Ofindo
Instagram Facebook
This privacy policy explains which types of your personal data (referred to below as “data” for short) are processed, for which purposes and to what extent. The privacy policy applies to all processing of personal data that is carried out, both in the course of providing the services and in particular on the websites, in the app and within external online presences such as the social media profiles (referred to below collectively as the “online service”).
Last updated: 2 August 2026

Contents

Controller

Contact form
Overview of processing

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of data processed
  • Master data.
  • Payment data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta and communication data.
Categories of data subjects
  • Customers.
  • Prospective customers.
  • Communication partners.
  • Users.
  • Participants in prize draws and competitions.
  • Business and contractual partners.
  • Participants.
Purposes of processing
  • Provision of contractual services and customer service.
  • Contact requests and communication.
  • Security measures.
  • Direct marketing.
  • Reach measurement.
  • Tracking.
  • Office and organisational procedures.
  • Conversion measurement.
  • Affiliate tracking.
  • Managing and responding to enquiries.
  • Running prize draws and competitions.
  • Feedback.
  • Marketing.
  • Profiles with user-related information.
  • Provision of our online service and user-friendliness.
  • Information technology infrastructure.
Transfer of personal data

In the course of processing personal data, it may happen that the data is transferred to other bodies, companies, legally independent organisational units or persons, or that it is disclosed to them. The recipients of this data may include, for example, service providers entrusted with IT tasks or providers of services and content that are embedded in a website. In such cases the statutory requirements are observed, and appropriate contracts or agreements serving to protect your data have been concluded with the recipients of your data.

Provision of the online service and web hosting

Users' data is processed in order to make the online services available. For this purpose the user's IP address is processed, which is necessary to transmit the content and functions of the online service to the user's browser or device.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta and communication data (e.g. device information, IP addresses); content data (e.g. entries in online forms).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of the online service and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); security measures.
  • Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Provision of the online service on rented storage space: To provide the online service, storage space, computing capacity and software are used that are rented or otherwise obtained from a server provider (also called a “web host”); Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
  • Hostinger (web hosting): Operation of the servers on which our website and our programming interface (api.ofindo.app) run, including the email mailboxes; Service provider: HOSTINGER, UAB, Švitrigailos str. 34, LT-03230 Vilnius, Lithuania; Server location: Data centre within the European Union (Frankfurt am Main, Germany); Data processed: all data that arises when our service is accessed, in particular the server log files described above including the IP addresses, as well as the content and addresses of incoming and outgoing emails; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.hostinger.de/; Privacy policy: https://www.hostinger.com/legal/privacy-policy; Data processing agreement: https://www.hostinger.com/legal/dpa.
  • Supabase (database and user accounts): Central database, user management and file storage of our service; Service provider: Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513; Server location: The data is stored exclusively in a data centre within the European Union (Frankfurt am Main region, Germany); Data stored there: account and sign-in data (email address, encrypted password, times of sign-in; when signing in via Google or Apple, the respective access tokens), profile details (first name and surname, profile picture, postcode, date of birth, language, selected city, personal settings), saved and followed content, view counters for events, places and news, settings and logs for notifications including the push identifier of the device, delivery and click figures for adverts, chat assistant histories and – for business partners – profile, invoice and payment data; Legal basis: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR); Third-country transfer: The provider is based outside the European Union. For any access from a third country, the European Commission's standard contractual clauses have been agreed with the provider; Website: https://supabase.com/; Privacy policy: https://supabase.com/privacy; Data processing agreement: https://supabase.com/legal/customer-resources/data-processing-addendum.
  • Algolia (search function): Operation of the search within our service; Service provider: Algolia SAS, 55 Rue d'Amsterdam, 75008 Paris, France; Server location: Our search index is located in the provider's European region; Data processed: the search terms entered and the technical details needed to answer the search query. We only transmit information about which search result was clicked, and signals for improving the search results, if consent has been given; a pseudonymous identifier is used for this, not your account identifier; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) for operating the search; consent (Art. 6(1)(a) GDPR) for the analysis of search behaviour; Website: https://www.algolia.com/; Privacy policy: https://www.algolia.com/policies/privacy; Data processing agreement: available from the provider at privacy@algolia.com.
  • Collection of access data and log files: Access to the online service is logged in the form of “server log files”. The server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, notification of successful access, the browser type and version, the user's operating system, the referrer URL (the page visited previously) and, as a rule, IP addresses and the requesting provider. The server log files may be used on the one hand for security purposes, e.g. to prevent the servers being overloaded (in particular in the event of abusive attacks, known as DDoS attacks), and on the other hand to ensure the capacity utilisation of the servers and their stability; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data that needs to be retained longer for evidence purposes is exempt from deletion until the incident in question has been finally clarified.
  • Email delivery and hosting: The web hosting services used also include the sending, receiving and storage of emails. For these purposes the addresses of the recipients and senders, as well as further information relating to the sending of emails (e.g. the providers involved) and the content of the emails concerned, are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails are generally not sent in encrypted form on the internet. As a rule, emails are encrypted in transit, but (unless an end-to-end encryption method is used) not on the servers from which they are sent and received. No responsibility is therefore accepted for the transmission path of emails between the sender and receipt on the servers provided; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
  • Content delivery network: A content delivery network is a service that helps to deliver the content of an online service, in particular media files such as graphics or program scripts, faster and more securely by means of regionally distributed servers connected via the internet; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
Contact and enquiries

When you get in touch (e.g. via the contact form, by email, by telephone or via social media), and in the context of existing user and business relationships, the details of the persons making the enquiry are processed to the extent necessary to answer the contact requests and carry out any measures requested.

  • Types of data processed: Contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta and communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners.
  • Purposes of processing:Contact requests and communication; managing and responding to enquiries; feedback (e.g. collecting feedback via an online form); provision of the online service and user-friendliness.
  • Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR).

Further information on processing operations, procedures and services:

  • Contact form: When users get in touch via the contact form, by email or through other channels of communication, the data provided in this context is processed in order to deal with the matter raised; Legal basis: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).
  • Brevo: Email marketing platform; Service provider: Sendinblue GmbH, // Köpenicker Straße 126 10179 Berlin, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.brevo.com/; Privacy policy: https://www.brevo.com/de/legal/privacypolicy/; Unsubscribe email address (opt-out): Unsubscribe email address;
  • ManyChat: Chatbot and marketing platform; Service provider: ManyChat Inc., 535 Mission St, San Francisco, CA 94105, USA; Legal basis: Consent (Art. 6(1)(a) GDPR) where you actively subscribe to regular messages; legitimate interests (Art. 6(1)(f) GDPR) where user enquiries are answered; Website: https://manychat.com/; Privacy policy: https://manychat.com/privacy.html; Unsubscribing (opt-out): You can stop receiving messages at any time by sending the text “stop” in the chat. When you unsubscribe, the data is deleted from the list of message recipients.
  • Google reCAPTCHA: We use the Google service reCaptcha to determine whether a particular entry in our contact or newsletter form is being made by a human or a computer. Google uses the following data to check whether you are a human or a computer: the IP address of the device used, the web page you visit and on which the captcha is embedded, the date and duration of the visit, the identification data of the browser and operating system type used, your Google account if you are logged in to Google, mouse movements on the reCaptcha areas and tasks in which you have to identify images. Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). We have a legitimate interest in this data processing in order to ensure the security of our website and to protect ourselves against automated entries (attacks).
Newsletters and electronic notifications

Newsletters, emails, push notifications and other electronic notifications (referred to below as “newsletters”) are sent only with the recipients' consent or where permitted by law. Where the content of a newsletter is specifically described when signing up for it, that description is decisive for the user's consent. Otherwise, the newsletters contain information about updates and new offers.

To sign up for the newsletter, it is generally sufficient to provide your email address. However, we may also ask you to provide your name, so that we can address you personally in the newsletter, or further details where these are required for the purposes of the newsletter.

Double opt-in procedure: Signing up for the newsletter generally takes place in what is known as a double opt-in procedure. This means that after signing up you receive an email asking you to confirm your registration. This confirmation is necessary so that nobody can sign up using someone else's email address. Newsletter sign-ups are logged so that the sign-up process can be evidenced in accordance with the legal requirements. This includes storing the time of sign-up and of confirmation as well as the IP address. Changes to your data stored with the mailing service provider are likewise logged.

Deletion and restriction of processing: Email addresses that have been unsubscribed may be stored for up to three years on the basis of legitimate interests before they are deleted, so that consent given previously can be evidenced. The processing of this data is restricted to the purpose of a possible defence against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. Where there is an obligation to observe objections permanently, the email address is stored in a blocklist solely for this purpose.

The sign-up procedure is logged on the basis of legitimate interests for the purpose of evidencing that it was carried out properly. Where service providers have been commissioned to send emails, this is done on the basis of the legitimate interest in an efficient and secure mailing system.

Content:

Information about the services, promotions and offers.

  • Types of data processed: Master data (e.g. names, addresses); contact data (e.g. email, telephone numbers); meta and communication data (e.g. device information, IP addresses); usage data (e.g. websites visited, interest in content, access times).
  • Data subjects: Communication partners; users (e.g. website visitors, users of online services).
  • Purposes of processing: Direct marketing (e.g. by email or post); provision of contractual services and customer service.
  • Legal basis: Consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR).
  • Right to object (opt-out): You can cancel the newsletter at any time, i.e. withdraw your consent or object to receiving it in future. You will find a link to unsubscribe from the newsletter at the end of every newsletter email. You can switch off push notifications at any time in your smartphone's settings. You can stop messages on social media by sending the command “stop” in the chat.
  • Condition for using free services: Consent to receiving update emails may be made a condition for using free services (e.g. access to certain content or participation in certain promotions). If you would like to use the free service without signing up for the newsletter, please get in touch.

Further information on processing operations, procedures and services:

  • Brevo: Email marketing platform; Service provider: Sendinblue GmbH, // Köpenicker Straße 126 10179 Berlin, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.brevo.com/; Privacy policy: https://www.brevo.com/de/legal/privacypolicy/; Unsubscribe email address (opt-out): Unsubscribe email address;
  • WonderPush: Platform for push notifications; Service provider: WonderPush, 19 avenue d'Italie, 75013 Paris, France; Server location: According to the provider, data from Europe is stored in Europe; Data processed: the push identifier of your browser or device, technical details of the device and operating system, the types of notification you have chosen and information on the delivery and opening of the notifications; Legal basis: Consent (Art. 6(1)(a) GDPR) – push notifications are sent only after express consent in the browser or on the device; Website: https://www.wonderpush.com/; Privacy policy: https://www.wonderpush.com/policies/privacy/; Data processing agreement: WonderPush DPA (PDF); Withdrawal: You can switch off notifications at any time in the Ofindo settings or in your device's system settings.
  • ManyChat: Chatbot and marketing platform; Service provider: ManyChat Inc., 535 Mission St, San Francisco, CA 94105, USA; Legal basis: Consent (Art. 6(1)(a) GDPR) where you actively subscribe to regular messages; legitimate interests (Art. 6(1)(f) GDPR) where user enquiries are answered; Website: https://manychat.com/; Privacy policy: https://manychat.com/privacy.html; Unsubscribing (opt-out): You can stop receiving messages at any time by sending the text “stop” in the chat. When you unsubscribe, the data is deleted from the list of message recipients.
Promotional communication by email, post or telephone

Personal data is processed for the purposes of promotional communication, which may take place via various channels, such as email, telephone, post or social media, in accordance with the statutory requirements.

Recipients have the right to withdraw consent they have given at any time or to object to promotional communication at any time.

After withdrawal or objection, the data required to evidence the previous authorisation to contact or send material is stored for up to three years after the end of the year of withdrawal or objection, on the basis of legitimate interests. The processing of this data is restricted to the purpose of a possible defence against claims. On the basis of the legitimate interest in permanently observing the user's withdrawal or objection, the data required to avoid contacting them again (e.g., depending on the communication channel, the email address, telephone number or name) is stored.

  • Types of data processed: Master data (e.g. names, addresses); contact data (e.g. email, telephone numbers).
  • Data subjects: Communication partners.
  • Purposes of processing: Direct marketing (e.g. by email or post).
  • Legal basis: Consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Brevo: Email marketing platform; Service provider: Sendinblue GmbH, // Köpenicker Straße 126 10179 Berlin, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.brevo.com/; Privacy policy: https://www.brevo.com/de/legal/privacypolicy/; Unsubscribe email address (opt-out): Unsubscribe email address;
  • ManyChat: Chatbot and marketing platform; Service provider: ManyChat Inc., 535 Mission St, San Francisco, CA 94105, USA; Legal basis: Consent (Art. 6(1)(a) GDPR) where you actively subscribe to regular messages; legitimate interests (Art. 6(1)(f) GDPR) where user enquiries are answered; Website: https://manychat.com/; Privacy policy: https://manychat.com/privacy.html; Unsubscribing (opt-out): You can stop receiving messages at any time by sending the text “stop” in the chat. When you unsubscribe, the data is deleted from the list of message recipients.
Prize draws and competitions

Personal data of participants in prize draws and competitions is processed in compliance with the relevant data protection provisions, to the extent that the processing is contractually necessary for providing, running and handling the prize draw, the participants have consented to the processing, or the processing serves legitimate interests (e.g. in the security of the prize draw or protection against misuse through the possible recording of IP addresses when entries are submitted).

If participants' entries are published as part of the prize draws (e.g. in the course of a vote or a presentation of the entries or of the winners, or in reporting on the prize draw), please note that the participants' names may also be published in this context. Participants can object to this at any time.

If the prize draw takes place within an online platform or a social network (e.g. Facebook or Instagram, referred to below as the “online platform”), the terms of use and privacy policies of the respective platforms also apply.

Participants' data is deleted as soon as the prize draw or competition has ended and the data is no longer required to inform the winners or because queries about the prize draw are to be expected. As a rule, participants' data is deleted no later than 6 months after the end of the prize draw. Winners' data may be retained for longer, e.g. in order to answer queries about the prizes or to deliver the prizes; in this case the retention period depends on the type of prize and is, for example, up to three years for goods or services, e.g. in order to deal with warranty cases. Participants' data may also be stored for longer, e.g. in the form of reporting on the prize draw in online and offline media.

Where data was also collected for other purposes in the course of the prize draw, its processing and retention period are governed by the privacy information on that use (e.g. in the case of signing up for the newsletter as part of a prize draw).

  • Types of data processed: Master data (e.g. names, addresses); content data (e.g. entries in online forms); meta and communication data (e.g. device information, IP addresses).
  • Data subjects: Participants in prize draws and competitions.
  • Purposes of processing: Running prize draws and competitions.
  • Legal basis: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR).
Surveys and questionnaires

Surveys and questionnaires are carried out in order to gather information for the survey purpose communicated in each case. The surveys and questionnaires carried out (referred to below as “surveys”) are evaluated anonymously. Personal data is processed only to the extent necessary to provide the surveys and carry them out technically (e.g. processing the IP address in order to display the survey in the user's browser or using a cookie to allow the survey to be resumed).

  • Types of data processed: Contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta and communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners; participants.
  • Purposes of processing: Feedback (e.g. collecting feedback via an online form).
  • Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
Web analytics, monitoring and optimisation

Web analytics (also referred to as “reach measurement”) serves to evaluate the flow of visitors to the online service and may include behaviour, interests or demographic information about the visitors, such as age or gender, as pseudonymous values. Reach analysis makes it possible to see at what time the online service or its functions or content are used most frequently or invite reuse. It can also be understood which areas need optimising.

In addition to web analytics, test procedures are also used, e.g. to test and optimise different versions of the online service or of its components.

Unless stated otherwise below, profiles, i.e. data combined for a usage process, may be created for these purposes, and information may be stored in a browser or on a device and read from it. The information collected includes in particular the pages visited and the elements used there, as well as technical details such as the browser used, the computer system used and information on times of use. Where users have agreed, to us or to the providers of the services we use, to the collection of their location data, location data may also be processed.

It is also possible that users' IP addresses are stored. In general, no clear data of users is stored in the course of web analytics, A/B testing and optimisation, but pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Anonymous data collection in Ofindo: We count anonymously how often and from how many devices our service is accessed each day. Without this figure it would not be possible to establish whether our service works and is used at all, whether a fault actually affects users and whether it remains viable to keep the service running.

What is recorded is the time, the page accessed, the platform used (website, web app, iOS or Android app), the app version, the selected city and technical details of the browser, operating system and screen size. In addition, switching between the four main areas of the service (Explore, Events, Map and Search) is recorded. When the service is accessed in a browser, we also record once which website the visit came from – the address of the referring page, as far as your browser transmits it; usually this is only the domain, such as google.com – and, where present, campaign details from the address accessed (so-called utm parameters). This shows us which of our own links, posts or ads bring visitors to us. Without consent, we do not transmit anything else that is done within the service to the provider of the analytics software: neither individual items of content or clicks nor search terms. No usage profiles are created there and data is not combined with other sources.

This is to be distinguished from counters that we keep in our own database: how often an event, a place or a news item was viewed and how often an advert was delivered or clicked. They serve to highlight popular content and to settle accounts with advertising partners. Without consent, these counters are kept without any identifier – neither a device identifier nor a user identifier is stored – so that it cannot be derived from them who viewed something.

For this count, no identifier is stored on the device and none is read from it. To prevent the same access being counted more than once, we form an identifier on our server from the IP address, the browser identifier (user agent) and the calendar day. This identifier changes daily and therefore does not allow recognition beyond the day; the IP address itself is neither stored nor transmitted to the provider of the analytics software. Evaluation takes place exclusively in anonymised, aggregated form: individual persons are not recognisable in it and cannot be identified by us either. We are therefore not in a position to attribute this data to a particular person (Art. 11 GDPR).

The legal basis is our legitimate interest in a statistical evaluation of the use of our service (Art. 6(1)(f) GDPR). Consent under Section 25(1) TDDDG (the German Telecommunications and Digital Services Data Protection Act, Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) is not required for this, as information is neither stored on the device nor read from it. Any evaluation going beyond this – in particular recognition over several days, the creation of usage profiles and advertising tailored to individuals – takes place exclusively on the basis of consent, which can be withdrawn at any time with effect for the future in the privacy settings.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta and communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Reach measurement (e.g. access statistics, recognition of returning visitors); profiles with user-related information (creation of user profiles); tracking (e.g. interest-based or behavioural profiling, use of cookies); provision of the online service and user-friendliness.
  • Security measures: Use of pseudonyms and IP masking (pseudonymisation of the IP address).
  • Legal basis: Consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR) – exclusively for the reach measurement described above, which does not require consent and involves no storing or reading of information on the device.
  • Right to object (opt-out): You can withdraw consent you have given at any time with effect for the future in the cookie and data settings. You can also switch off cookies in your browser's settings. However, this may restrict functions of the online service.

Further information on processing operations, procedures and services:

  • Mixpanel: Web analytics, reach measurement and measurement of user flows; Service provider: Mixpanel Inc., One Front Street, Floor 28, San Francisco, CA 94111, USA.; Processing in the EU: The data is transmitted to Mixpanel's European servers (api-eu.mixpanel.com) and processed there; the user's IP address is not transferred in the process; Legal basis: Consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR) – exclusively for the reach measurement that does not require consent, using an identifier that changes daily and is formed on the server; Website: https://mixpanel.com/de/; Privacy policy: https://mixpanel.com/legal/privacy-policy/; Further information: https://mixpanel.com/legal/dpa/.
  • Brevo: Email marketing platform; Service provider: Sendinblue GmbH, // Köpenicker Straße 126 10179 Berlin, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.brevo.com/; Privacy policy: https://www.brevo.com/de/legal/privacypolicy/; Unsubscribe email address (opt-out): Unsubscribe email address;
Affiliate programmes and affiliate links

So-called affiliate links or other references (which may include, for example, links, search forms, widgets or discount codes) to the offers and services of third-party providers are embedded (referred to collectively as “affiliate links”). If users follow the affiliate links or subsequently take up the offers, we may receive a commission or other benefits from these third-party providers (referred to collectively as “commission”).

In order to track whether users have taken up the offers via an affiliate link that we use, it is necessary for the respective third-party providers to learn that the users followed an affiliate link used within our online service. The assignment of the affiliate links to the respective transactions or other actions (e.g. purchases) serves solely the purpose of settling commission and is removed as soon as it is no longer required for that purpose.

For the purposes of the aforementioned assignment, the affiliate links are supplemented by certain values that form part of the link. These values may include in particular the originating website (referrer), the time, an online identifier of the operator of the website on which the affiliate link was located, an online identifier of the respective offer, the type of link used and the type of offer.

How we actually use affiliate links: The links we use contain only parameters that identify our service as the origin of the click. An identifier that would allow conclusions to be drawn about individual users is neither created nor transmitted. Whether an affiliate link was clicked is recorded by us solely as a counter in our own database; we do not store or read any identifier on the device for this purpose. If the third-party provider uses cookies or similar technologies on its own website after the redirect, it does so on its own responsibility – the privacy information of the respective provider applies to this.

Notes on the legal basis: Users' data is processed on the basis of our legitimate interests (i.e. an interest in efficient, economical and recipient-friendly services and in settling commission). Consent under Section 25(1) TDDDG is not required for this, as we neither store information on the device nor read information from it for the tracking.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta and communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Affiliate tracking.
  • Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

Customer reviews and rating schemes

We take part in review and rating schemes in order to evaluate, optimise and promote the services. If users rate or otherwise give feedback via the participating rating platforms or schemes, the general terms and conditions or terms of use and the privacy information of the providers also apply.

To ensure that the persons giving a rating have actually used our services, we transmit, with the customer's consent, the data required for this purpose regarding the customer and the service used to the respective rating platform (including name, email address and order number or item number). This data is used solely to verify the authenticity of the users.

  • Types of data processed: Contract data (e.g. subject matter of the contract, term, customer category); usage data (e.g. websites visited, interest in content, access times); meta and communication data (e.g. device information, IP addresses).
  • Data subjects: Customers; users (e.g. website visitors, users of online services).
  • Purposes of processing: Feedback (e.g. collecting feedback via an online form); marketing.
  • Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Rating widget: We embed so-called “rating widgets” in our online service. A widget is a functional and content element embedded in our online service that displays changing information. It may be shown, for example, in the form of a seal or comparable element, sometimes also called a “badge”. Although the relevant content of the widget is displayed within our online service, it is retrieved at that moment from the servers of the respective widget provider. Only in this way can the current content always be shown, primarily the current rating. For this, a data connection must be established from the web page accessed within our online service to the widget provider's server, and the widget provider receives certain technical data (access data, including the IP address) that is needed for the content of the widget to be delivered to the user's browser. Furthermore, the widget provider receives information that users have visited our online service. This information may be stored in a cookie and used by the widget provider to recognise which online services taking part in the rating scheme the user has visited. The information may be stored in a user profile and used for advertising or market research purposes; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).
Presences on social networks (social media)

We maintain online presences within social networks and in this context process users' data in order to communicate with the users active there or to offer information.

In doing so, users' data may be processed outside the European Union. This may give rise to risks for users because, for example, it could make it more difficult to enforce users' rights.

Furthermore, users' data within social networks is as a rule processed for market research and advertising purposes. For example, usage profiles may be created on the basis of users' usage behaviour and the interests resulting from it. The usage profiles may in turn be used, for example, to place adverts within and outside the networks that presumably correspond to the users' interests. For these purposes, cookies are as a rule stored on the users' computers, in which the users' usage behaviour and interests are stored. Furthermore, data may also be stored in the usage profiles independently of the devices used by the users (in particular if the users are members of the respective platforms and are logged in to them).

For a detailed description of the respective forms of processing and the options to object (opt-out), we refer to the privacy policies and information provided by the operators of the respective networks.

In the case of requests for information and the assertion of data subject rights, too, we point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. Should you nevertheless need help, you can contact us.

  • Types of data processed: Contact data (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta and communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Contact requests and communication; feedback (e.g. collecting feedback via an online form); marketing.
  • Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Instagram: Social network; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.
  • Facebook pages: Profiles within the social network Facebook - We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data of visitors to our Facebook page (“fan page”). This data includes information about the types of content that users view or interact with, or the actions they take (see “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by the users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see “Device Information” in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under “How do we use this information?”, Facebook also collects and uses information to provide analytics services, known as “Page Insights”, for page operators so that they gain insights into how people interact with their pages and with the content connected with them. We have concluded a special agreement with Facebook (“Information about Page Insights”, https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular which security measures Facebook must observe and in which Facebook has agreed to fulfil the data subject rights (i.e. users can, for example, send requests for information or deletion directly to Facebook). The rights of users (in particular to information, deletion, objection and to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Information about Page Insights” (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Standard contractual clauses (ensuring the level of data protection when processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further information: Joint controllership agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data. The joint controllership is limited to the collection by and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. The further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, which concerns in particular the transfer of the data to the parent company Meta Platforms, Inc. in the USA (on the basis of the standard contractual clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
  • LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Data processing agreement: https://legal.linkedin.com/dpa; Standard contractual clauses (ensuring the level of data protection when processing in third countries): https://legal.linkedin.com/dpa; Right to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
  • YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Privacy policy: https://policies.google.com/privacy; Right to object (opt-out): https://adssettings.google.com/authenticated.
  • Xing: Social network; Service provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.xing.de; Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.
Plugins and embedded functions and content

If you activate “External media” in the cookie and data settings, functional and content elements are embedded in the online service that are loaded from the servers of their respective providers (referred to below as “third-party providers”). These may be, for example, graphics, videos, fonts or maps (referred to below uniformly as “content”).

Embedding always requires the third-party providers of this content to process the user's IP address, since without the IP address they could not send the content to the user's browser. The IP address is therefore required for displaying this content or these functions. We endeavour to use only content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, the time of the visit and other details about the use of our online service, and may also be combined with such information from other sources.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta and communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of the online service and user-friendliness.
  • Legal basis: Consent (Art. 6(1)(a) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Obtaining fonts (and symbols) for the purpose of a technically secure, maintenance-free and efficient use of fonts and symbols with regard to being up to date and loading times, their uniform display and consideration of possible licensing restrictions. The user's IP address is communicated to the provider of the fonts so that the fonts can be made available in the user's browser. Technical data (language settings, screen resolution, operating system, hardware used) is likewise transmitted, which is necessary for providing the fonts depending on the devices used and the technical environment; Service provider: Adobe Systems Software Ireland Companies, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://www.adobe.com/de/; Privacy policy: https://www.adobe.com/de/privacy/policy.html; Cross-border data transfers: https://www.adobe.com/de/privacy/eudatatransfers.html.
  • Apple Maps: Map; Service provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork Ireland, parent company: Apple, One Apple Park Way, Cupertino, CA 95014, USA; Legal basis: Consent (Art. 6(1)(a) GDPR); Privacy policy: https://www.apple.com/de/privacy/, Terms of use: https://www.apple.com/legal/internet-services/maps/legal-de.html.
Changes and updates to the privacy policy

We ask you to check the content of the privacy policy regularly. The privacy policy is adapted as soon as changes to the data processing carried out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or some other individual notification.

Regarding the addresses and contact details of companies and organisations in this privacy policy, please note that the addresses may change over time; we therefore ask you to check the details before getting in touch.

Nicht mehr suchen.
Einfach Ofindo öffnen.
Laden im App Store Jetzt bei Google Play
QR-Code: Ofindo im App Store Laden im App Store
QR-Code: Ofindo bei Google Play Jetzt bei Google Play
Scanne den QR-Code mit deinem Smartphone