Privacy Information

for visitors to the website and for customers

Data Subjects

1This notice is addressed to all persons who

1.visit the website https://onepage.io/ or

2.are customers of the Controller, which also includes prospective and former customers.

As a rule, all information applies to both groups of data subjects unless a section is expressly marked as applying only to one of the groups.

2All personal designations refer to all genders. Where, for ease of reading, a gendered term is used, it is to be understood as including all genders (m/f/d).

Controller

The controller responsible for the processing described here is: Onepage GmbH, Hanauer Landstraße 172, 60314 Frankfurt am Main, E: support@onepage.io, Management: Marcel Knopf, external data protection officer: STANHOPE Rechtsanwaltsgesellschaft mbH, Rechtsanwalt Dr. Stephan Gärtner, E: request@thenextstanhope.de.

Rights of Data Subjects and Other Notes

1Data subjects have the following rights with regard to their stored personal data: the right to access, the right to rectify inaccurate data, the right to erase data for which there is no longer any reason to retain, the right to restrict processing, and the right to data portability. Furthermore, they have the right to lodge a complaint with the supervisory authority responsible for the controller.

2Where processing is based on the data subject’s consent, the data subject has the right to withdraw that consent at any time with effect for the future; the lawfulness of processing based on consent before its withdrawal is not affected. Withdrawal can be declared informally via any of the above contact channels (Controller).

3Insofar as the processing is based on the fulfillment of a legitimate interest, i.e., on Article 6(1)(1)(f) GDPR, the data subjects may object to the processing at any time, for example, by sending an informal message to one of the above-mentioned contact channels (controller). If the objection is justified, processing will be terminated. If the legitimate interest lies in direct marketing, the objection is always justified.

4No automated decision-making, including profiling, takes place.

5A legal obligation to process data exists only where reference is made to Article 6(1)(1)(c) GDPR.

6Where data processing is described below, this does not mean that the data subjects have any kind of claim to the associated actions (e.g., media recordings, evaluations). The claims of the data subject arise from paragraphs 1 to 3 of this section. The data processing described below only describes possible courses of action, which do not apply to all data subjects.

Transfer to countries outside the European Union

1If personal data is transferred to locations outside the European Union, the controller must provide additional safeguards in accordance with Article 44 et seq. GDPR.

2If the controller refers to a so-called adequacy decision in the following privacy policy, this means that the recipient is located in a country, territory, or specific sector that the EU Commission has decided offers an adequate level of data protection. The guarantee then follows from Article 45 GDPR.

3If the controller refers to the so-called EU standard contractual clauses in the following privacy policy, this means that the recipient has contractually committed itself to comply with the EU data protection principles on the basis of the so-called EU standard contractual clauses. The guarantee then follows from Article 46 GDPR.

4If the controller refers to so-called binding internal data protection regulations in the following privacy policy, this means that the competent supervisory authority has approved the transfer. The guarantee then follows from Article 47 GDPR.

5If the controller states in the following privacy policy that the data subjects have expressly consented to the transfer to a country outside the European Union, this means that they nevertheless consent to the transfer in full knowledge of all the risks involved. The guarantee then follows from Article 49(1)(a) GDPR. Any risk warnings can be found in the glossary.

Privacy Information for Customers

The information in this section is intended only for customers.

Expected Standard Data Processing (Customers)

Contract initiation:

First contact

The contract is initiated as follows: Either the data subjects make initial contact with the controller or vice versa. In this case, the controller processes all data that the data subjects voluntarily provide. This often includes contact details (name, contact details such as email address, postal address, telephone number) and communication data (description of the content, conversation notes, form entries). The controller prepares an offer on this basis and stores this data. The purpose is to initiate or establish a contract. The legal basis is Article 6(1)(b) GDPR.

Assertion of rights

If the data subject asserts their rights under the GDPR or other legal provisions, the controller processes the data in order to examine these claims and, if necessary, to fulfill them. The purpose is to fulfill a legal obligation. The legal basis is Article 6(1)(c) GDPR in conjunction with the standard from which the legal obligation arises.

Deletion:

After expiry of the retention periods (see below “After the end of the active contractual relationship”), the data will be deleted. The deletion serves to fulfill a legal obligation and is based on Article 6(1)(c) GDPR in conjunction with Article 5(1)(a) and (e) GDPR.

Active Contractual Relationship

Performance of the contract

After the contract has been concluded, the controller collects further communication and billing data (delivery of services, responding to inquiries) in order to fulfill the contract. The purpose is to execute a contract. The legal basis is Article 6(1)(1)(b) GDPR.

Changes in processing

If the controller changes the processing, in particular by appointing new recipients, it will inform the data subjects of the change by email, sending them the updated data protection information by email. The purpose of this is to fulfill the transparency obligations under the GDPR (Articles 12 to 14 GDPR). The legal basis is Article 6(1)(1)(c) GDPR.

Assertion of rights

If the data subject exercises rights under the GDPR or other regulations, the Controller processes the data required for this purpose and the correspondence. The purpose is to process the request and to comply with legal obligations. The legal basis is Article 6(1)(1)(c) GDPR in conjunction with the provision from which the legal obligation arises.

Conflicts in contractual relationships

In the event of a legal dispute between the data subjects and the controller, the data will be processed in order to issue appropriate statements and, if necessary, to obtain external legal advice. The following data will be processed in this context: name, contact details, all transactions related to the legal dispute. The processing serves to obtain external legal advice/support and to exercise the controller's own rights. The legal basis is Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purposes. Insofar as data is processed externally, this does not constitute contract processing (cf. DSK short paper 13), but rather data transfer, which in turn is justified by Article 6(1)(1)(f) GDPR. This is therefore a case of other outsourcing.

Deletion

After expiry of the retention periods (see below under “After end of contract and general retention periods”), the data are deleted, unless there is a further legal obligation to retain or process the data. The legal basis is Article 6(1)(1)(c) GDPR in conjunction with Article 5(1)(a),(e) GDPR.

After the end of the active contractual relationship

Storage in accordance with German law

1After the end of the contractual relationship, all aforementioned data that is still stored will be retained. With regard to retention, the purpose and legal basis are set out in the list of retention periods below (paragraph 2).

2The following retention periods apply:

a.Accounting documents are retained for 8 years, beginning on December 31 of the calendar year in which the respective document was created. The processing serves to fulfill a legal obligation and is based on Article 6(1)(1)(c) GDPR in conjunction with § 147 AO, § 257 HGB.

b.Internal records relevant for tax purposes that are not accounting documents are retained for 10 years, beginning on December 31 of the calendar year in which the respective document was created. The processing serves to fulfill a legal obligation and is based on Article 6 (1) sentence 1 lit. c GDPR in conjunction with § 147 AO, § 257 HGB.

c.Business communication data (e.g., customer letters) and comparable documents relevant for tax purposes are retained for 6 years, beginning on December 31 of the calendar year in which the respective document was created. The processing serves to fulfill a legal obligation and is based on Article 6(1)(1)(c) GDPR in conjunction with § 147 AO, § 257 HGB.

d.Data generated when data subjects assert data protection claims against the controller shall be retained for three years, beginning on December 31 of the calendar year in which the controller responds to such claims. The processing serves to protect the interest in defending against claims and is based on Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the above-mentioned purpose. The duration of the legitimate interest follows from the statute of limitations for claims for damages (Sections 195, 199(1) BGB) and, in addition, from the statute of limitations under administrative offense law (Section 31(2) No. 1 OWiG in conjunction with Article 83 GDPR).

e.Data that arises when data subjects assert other claims against the controller is retained for three years, beginning on December 31 of the calendar year in which the controller responds to such claims. The processing serves to protect the interest in defending against claims and is based on Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the above-mentioned purpose. The duration of the legitimate interest follows from the statute of limitations for claims for damages (Sections 195, 199(1) BGB).

f.Data based on consent must be retained until consent is revoked or until the purpose associated with the processing ceases to apply, whichever occurs first. Retention serves the purpose associated with consent and is based on Article 6(1)(1)(a) GDPR.

g.Data proving that consent has been given must be retained for 3 years, starting from the date on which consent is revoked or the purpose ceases to apply, whichever occurs first. The processing serves to protect the interest in defending against claims and is based on Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the above-mentioned purpose. The duration of the legitimate interest follows from the statute of limitations provisions of administrative offense law (Section 31(2)(1) OWiG in conjunction with Article 83 GDPR).

Deletion of Data

After expiry of the retention periods, the data are deleted, unless a further legal obligation to retain or process the data exists. The legal basis is Article 6(1)(1)(c) GDPR in conjunction with Article 5(1)(a),(e) GDPR.

Non-Routine Data Processing (Customers)

Videoconferencing

1The controller shall enable the data subjects to communicate via video conference.

2If the data subjects opt for the video conference, the controller shall obtain the necessary consent. For this purpose, the controller shall process the name, time, and status of the consent. The purpose is to fulfill a legal obligation. The legal basis is Article 6(1)(1)(c) GDPR in conjunction with Article 7(1) GDPR.

3The controller conducts discussions via video conference. In doing so, it processes the image and sound data generated in the process as well as any transcripts. The purpose is contract-related communication with the data subjects. The legal basis is Article 6(1)(1)(a) GDPR. This is not precluded by the prohibition in Article 9(1) GDPR, as the exception in Article 9(2)(a) GDPR applies here.

Transfer of data to tax advisory firm

The controller transmits the data relevant for tax purposes (invoices, incoming payments, etc.) to an external tax consulting firm. This includes the following data: name, contact details, all data relevant for taxation that the data subjects voluntarily provide. The purpose of the aforementioned processing operations is to obtain external tax law support. The legal basis is Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the above-mentioned purpose. Insofar as data is processed by the external tax consulting firm, this does not constitute contract processing (cf. DSK Short Paper 13), but rather a data transfer, which in turn is justified by Article 6(1)(1)(f) GDPR. This is therefore a case of other outsourcing.

Reviews/Testimonials

1The controller collects testimonials from the data subjects.

2First, it requests consent for this and documents the response. For this purpose, it processes the name, time, and status of the consent. The purpose is to fulfill a legal obligation. The legal basis is Article 6(1)(1)(c) GDPR in conjunction with Article 7(1) GDPR.

3If consent is given, the following happens: The controller collects the testimonials and publishes them, insofar as the consent given permits this. The following data is processed in this context: name, status of consent, date of the decision. The purpose of the processing is to present the controller. The legal basis is Article 6(1)(1)(a) GDPR.

Video testimonials

1In certain selected cases, the controller allows data subjects to provide a video testimonial.

2If the data subjects decide to do so, the controller obtains the necessary consent. For this purpose, the controller processes the name, time, and status of the consent. The purpose is to fulfill a legal obligation. The legal basis is Article 6(1)(1)(c) GDPR in conjunction with Article 7(1) GDPR.

3The controller produces the video testimonial and publishes it, insofar as consent permits. The following data is processed in this context: name, image and audio data. The purpose is to present the controller to the public. The legal basis is the consent of the data subjects within the meaning of Article 6(1)(1)(a) GDPR.

Advertising communications via email (legitimate interest)

The controller uses the email addresses of the data subjects for advertising purposes. In doing so, it processes the following data: name, email address. The legal basis is Article 6(1)(1)(f) GDPR, whereby the legitimate interest arises from the contractual status and Recital 47 GDPR.

Advertising communications by mail (legitimate interest)

The controller uses the addresses of the data subjects to send them advertising by post. The legal basis is Article 6(1)(1)(f) GDPR, whereby the legitimate interest arises from the contractual status and Recital 47 GDPR.

Advertising calls by telephone (consent)

1The controller uses the telephone numbers of the data subjects to contact them for advertising purposes.

3The controller uses the telephone numbers to contact the data subjects for advertising purposes. In doing so, it processes the following data: name, telephone number. The legal basis is the consent of the data subjects within the meaning of Article 6(1)(1)(a) GDPR.

Use of large language models

As part of contract initiation and active contract execution, customer data is processed using an AI system in the form of a large language model (LLM). This is done as follows:

a.Entering the prompt: Employees of the controller enter relevant information or questions relating to the customer or contract-related communication as a prompt in the system's input field.

b.Tokenization: The entered prompt is converted by the IT application into a form that can be understood by the LLM by breaking the text down into individual units (tokens). This allows the model to analyze the structure and content.

c.Processing by the model: The tokens are processed by numerous layers of the AI model to recognize context, meaning, and connections. Each layer contributes to a better analysis of the prompt's content.

d.Generation of the response: The model uses the knowledge it has learned to generate a response based on the prompt. The model predicts how to complete a suitable response on a token-by-token basis until the text is complete.

e.Conversion into readable text: The tokens generated by the model are converted back into readable text and displayed to the employees of the controller. The response is based both on the model's trained data and on the specific specifications in the prompt.

The following data is processed in this process: Data from the active contractual relationship (e.g., the customer's name and contact details, current contract content, service or payment details, data from contract-related communication and correspondence). The processing serves to implement and support an existing contractual relationship, analyze and answer contract-related questions, provide customer service support, and fulfill the contract. The legal basis is Article 6(1)(1)(b) GDPR.

Outsourcing: Recipients, processors (customers)

The following recipients and other external bodies receive data from the data subjects in this context:

Google (Suite):

Various applications from Google Ireland Ltd. (Ireland - EU) are used, which has been commissioned in accordance with Article 28 of the GDPR. The transfer of data to a third country (in this case to Google LLC in the USA), which cannot be ruled out, is justified in accordance with Article 45 of the GDPR. The following tools are used:

•Google Workspace

•Google Looker Studio

•Google Gemini (AI application)

Hyros:

The analysis tool Hyros from Hyros, Inc. (USA) is used, which has been commissioned in accordance with Article 28 of the GDPR. The fact that the third-party provider is located outside the EU does not preclude the commissioning, as the transfer is justified in accordance with Article 45 of the GDPR.

Datev:

The accounting tool “Datev” from Datev eG (Germany - EU) is used, which has been commissioned in accordance with Article 28 GDPR.

External tax consulting firm:

The accounting data is transferred to an external tax consulting firm. Insofar as data is processed by the tax consulting firm, this does not constitute order processing (cf. DSK short paper 13), but rather data transfer, which in turn is justified by Article 6(1)(1)(f) GDPR. This is therefore a case of other outsourcing.

AWS (Suite):

Various applications from Amazon Web Services EMEA SARL (Luxembourg - EU) are used, which has been commissioned in accordance with Article 28 GDPR. The transfer of data to a third country (in this case to Amazon Web Services Inc., USA), which cannot be ruled out, is justified in the case of employee data in accordance with Article 46 GDPR and in the case of all other data in accordance with Article 45 GDPR. The following tools are used:

•AWS cloud

Slack:

The collaboration tool “Slack” from Slack Technologies Ireland Limited (Ireland - EU) is used. Any transfer of data to a third country (in this case the USA) that cannot be ruled out is justified in accordance with Article 45 GDPR.

Zoom:

The webinar and video conferencing tool “Zoom” from Zoom Video Communications, Inc. (USA) is used, which has been commissioned in accordance with Article 28 of the GDPR. Any transfer of data to a third country (in this case the USA) that cannot be ruled out is justified in accordance with Article 45 of the GDPR.

Intercom:

The automation tool “Intercom” from Intercom, Inc. (USA), which has been commissioned in accordance with Article 28 GDPR, is used. Any transfer of data to a third country (in this case the USA) that cannot be ruled out is justified in accordance with Article 45 GDPR.

Stripe:

The payment service “Stripe” from Stripe Payments Europe, Ltd. (Ireland - EU) is used, which has been commissioned in accordance with Article 28 GDPR. Stripe Payments Europe, Ltd. is a subsidiary of Stripe, Inc., based in the USA. Stripe Payments Europe, Ltd. is subject to European data protection law. In particular, the following data is processed by the controller: (1) information that the data subjects use this service, (2) the amount and time of payment by the data subjects, (3) personal data and account information necessary to carry out the transaction, and (4) personal data required by the controller to resolve conflicts and to check and prevent fraud. The controller receives the information relating to 2, 3, and 4 from the third-party provider.

OpenAI-ChatGPT:

In connection with the use of artificial intelligence, the API tool “OpenAI API” from OpenAI, LLC (USA) is used, which has been commissioned in accordance with Article 28 GDPR. Any transfer of data to a third country (in this case the USA) that cannot be ruled out is justified in accordance with Article 46 GDPR.

Claude:

In connection with the use of artificial intelligence, the tool “Claude” from Anthropic PBC (USA) is used, which has been commissioned in accordance with Article 28 GDPR. The fact that this provider is based outside the European Union does not preclude its commissioning. This is because it has committed itself in accordance with the EU standard contractual clauses, so that the transfer is justified under Article 46 GDPR.

HubSpot (Suite):

Various applications from HubSpot, Inc. (USA) are used. The transfer of data to a third country (in this case, the USA) cannot be ruled out and is justified in accordance with Article 46 GDPR for employee data and Article 45 GDPR for all other data. The following tools are used:

•HubSpot CRM

•HubSpot Marketing Hub

Mailchimp:

The automation tools “Mailchimp” / “Mandrill” from The Rocket Science Group LLC d/b/a Mailchimp (USA), which has been commissioned in accordance with Article 28 GDPR, are used. Any transfer of data to a third country that cannot be ruled out is justified in accordance with Article 45 GDPR.

Privacy policy for visitors to the website

The information in this section is intended only for visitors to the website:

Expected standard data processing

Informational use:

Presentation of the website

Those affected initially use the website for informational purposes, i.e., they visit the website without actively interacting with it. In this case, the controller collects the following data from those affected, insofar as this is technically necessary for the presentation of the website: IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, website from which the request originates, browser, operating system and its interface, language and version of the browser software. The purpose is to display the website. The legal basis is Article 6(1)(1)(f) GDPR, whereby the legitimate interest arises from the aforementioned purpose.

Assertion of rights

Conflicts in the usage relationship

In the event of a legal dispute between the data subjects and the controller, the data will be processed in order to issue appropriate statements and, if necessary, to obtain external legal advice. The following data will be processed in this context: name, contact details, all transactions related to the legal dispute. The processing serves to obtain external legal advice/support and to exercise the rights of the controller. The legal basis is Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purposes. Insofar as data is processed externally, this does not constitute contract processing (cf. DSK short paper 13), but rather data transfer, which in turn is justified by Article 6(1)(1)(f) GDPR. This is therefore a case of other outsourcing.

Deletion:

After the end of use

Storage in accordance with German law

1After the end of use of the website, all aforementioned data that is still stored will be retained. With regard to retention, the purpose and legal basis are set out in the list of retention periods below (paragraph 2).

2The following retention periods apply:

a.Retention period 1: Data that arises when data subjects assert data protection claims against the controller is retained for three years, beginning on December 31 of the calendar year in which the controller responds to the claim. The processing serves to protect the interest in defending against claims and is based on Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the above-mentioned purpose. The duration of the legitimate interest follows from the statute of limitations for claims for damages (Sections 195, 199(1) BGB) and, in addition, from the statute of limitations under administrative offense law (Section 31(2) No. 1 OWiG in conjunction with Article 83 GDPR).

b.Retention period 2: Data arising when data subjects assert other claims against the controller shall be retained for three years, beginning on December 31 of the calendar year in which the controller responds to such claims. The processing serves to protect the interest in defending against claims and is based on Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the above-mentioned purpose. The duration of the legitimate interest follows from the statute of limitations for claims for damages (Sections 195, 199(1) BGB).

c.Retention period 3: Data based on consent must be retained until consent is revoked or until the purpose associated with the processing ceases to apply, whichever occurs first. The retention serves the purpose associated with the consent and is based on Article 6(1)(1)(a) GDPR.

d.Retention period 4: Data proving that consent has been given must be retained for 3 years, starting from the date on which consent is revoked or the purpose ceases to apply, whichever occurs first. The processing serves to protect the interest in defending against claims and is based on Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the above-mentioned purpose. The duration of the legitimate interest follows from the statute of limitations provisions of administrative offense law (Section 31(2)(1) OWiG in conjunction with Article 83 GDPR).

Deletion of data

The data will be deleted after the retention periods have expired. The purpose of the deletion is to fulfill a legal obligation and is based on Article 6(1)(1)(c) GDPR in conjunction with Article 5(1)(a) and (e) GDPR.

Exceptional data processing

External web hosting

The controller uses an external web host to display the website and process the data required for this purpose. In doing so, it processes the following data: IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, website from which the request originates, browser, operating system and its interface, language and version of the browser software. The purpose is to display the website. The legal basis is Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the above-mentioned purpose.

Cookie consent

The controller allows the data subject to choose whether to consent to the use of cookies and uses a cookie consent tool for this purpose. In doing so, it processes the following data: IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, website from which the request originates, browser, operating system and its interface, language and version of the browser software, consent status, date of consent. The purpose is to fulfill a legal obligation. The legal basis is Article 6(1)(1)(c) GDPR in conjunction with Article 7(1) GDPR.

Form

The controller provides a form tool on the website. This is used for communication between data subjects and the controller, whereby the data subjects' entries are documented and transmitted to the controllers. The following data is processed in this context: data on the content, nature, and scope of the entries in the respective form. The purpose is to initiate and/or execute contracts. The legal basis is Article 6(1)(1)(b) GDPR.

Payment

The data subjects visit the website and make declarations (e.g., checking boxes, shopping cart decisions) with the aim of concluding a contract that involves a charge. The controller provides the option of online payment for this purpose. To this end, the data subjects are directed to an external payment provider, which accepts the payment order, executes it, and sends confirmation to the controller that the payment has been completed. The following data is processed in this context: payment status. The purpose is to initiate and/or execute contracts. The legal basis is Article 6(1)(1)(b) GDPR.

On this website, data subjects have the option of registering to use an internal area, subsequently logging in to it, and finally logging out again. When they register for the internal area, the controller collects the data that the data subjects provide during the registration process. Within the internal area, the controller records the actions of the data subjects to the extent necessary to provide the internal area with its functions. The following data is processed in this context: (1) the registration data entered by the data subjects, (2) data about logins, (3) data about actions performed by the data subjects within the login area, (4) data about the logout status. The purpose is to initiate and/or execute contracts. The legal basis is Article 6(1)(1)(b) GDPR.

Email automation and advertising via email (legitimate interest)

The controller collects data on the website, which it processes for automated communication purposes, both (1) for contractual and (2) for advertising purposes. In doing so, it processes the following data: name, email addresses, tags (which indicate certain characteristics, e.g., existing customers, interested parties, etc.), communication data, information on reading behavior (time of opening the email, status of response). Purpose (1) is the initiation and/or execution of contracts and purpose (2) is advertising, direct marketing. The legal basis for purpose (1) is Article 6(1)(1)(b) GDPR. The legal basis for purpose (2) is Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the above-mentioned purpose (2).

Analysis of usage behavior

Cookies are used to analyze the user behavior of those affected on this website. These are text files that are stored on the computer of those affected and enable an analysis of the use of the website. The information about usage behavior is used to generate reports on activities and interactions. The local controller uses this data to regularly improve the user experience on the website. The statistics obtained also enable it to improve its offering in order to direct the interest of the data subjects more specifically towards products and services that are suitable for them. Further details can be found below in the information on third-party providers. The following data is processed: cookie-based data on interactions (in particular the sequence of interactions, length of stay). Further details can be found below in the information on third-party providers. The purpose is to optimize this website and improve advertising targeting of data subjects. The legal basis is Article 6(1)(1)(a) GDPR.

Social Media

The controller uses social media and social networks. It has no influence on the data collected and data processing operations, nor is it fully aware of the full scope of data collection, the purposes of processing, the storage periods, and the circumstances of the deletion of personal data. When data subjects visit the controller's company and product pages on social media or advertisements (so-called ads), it is possible that the providers of social media and networks may store the data collected about them as usage profiles and use them for the purposes of advertising, market research, and/or the needs-based design of their websites. Further details can be found below in the information on third-party providers. The following applies to responsibility for this data processing: Insofar as the controller analyzes visitor interactions with its company page, both it and the respective third-party provider of the social network or medium are jointly responsible under data protection law; this is in accordance with Article 26 GDPR.

In all other cases, the respective third-party provider of the social network or medium is commissioned in accordance with Article 28 GDPR. The following data is processed in this context: cookie- or pixel-based data about interactions with the website and the company and/or product pages of the controllers, and, where applicable, the email address, name, and communication data. Further details can be found below in the information on third-party providers. The purpose is to present the controllers. The legal basis is Article 6(1)(1)(a) GDPR.

Video embedding

Plugins from a video portal are integrated into the website. Each time a page offering one or more video clips is accessed, a direct connection is established between the browser of the person concerned and a server of the video portal. Further details can be found below in the information on third-party providers. The following data is processed in this context: cookie-based data that carries the following information: (1) Information that the data subjects have visited this website (and, if applicable, the specific subpage), (2) Information that a specific video has been clicked on. Further details can be found below in the information on third-party providers. The purpose is to display videos, optimize this website, and improve advertising targeting of the data subjects. The legal basis is Article 6(1)(1)(a) GDPR.

Ads/Remarketing

The controller places advertisements, known as ads, on social media, such as search engines or social networks. These ads are displayed to the data subjects after they have visited the controller's website and a cookie has been set on their device that identifies them again, known as remarketing. The following data is processed in this context: cookie- or pixel-based data about interactions with the website and the company and/or product pages of the controller. The purpose of the processing is to present the controller and to address the data subject for advertising purposes. The legal basis is Article 6(1)(1)(a) GDPR.

External fonts

In connection with the website, external font directories are accessed. In doing so, data is transmitted to external third-party providers, who use it to determine the results and success of certain font types in order to optimize their own offerings. Specifically, the following happens: As soon as the data subjects visit this website, their browsers send HTTP requests to the respective external third-party provider of the fonts. The URL requested in this process identifies the font families. This data is logged so that the respective external third-party provider can determine how often a particular font family is requested. Furthermore, the font is adapted to the respective browser type, which in turn requires the collection and storage of data on the browser type. This also generates statistics, which in turn are used to optimize the fonts. Finally, the referral URL is logged so that the data can be used for production maintenance and an aggregated report on the top integrations can be generated based on the number of font requests. The duration of storage depends on the respective provider. The following data is processed: cookie-based data about interactions (in particular, the sequence of interactions, length of stay). This data is processed to generate aggregated usage statistics that measure the popularity of font families. The legal basis is Article 6(1)(1)(a) GDPR.

Report abuse

Those affected can report misuse of Onepage websites using a form. They must specify the type of misuse, a description of the misuse, and the URL. The controller checks whether the URL leads to a website that was created with Onepage and is provided by Onepage. The purpose is to avoid liability risks. The legal basis is Article 6(1)(1)(f) GDPR, whereby the legitimate interest follows from the aforementioned purpose.

Outsourcing: Recipients, processors (customers)

The following recipients and other external bodies receive data from the data subjects in this context:

Google (Suite):

Various applications from Google Ireland Ltd. (Ireland - EU) are used, which has been commissioned in accordance with Article 28 GDPR. Any transfer of data to a third country (in this case to Google LLC in the USA) that cannot be ruled out is justified in accordance with Article 45 GDPR. The following tools are used:

•Google Workspace

•Google Gemini (AI application)

•Google Cloud Platform (Hosting)

•Google Analytics

The following should be added here: Google Analytics helps to analyze user behavior on the website. The IP address is truncated by the third-party provider within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a server of the third-party provider in the USA and truncated there. The IP address transmitted by the browser when using this tool is not merged with other data by the third-party provider. The tool is also used for cross-device analysis of visitor flows, which is carried out via a user ID.

•Google Tag Manager

The following should be added here: This tool allows the controller to integrate various codes and services into this website in an orderly and simplified manner. This tool implements the tags or triggers the tags associated with them. When a tag is triggered, the third-party provider may also process personal data.

•Google DoubleClick

The following should be noted in this regard: DoubleClick uses cookies to display ads that are relevant to the data subjects, to improve campaign performance reports, or to prevent data subjects from seeing the same ads multiple times. Using a cookie ID, the third-party provider records which ads are displayed in which browser and can thus prevent them from being displayed multiple times. In addition, DoubleClick can use cookie IDs to track so-called conversions related to ad requests. This is the case, for example, when data subjects see a DoubleClick ad and later use the same browser to visit the website of the local controller and make a purchase there. Due to the marketing tools used, the browser automatically and directly establishes a connection to the third-party provider's server. Through the integration of DoubleClick, the third-party provider receives the information that the data subjects have accessed the corresponding part of the local website or clicked on the controller's ad. If the data subjects are registered with a service of the third-party provider, the latter can assign the visit to the respective account of the data subjects. Even if the data subjects are not registered with the third-party provider or have not logged in, it is possible that the third-party provider may obtain and store their IP address.

•Google Ads / Google Remarketing

The following should be noted in this regard: When data subjects interact with the controller online, for example by visiting this website, they can be identified as suitable recipients of advertisements, known as “ads,” via cookies (known as ad server cookies). These cookies can also be used to measure and evaluate the success of a campaign. When the data subjects then visit the social media site of the local third-party provider, such as its search engine, they are recognized and shown the “ads” of the local controller (“remarketing”). This happens when the respective browser of the data subjects automatically establishes a direct connection to the server of the local third-party provider. The ads are then delivered via Google Ad Servers. The ad server cookies used for this purpose usually expire after 30 days and are not intended to personally identify the data subjects. The unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions), and opt-out information (indicating that the user no longer wishes to be targeted) are usually stored as analysis values for this cookie. Those affected can make tracking more difficult and prevent it, for example (a) by adjusting the settings of their browser software (in particular, suppressing third-party cookies means that they will not receive any third-party advertisements) or (b) by deactivating cookies for conversion tracking by setting their browser to block cookies from the domain of the third-party provider in question, whereby this setting will be deleted when the data subjects delete the cookies. The purpose is to present the responsible parties, analyze usage behavior in relation to interaction with this website, and communicate with the data subjects via the social media presented here (for advertising purposes, if applicable).

•Google Looker Studio

•Google Fonts

Please note the following: Google Fonts is a directory of external fonts that are integrated here. IP addresses are neither logged nor stored nor analyzed on Google servers. The Google Fonts Web API logs details of HTTP requests (requested URL, user agent, and referrer URL). Access to this data is restricted and strictly controlled. Google does not use any of the information collected by Google Fonts to create profiles of end users. Only the fonts (one year) and the associated CSS files (one day) are stored on the end user's device.

•Google Meet

•YouTube (Principle)

The following should be noted in this regard: YouTube is a portal on which videos are shown.

•YouTube (own channel)

The following should be noted in this regard: The controller operates its own YouTube channel.

•YouTube (Plugin)

The following should be noted in this regard: The controller has integrated a YouTube plugin on the website which, when clicked, leads to YouTube and its channel and also processes the data of the data subjects.

Microsoft (Suite):

Various applications from Microsoft Corporation (USA) are used, which has been commissioned in accordance with Article 28 of the GDPR. The transfer of data to a third country (in this case the USA), which cannot be ruled out, is justified in accordance with Article 45 of the GDPR. The following tools are used:

•Microsoft Advertising

•Bing Ads

Meta (social network):

The social networks and media of Meta Platforms Ireland Limited (Ireland - EU) are used. However, it cannot be ruled out that data may be transferred to or integrated with the parent company, Meta Platforms Inc. (USA). Insofar as the controller and the aforementioned provider are jointly responsible, the agreement can be found here: https://www.facebook.com/legal/terms/page_controller_addendum. There you will find all information on the scope of application and the distribution of tasks. In all other cases, the aforementioned provider has been commissioned in accordance with Article 28 GDPR. The transfer of data to a third country (in this case to Meta Platforms Inc. USA), which cannot be ruled out, is justified in the case of employee data in accordance with Article 46 GDPR and in the case of all other data in accordance with Article 45 GDPR. The following social networks, media, and/or tools are used:

•Facebook (company website)

•Facebook (Plugin)

•Facebook (Pixel)

•Facebook (Ads)

•Instagram (company website)

•Instagram (Plugin)

•Instagram (Pixel)

•Instagram (Ads)

LinkedIn (social network):

The social network “LinkedIn” from LinkedIn Ireland Unlimited Company (Ireland - EU) is used. However, it cannot be ruled out that data may be transferred to or integrated with the parent company, LinkedIn Corporation (USA). The transfer of data to a third country (in this case the USA) cannot be ruled out and is justified in accordance with Article 46 GDPR. The following tools are used:

•LinkedIn (company website)

•LinkedIn (Plugin)

•LinkedIn (Ads)

•LinkedIn (Recruiting)

TikTok (social network):

The social network “TikTok,” which is jointly offered by TikTok Technology Limited (EU - Ireland) and TikTok Information Technologies UK Limited (United Kingdom of England and Northern Ireland), is used. However, the third-party providers' privacy policy states that they also pass on data to other companies in their “group of companies” without specifying which companies belong to this group. Despite public statements to the contrary, it cannot therefore be ruled out that the data may be transferred to companies in the USA and/or the People's Republic of China, in particular to the parent company Beijing Bytedance Technology Ltd. (People's Republic of China), and also processed there. Insofar as the controller and the third-party providers of the social network or medium presented here are jointly responsible, they have agreed on joint responsibility in accordance with Article 26 GDPR. In all other cases, the provider of the social network or medium has been commissioned in accordance with Article 28 GDPR. Any transfer of data to a third country (in this case, the USA) that cannot be ruled out is justified in accordance with Article 49(1)(a) GDPR. The following tools are used:

•TikTok (company website)

•TikTok (Plugin)

•TikTok (Pixel)

•TikTok (Ads)

X (social network):

The social network “X” of Twitter International Company (Ireland - EU) is used. However, it cannot be ruled out that data may be transferred to or integrated with the parent company, X Corp. (USA). Details on how this third-party provider processes data are described here: https://twitter.com/de/privacy. Any transfer of data to a third country (in this case, the USA) that cannot be ruled out is justified in accordance with Article 46 of the GDPR. The following tools are used:

•X (company website)

•X (Plugin)

•X (Ads)

HubSpot (Suite):

•HubSpot CRM

•HubSpot Marketing Hub

Mailchimp:

Glossary

A glossary follows. Not all of the terms explained in the glossary necessarily play a role in the data processing operations described here. They are provided solely for general understanding and transparency.

1.Personal data. This is any information that directly or indirectly allows conclusions to be drawn about natural persons, i.e., human beings.

2.Processing of personal data. Any active or passive handling of personal data, from collection and core processing to deletion.

3.Controller. This is the natural or legal person or other body that, alone or jointly with others, decides on the purposes and means of processing personal data. The controller is specified in more detail on the cover page.

4.Data subject. This is the identified or identifiable natural person to whom the personal data relates.

5.Consent. This is a verifiable declaration of intent that is voluntarily given prior to the processing of personal data and which permits the specific processing of the personal data of the data subject making the declaration.

6.Social media / company and/or product page. This wording means that the controller maintains a company or product page on a social media platform, which is also linked to the website. If the data subjects click on this link (meaning the link to the company or product page), they will be taken to the controller's profile.

7.Social media/plugin. This wording means that the controller has integrated a plugin from a third-party provider of a social network or medium into the website. If the data subjects click on this plugin, they will be taken to the controller's profile. The controller uses the so-called two-click solution. This means that, after clicking, no personal data is initially passed on to the respective third-party provider of the plugin. The third-party provider can be identified by the design of the plugin (e.g., by the logo). The controller enables data subjects to communicate directly with the third-party provider of the plugin via the button. Only when they click on the marked field and thereby activate it does the third-party provider receive the information that the data subjects have accessed this website. Only then is the data transmitted. By activating the plugin, personal data of the data subjects is transmitted to the respective third-party provider. This data transfer takes place regardless of whether the data subjects have an account with the respective third-party provider and are logged in there. If they are logged in to the third-party provider, their data collected by the local controller will be directly assigned to the account that the data subjects maintain with the respective third-party provider.

8.Social media/ads. This wording means that the controller uses so-called “ads” (advertisements) in a social medium. With the help of “ads,” the local controller can draw attention to its offers within the respective social network or medium. It can determine how successful the individual advertising measures are in relation to the data from the advertising campaigns. The aim is to show data subjects “ads” that are of interest to them, to make this website more interesting for them, and to calculate advertising costs fairly. These “ads” are delivered by the respective third-party provider. If the data subjects access the website of the local controller via ads presented to them by the respective third-party provider, a cookie is stored on the data subjects' computers. These cookies are not generally intended to identify the data subjects personally.

9.Social media/pixels. This wording means that the controller uses so-called pixels. This is an analysis tool that the controller can use to measure the effectiveness of advertising. It is generally used to understand and track people's actions on a website. The controller has implemented the pixel on its website by placing the pixel code in the header. When data subjects visit the website and perform an action (e.g., make a purchase), the pixel is triggered and the action is reported. In this way, the controller learns when data subjects perform an action and can evaluate it.

10.Social media/upload to custom audience. This wording means that the controller uploads the data of the data subjects (usually their email address) to a third-party provider of a social network or medium, naturally only after obtaining consent. This enables the local controller to display interest-based advertisements (“ads”) to the data subjects when they visit a social network or medium. This is done as follows: The controller uploads the contact data (usually the email address) to the respective third-party provider. The third-party provider then checks whether the data subjects are registered with them using these contact details. If not, the contact details are not entered into the custom audience (a type of database maintained by the controller at the respective third-party provider). If they are, the data is entered into the controller's Custom Audience. If the data subjects then visit the social network or medium provided by the respective third-party provider, the local controller has the option of displaying advertisements to the data subjects that are of interest to them.

11.Social media or video embeds / publication of media recordings. This wording means that the controller uploads media recordings of the data subjects (photos, audio and/or film recordings) to the respective social media or network or to the respective video portal and publishes them there.

12.Video embeds/plugins. This term means that plugins from a video portal are integrated into the controller's website. Each time a page offering one or more video clips is accessed, a direct connection is established between the browser of the data subject and a server of the respective third-party provider. The respective third-party provider stores the data of the data subjects as usage profiles and uses them for the purposes of advertising, market research, and/or the needs-based design of its website. Such evaluation is carried out in particular (even for data subjects who are not logged in) to provide needs-based advertising and to inform other users about the activities of the data subjects on the website of the controller. The data subject has the right to object to the creation of these user profiles, whereby they must contact the respective third-party provider to exercise this right. Further information on the purpose and scope of data collection and its processing by the respective third-party provider can be found in the privacy policy.

13.Video embeds / Own channel. This term means that the controller offers their own channel on the video portal.

14.AI/Artificial intelligence. Artificial intelligence refers to a system's ability to perform tasks that normally require human intelligence. This includes recognizing patterns, making decisions, learning new information, and adapting to new situations. AI uses algorithms and statistical models to analyze information and draw conclusions from it.

15.AI system. This is a software-based system that uses algorithms to perform tasks autonomously or semi-autonomously (e.g., Google Gemini, ChatGPT).

16.AI model. An AI model is a mathematical or algorithmic system that has been trained through machine learning to perform specific tasks. It relies on data sets to recognize patterns, make predictions, support decisions, or perform other automated functions. AI models can take various forms, including neural networks, decision trees, or statistical algorithms, and are typically used to efficiently solve data-based problems.

17.LLM/Large Language Models. Large language models are a specialized form of AI models that are trained to understand and generate natural language text. They are often based on deep neural networks and use huge amounts of text data to develop their language skills. LLMs can perform tasks such as text completion, translation, conversation, or style analysis. Examples include models such as GPT (Generative Pre-trained Transformer) from OpenAI. These models are capable of producing human-sounding text and providing context-aware responses, making them particularly useful in applications such as chatbots, virtual assistants, and content creation tools.