Privacy policy for Share with Saal

5.1 Data processing for Share with Saal

5.1.1 Purposes and legal basis

Purposes and legal basis In accordance with art. 6 paragraph 1 letter a) GDPR your data will be transmitted to our marketing department and customer service through the registration form located within the registration page for Share with Saal. All images and texts that you provide us within the context of Share with Saal can be used for publication, for example, on our websites, blogs, social media accounts or newsletters.

5.1.2 Data collected

• Salutation
• First name
• Surname
• Email address
• Link to social media profiles
• Application text
• Uploaded images

5.1.3 Duration of storage

Your data will be deleted by us a maximum of 10 years after completion of the product test, provided that there are no legal storage obligations to the contrary. The data is stored to ensure service quality.

6) Use of your data for direct advertising

Subscription to our e-mail newsletter

If you have provided us with your e-mail address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services from our range by e-mail. In this respect, data processing is carried out solely on the basis of our legitimate interest in personalized direct advertising. If you have initially objected to the use of your e-mail address for this purpose, we will not send you an e-mail. You are entitled to object to the use of your e-mail address for the aforementioned advertising purpose at any time with effect for the future by notifying the data controller named at the beginning. For this you only have to pay the transmission costs according to the basic tariffs. Upon receipt of your objection, the use of your e-mail address for advertising purposes will cease immediately.

7) Data processing for order processing

7.1 For the processing of your order we work together with several service providers, who support us in whole or in part in the execution of concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information. The personal data collected by us will be passed on to the transport company commissioned with the delivery within the scope of contract processing, to the extent that is necessary for the delivery of the goods. We will pass on your payment data to the commissioned credit institution within the framework of payment processing, if this is necessary for payment processing. If payment service providers are used, we explicitly inform you of this below. The legal basis for the transfer of data is Art. 6 para. 1 point b GDPR.

7.2 Use of payment service providers

-Paypal
We offer payment via Paypal. Payment shall be made by PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"). For further information on data protection law, please refer to PayPal's data protection declaration: https://www.paypal.com/uk/webapps/mpp/ua/privacy-full

- Computop
We offer payment by credit card. Payment is made by Computop Wirtschaftsinformatik GmbH, Schwarzenbergstr. 4, 96050 Bamberg, Germany. For further information on data protection law, including information on the credit agencies used, please refer to Computop's data protection declaration: https://computop.com/uk/data-protection

- Novalnet AG
We offer payment via iDeal. Payment is made by Novalnet AG, Zahlungsinstitut (ZAG), Feringastraße 4, 85774 Unterföhring, Germany. For further information on data protection law, including information on the credit agencies used, please refer to Novalnet’s data protection declaration: https://www.novalnet.com/privacy-policy/

8) YouTube (videos)

We have integrated YouTube components on this website. The operating company of YouTube is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

YouTube is an Internet video portal that allows video publishers to post video clips free of charge and other users to view, rate and comment on them, also free of charge. YouTube allows the publication of all types of videos, which is why complete film and television programmes, but also music videos, trailers or videos made by users themselves can be accessed via the internet portal. Each time you call up one of the individual pages of this website that is operated by us and on which a YouTube component (YouTube video) has been integrated, the internet browser on your IT system is automatically prompted by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. Further information on YouTube can be found at https://www.youtube.com/yt/about/. Within the scope of this technical procedure, YouTube and Google receive information about which specific sub-page of our website is visited by you.
If you are logged in to YouTube at the same time, YouTube recognizes which specific sub-page of our website you are visiting when you call up a sub-page that contains a YouTube video. This information is collected by YouTube and Google and assigned to your YouTube account.

YouTube and Google always receive information via the YouTube component that you have visited our website if you are logged into YouTube at the same time as calling up our website; this takes place regardless of whether you click on a YouTube video or not. If you do not want this information to be transmitted to YouTube and Google, you can prevent the transmission by logging out of your YouTube account before accessing our website.

These processing operations are only carried out if you have given your express consent in accordance with Art. 6 (1) lit. a DS-GVO.

You can view YouTube’s privacy policy at https://www.google.com/intl/en/policies/privacy/.

9) Marketing

9.1 Google Ads (Conversion Tracking) and Remarketing

We utilize Google Ads Conversion Tracking and Remarketing on this website, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ads is an online advertising system, allowing us to promote and optimize our services and products.

Through Google Ads Conversion Tracking and Remarketing, we are capable of tracking specific user actions that occur after clicking on our Google Ads advertisement. This tool allows us to measure the effectiveness of our advertising campaigns, evaluate the success of various advertising measures, and improve our website along with our advertising activities.

Advertisements are displayed based on search queries on websites of the Google advertising network. Additionally, we use Ads Remarketing Lists for search advertisements. This enables us to customize search ad campaigns for users who have previously visited our website. Through these services, we can combine our ads with certain search terms or display ads for previous visitors, for example, advertising services that visitors have viewed on our website. Therefore, we can display user interest-based advertising on other websites within the Google advertising network (as "Google ads" within Google search or on other websites).

During each visit to our website where a Google Ads component is integrated, information about the actions you undertake is collected and transmitted to Google to evaluate the relevance and effectiveness of our ads. If you are logged into Google at the same time, this information is directly associated with your Google account.

For conversion tracking, cookies are stored on your device, which expire after 30 days. You have the option to object to data storage by conversion tracking by disabling the use of cookies in your browser settings.

The use of Google Ads Conversion Tracking and Remarketing is carried out only with your explicit consent in accordance with Art. 6 Para. 1 lit. a GDPR. For more information on privacy at Google, please visit: https://policies.google.com/privacy?hl=en.

9.2 DoubleClick

This website contains components of DoubleClick by Google. DoubleClick is a brand of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), under which special online marketing solutions are marketed to advertising agencies and publishers.

DoubleClick by Google transfers data to the DoubleClick server with each impression as well as with clicks or other activities. Each of these data transfers triggers a cookie request to your browser. If the browser accepts this request, DoubleClick sets a cookie on your IT system. The purpose of the cookie is to optimise and display advertising. The cookie is used, among other things, to serve and display user-relevant advertising and to create reports on advertising campaigns or to improve them. Furthermore, the cookie is used to avoid multiple displays of the same advertisement.

DoubleClick uses a cookie ID, which is required to process the technical procedure. The cookie ID is needed, for example, to display an advertisement in a browser. DoubleClick can also use the cookie ID to record which advertisements have already been displayed in a browser in order to avoid duplicate placements. Furthermore, the cookie ID enables DoubleClick to record conversions.

A DoubleClick cookie does not contain any personal data. However, a DoubleClick cookie may contain additional campaign identifiers. A campaign identifier serves to identify the campaigns with which you have already been in contact.

Each time you call up one of the individual pages of this website which is operated by us and on which a DoubleClick component has been integrated, the internet browser on your IT system is caused by the respective DoubleClick component to transmit data to Google for the purpose of online advertising and the settlement of commissions. As part of this technical process, Google obtains knowledge of data that Google also uses to generate commission statements. Among other things, Google can track that you have clicked on certain links on our website.

You can prevent DoubleClick and our website from setting cookies at any time by adjusting your internet browser settings accordingly. In addition, cookies that have already been set can be deleted at any time via the Internet browser or other software programmes.

These processing operations are only carried out if express consent is given in accordance with Art. 6 (1) lit. a GDPR.

You can view the privacy policy of DoubleClick by Google at: https://policies.google.com/?hl=en.

9.3 Microsoft Ads (formerly Bing Ads)

We have integrated Microsoft Advertising components on this website. Microsoft Advertising is operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521.

Microsoft Advertising is an online advertising system that allows us to promote and optimize our services and products. Through Microsoft Advertising, specifically the Conversion and Tracking Tool, we are able to track certain user actions that occur after clicking on our Microsoft Bing advertisement.

With each call-up to one of the individual pages of this website, operated by us and on which a Microsoft Advertising component has been integrated, information regarding the actions carried out by you is collected and transmitted to Microsoft for evaluating the relevance and effectiveness of our ads. Microsoft and we can identify that someone clicked on an ad, was redirected to our online offer, and reached a predetermined landing page (so-called conversion page).

Furthermore, with the help of remarketing lists created based on visitors’ activities on our website, we can segment target groups and then optimize our Bing advertising campaigns based on these segments.

These processes are carried out only if you have given your explicit consent in accordance with Art. 6 (1) lit. a GDPR.

If you do not want to participate in the tracking process of Bing Ads, you can deactivate the necessary setting of a cookie in your browser settings or use the Microsoft opt-out page: choice.microsoft.com/en-GB/opt-out.

For further information on data protection and the cookies used by Microsoft Bing Ads, you can find Microsoft's privacy policy at: https://privacy.microsoft.com/en-gb/privacystatement.

Microsoft will store the data for a maximum period of 180 days.

9.4 Meta

We utilize the "Meta Conversion Tracking Pixel" as well as the Custom Audience Pixel on our website, provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (Facebook)).

The Meta Conversion Tracking Pixel allows us to track user behavior after users have been redirected to our website by clicking on a Facebook advertisement, to measure the effectiveness of Facebook ads for statistical and market research purposes.

The Custom Audience Pixel is a small piece of JavaScript code that is integrated into all of our web pages and offers various functions for sending application-specific events and user-defined data to Facebook. We use this pixel to record information about how visitors use our website. The pixel captures and sends information about the user’s browser settings, a hashed version of the Facebook ID, and the visited URL to Facebook. This allows us to re-target our visitors for advertising purposes using Facebook ads by creating audience-oriented advertising.

The data collected in this way is anonymous to us, i.e., we do not see the personal data of individual users. However, this data is stored and processed by Facebook, and therefore, we inform you based on our knowledge. Facebook can link this information to your Facebook account and also use it for its own advertising purposes, in accordance with Facebook's Data Usage Policy https://www.facebook.com/about/privacy/. You can allow Facebook and its partners to place ads on and off Facebook. A cookie may also be stored on your computer for these purposes.

These processes are carried out only if you have given your explicit consent in accordance with Art. 6 (1) lit. a GDPR. You can object to the collection of your data by Facebook Pixel or the use of your data for displaying Facebook ads by visiting the following address: https://www.facebook.com/settings?tab=ads.

We ensure the appropriateness of data transfer to the third country, the USA, by agreeing to EU standard contractual clauses.

10) Google Analytics

On our websites, we use Google Analytics, a web analytics service provided by Google Ireland Limited (https://www.google.de/intl/en/about/), Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). In this context, pseudonymised usage profiles are created and cookies (see point “Cookies”) are used. The information generated by the cookie about your use of this website, such as

1. the browser type/version,
2. the operating system used,
3. the referrer URL (the previously visited page),
4. the host name of the accessing computer (IP address) and
5. time of the server request,

are transmitted to a Google server in the USA and stored there. The information is used to evaluate the use of the website, to compile reports on website activity and to provide other services associated with the use of the website and the Internet for the purposes of market research and the design of these Internet pages in line with requirements. This information may also be transferred to third parties if this is required by law or if third parties process this data on our behalf. Under no circumstances will your IP address be merged with other Google data. The IP addresses are anonymised so that an allocation is not possible (IP masking).

You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.

These processing operations will only be carried out if you have given your express consent in accordance with Art. 6 (1) lit. a DS-GVO.

Furthermore, you can prevent the collection of the data generated by the cookie and related to your use of the website (incl. your IP address) as well as the processing of this data by Google by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=en).

As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent the collection by Google Analytics by clicking on the following link: Deactivate Google Analytics. An opt-out cookie will be set, which prevents the future collection of your data when visiting this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again.

You can view the Google Analytics privacy policy at: https://support.google.com/analytics/answer/6004245?hl=en

11) Google Tag Manager

We use the service called Google Tag Manager from Google. "Google" is a group of companies and consists of Google Ireland Ltd (provider of the service), Gordon House, Barrow Street, Dublin 4, Ireland as well as Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA and other affiliated companies of Google LLC.

We have concluded an order processing agreement with Google. The Google Tag Manager is an auxiliary service and processes personal data itself only for technically necessary purposes. The Google Tag Manager takes care of loading other components, which in turn may collect data. The Google Tag Manager does not access this data.

These processing operations are carried out exclusively when explicit consent is given in accordance with Art. 6 Para. 1 lit. a GDPR.

Further information on Google Tag Manager as well as Google's privacy policy can be found at: https://www.google.com/intl/de/policies/privacy/.

12) Analytics

12.1 Hotjar

We have integrated Hotjar components on this website to statistically evaluate visitor data. The operating company is Hotjar Limited, Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta.

Hotjar is an analysis and feedback tool that analyzes the behavior and feedback of users on our website. Using various tools such as Heatmaps, Conversion Funnels, and Surveys, we can capture information such as click behavior, scrolling behavior, and other visitor interactions on our website. By using Hotjar, we can improve and optimize our website and offerings. More information about Hotjar’s features can be found at Hotjar.

While visiting our website, Hotjar collects information about your user behavior, e.g., which pages you visit, how long you stay on the page, and what actions you perform. Technical data such as anonymized IP address, screen size, and browser information are also collected. This data is anonymized and never shared with Hotjar directly.

These processing activities are only carried out if you have given your explicit consent according to Art. 6 (1) lit. a GDPR. You have the option to deactivate data collection by Hotjar by visiting Hotjar’s opt-out page here and selecting Disable Hotjar. More information on privacy at Hotjar can be found at Hotjar Privacy.

Hotjar stores the collected data for a period of 365 days. After this period, the data is automatically deleted.

12.2 Microsoft Clarity

We have integrated Microsoft Clarity components on this website. The operating company is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Microsoft Clarity is a web analytics tool that processes data, including the transfer of data to the USA, where an adequate level of data protection does not exist. Microsoft uses Standard Contractual Clauses to ensure compliance with European data protection standards.

Every time a page of our website with Microsoft Clarity components is accessed, data processing by Microsoft is initiated. Microsoft can receive, process, and use information about the use of our website for user behavior analysis. This may include information such as click behavior, scrolling behavior, and other interactions of visitors on our website. More information about data processing by Microsoft Clarity can be found in Microsoft's privacy statement available here.

Processing is only carried out with your explicit consent according to Art. 6 (1) lit. a GDPR. More information about the Standard Contractual Clauses at Microsoft can be found here. The use of Microsoft Clarity carries risks due to data transmission to countries without an adequate EU level of data protection, but Microsoft commits to complying with European data protection standards.

Microsoft stores the collected data for a period of 30 days. After this period, the data is automatically deleted.

12.3 UX Cam

We have integrated UX Cam components in our app to analyze user behavior. The operating company is UXCam GmbH, Badstraße 20, 13357 Berlin, Germany.

UX Cam is an analytics tool that helps us understand how users interact with our app. By using UX Cam, we can improve and optimize our app for a better user experience. More information about UX Cam’s features can be found at UX Cam.

If you decide to use our app, we collect the following data in order to provide our services: Each user is assigned a unique and consistent random pseudo ID that is used to track their interactions with the app. We collect information about the type, version, model, and operating system of the device the end user is using. Additionally, we collect the country from which the user is accessing the app, but we do not collect specific location information beyond the country level. We track the screens the end user visits within the application with UX Cam and record the end user's interactions within the app, including screen actions (such as taps and scrolls) and gestures.

These processing activities are on the basis of our legitimate interests in data processing pursuant to Art. 6 para. 1 lit. f GDPR. The legitimate interest pursued by us is the improvement and optimization of the app for the benefit of all app users.

UX Cam stores the collected data for a period of 365 days. After this period, the data is automatically deleted.

12.4 Firebase Crashlytics

We have integrated Firebase Crashlytics into our app to analyze crashes and other technical issues. The operating company is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Firebase Crashlytics is an analytics tool that helps us monitor and improve the stability of our app. By using Firebase Crashlytics, we can identify and resolve potential technical issues to enhance the user experience. More information about Firebase Crashlytics’ features can be found at Firebase Crashlytics.

If you decide to use our app, we collect the following data to perform a comprehensive error analysis: Each user is assigned a unique and consistent pseudo ID that is used to track crashes. We collect information about the type, version, model, and operating system of the device you are using, as well as the IP address, which is anonymized. This information is necessary to analyze the causes of crashes and improve the stability of our app.

These processing activities are carried out on the basis of our legitimate interests in data processing pursuant to Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in improving the stability and reliability of our app for the benefit of all app users.

Firebase Crashlytics stores the collected data for a period of 90 days. After this period, the data is automatically deleted.

12.5 Calendly

We use Calendly to manage appointments and scheduling. The operating company is Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA.

Calendly is a scheduling tool that allows users to book appointments with us. By using Calendly, we can streamline our appointment process and provide a better experience for our users. More information about Calendly’s features can be found at Calendly.

When you schedule an appointment with us through Calendly, the following personal data is collected: your name, email address, and any additional information you provide during the scheduling process. This information is necessary to confirm appointments and facilitate communication. The data collected is processed on the basis of your explicit consent pursuant to Art. 6 para. 1 lit. a GDPR, as you willingly provide this information for the purpose of scheduling an appointment.

You have the right to withdraw your consent at any time with effect for the future. To do so, please contact us using the information provided in this privacy policy.

Calendly retains the data collected for scheduling purposes in accordance with its own data retention policy. For further details on how Calendly handles personal data, please refer to their privacy policy at Calendly Privacy Policy.

13) Rights of the data subject

13.1 The applicable data protection law grants you comprehensive rights of data subjects (rights of information and intervention) with regard to the data controller for the processing of your personal data, about which we inform you below:

- Right to information pursuant to Art. 15 GDPR: In particular, you have a right of access to your personal data processed by us, the processing purposes, the categories of personal data processed, the recipients or categories of recipients to whom your data have been or will be disclosed, the planned storage period or the planned storage period, the criteria for determining the duration of the storage, the existence of a right to rectification, deletion, restriction of processing, objection to processing, a complaint to a supervisory authority, the origin of your data if these were not collected by us from you, the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved and the scope concerning you and the desired effects of such processing, as well as your right to be informed of the guarantees provided in accordance with Article 46 GDPR for the transfer of your data to third countries;

Right to rectification pursuant to Article 16 of the GDPR: You have a right to immediate rectification of incorrect data concerning you and/or completion of your incomplete data stored by us;

- Right of deletion pursuant to Art. 17 GDPR: You have the right to request the deletion of your personal data if the requirements of Art. 17 para. 1 GDPR are met. However, this right shall not apply in particular if the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims;

- Right to restrict processing pursuant to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data contested is verified, if you refuse to delete your data due to inadmissible data processing and instead request the restriction of the processing of your data, if you need your data to assert, exercise or defend legal claims, after we no longer need this data after the purpose has been achieved, or if you have filed an objection for reasons of your particular situation, as long as it is not yet clear whether our legitimate reasons prevail;

- Right to information in accordance with Art. 19 GDPR: If you have exercised your right to have the data controller correct, delete or limit the processing, he/she is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this correction or deletion of the data or restriction on processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed of these recipients.

- Right to data transferability pursuant to Art. 20 GDPR: You have the right to receive the personal data you have provided us in a structured, current and machine-readable format or to request its transfer to another person responsible, insofar as this is technically feasible;

- Right to revoke consent given pursuant to Art. 7 para. 3 GDPR: You have the right to revoke consent once given to the processing of data at any time with effect for the future. In the event of revocation, we will delete the data concerned without delay, unless further processing can be based on a legal basis for processing without consent. The revocation of consent shall not affect the legality of the processing carried out on the basis of the consent until revocation. The revocation can be carried out by message to the contact data of the responsible person;

- Right of appeal under Article 77 of the GDPR: If you believe that the processing of personal data concerning you infringes the GDPR, you have the right of appeal to a supervisory authority, in particular in the Member State where you reside, work or suspected infringement, without prejudice to any other administrative or judicial rem

13.2 RIGHT OF OBJECTION

IF, WITHIN THE FRAMEWORK OF A CONSIDERATION OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR PREDOMINANT LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON THE GROUNDS THAT ARISE FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN PROVE COMPELLING REASONS WORTHY OF PROTECTION FOR PROCESSING WHICH OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU MAY EXERCISE THE CONTRADICTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.

14) Duration of storage of personal data

The duration of the storage of personal data is determined by the respective legal retention period (e.g. commercial and tax retention periods). After expiry of this period, the corresponding data will be routinely deleted, provided that they are no longer necessary for the performance or initiation of the contract and/or there is no longer any legitimate interest on our part in the further storage.

15) Changes to the data protection declaration

We reserve the right to occasionally adapt this data protection declaration so that it always complies with current legal requirements or to implement changes to our services in the data protection declaration, e.g. when introducing new services. The new data protection declaration will then apply for your next visit.

16) Applicability

This translation is for information purposes only and is not a legally binding document. The original provisions are set out in the original German version.

Data protection officer

THALES Rechtsanwälte.Datenschutz
Dr. Christian Szidzek & Partner
Prymstraße1
97070 Würzburg
E-Mail: info@thales-datenschutz.de

Supervisory authority

LDA Bayern
Bayerisches Landesamt für Datenschutzaufsicht
Promenade 18
91522 Ansbach

Status: 26.10.2023