service. Further information on the terms of use of Matomo and the data protection regulations can be found at: https://matomo.org/privacy/

Newsletter

Newsletter data

If you would like to receive the newsletter offered on the website, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter. No further data is collected, or only on a voluntary basis.

CleverReach

This website uses CleverReach to send newsletters. The provider is CleverReach GmbH & Co KG, Schafjückenweg 2, 26180 Rastede, Germany (hereinafter referred to as "CleverReach"). CleverReach is a service that can be used to organise and analyse the sending of newsletters. The data you enter for the purpose of receiving the newsletter (e.g. email address) is stored on CleverReach's servers in Germany or Ireland.

Our newsletters sent with CleverReach enable us to analyse the behaviour of newsletter recipients. Among other things, we can analyse how many recipients have opened the newsletter message and how often which link in the newsletter was clicked on. Conversion tracking can also be used to analyse whether a predefined action (e.g. purchase of a product on this website) has taken place after clicking on the link in the newsletter. Further information on data analysis by CleverReach newsletters can be found at

https://www.cleverreach.com/de/funktionen/reporting-und-tracking/

The data processing takes place on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time by unsubscribing from the newsletter. The legality of the data processing operations that have already taken place remains unaffected by the cancellation.

If you do not wish to be analysed by CleverReach, you must unsubscribe from the newsletter. We provide a corresponding link for this purpose in every newsletter message. The data you provide us with for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and deleted from the newsletter distribution list after you unsubscribe from the newsletter. Data stored by us for other purposes remains unaffected by this.

After you unsubscribe from the newsletter distribution list, your e-mail address may be stored by us or the newsletter service provider in a blacklist if this is necessary to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). Storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.

You can find more details in CleverReach's privacy policy at:

https://www.cleverreach.com/de/datenschutz/

Order processing

We have concluded an order processing agreement (AVV) for the use of the above-mentioned service.

Events / Event registrations

Purposes of processing
Planning and implementation of events (registration, waiting list, confirmation, admission/name badges), communication before/after the event (schedule information, changes, organisational follow-up), security and access management, and internal records (attendance figures, billing).

Legal basis
Art. 6 para. 1 lit. a GDPR (participation/pre-contractual measures) and Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient organisation, security, evidence).

Optional/voluntary: Information on catering preferences/allergies or accessibility requirements (health data) only with consent in accordance with Art. 9 para. 2 lit. a GDPR.

Data categories
Master data (name, title/position/company if applicable), contact details (email, optional telephone number), event data (registered/participation/waiting list, session selection if applicable), organisational information (accompanying person; voluntary dietary/accessibility information), technical metadata for online registration (time stamp, IP/log) .

Data sources
Directly from you (form/email). For accompanying persons only if you register them – please inform them of this information.

Recipients/contract processing
Internal event organisation/office/IT; processors employed by us (e.g. registration/form/email dispatch and hosting services).
Note on services used on this website: Email communication may be handled via the mailing services described in ‘Newsletter’ (e.g. CleverReach, including tracking settings as described in that section) for the purposes of event organisation. For online events, the information under ‘Audio and video conferences’ (e.g. Zoom, Microsoft Teams) also applies.

Third country transfers
Use of service providers outside the EU/EEA only with appropriate safeguards (e.g. EU standard contractual clauses or DPF certification for US recipients); details can be found in the respective tool sections of this statement.

Storage period
Registration data/participation lists: generally up to 6 months after the end of the event (organisation/evidence), followed by deletion/anonymisation.
Accounting/business documents: in accordance with statutory periods (usually 6–10 years).
Voluntary health information: deletion no later than 30 days after the end of the event.

Necessity of provision
Your name and email address are required for participation. Voluntary information (e.g. allergies/accessibility) is only required if necessary; without this information, individual requirements may not be taken into account.

Photo/video notice
Any photo/video recordings for documentation/communication purposes are regulated separately and voluntarily (consent in accordance with Art. 6 para. 1 lit. a GDPR). Participation is not dependent on this.

Rights of data subjects
You have the right to information, correction, deletion, restriction, data portability and objection to processing on the basis of legitimate interests (Art. 21 GDPR) and to revoke consent granted with effect for the future. Contact: datenschutz@holisticon.de

Vimeo ohne Tracking (Do-Not-Track)

This website uses plugins from the video portal Vimeo. The provider is Vimeo Inc, 555 West 18th Street, New York, New York 10011, USA.

When you visit one of our pages equipped with Vimeo videos, a connection to the Vimeo servers is established. This tells the Vimeo server which of our pages you have visited. Vimeo also obtains your IP address. However, we have configured Vimeo so that Vimeo will not track your user activities and will not set any cookies.

The use of Vimeo is in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission and, according to Vimeo, on "legitimate business interests". You can find details here:

https://vimeo.com/privacy

Further information on the handling of user data can be found in Vimeo's privacy policy at:

https://vimeo.com/privacy

The company is certified in accordance with the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link:

https://www.dataprivacyframework.gov/participant/5711

Audio- und Videokonferenzen

Data processing

We use online conferencing tools, among others, to communicate with our customers. The individual tools we use are listed below. If you communicate with us by video or audio conference via the internet, your personal data will be collected and processed by us and the provider of the respective conference tool.

The conference tools collect all the data that you provide/enter to use the tools (e-mail address and/or your telephone number). The conference tools also process the duration of the conference, the start and end (time) of participation in the conference, the number of participants and other "contextual information" in connection with the communication process (metadata).

Furthermore, the provider of the tool processes all technical data required to handle online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or loudspeaker and the type of connection.

If content is exchanged, uploaded or provided in any other way within the tool, it is also stored on the tool provider's servers. Such content includes, in particular, cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information that is shared while using the service.

Please note that we do not have full control over the data processing operations of the tools used. Our options are largely determined by the company policy of the respective provider. Further information on data processing by the conference tools can be found in the data protection declarations of the tools used, which we have listed below this text.

Purpose and legal basis

The conference tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6 para. 1 lit. b GDPR). Furthermore, the use of the tools serves the general simplification and acceleration of communication with us or our company (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). If consent has been requested, the tools in question are used on the basis of this consent; consent can be withdrawn at any time with effect for the future.

Storage duration

The data collected directly by us via the video and conference tools will be deleted from our systems as soon as you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no influence on the storage period of your data, which is stored by the operators of the conference tools for their own purposes. For details, please contact the operators of the conference tools directly.

We use the following conference tools:

Zoom

We use Zoom. The provider of this service is Zoom Communications Inc, San Jose, 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA. Details on data processing can be found in the

Privacy policy of Zoom: https://explore.zoom.us/de/privacy/

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. You can find details here: https://explore.zoom.us/de/privacy/

Order processing

We have concluded an order processing agreement (AVV) for the use of the above-mentioned service.

Microsoft Teams

We use Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Details on data processing can be found in the Microsoft Teams privacy policy:

https://privacy.microsoft.com/de-de/privacystatement

The company is certified in accordance with the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information on this can be obtained from the provider at the following link:

https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt0000000KzNaAAK&status=Active

Order processing

We have concluded an order processing agreement (AVV) for the use of the above-mentioned service.

Applicant data

We have concluded an order processing agreement (AVV) for the use of the above-mentioned service.

  • Name
  • First name
  • email
  • Telephone number
  • and all documents uploaded by you.

Personio

To manage and process your applications, we use the services of Personio GmbH & Co KG, Rundfunkplatz 4, 80335 Munich, Germany, which acts as our processor. When using this service, your IP address is automatically transmitted to Personio.

Personio stores your data on servers within the European Union and ensures that all necessary technical and organisational measures are taken to protect your data. For further details, please refer to Personio's privacy policy:

https://www.personio.de/datenschutzerklaerung/

Order processing

We have concluded an order processing contract (AVV) for the use of the above-mentioned service.

Scope and purpose of data collection

If you send us an application, we process your associated personal data (e.g. contact and communication data, application documents, notes taken during job interviews, etc.) insofar as this is necessary to decide on the establishment of an employment relationship. The legal basis for this is § 26 BDSG under German law (initiation of an employment relationship), Art. 6 para. 1 lit. b GDPR (general contract initiation) and - if you have given your consent - Art. 6 para. 1 lit. a GDPR. Consent can be revoked at any time. Your personal data will only be passed on within our company to persons who are involved in processing your application.

If the application is successful, the data submitted by you will be stored in our data processing systems on the basis of § 26 BDSG and Art. 6 para. 1 lit. b GDPR for the purpose of implementing the employment relationship.

Data retention period

If we are unable to make you a job offer, you reject a job offer or withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application).

The data will then be deleted and the physical application documents destroyed. The retention serves in particular as evidence in the event of a legal dispute. If it is evident that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), the data will only be deleted when the purpose for further storage no longer applies.

Data may also be stored for longer if you have given your consent (Art. 6 para. 1 lit. a GDPR) or if statutory retention obligations prevent deletion.

Inclusion in the applicant pool

If we do not make you a job offer, you may have the opportunity to be included in our applicant pool. If you are accepted, all documents and details from your application will be transferred to the applicant pool so that you can be contacted in the event of suitable vacancies.

Inclusion in the applicant pool is based exclusively on your express consent (Art. 6 para. 1 lit. a GDPR). Giving consent is voluntary and is not related to the current application process. The data subject can withdraw their consent at any time. In this case, the data will be irrevocably deleted from the applicant pool, provided there are no legal grounds for retention.

The data from the applicant pool will be irrevocably deleted no later than two years after consent has been granted.