1. Introduction

This website is provided by EY Consulting GmbH (hereinafter also referred to as “etventure”, “we” or “us”). In accordance with Article 13 of the EU General Data Protection Regulation (GDPR), we hereby inform you about the processing of your personal data when you access and use our website.

2. Responsibilities

You will find the name and contact details of the person responsible in our imprint.

3. Processing of personal data

3.1 General overview of processing activities and service providers

On our websites we offer various services, which are listed below:

• E-Mail-Newsletter (6.1)
  Please register with your e-mail address if you would like to be informed about news in our newsletter. You must confirm your subscription to the newsletter (double opt-in).
• Contact forms (6.2)
  Fill in the form in order that we can contact you.
• Applications (6.3)
  You can apply online via our job portal. The data will only be processed for application purposes.
• Commentary function (6.4)
  You can post comments on our blog as a guest or alternatively after logging in with other accounts such as Facebook or Twitter.
• Landing Pages (6.5)
  You can download materials such as studies, trend reports, case studies and templates after entering your personal data on our website. The data will be used in general to offer you our service and to continuously improve it.

In order to offer these online services and to continuously optimize our website, we use the services of other service providers on our website. Data, including personal data, is sent to and used by the following service providers:

Analysis tools, remarketing and targeting

• Google Analytics
• Google Tag Manager
• Google AdWords
• Crazy Egg
• Facebook-Pixel
• WhatConverts
• Disqus
• Twitter
• LinkedIn
• Hubspot

Additional service providers

• YouTube
• GoogleMaps
• Google Fonts
• Vimeo
• Gravatar
• reCAPTCHA

The information obligations pursuant to Art. 13 GDPR are described below or are provided directly for the services mentioned above.

4. Operation of the website

4.1 Type and scope for processing personal data

The following information, which your browser automatically transmits to us, is processed when you visit our website:

• Browsertype / -version
• Operating system
• Name of the previously visited website
• IP address / host name of your computer
• Date and time of the server request

4.2 Purposes and legal basis for processing personal data

Your personal data will be processed by the responsible person for the following purposes in accordance with the following legal bases:

• Enabling the use and operation of the website (legitimate interest: Presentation of the service portfolio of the person responsible and possibility of making contact by customers and interested parties)
• Ensuring the proper operation of the website (fulfilment of legal obligations, i.e. security of processing pursuant to Art. 5 of the DSGVO, e.g. to defend against and clarify cyber attacks)

4.3 Recipients or categories of recipients

Our website is technically operated by Microsoft Corporation (Microsoft Azure, One Microsoft Way, Redmond, WA 98052-6399, USA). The data is stored in European data centres.

Pursuant to Art. 46 paragraph 2 letter c GDPR, an agreement on compliance with the current data protection level in Europe (EU standard contractual clauses) has been concluded with our service provider.

Please refer to the service provider’s privacy policy for further information: https://www.microsoft.com/de-de/trustcenter/CloudServices/Azure/GDPR

Personal data will continue to be disclosed if this is necessary for the prevention of criminal offences and/or we are otherwise legally obliged to do so.

4.4 Duration of data storage

The personal data is automatically deleted 4 weeks after the end of the connection, provided there are no legal retention periods to the contrary.

4.5 Right of cancellation, opposition and rectification

The acquisition of the data for the provision of the website and the storage of the data in logfiles is absolutely necessary for the operation of the website. The user therefore has no possibility of cancellation, opposition or rectification.

5. Use of cookies

5.1 Type and scope for processing personal data

Our website uses cookies to offer you a convenient and feature-rich online service and to verify your authorization to use the service. Cookies are text files that contain information to identify returning visitors solely for the duration of their visit to the website. Cookies are stored on the hard disk of your computer and do not cause any damage.

The website cookies contain personal data. Cookies save you the multiple entry of data, simplify the transmission of specific content and help us to identify particularly popular parts of our website. They enable us to continuously improve the structure and content of our website.

The following cookies are stored on your device:

Types	Name	Function / Purpose	Duration
Google Analytics	_ga&_gid _gat & _dc_gtm_[xxxxx] _gaexp	„_ga“ & „_gid“ Cookies are needed to distinguish between users „_gat“ reducing the requirement rate, „_dc_gtm_[xxxxx]“ if Google Analytics is used via the Google Tag Manager Used to determine the involvement of a user in an experiment and the process of experiments in which a user has been involved	2 years / 1 day 1 minute 90 days
CloudFlare	__cfduid	The cookie is set by the CloudFlare-service to identify trusted web traffic. It does not correspond to any user ID, nor does the cookie store personal data	5 years
Facebook	fr	Trafficking/Retargeting	90 days
Google Advertising (doubleclick.net)	IDE _uetsid	Google DoubleClick cookie is used to make ads more appealing to users and more valuable to publishers and advertisers. Usually to select user-relevant ads, improve the campaign performance or to avoid that a user sees the same ads multiple times n/a	1 year n/a
Hubspot	__hstc hubspotutk __hssc __hssrc __hs_opt_out __hs_do_not_track __hs_testcookie hsPagesViewedThisSession	The main cookie for recording visitors. It contains: the domain, the user token (utk, see below), the first timestamp (of the first visit), the last timestamp (of the last visit), the current timestamp (for this visit) and the number of sessions (increases with each following session) This cookie is used to collect the identity of a user. This cookie is transferred to HubSpot when a form is submitted and used to deduplicate contacts Cookie for recording sessions. This is used to determine whether we need to increase the number of sessions and timestamps in the __hstc cookie. It contains: the domain, the number of page views (viewCount, increases with each page view in a session) and the time stamp at the beginning of the session Each time HubSpot changes the session cookie, this cookie is also set. We simply set it to “1” and use it to determine whether the user has restarted his browser. If this cookie does not exist at the time of our cookie management, we can assume that it is a new session This cookie is used by the Privacy Policy to remind that they will not be asked to accept this cookie again. This cookie is set when you give users the option to disable Cookies This cookie is set when you give users the choice to disable Cookies and they choose to do so. This deactivates tracking and personalization This cookie is used to test whether it supports the activation of cookies This cookie is used to record page views in a session	2 years 10 years 30 minutes unlimited (session) 2 years session session 10 years
Crazy Egg	_ceg.s, _ceg.u, ceir	To track visitors & visitor sessions using heat-, scroll- & clickmaps to analyze user behavior	3 months
Own Cookies	etv_campaign etv_medium etv_sourceetv_Modal_Popupga-disable-UA-[xxxxx]cookieconsent_status	Cookies are used to track campaign sources from the url Cookie shows or removes overlay for the newsletter Cookie shows status if Google Analytics has been deactivated. Cookie asks if all cookies are enabled or disabled (EU cookie policy notification the first time you visit the site)	??? 5 days 81 years 1 year
WhatsConvert	wc_client	Phonenumber Tracking	n/a
Disqus	_jid _utma _utmb _utmc _utmt _utmz disqus_unique	Used to add comments to the website and to remember the user’s Disqus credentials on websites that use this service. Collects data about the number of visits a user makes to the website as well as the data for the first and last visit. Used by Google Analytics. Registers a timestamp with the exact time of access to the website. Used by Google Analytics to calculate the duration of a website visit. Registers a timestamp with the exact time at which the user leaves the website. Used by Google Analytics to calculate the duration of a website visit. Used to decrease the speed of requests to the server. Collects data about where the user came from, which search engine was used, which link was clicked and which search term was used. Used by Google Analytics. Collects statistics about the user’s visits to the website, such as number of visits, average time spent on the website and pages loaded.	session 2 years session session session 6 months 1 year
LinkedIn (ads.linkedin.com)	BizoID BizoData BizoUserMatchHistory BizoNetworkPartnerIndex lang bcookie bscookie lidc _lipt L1c	LinkedIn advertisement analyses LinkedIn advertisement analyses LinkedIn advertisement analyses LinkedIn advertisement analyses language Browser-ID-Cookie Secure-Browser-ID-Cookie Used for routing n/a Browser-ID-Cookie	6 months 6 months 6 months 6 months n/a 1 year 1 year 1 day 29 days session
Twitter	n/a	n/a	n/a

If you wish to make changes to the cookie settings or object to their use, you can do so here.

5.2 Purposes and legal basis for processing personal data

The legal basis for the processing of personal data using technically necessary cookies is Art. 6 paragraph 1 letter f GDPR (Justified Interest: Analysis of your browsing behaviour to optimize our website).

The legal basis for the processing of personal data using cookies for analytical purposes is Art. 6 paragraph 1 letter a GDPR. In this case, we ask for your permission before setting the cookie on the website.

5.3 Duration of data storage, possibility of opposition and removal

Cookies are stored on your computer and transmitted to our website. Therefore, you as a user also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website entirely.

6. General services

6.1 E-Mail-Newsletter

6.1.1 Type and scope for processing personal data

Our website enables you to receive free e-mail newsletters on a regular basis. The following data will be sent to us when you register for the e-mail newsletter:

• E-mail-address (mandatory)
• Personal data such as name, title, e-mail format (optional)
• Topic of the e-mail newsletter
• IP address of the requesting computer
• Date and time of registration

In the course of the registration process, your permission is obtained for the processing of the data and reference is made to this data protection declaration.

We use the double opt-in procedure for registration. This means that we will not send you an e-mail newsletter until you confirm your registration via a link contained in an e-mail sent by us after you have provided your e-mail address.

The registration and confirmation are logged. This is to ensure that only you can register for the newsletter service as a user of the specified e-mail address. Your confirmation must be received as soon as we send the e-mail, otherwise your registration and e-mail address will be deleted from the service provider’s database. Until you confirm your registration, our newsletter service will not accept any further registrations under this e-mail address.

6.1.2 Purposes and legal basis of the processing

The purpose of collecting your e-mail address is to deliver the e-mail newsletter to the appropriate target group. The e-mail address will only be used for sending the newsletter. The legal basis for the processing of the data after registration for the newsletter by the user is Art. 6 paragraph 1 letter a GDPR (consent). The processing of the IP address and the time of registration is conducted on the basis of Art. 5 paragraph 2 GDPR (accountability / proof of consent).

6.1.3 Transmission of your data to a third country or international organisation

To send the e-mail newsletter, your personal data (e-mail address, surname, first name) will be sent to our service provider HubSpot Inc. (HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA). HubSpot is certified under the US-EU data protection agreement „Privacy Shield“ and is therefore committed to comply with EU General Data Protection Regulations (GDPR). Furthermore, we have concluded a „Data-Processing-Agreement“ with HubSpot. This is a contract in which HubSpot is obligated to protect the data of our users, to process them on our behalf in accordance with the data protection regulations and in particular not to pass them on to third parties.

6.1.4 Recipients or categories of recipients

For sending and collecting user data for our e-mail newsletter we use the service HubSpot Inc. (25 First Street, 2nd Floor, Cambridge, MA 02141, USA). If you register for our newsletter, the data provided during registration will be transmitted to HubSpot and processed there. You will then receive an e-mail to confirm your registration. HubSpot offers extensive analysis options for using the newsletter. These analyses are group-related and are not used by us for individual evaluation.

6.1.5 Duration of data storage

Your personal data will be deleted at your request or when the service is discontinued. We store your login data without double opt-in for 90 days.

6.1.6 Right of cancellation, opposition and rectification

You can cancel the service at any time by clicking on “Unsubscribe” in the e-mail newsletter. You will not receive any e-mail newsletters after you unsubscribe. If we have to process your e-mail address for other reasons, your e-mail address will be blocked from being mailed.

6.1.7 Consequences of nonprovision

Our e-mail newsletter is a voluntary service. An e-mail address is required for the transmission of our e-mail newsletter.

6.1.8 Existence of automated decision making including profiling

Automated decision making or profiling does not take place.

6.2 Contact forms

6.2.1 Type and scope of processing of personal data

In the contact forms on our website the following personal data are requested, whereby the fields marked with * are mandatory:

• Name and surname
• Company
• Email
• Telephone number
• Content of your message

6.2.2 Purposes and legal basis of the processing of personal data

Entering your data in the contact forms on our website gives us the opportunity to contact you personally and to offer you our services. The legal basis for the processing of the data after entering them into the contact form by the user is Art. 6 para. 1 lit. a GDPR (consent). The processing of the IP address and the time of registration is based on Art. 5 paragraph 2 GDPR (accountability / proof of consent).

6.2.3 Transfer of your data to a third country or international organization

Contact information is sent to Salesforce Inc. (Europe) on the basis of Article 46 paragraph 2 letter c GDPR (EU standard contractual clauses). Salesforce Inc. is also certified under the Privacy Shield Agreement, providing a guarantee to comply with European data protection law (Link).

6.2.4 Recipients or categories of recipients

The data entered via the contact forms are stored at our service provider Salesforce Inc. (The Landmark @ One Market, Suite 300, San Francisco, CA 94105) in European data centers. Please refer to the Salesforce Inc. privacy policy for more information.

6.2.5 Duration of data storage

The data will be stored for as long as necessary for the provision of the services requested by the user or for the purposes specified in this document.

6.2.6 Right of cancellation, opposition and correction

Upon written request, you have the right to receive information free of charge about the personal data that has been stored about you. In addition, you have the right to correct incorrect data as well as to block or delete your personal data, insofar as there is no legal obligation to store such data.

6.2.7 Consequences of nonprovision

Our contact form is a voluntary service. To use the contact form, the data listed in 6.2.1 is required.

6.2.8 Existence of automated decision making including profiling

Automated decision making or profiling does not take place.

6.3 Applications

6.3.1 Type and scope of processing of personal data

For the application via our job portal, a form is provided in which application-relevant data must be entered. In addition, attachments can be uploaded.

If desired, a connection with LinkedIn can be established. Your master data will then be included in our application form.

Alternatively, you have the option of automatically loading the data from your LinkedIn profile into our systems. To do this, you will be redirected to LinkedIn’s website, where you will have to authorize the transmission by entering your LinkedIn access data. After authorizing access to your profile information, the following information is automatically transferred from your LinkedIn user account to your application:

• Profile overview: name, photo, profile slogan, current positions
• Complete Profile: In addition to the overview, work experience, education, knowledge and skills and recommendations
• Email address: The primary email address you use for your account
• Contact information: Address, telephone number and linked accounts

6.3.2 Purposes and legal basis of the processing of personal data

Entering your own personal data enables you to submit your application data and documents to us online. The data will only be processed for application purposes. The legal basis for the processing of the data is in accordance with Art. 88 GDPR in connection with §26 Federal Data Protection Act (initiation of an employment relationship). In accordance with Art. 6 Para. 1 lit. a GDPR (consent), we also offer you the possibility:

• to be added to our talent pool,
• to increase your application chances by passing them on to our subsidiaries or
• to take over your application documents via LinkedIn Inc.

The processing of the IP address and the time of registration is based on Art. 5 paragraph 2 GDPR (accountability / proof of consent).

6.3.3 Recipients or categories of recipients

For the operation of the online job portal we rely on the service provider Comeet Inc. (550 p. California Ave Suite 1, Palo Alto, CA 94306, USA), to which the application-relevant data is transmitted.

LinkedIn is an offer of LinkedIn Corporation, Mountain View, California, USA. We do not collect personal data regarding your use of the LinkedIn service and have no influence on which data is collected and used by the provider.

LinkedIn is the only responsible for the use of your data by LinkedIn. Currently it must be assumed that at least the IP address and device-related information is recorded and used and, in particular, that the visit to our website is assigned to your account at LinkedIn. It is also possible that LinkedIn tries to save cookies on the computer used.

Please refer to LinkedIn’s privacy policy for the scope and purpose of data collection by LinkedIn and the further processing and use of your data there:
https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv. There you will also receive further information about your corresponding data protection rights and setting options for the protection of your privacy. As a member of LinkedIn, you may have separately agreed to LinkedIn’s privacy policy in your registration for this service.

6.3.4 Transfer of your data to a third country or international organization including processing guarantees

Your application data will be transmitted to Comeet Inc. in the USA on the basis of Art. 46 paragraph 2 letter c GDPR (EU standard contract clauses).
If you have not used a LinkedIn profile to fill out the application form, you have consented to the transfer of your data to LinkedIn in accordance with Art. 49 paragraph 1 letter a GDPR.

6.3.5 Duration of data storage

The data will be stored until the application process is completed. If we should decide on another candidate, your data will be deleted after 6 months. If you have agreed to be included in the talent pool, your application data will be deleted after a further 6 months, unless an extension is requested.

When an employment relationship begins, the data is transferred to the employee database until it ends.

6.3.6 Right of cancellation, opposition and correction

You have the right to request information from us at any time about the data stored about you and about the origin, recipients or categories of recipients to whom this data is passed on; as well as for the purpose of storage. You can object to the processing of your application for the above-mentioned purposes at any time with effect for the future. Please send all information requests, requests for information or objections to data processing to us by email.

6.3.7 Consequences of nonprovision

Unfortunately, we cannot consider your application without your application documents.

6.3.8 Existence of automated decision making including profiling

Automated decision making or profiling does not take place.

6.3.9 Other information

All data is transferred to our servers via an encrypted LinkedIn interface. Using the LinkedIn API interface is a LinkedIn service. For more information on using the LinkedIn API interface, see https://hilfe.linkedin.com/app/answers/detail/a_id/4182/ft/eng

6.4 Commenting function

6.4.1 Type and scope of processing of personal data

The comment function allows you to post comments on our blog. You can do this either as a guest or log in with your social media account such as Facebook or Twitter. The following data is processed:

• Comment
• Date/Time
• IP address
• Browser type
• When logging in with an account: account name, profile picture

6.4.2 Purposes and legal basis of the processing of personal data

The submission of personal data when posting in our blog is voluntary. It enables the company to respond more specifically to the suggestions and wishes of the commentator and to understand his or her motives more precisely. The legal basis for the processing of the data after entering them into the contact form by the user is Art. 6 para. 1 lit. a GDPR (consent). The processing of the IP address and the time of registration is based on Art. 5 paragraph 2 GDPR (accountability / proof of consent).

6.4.3 Transfer of your data to a third country or international organization

Your comments will be sent to the service provider Disqus Inc. (301 Howard St #300, San Francisco, CA 94105, USA). DISQUS is certified under the Privacy Shield Agreement and thus offers a guarantee to comply with European data protection law.

6.4.4 Recipients or categories of recipients

For the operation of our blog and the use of the comment function we use the service provider Disqus Inc. all comments are processed on the servers of the service provider. All comments incl. date and, if you are logged in with an account, also the account name and if applicable your profile picture as well as technical data such as IP address, browser type and date/time are transmitted. The service provider uses cookies for this.

6.4.5 Duration of data storage

The data is stored as long as the blog article and comment exists or is removed by our employees, if these do not correspond to our netiquette.

6.4.6 Right of cancellation, opposition and correction

Upon written request, you have the right to receive information free of charge about the personal data that has been stored about you. In addition, you have the right to correct incorrect data as well as to block or delete your personal data, insofar as there is no legal obligation to store such data. Please note the data protection declaration and the corresponding opt-out options.

6.4.7 Consequences of nonprovision

Our contact form is a voluntary service. To use the comment function, the data listed in 6.4.1 is required.

6.4.8 Existence of automated decision making including profiling

Automated decision making or profiling does not take place.

6.5 Landing Pages

6.5.1 Type and scope of processing of personal data

When requesting further information material such as studies, trend reports, case studies or templates on our landing pages, you must enter the following personal data in an online form, whereby only the mandatory fields marked with a * sign must be filled in:

• Name and surname
• Company/Position
• Email
• Telephone number

6.5.2 Purposes and legal basis for processing personal data

The data will be used in general to offer you our services and to continuously improve them. No clear names are required for requesting information material; the entry of anonymous designations is permitted. The legal basis for the processing of the data after entering them in the online form by the user is Art. 6 para. 1 lit. a GDPR (consent). The processing of the IP address and the time of registration is based on Art. 5 paragraph 2 GDPR (accountability / proof of consent).

6.5.3 Transfer of your data to a third country or international organization including processing guarantees

Contact information is sent to Salesforce Inc. (Europe) on the basis of Article 46 paragraph 2 letter c GDPR (EU standard contractual clauses). In addition, Salesforce Inc. is certified under the Privacy Shield Agreement, providing a guarantee to comply with European data protection law in accordance with Art. 45 GDPR (Link).

6.5.4 Recipients or categories of recipients

The contact details are stored at our service provider Salesforce Inc. (The Landmark @ One Market, Suite 300, San Francisco, CA 94105) in European data centers. Please refer to Salesforce’s privacy policy for more information.

6.5.5 Duration of data storage

The data will be stored for as long as necessary to provide the services requested by the user or for the purposes specified in this document. You can ask us to block or remove the data.

6.5.6 Right of cancellation, opposition and correction

Upon written request, you have the right to receive information free of charge about the personal data that has been stored about you. In addition, you have the right to correct incorrect data as well as to block or delete your personal data, insofar as there is no legal obligation to store such data.

6.5.7 Consequences of nonprovision

Our landing pages and the information provided there for downloading are a voluntary service. In order to use this information, the data listed in 6.5.1 must be provided.

6.5.8 Existence of automated decision making including profiling

Automated decision making or profiling does not take place.

7. Analytical tools, remarketing and targeting

7.1 Google Analytics

7.1.1 Type and scope of processing of personal data

We use the component Google Analytics (with anonymisation function) on this website. Google Analytics is a web analytics service. Web analysis is the gathering, collection and evaluation of data on the behaviour of visitors to Internet sites. A web analysis service collects, among other things, data on the website from which a person concerned has accessed a website (so-called referrer), which subpages of the website have been accessed or how often and for how long a subpage has been viewed.

We use the addition “_gat._anonymizeIp” for web analysis via Google Analytics. By using this addition, Google shortens and anonymizes the IP address of your Internet connection when you access our Internet pages from a member state of the European Union or from another state party to the Agreement on the European Economic Area.

7.1.2 Purposes and legal basis for processing personal data

The processing of your personal data enables us to analyse your surfing behaviour. We are able to compile information about the use of the individual components of our website by evaluating the data obtained. This helps us to continuously improve our website and its usability. For these purposes, it is also in our legitimate interest to process the data in accordance with Art. 6 para. 1 lit. f GDPR. By anonymizing the IP address, your interest in protecting your personal data is sufficiently taken into account.

7.1.3 Recipients or categories of recipients

The operating company of the Google Analytics component is Google LLC, 1600 AmphitheatreParkway Mountain View, CA 94043, USA.

7.1.4 Duration of data storage and criteria for determining the storage period, if applicable

The data will be deleted as soon as they are no longer needed for our recording purposes. Due to long sales processes and a customer journey lasting up to 2 years, we store our data for 26 months.

7.1.5 Transmissions to a third country and existence of the adequacy decision

The personal data will be transferred to a third country. Google LLC is certified according to the Privacy Shield Agreement and thus offers a guarantee to comply with European data protection law according to Art. 45 GDPR (Link).

7.1.6 Right of cancellation, opposition and correction

You can prevent the setting of cookies by our website at any time by means of an appropriate setting of the Internet browser used and thus permanently object to the setting of cookies. Such a setting of the Internet browser used would also prevent Google from placing a cookie on your information technology system. In addition, a cookie already set by Google Analytics can be deleted at any time via the Internet browser or other software programs.

Furthermore, you have the opportunity to object to and prevent the collection of data generated by Google Analytics relating to the use of this website and the processing of this data by Google.

To do this, you must download and install a browser add-on from the link https://tools.google.com/dlpage/gaoptout. This browser add-on informs Google Analytics via JavaScript that no data and information on visits to websites may be transmitted to Google Analytics. The installation of the browser add-on is considered a contradiction by Google. If your information technology system is deleted, formatted or reinstalled at a later time, the browser add-on must be reinstalled to disable Google Analytics. If the browser add-on is uninstalled or deactivated by the person concerned or another person within their control, it is possible to reinstall or reactivate the browser add-on.

Further information and Google’s current privacy policy can be found at https://www.google.de/intl/de/policies/privacy/ and http://www.google.com/analytics/terms/de.html. Google Analytics will be explained in more detail under this link https://www.google.com/intl/de_en/analytics/.

7.2 Google Tag Manager

This website uses the Google Tag Manager. This service allows web page tags to be managed through an interface. The Google Tag Manager only implements tags. This means that no cookies are used and no personal data is collected. The Google Tag Manager triggers the services described in Section 7. et seq. and Section 8. et seq. which in turn collect data if necessary. However, the Google Tag Manager does not access this data. If a deactivation has been made at domain or cookie level, it remains valid for all tracking tags, provided that they are implemented with the Google Tag Manager.

7.3 Google AdWords

7.3.1 Type and scope for processing personal data

We also use the Google advertising tool “Google-Adwords” to promote our website.

7.3.2 Purposes and legal basis for processing personal data

The information collected with the help of the “conversion cookies” is used by Google to generate visit statistics for our website. These statistics show us the total number of users who clicked on our ad and also which pages of our website were subsequently accessed by the respective user. However, we or others who advertise via “Google-Adwords” do not receive any information with which users can be personally identified.

7.3.3 Transfer of your data to a third country or international organization

The operating company of the Google Adwords component is Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA.

7.3.4 Recipients or categories of recipients

For this purpose we use the analysis service “Conversion-Tracking” of Google LLC, 1600 AmphitheatreParkway, Mountain View, CA 94043 USA.

7.3.5 Transmissions to a third country and existence of the adequacy decision

The personal data will be transferred to a third country. Google LLC is certified according to the Privacy Shield Agreement and thus offers a guarantee to comply with European data protection law according to Art. 45 GDPR (Link).

7.3.6 Duration of data storage

If you accessed our website via a Google ad, a cookie is stored on your computer. Cookies are small text files that your Internet browser stores on your computer. These so-called “conversion cookies” lose their validity after 30 days and do not serve your personal identification. If you visit certain pages of our website and the cookie has not yet expired, we and Google may recognize that you as a user have clicked on one of our ads placed on Google and have been redirected to our page.

7.3.7 Right of cancellation, opposition and correction

You can prevent the installation of “conversion cookies” by making the appropriate settings in your browser, such as browser settings that generally deactivate the automatic setting of cookies or specifically only block cookies from the “googleadservices.com” domain.

7.4 Crazy Egg

7.4.1 Type and scope for processing personal data

Crazy Egg generates information about how you interact with our website. The interactions that are recorded or analyzed may include a website visitor’s mouse movements and clicks, keystrokes entered and/or pages viewed or visited, including the duration of such visits.

Crazy Egg uses cookies on our website for the following purposes:

• to determine whether you are visiting our website for the first time
• to evaluate usage patterns and perform traffic analyses; to identify preferences
• to diagnose problems with our servers
• to analyze trends and to manage Crazy Egg products and services.

The following data is collected:

• Browser information
• Operating System Information
• Mobile Device Information (e.g. device ID, mobile operating system, etc.)
• IP address
• Page accessed
• Geographical location
• Time of the visit
• Referring page, application or service

Cookies placed by Crazy Egg on your computer do not include any personal data such as name, telephone number, email address or postal address. Crazy Egg also does not link cookies to personal data in its servers or databases.

7.4.2 Purposes and legal basis for processing personal data

We use the software and services of Crazy Egg Inc, Crazy Egg, Inc.
16220 E. Ridgeview Lane, La Mirada, CA 90638, USA, to analyze and obtain information about how you behave on our website. The aim is to further develop and modify our website on the basis of these findings. The legal basis for the processing of the data is Art. 6 para. 1 lit. a GDPR (consent). The processing of the IP address and the time of registration is based on Art. 5 paragraph 2 GDPR (accountability / proof of consent).

7.4.3 Transfer of your data to a third country or international organization and appropriate or adequate guarantees

The legal basis for the processing of personal data by the third party provider is Art. 6 para. 1 lit. a GDPR. In accordance with Art. 46 paragraph 2 letter c GDPR, an additional agreement has been concluded with our service provider to comply with the current data protection level in Europe (EU standard contract clauses).

7.4.4 Recipients or categories of recipients

The generated data is stored on the web servers and in Crazy Egg’s databases to perform analyses and generate reports.

Visitor information (including personally identifiable information) may be shared with certain third parties and individuals who help to facilitate technical aspects of the Crazy Egg service or perform functions related to the management of Crazy Egg, such as third parties who provide storage facilities for certain visitor information collected and analyzed by Crazy Egg. These third parties perform tasks on behalf of Crazy Egg and are contractually obliged not to pass on or use visitor information for other purposes. However, Crazy Egg is not responsible in the event that personal data is disclosed to such a third party as a result of a breach or loss of security or for non-compliance by such third party with the aforementioned requirements.

Crazy Egg also reserves the right to share visitor information (including personally identifiable information):

• (i) to comply with laws, regulations or legal requirements;
• (ii) enforce, apply or investigate violations of the Terms of Use or other agreements;
• (iii) to respond to public requests;
• or (iv) protect the rights, property, user experience or safety of Crazy Egg.

Crazy Egg may also share customer information with our affiliates provided that they comply with this Privacy Policy and the Terms of Use.

7.4.5 Duration of data storage

Information on how long Crazy Egg stores personal data is currently still requested. These will be supplemented by us in the near future.

7.4.6 Right of cancellation, opposition and correction

If you do not want us to use Crazy Egg to place cookies on your computer, you should set your browser to reject all cookies, including first-party cookies. Please note that if you set your browser to refuse cookies, some features of our website may not be available. Please also note that – even if you set your browser to refuse all cookies – your activities on our website will continue to be recorded by the analysis service.

For more information about rejecting cookies, see your browser’s instructions for changing your cookie settings. If you do not set your browser to refuse cookies, you agree that cookies, including the initial provider cookies used by Crazy Egg, will be stored on your computer when you visit websites. For more information about the use of cookies, see Crazy Egg’s cookie policy.

If you wish to opt-out of Crazy Egg’s collection of visitor information, please read Crazy Egg’s opt-out instructions. Please note that if you use a computer or Internet browser other than the one at the time you unsubscribe from the Analytics Service, Crazy Egg will not be able to display the opt-out and collect visitor information. Under these circumstances, you must call up the above link again for your opt-out decision to take effect again.
Please also note the corresponding data protection declaration and the corresponding opt-out options.

7.5 Facebook-Pixel

7.5.1 Type and scope for processing personal data

Due to our legitimate interests in analysis, optimization and economic use of our online offer we use the so-called “Facebook pixel” within our online offer.

7.5.2 Purposes and legal basis of the processing

With the help of the Facebook Pixel, Facebook is able to determine the visitors of our online offer as a target group for the presentation of ads (so-called “Facebook Ads”). Accordingly, we use the Facebook pixel to display the Facebook ads we post only to Facebook users who have also shown an interest in our online offering or who have certain features (e.g. interests in certain topics or products that are determined by the websites visited) that we transmit to Facebook (so called “custom audiences”). We also want to use the Facebook Pixel to ensure that our Facebook ads meet the potential interests of users and are not a nuisance. The Facebook Pixel also helps us track the effectiveness of Facebook ads for statistical and market research purposes by showing whether users have been redirected to our website after clicking on a Facebook ad (so-called “conversion”).

7.5.3 Transmission of your data to a third country or international organisation

Facebook processes the data in accordance with Facebook’s Data Usage Policy. Please read the notes on the presentation of Facebook ads in the Facebook Data Usage Policy: https://www.facebook.com/policy.php. For specific information and details about the Facebook Pixel and how it works, visit the Facebook Help section: https://www.facebook.com/business/help/651294705016616.

7.5.4 Recipients or categories of recipients

The service is provided by Facebook Inc. (1 Hacker Way, Menlo Park, CA 94025, USA). If you are an EU resident, the service is provided by Facebook Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).

Facebook is certified under the Privacy-Shield-Agreement and therefore offers a guarantee to comply with European data protection law.

7.5.5 Duration of data storage

We do not know how long Facebook processes the above data and for what additional purposes.

7.5.6 Right of cancellation, opposition and rectification

You can opt-out of the use of the Facebook pixel and the use of your data to display Facebook ads. To set what types of ads you see within Facebook, you can visit the page set up by Facebook and follow the instructions on usage-based advertising settings: https://www.facebook.com/settings?tab=ads. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.

7.5.7 Further information

You may also opt out of the use of cookies to measure reach and for advertising purposes via the deactivation page of the network advertising initiative (http://optout.networkadvertising.org/) and additionally the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).

7.6 Twitter Ads Conversion Tracking

On our website we use the analysis and conversion tracking technology of Twitter, Inc. (1355 Market Street, Suite 900, San Francisco, CA 94103 U.S.A.).

Twitter’s abovementioned technology allows you to see more relevant ads based on your interests or to analyse the user behaviour of our ads. Twitter also provides us with aggregated and anonymous reports of ad activity and information about how you interact with our site.

Twitter is certified under the Privacy-Shield-Agreement and therefore offers a guarantee to comply with European data protection law. For more information on how Twitter processes and uses data, please read Twitter’s privacy policy: https://twitter.com/de/privacy#update.

If you do not want Twitter to process and use your data, you can make use of the opt-out function at any time: https://twitter.com/personalization

7.7 LinkedInConversion Tracking

On our website we use the analysis and conversion tracking technology of the LinkedIn platform (LinkedInIrelandUnlimited Company, Wilton Place, Dublin 2, Ireland).

With the aforementioned LinkedIn technology you can see more relevant ads based on your interests or analyse the user behaviour of our ads. LinkedIn also provides us with aggregated and anonymous reports of ad activity and information about how you interact with our website.

Information on data protection at LinkedIn can be found here:https://www.linkedin.com/legal/privacy-policy#choices-oblig.

You can opt-out of the analysis of your usage behavior by LinkedIn and the display of interest-based recommendations. Click on the field “Reject on LinkedIn” (for LinkedIn members) or “Reject” (for other users) under the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

7.8 Hubspot

7.8.1 Type and scope for processing personal data

We use the software solution of the provider HubSpot to carry out marketing campaigns and to address customers and potential customers in specific target groups.

HubSpot is used in the following areas:

• E-mail marketing (newsletters and automated mailings, e.g. for the provision of downloads)
• Blog
• Reporting (e.g. traffic sources, accesses, etc. …)
• Contact management (e.g. user segmentation & CRM)
• Landing Pages and contact forms
• Social media planning and monitoring

7.8.2 Purposes and legal basis of the processing

HubSpot allows you to learn more about our company, download content and provide your contact information and other demographic information.

This information and various contents of our website are stored on servers of our software partner HubSpot. They can be used by us to get in touch with you and to determine which services of our company are of interest to you. All information we collect is subject to this privacy policy. We use all collected information exclusively for the provision of individualized content, for direct addressing and for the analysis of user behaviour.

7.8.3 Transmission of your data to a third country or international organisation

HubSpot is certified under the US-EU data protection agreement „Privacy Shield“ and therefore commits itself to comply with EU data protection regulations. Furthermore, we have concluded a „Data-Processing-Agreement“. with HubSpot. This is a contract in which HubSpot agrees to protect our users’ data, to process it on our behalf in accordance with data protection regulations and in particular not to pass it on to third parties.

7.8.4 Recipients or categories of recipients

This information and various contents of our website are stored on servers of our software partner HubSpot (2nd Floor 30 North Wall Quay, Dublin 1, Ireland).

Furthermore, the data is compared with Salesforce Inc. (The Landmark @ One Market, Suite 300, San Francisco, CA 94105). The data is processed in European data centres. Please refer to the Salesforce Inc. Privacy Policy for more information.

7.8.5 Duration of data storage

The data will be stored for as long as necessary to provide the services requested by the user or for the purposes specified in this document.

7.8.6 Right of cancellation, opposition and rectification

Upon written request, you have the right to receive information free of charge about the personal data that has been stored about you. In addition, you have the right to correct incorrect data as well as to block or delete your personal data, insofar as there is no legal obligation to store such data. This service must be provided within 30 days.

7.8.7 Further information

HubSpot is certified under the terms of the “EU – U.S. Privacy Shield Framework” and is subject to the TRUSTe’s Privacy Seal and the “U.S. – Swiss Safe Harbor” Framework.

Information on HubSpot’s data protection regulations can be found here: https://legal.hubspot.com/privacy-policy
Further information from HubSpot regarding the EU Regular Data Protection Regulations can be found here: https://legal.hubspot.com/data-privacy

8. Other service providers

8.1 YouTube

On our website we use components (videos) from YouTube, LLC 901 Cherry Ave, 94066 San Bruno, CA, USA, a company of Google LLC, AmphitheatreParkway, Mountain View, CA 94043, USA.

We use the option” – extended data protection mode -” provided by YouTube.

When you access a page that has an embedded video, it connects to the YouTube servers and displays the content on the website by notifying your browser.

According to YouTube, in ” – extended privacy mode -” only data is transmitted to the YouTube server, especially about which of our websites you visited when you watch the video. If you are logged in to YouTube at the same time, this information will be associated with your YouTube account. You can prevent this by logging out of your member account before visiting our website. Google also provides you with an opt-out function: https://adssettings.google.com/authenticated

For more information about YouTube’s privacy practices, visit the following link: https://www.google.de/intl/de/policies/privacy/

8.2 GoogleMaps

We use the component “Google Maps” of the company Google LLC, 1600 AmphitheatreParkway, Mountain View, CA 94043 USA, hereinafter “Google”.

Each time you access the Google Maps component, Google sets a cookie to process user settings and data when you view the page that includes the Google Maps component. As a rule, this cookie is not deleted when you close your browser but expires after a certain time, unless you delete it manually beforehand. This information may include, but is not collected without your consent (usually as part of your mobile device settings) and is usually transmitted to and stored by Google on servers in the United States. The provider of this site has no influence on this data transmission.

If you do not agree to this processing of your data, it is possible to deactivate the “Google Maps” service and thus prevent the transfer of data to Google. To do this, you must deactivate the JavaScript function in your browser. Google provides you with the following opt-out function: https://adssettings.google.com/authenticated.

However, we would like to point out that in this case you cannot use “Google Maps” or only to a limited extent.

The use of “Google Maps” and the information obtained via “Google Maps” is subject to the Google Terms of Use http://www.google.de/intl/de/policies/terms/regional.html

and the additional terms and conditions for “Google Maps “https://www.google.com/intl/de_en/help/terms_maps.html.

8.3 Vimeo

On our site we use components of the provider Vimeo. Vimeo is a service of Vimeo LCC, 555 West 18th Street, New York, New York 10011, USA.

Each time you visit our website equipped with such a component, this component causes the browser you are using to download a corresponding representation of the Vimeo component. If you access our site while logged in to Vimeo, Vimeo uses the information collected by the component to identify which specific page you are visiting and to associate this information with your personal account at Vimeo. For example, if you click the “Play” button or make comments, this information will be transferred to your personal user account at Vimeo and stored there. In addition, the information that you have visited our site will be passed on to Vimeo. This is independent of whether you click on the component or not.

If you wish to prevent Vimeo from transmitting and storing information about you and your conduct on our website, you must log out of Vimeo before visiting our site. Vimeo’s privacy policy provides more detailed information, in particular regarding the collection and use of data by Vimeo: https://vimeo.com/privacy

8.4 reCAPTCHA

To protect input forms on our site, we use the service “reCAPTCHA” of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter “Google”. By using this service it can be distinguished whether the corresponding input is of human origin or is abusive through automated machine processing.

To our knowledge, the referrer URL, the IP address, the behaviour of website visitors, information about operating system, browser and dwell time, cookies, display instructions and scripts, the user’s input behaviour and mouse movements in the “reCAPTCHA” checkbox area are transmitted to “Google”.

Google uses the information obtained in this way, among other things, to digitize books and other printed matter and to optimize services such as Google Street View and Google Maps (e.g. house number and street name recognition).

The IP address transmitted within the scope of “reCAPTCHA” will not be merged with other Google data unless you are logged in to your Google account at the time you use the “reCAPTCHA” plug-in. If you want to prevent this transmission and storage of data about you and your behaviour on our website by “Google”, you must log out of “Google” before you visit our site or use the reCAPTCHA Plug-in. Google also provides you with an opt-out function: https://adssettings.google.com/authenticated.

The use of the information obtained through the “reCAPTCHA” service is in accordance with the Google data protection declaration: https://www.google.com/intl/de/policies/privacy/.

9. Rights of persons concerned

You have various rights in handling your personal data, such as the right to information about the data stored by us concerning your person or the right to correction, restriction of processing, right to data transferability, right of objection or deletion of your data. If you have any questions regarding the assertion of your rights, please contact our data protection officer in writing. To do so, please use the postal address in the imprint (keyword “Data Protection Officer”) or by e-mail at datenschutz@de.ey.com.

10. Right of appeal to the supervisory authority

You have the right to file a complaint with the following supervisory authority if you believe that our processing of your personal data violates the applicable data protection laws:

Berlin Commissioner for Data Protection and Freedom of Information, An der Urania 4-10, 10787 Berlin.

11. Links to other websites

Our website contains links to other websites. We have no influence on whether their operators comply with the data protection regulations. Despite prior careful control of content, we cannot assume any liability for external links to external content.

12. Validity and updating of the data protection declaratio

Due to the further development of our website or the implementation of new technologies, it may become necessary to change this data protection declaration with effect for the future. We recommend that you take a look at the current data protection declaration.

Berlin, 25.05.2018