Privacy policy

Preamble

With the following privacy policy, we would like to inform you about which types of your personal data (hereinafter also referred to as "data") we process, for which purposes, and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offering").

The terms used are not gender-specific.

This privacy policy describes the processing operations that actually take place at our company. Chapters on procedures that we do not currently carry out (e.g., newsletters or job application procedures) are marked with a corresponding note.

Other online presences

This privacy policy also applies to the following online presences:

When you open the appointment booking page, you are redirected to Microsoft services (Microsoft Bookings). For details, see Appointment booking with Microsoft Bookings.

Preamble
Controller
Overview of processing operations
Relevant legal bases
Security measures
Transfer of personal data
International data transfers
General information on data storage and deletion
Rights of data subjects
Business services
Business processes and procedures
Use of online platforms for offering and sales purposes
Providers and services used in the course of business
Provision of the online offering and web hosting
Blogs and publication media
Contact and inquiry management
Communication via messaging services
Artificial intelligence (AI)
Video conferences, online meetings, webinars, and screen sharing
Cloud services
Newsletters and electronic notifications
Promotional communication via email, mail, fax, or phone
Surveys and polls
Customer reviews and rating procedures
Digital badges
Presences on social networks (social media)
Plug-ins, embedded features, and embedded content
Management, organization, and supporting tools
Processing of data in the context of employment relationships
Job application procedures
Changes and updates

Controller

powerbunch GmbH
Kommerner Str. 138
53879 Euskirchen, Germany

Authorized representatives: Reiner Keller (Managing Director)

Email address: mail@powerbunch.de
Phone: +49 160 125 01 75
Legal notice: https://www.powerbunch.de/impressum/

No data protection officer has been appointed, as there is no legal obligation to do so.

Overview of processing operations

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects concerned.

Types of data processed

Master data.
Employee data.
Payment data.
Contact data.
Content data.
Contract data.
Usage data.
Metadata, communications data, and procedural data.
Social data.
Image and/or video recordings.
Audio recordings.
Log data.
Performance and behavioral data.
Working time data.
Salary data.

Special categories of data

Health data.
Religious or philosophical beliefs.

Purposes of processing

Provision of contractual services and fulfillment of contractual obligations.
Communication.
Security measures.
Office and organizational procedures.
Organizational and administrative procedures.
Feedback.
Marketing.
Provision of our online offering and user-friendliness.
Establishment and implementation of employment relationships.
Information technology infrastructure.
Public relations and information purposes.
Financial and payment management.
Public relations.
Sales promotion.
Business processes and business management procedures.
Artificial intelligence (AI).

Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or registered office. If more specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.

Consent (Art. 6 (1) sentence 1 (a) GDPR) - The data subject has given consent to the processing of his or her personal data for one or more specific purposes.

Performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Legal obligation (Art. 6 (1) sentence 1 (c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.

Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Processing of special categories of personal data in the employment relationship (Art. 9 (2) (b) GDPR in conjunction with Section 26 (3) BDSG) - Processing is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller in the field of employment and social security and social protection law.

National data protection regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). The BDSG contains, in particular, special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and transfer, as well as automated individual decision-making, including profiling. In addition, the data protection laws of the individual German federal states may apply.

Relevant legal bases under the Swiss Data Protection Act: If you are located in Switzerland, we process your data on the basis of the Federal Act on Data Protection (Swiss FADP). Unlike the GDPR, for example, the Swiss FADP does not generally require that a legal basis for the processing of personal data be stated. However, it requires that the processing of personal data be carried out in good faith and be lawful and proportionate (Art. 6 (1) and (2) of the Swiss FADP). In addition, we collect personal data only for a specific purpose that is recognizable to the data subject and process it only in a manner compatible with this purpose (Art. 6 (3) of the Swiss FADP).

Note on the applicability of the GDPR and the Swiss FADP: This privacy notice provides information under both the Swiss FADP and the General Data Protection Regulation (GDPR). The GDPR terminology is used because of its broader territorial application and to aid understanding. In particular, rather than the Swiss FADP terms "Bearbeitung" of "Personendaten" (processing of personal data), "überwiegendes Interesse" (overriding interest), and "besonders schützenswerte Personendaten" (sensitive personal data), this notice uses the GDPR terms "Verarbeitung" of "personenbezogenen Daten" (processing of personal data), "berechtigtes Interesse" (legitimate interest), and "besondere Kategorien von Daten" (special categories of data). However, where the Swiss FADP applies, the legal meaning of these terms continues to be determined by the Swiss FADP.

Security measures

In accordance with the legal requirements and taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of the threat to the rights and freedoms of natural persons, we take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.

The measures include, in particular, ensuring the confidentiality, integrity, and availability of data through controls over physical and electronic access to data, access permissions, data input, disclosure, availability, and separation. We have also established procedures that ensure the exercise of data subject rights, the deletion of data, and responses to threats to data. In addition, we take personal data protection into account when developing or selecting hardware, software, and procedures, in accordance with the principle of data protection by design and by default.

Transport encryption (HTTPS): Our website uses HTTPS with transport encryption (TLS). This encrypts data in transit between your browser and our web server. Transport encryption is one of our technical measures to protect personal data.

Transfer of personal data

In the course of our processing of personal data, the data may be transferred to or disclosed to other bodies, companies, legally independent organizational units, or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are embedded in a website. In such cases, we observe the legal requirements and, where necessary, conclude appropriate contracts or agreements with the recipients, e.g., data processing agreements pursuant to Art. 28 GDPR.

International data transfers

Data processing in third countries: If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in the context of using third-party services or disclosing or transferring data to other persons, bodies, or companies (which can be recognized by the postal address of the respective provider or if the privacy policy expressly refers to data transfers to third countries), this is done only in accordance with the legal requirements (Art. 44 et seq. GDPR).

For data transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), which was recognized as a secure legal framework by an adequacy decision of the EU Commission dated July 10, 2023. The DPF applies only to recipients certified under the DPF and only to the processing covered by the certification. If a recipient is not certified or the DPF does not cover a transfer, we rely on standard contractual clauses of the EU Commission, insofar as they have been agreed with the respective provider.

Where we base transfers on standard contractual clauses, we check the requirements for their effective use and take supplementary protective measures where necessary. If the required protective conditions cannot be ensured, the transfer in question does not take place or is suspended.

For the individual service providers, we inform you whether they are certified under the DPF and whether standard contractual clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/ (in English). Upon request to mail@powerbunch.de, we will inform you about the respective safeguards and how you can obtain a copy of them.

For data transfers to other third countries, corresponding safeguards apply, in particular standard contractual clauses, explicit consent, or transfers required by law. Information on third-country transfers and applicable adequacy decisions can be found in the information provided by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de

Disclosure of personal data abroad: In accordance with the Swiss FADP, we disclose personal data abroad only if adequate protection of the data subjects is ensured (Art. 16 Swiss FADP). If the Federal Council has not determined that adequate protection exists (list: https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html), we take alternative safeguards.

On August 14, 2024, the Swiss Federal Council decided to recognize the USA as a country with an adequate level of data protection for companies certified under the Swiss-U.S. Data Privacy Framework. The corresponding amendment to the Data Protection Ordinance entered into force on September 15, 2024. For transfers to the USA, we therefore rely primarily on the DPF, provided the respective recipient is certified. Otherwise, we rely on standard data protection clauses that the FDPIC has recognized as safeguards (in particular the EU Commission's standard contractual clauses adapted to Swiss law).

Where we base transfers on standard data protection clauses, we check the requirements for their effective use and take supplementary protective measures where necessary. If the required protective conditions cannot be ensured, the transfer in question does not take place or is suspended.

For the individual service providers, we inform you whether they are certified under the DPF and whether standard data protection clauses are in place. The list of certified companies and further information on the DPF can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/ (in English).

For data transfers to other third countries, corresponding safeguards apply, including international treaties, specific guarantees, standard data protection clauses approved by the FDPIC, or binding corporate rules recognized in advance by the FDPIC or a competent data protection authority of another country.

General information on data storage and deletion

We delete the personal data we process in accordance with the statutory provisions as soon as the underlying consents are withdrawn or there are no further legal grounds for the processing. This applies to cases in which the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule exist if statutory obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for the assertion of legal claims or for the protection of the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing operations.

Inquiries and appointment bookings: We delete inquiries and appointment bookings as soon as they have been dealt with and we no longer need them, for example for a subsequent quote, an order, or invoicing. We retain documents that we are legally required to keep (business letters for six years, invoices for eight years, books and annual financial statements for ten years) until the end of these periods.

We store personal data for as long as is necessary for the respective purpose or as long as a relevant statutory reason for retention exists. Longer retention obligations apply only to the documents required for this purpose. For example, an obligation to retain invoices does not extend the storage of other project, contact, or appointment data.

The retention periods under commercial and tax law begin at the end of the calendar year in which the document was created, for example when the accounting voucher was created or the business letter was received or sent (Section 147 (4) AO, Section 257 (5) HGB). Other periods of at least one year for which the law does not specify a start begin, in our practice, at the end of the calendar year in which the event triggering the period occurred. For ongoing contractual relationships, this event is the end of the contractual relationship.

Where data is no longer retained for its originally intended purpose but is kept due to legal requirements or other reasons, we process it solely for the purposes that justify its retention.

Further information on processing operations, procedures, and services:

Retention and deletion of data: The following general periods apply to retention and archiving under German law:

10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, and the work instructions and other organizational documents required to understand them (Section 147 (1) no. 1 in conjunction with (3) AO, Section 257 (1) no. 1 in conjunction with (4) HGB).
8 years - Accounting vouchers, such as invoices and expense receipts (Section 147 (1) no. 4 in conjunction with (3) sentence 1 AO, Section 14b (1) UStG, and Section 257 (1) no. 4 in conjunction with (4) HGB).
6 years - Other business documents: commercial or business letters received, copies of commercial or business letters sent, and other documents insofar as they are relevant for taxation, e.g., hourly wage records, cost allocation sheets, costing documents, price labels, payroll documents insofar as they are not already accounting vouchers, and cash register receipts (Section 147 (1) nos. 2, 3, and 5 in conjunction with (3) AO, Section 257 (1) nos. 2 and 3 in conjunction with (4) HGB).
3 years - We generally retain documents that we need in individual cases to assert, exercise, or defend against claims until the end of the regular limitation period of three years (Sections 195, 199 BGB). The period generally begins at the end of the year in which the claim arose and the creditor became aware of the circumstances giving rise to the claim and of the identity of the debtor, or should have become aware of them without gross negligence. Different statutory periods, for example the maximum periods under Section 199 (2) to (4) BGB, remain unaffected. The limitation period does not impose a general obligation to store all data for that long.

Retention and deletion of data: The following general periods apply to retention and archiving under Swiss law:

10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, accounting vouchers, and invoices, as well as all required work instructions and other organizational documents (Art. 958f of the Swiss Code of Obligations (CO)).
10 years - Data needed to account for potential claims for damages or similar contractual claims and rights, and to handle related inquiries, based on previous business experience and customary industry practice, is stored for the statutory limitation period of ten years, unless a shorter five-year period applies in the relevant case (Art. 127, 130 CO). Claims for rent, lease payments, interest on capital, and other periodic payments; for the supply of food, board, and debts owed to innkeepers; for craft work, retail sales of goods, medical services, professional services of lawyers, legal agents, procurators, and notaries; and arising from employees' employment relationships become time-barred after five years (Art. 128 CO).

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Art. 7 (3), Art. 15 to 21, and Art. 77 GDPR:

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
Right to withdraw consent: You can withdraw any consent you have given at any time with effect for the future, e.g., by email to mail@powerbunch.de. This does not affect the lawfulness of the processing carried out on the basis of your consent before its withdrawal.
Right of access: You have the right to request confirmation as to whether data concerning you is being processed and to access this data, as well as to further information and a copy of the data in accordance with the legal requirements.
Right to rectification: In accordance with the legal requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, in accordance with the legal requirements, to request restriction of the processing of the data.
Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used, and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
Complaint to a supervisory authority: In accordance with the legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the member state of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Rights of data subjects under the Swiss FADP:

As a data subject, you have the following rights in accordance with the provisions of the Swiss FADP:

Right of access: You have the right to request confirmation as to whether personal data concerning you is being processed, and to receive the information necessary for you to assert your rights under this Act and to ensure transparent data processing.
Right to receive or transfer data: You have the right to request that the personal data you have disclosed to us be provided to you in a commonly used electronic format.
Right to rectification: You have the right to request the rectification of inaccurate personal data concerning you.
Right to object and to erasure and destruction: You have the right to object to the processing of your data and to request that personal data concerning you be erased or destroyed.

No automated decision-making, including profiling, pursuant to Art. 22 GDPR takes place.

Business services

We process data of our contractual and business partners, e.g., customers and prospective customers (collectively referred to as "contractual partners"), in the context of contractual and comparable legal relationships and related measures, and with regard to communication with the contractual partners (or pre-contractually), for example to answer inquiries.

We use this data to fulfill our contractual obligations. These include, in particular, obligations to provide the agreed services, any obligations to provide updates, and obligations to remedy defects covered by statutory liability and other failures of performance. We also use the data to safeguard our rights, carry out the administrative tasks associated with these obligations, and organize the company. In addition, we process the data on the basis of our legitimate interests in proper and cost-effective business management and in security measures to protect our contractual partners and our business operations from misuse and threats to their data, secrets, information, and rights (e.g., by involving telecommunications, transport, and other support services, as well as subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Under applicable law, we disclose contractual partners' data to third parties only to the extent necessary for the purposes stated above or to fulfill legal obligations. This privacy policy informs contractual partners about other forms of processing, such as processing for marketing purposes.

We inform contractual partners which data is required for the aforementioned purposes before or during data collection, e.g., in online forms, by special marking (e.g., colors) or symbols (e.g., asterisks or similar), or in person.

We delete the data as soon as it is no longer required for the performance of the contract and for any claims arising from it. We retain documents that we must keep for commercial or tax law reasons until the end of the statutory periods (in particular invoices and accounting vouchers for eight years, business letters for six years; see "General information on data storage and deletion"). We delete data disclosed to us by the contractual partner in the context of an order in accordance with the requirements and generally after the end of the order.

Processing on behalf of our customers: Where we process personal data on behalf of a customer as part of a project, e.g., in the customer's Microsoft 365 environment, we do so on the customer's instructions as a processor on the basis of a contract pursuant to Art. 28 GDPR. The customer is then the controller for this data, and the customer's privacy notices apply.

Data subjects: Service recipients and clients; prospective customers; business and contractual partners. Participants in educational programs and courses.

Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; communication; office and organizational procedures; organizational and administrative procedures. Business processes and business management procedures.

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR); legal obligation (Art. 6 (1) sentence 1 (c) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures, and services:

Education and training services: We conduct training sessions and workshops by arrangement. We process the data of the participants (e.g., name, contact details, company, and attendance) in order to provide our training services to them. The data processed, as well as the type, scope, purpose, and necessity of its processing, are determined by the underlying contractual and training relationship. We do not process special categories of personal data, such as health information, in training sessions. Legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR); for participants who are not themselves our contractual partners, legitimate interests (Art. 6 (1) sentence 1 (f) GDPR) in conducting the training agreed with their company.

Consulting: We process the data of our clients as well as prospective clients and other clients or contractual partners (collectively referred to as "clients") in order to provide our services to them. The procedures that are part of consulting and serve its purposes include: contacting and communicating with clients, conducting needs and requirements analyses, planning and implementing consulting projects, documenting project progress and results, recording and managing client-specific information and data, scheduling and organizing appointments, providing consulting resources and materials, invoicing and payment management, post-project activities and follow-up for consulting projects, and quality assurance and feedback processes. The data processed, as well as the type, scope, purpose, and necessity of its processing, are determined by the underlying contractual and client relationship.

Where necessary to perform our contract or required by law, or where clients have given their consent, we disclose or transfer clients' data to third parties or persons acting on our behalf, such as authorities, subcontractors, or providers of IT, office, or comparable services; legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legal obligation (Art. 6 (1) sentence 1 (c) GDPR), and consent (Art. 6 (1) sentence 1 (a) GDPR), where given.

Data analysis: We process the data of our customers and other clients in order to provide them with data analysis, evaluation, and consulting as well as related services. The required information includes the information needed for analysis, evaluation, and invoicing, as well as contact information for necessary coordination. Insofar as we gain access to information of end customers, employees, or other persons, we process it in accordance with the legal and contractual requirements, usually as a processor (see "Processing on behalf of our customers"); legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legal obligation (Art. 6 (1) sentence 1 (c) GDPR), legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

IT services: We process the data of our customers and other clients in order to enable the planning, implementation, and support of IT solutions and related services for them. The required information is identified as such when the order, project, or comparable contract is concluded and includes the information needed to provide the services and for invoicing, as well as contact information so that any questions can be discussed. Insofar as we gain access to information of end customers, employees, or other persons, we process it in accordance with the legal and contractual requirements, usually as a processor (see "Processing on behalf of our customers").

The processing operations include, among other things, project management and documentation, which cover all phases from the initial requirements analysis to the completion of the project. This includes creating and managing project schedules, budgets, and resource allocations. Data processing also supports change management, in which changes in the course of the project are documented and tracked to ensure compliance and transparency.

Another process is customer relationship management (CRM), which includes recording and analyzing customer interactions and feedback in order to improve service quality and address individual customer needs efficiently. In addition, the processing includes technical support and troubleshooting, which covers recording and handling support requests, fixing errors, and regular maintenance.

Furthermore, reporting and performance analysis are carried out, in which performance metrics are recorded and evaluated in order to assess and continuously optimize the effectiveness of the IT solutions provided. All of these processes are aimed at ensuring high customer satisfaction and compliance with all relevant requirements; legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legal obligation (Art. 6 (1) sentence 1 (c) GDPR), legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Online courses and online training: We do not offer online courses or learning platforms. For training sessions that we conduct online by arrangement, the information under "Education and training services" and "Video conferences, online meetings, webinars, and screen sharing" applies.

Project and development services: We process the data of our customers and other clients (hereinafter collectively referred to as "customers") in order to enable them to select, acquire, or commission the chosen services or works and related activities, as well as their payment and provision, execution, or performance.

The required information is identified as such when the order, purchase, or comparable contract is concluded and includes the information needed to provide the services and for invoicing, as well as contact information so that any questions can be discussed. Insofar as we gain access to information of end customers, employees, or other persons, we process it in accordance with the legal and contractual requirements, usually as a processor (see "Processing on behalf of our customers"); legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR).

Management consulting: We process the data of our customers, clients, prospective customers, and other clients or contractual partners (collectively referred to as "customers") in order to provide our contractual or pre-contractual services, in particular consulting services, to them. The data processed, as well as the type, scope, purpose, and necessity of its processing, are determined by the underlying contractual and business relationship.

Where necessary to perform our contract or required by law, or where customers have given their consent, we disclose or transfer customers' data to third parties or persons acting on our behalf, such as authorities, courts, or providers of IT, office, or comparable services; legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legal obligation (Art. 6 (1) sentence 1 (c) GDPR), and consent (Art. 6 (1) sentence 1 (a) GDPR), where given.

Business processes and procedures

Personal data of service recipients and clients - including customers, clients, or business partners as well as other third parties - is processed in the context of contractual and comparable legal relationships and pre-contractual measures such as the initiation of business relationships. This data processing supports and facilitates business processes in areas such as customer management, sales, payment transactions, accounting, and project management.

The data collected serves to fulfill contractual obligations and to make operational processes efficient. This includes processing business transactions, managing customer relationships, optimizing sales strategies, and ensuring internal invoicing and financial processes. In addition, the data supports the safeguarding of the controller's rights and facilitates administrative tasks and the organization of the company.

Personal data may be passed on to third parties if this is necessary to fulfill the aforementioned purposes or legal obligations. The data is deleted after the statutory retention periods have expired or when the purpose of processing no longer applies. This also includes data that must be stored for longer due to tax and statutory documentation requirements.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); payment data (e.g., bank details, invoices, and payment history); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); contract data (e.g., subject matter of the contract, term, and customer category); usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, device types and operating systems used, and interactions with content and features); metadata, communications data, and procedural data (e.g., IP addresses, time information, identification numbers, and persons involved); log data (e.g., log files relating to logins, data retrieval, or access times). Employee data (information about employees and other persons in an employment relationship).

Data subjects: Service recipients and clients; prospective customers; communication partners; business and contractual partners; third parties; users (e.g., website visitors and users of online services); employees (e.g., salaried employees, temporary staff, and other staff). Customers.

Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; business processes and business management procedures; communication; marketing; sales promotion; public relations; financial and payment management. Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)).

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR); legitimate interests (Art. 6 (1) sentence 1 (f) GDPR). Legal obligation (Art. 6 (1) sentence 1 (c) GDPR).

Further information on processing operations, procedures, and services:

Customer management and customer relationship management (CRM): Procedures required in the context of customer management and customer relationship management (CRM) (e.g., customer acquisition in compliance with data protection requirements, measures to promote customer retention and loyalty, effective customer communication, complaint management and customer service with due regard for data protection, data management and analysis to support the customer relationship, management of CRM systems, secure account management, customer segmentation, and target group formation); legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Contact management and maintenance: Procedures required for organizing, maintaining, and securing contact information (e.g., setting up and maintaining a central contact database, regular updates of contact information, monitoring data integrity, implementing data protection measures, ensuring access controls, performing backups and restores of contact data, training employees in the effective use of contact management software, regular review of communication history, and adjustment of contact strategies); legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

General payment transactions: Procedures required for carrying out payment transactions, monitoring bank accounts, and controlling payment flows (e.g., creating and checking bank transfers, processing direct debits, checking bank statements, monitoring incoming and outgoing payments, chargeback management, account reconciliation, and cash management); legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Accounting, accounts payable, and accounts receivable: Procedures required for recording, processing, and controlling business transactions in accounts payable and accounts receivable (e.g., preparing and checking incoming and outgoing invoices, monitoring and managing outstanding items, carrying out payment transactions, managing payment reminders and collections, reconciling accounts receivable and payable, and accounts payable and accounts receivable accounting); legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legal obligation (Art. 6 (1) sentence 1 (c) GDPR), and legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Financial accounting and taxes: Procedures required for recording, managing, and controlling financially relevant business transactions and for calculating, reporting, and paying taxes (e.g., account assignment and posting of business transactions, preparation of quarterly and annual financial statements, carrying out payment transactions, managing payment reminders and collections, account reconciliation, tax advice, preparation and submission of tax returns, and handling tax matters); legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legal obligation (Art. 6 (1) sentence 1 (c) GDPR), legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Purchasing: Procedures required for procuring goods, raw materials, or services (e.g., supplier selection and evaluation, price negotiations, placing and monitoring orders, checking and controlling deliveries, invoice verification, managing orders, inventory management, and creating and maintaining purchasing guidelines); legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Sales: Procedures required for planning, implementing, and controlling measures to market and sell products or services (e.g., customer acquisition, preparing and following up on quotes, order processing, customer advice and support, sales promotion, product training, sales performance monitoring and analysis, and management of sales channels); legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Marketing, advertising, and sales promotion: Procedures required in the context of marketing, advertising, and sales promotion (e.g., market analysis and target group definition, development of marketing strategies, planning and implementation of advertising campaigns, design and production of advertising materials, online marketing including SEO and social media campaigns, event marketing and trade fair participation, customer loyalty programs, sales promotion measures, performance measurement and optimization of marketing activities, and budget management and cost control); legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Business analyses: Available data on business transactions, contracts, etc. is analyzed for business management purposes. The data subjects may include contractual partners, prospective customers, customers, visitors, and users of the controller's online offering. The analyses are used exclusively for business management evaluations, not for marketing or market research. They are used exclusively by the controller and are not disclosed externally unless they are anonymous analyses with aggregated, i.e., anonymized, values. Users' privacy is also taken into account: for analysis purposes, data is processed in pseudonymized form as far as possible and, where feasible, in anonymized form (e.g., as aggregated data); legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Public relations: Procedures required in the context of public relations (e.g., development and implementation of communication strategies, planning and implementation of PR campaigns, preparation and distribution of press releases, maintaining media contacts, monitoring and analysis of media response, organization of press conferences and public events, crisis communication, creation of content for social media and company websites, and management of corporate branding); legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Use of online platforms for offering and sales purposes

We offer our services on online platforms operated by other service providers. In this context, the privacy notices of the respective platforms apply in addition to our privacy notices. This applies in particular with regard to the procedures used on the platforms for reach measurement and interest-based marketing.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); contract data (e.g., subject matter of the contract, term, and customer category); usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, device types and operating systems used, and interactions with content and features). Metadata, communications data, and procedural data (e.g., IP addresses, time information, identification numbers, and persons involved).

Data subjects: Service recipients and clients; business and contractual partners. Prospective customers.

Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; marketing; business processes and business management procedures. Provision of our online offering and user-friendliness.

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures, and services:

kleinanzeigen: Online marketplace for e-commerce; service provider: kleinanzeigen.de GmbH, Albert-Einstein-Ring 26, 14532 Kleinmachnow, Germany; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.kleinanzeigen.de/. Privacy policy: https://themen.kleinanzeigen.de/datenschutzerklaerung/.

Digistore24: Sale of our digital products via a reseller. Digistore24 is the seller and contractual partner of the buyers, handles ordering, payment, invoicing, and download, and processes the data required for this as an independent controller. We receive the order data from Digistore24 (e.g., name, company, address, email address, product, order number, price, and time). We use it to answer questions about the product, to inform you about new versions of your product, if any, and to credit the purchase price toward later services, where a product provides for this. We do not receive bank account or card details. No Digistore24 order form is embedded on our website. The purchase button on our product pages is a simple link to the order form; Digistore24 receives data only when you open it. As long as sales of a product have not yet started, a request for email notification appears there instead (see "Contact and inquiry management"); service provider: Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany; legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.digistore24.com/. Privacy policy: https://www.digistore24.com/page/privacy/1/de.

Providers and services used in the course of business

In the course of our business activities, we use additional services, platforms, interfaces, or plug-ins from third-party providers (in short, "services") in compliance with the legal requirements. Their use is based on our interests in the proper, lawful, and economical management of our business operations and our internal organization.

Data subjects: Service recipients and clients; prospective customers; business and contractual partners. Employees (e.g., salaried employees, temporary staff, and other staff).

Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures. Business processes and business management procedures.

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures, and services:

DATEV: Software for accounting and for communication with tax advisors and authorities, with document storage; service provider: DATEV eG, Paumgartnerstr. 6 - 14, 90429 Nuremberg, Germany; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.datev.de/web/de/mydatev/datev-cloud-anwendungen/; privacy policy: https://www.datev.de/web/de/m/ueber-datev/datenschutz/. Data processing agreement: provided by the service provider.

Lexware Office (formerly Lexoffice): Online software for invoicing, accounting, banking, and tax filing with document storage; service provider: Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.lexoffice.de; privacy policy: https://www.lexoffice.de/datenschutz/. Data processing agreement: https://www.lexoffice.de/auftragsverarbeitung/.

Provision of the online offering and web hosting

We process users' data in order to provide our online services to them. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

Types of data processed: Usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, device types and operating systems used, and interactions with content and features); metadata, communications data, and procedural data (e.g., IP addresses, time information, identification numbers, and persons involved); log data (e.g., log files relating to logins, data retrieval, or access times). Content data (e.g., text or image messages and posts as well as information relating to them, such as details of authorship or time of creation).

Data subjects: Users (e.g., website visitors and users of online services).

Purposes of processing: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); security measures. Provision of contractual services and fulfillment of contractual obligations.

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures, and services:

Hosting the online offering on rented storage space: To provide our online offering, we use storage space, computing capacity, and software that we rent or otherwise obtain from a server provider (also called a "web host"); legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files." Server log files may include the address and name of the web pages and files accessed, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, the user's operating system, the referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. Server log files can be used for security purposes, e.g., to prevent server overload (especially in the event of abusive attacks, so-called DDoS attacks), and to manage server load and ensure server stability; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR). Deletion of data: our web host IONOS stores log file information with an anonymized IP address for a maximum of eight weeks and then deletes it. Data whose further retention is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

IONOS: Services in the field of providing information technology infrastructure and related services (e.g., storage space and/or computing capacity); service provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.ionos.de; privacy policy: https://www.ionos.de/terms-gtc/terms-privacy. Data processing agreement: https://www.ionos.de/hilfe/datenschutz/allgemeine-informationen-zur-datenschutz-grundverordnung-dsgvo/auftragsverarbeitung/.

IONOS WebAnalytics: Our web host IONOS evaluates access to our website statistically. This involves processing the previously visited page (referrer), the page or file accessed, browser type and version, operating system, device type, and time of access. The IP address is anonymized immediately after transmission and used only to determine the location of access. No cookies are set. The data is used for statistical evaluation and technical optimization of our website and is not passed on to third parties; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); service provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; information from IONOS: https://www.ionos.de/hilfe/datenschutz/datenverarbeitung-durch-ihr-ionos-produktes/webanalytics/.

Cookies and browser storage: Our website does not set any cookies and does not embed any tracking or analytics tools. The statistical evaluation by IONOS (see "IONOS WebAnalytics") takes place on the server and without cookies. The website does not store any information on your device or read any information from it beyond what is technically necessary to retrieve the pages. Consent pursuant to Section 25 TDDDG is therefore not required, and we do not display a cookie notice.

Fonts: The font files used on www.powerbunch.de are loaded from our own web server. When these font files are loaded, no connection is established to the servers of an external font provider. This information concerns our website, not the booking pages of Microsoft Bookings or other platforms.

Blogs and publication media

We currently do not operate a blog or comparable publication media. Should this change, we will adapt this privacy policy beforehand.

Contact and inquiry management

When you contact us (e.g., by mail, email, phone, appointment booking, or via social media), or as part of existing user and business relationships, we process the information provided by the person making the inquiry to the extent necessary to respond to inquiries and carry out any requested actions. We currently do not offer a contact form on our website. We do not use your inquiry for advertising or to measure the success of marketing activities. If you ask us by email to notify you as soon as a product is available, we send you exactly one message about that product. This does not sign you up for a newsletter or any further advertising. Until the message is sent, you can withdraw your request at any time by email to mail@powerbunch.de.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, device types and operating systems used, and interactions with content and features); metadata, communications data, and procedural data (e.g., IP addresses, time information, identification numbers, and persons involved); payment data (e.g., bank details, invoices, and payment history). Contract data (e.g., subject matter of the contract, term, and customer category).

Data subjects: Communication partners; service recipients and clients; prospective customers. Business and contractual partners.

Purposes of processing: Communication; organizational and administrative procedures; office and organizational procedures. Provision of contractual services and fulfillment of contractual obligations.

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), insofar as your inquiry is aimed at a contract with you or concerns an existing contract. Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR) in all other cases, in particular for inquiries from contacts at other companies. Our legitimate interest is answering and processing the inquiry.

Further information on processing operations, procedures, and services:

Contact by email, phone, or other means: When you contact us by email, phone, or other communication channels, we process the personal data transmitted to us in order to answer and process the respective request. This usually includes information such as name, contact information, and, where applicable, further information that is communicated to us and is necessary for appropriate processing. We use this data exclusively for the stated purpose of contact and communication. Legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Appointment booking with Microsoft Bookings: The address meet.powerbunch.de takes you to our booking page on Microsoft Bookings. Booking an appointment is free of charge and does not constitute an order for consulting or any other services. Customers with an existing contract can book appointments for agreed services via a separate booking link; the information in this section applies accordingly. Appointments take place as meetings in Microsoft Teams. When booking, we ask for your full name, your email address, and your phone number. A free-text field for notes on the appointment is optional. In addition, the selected appointment and the selected service are recorded.

We need your email address for the appointment confirmation, for reminders, and for the link to the Teams meeting. For online appointment booking, a phone number is a mandatory field. We use it to call you back if you do not attend the agreed Teams appointment. Online booking is not possible without name, email address, and phone number. However, you can also arrange an appointment by email to mail@powerbunch.de or by phone. Please enter in the free-text field only information that is necessary to prepare for the appointment. Do not submit any credentials, health data, or other particularly sensitive personal information, and no confidential information about third parties.

The booking data is stored in our Microsoft 365 environment (Microsoft Bookings and Exchange calendar). Microsoft processes it as our processor. For transfers to third countries, see "International data transfers" and "Microsoft EU Data Boundary" in the section "Cloud services." On the booking pages, Microsoft's notices also apply, including those on cookies used there. We delete appointment data as soon as the appointment has been dealt with and we no longer need it, for example for a subsequent quote, an order, or invoicing of agreed services.

Legal bases: performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR), insofar as you yourself are or wish to become our contractual partner. Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR), insofar as you book the appointment for your company. Our legitimate interest is organizing and conducting the appointment, including calling back in the event of non-attendance. Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Website: https://www.microsoft.com/de-de/microsoft-365/business/scheduling-and-booking-app. Privacy policy: https://privacy.microsoft.com/de-de/privacystatement. Data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA.

Communication via messaging services

We use messaging services for communication and therefore ask you to note the following information about how these services work, encryption, the use of communications metadata, and your options for objecting.

You can also contact us by alternative means, e.g., by phone or email. Please use the contact options provided to you or the contact options stated within our online offering.

In the case of end-to-end encryption of content (i.e., the content of your message and attachments), we point out that the communication content (i.e., the content of the message and attached images) is encrypted end to end. This means that the content of the messages cannot be viewed, not even by the messaging service providers themselves. You should always use an up-to-date version of the messaging app with encryption enabled to ensure that message content is encrypted.

Not all services mentioned here encrypt content end to end, for example chats in Microsoft Teams. Without end-to-end encryption, providers can also process the content. We also inform our communication partners that messaging service providers may learn that they communicate with us and when, and may process technical information about their devices and, depending on device settings, location information (so-called metadata).

Information on legal bases: If we ask communication partners for permission before communicating with them via messaging services, the legal basis for our processing of their data is their consent. Otherwise, if we do not ask for consent and they contact us on their own initiative, for example, we use messaging services in relation to our contractual partners and in the context of contract initiation as a contractual measure, and in the case of other prospective customers and communication partners on the basis of our legitimate interests in fast and efficient communication and in meeting our communication partners' need to communicate via messaging services. Furthermore, we point out that we do not transmit the contact data provided to us to the messaging services for the first time without your consent.

Withdrawal, objection, and deletion: You can withdraw any consent you have given and object to communication with us via messaging services at any time. In the case of communication via messaging services, we delete the messages in accordance with our general deletion policies (i.e., for example, as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise as soon as we can assume that we have answered any inquiries from the communication partners, if no reference back to a previous conversation is to be expected and no statutory retention obligations prevent deletion.

Right to refer you to other communication channels: To ensure your security, please understand that, for certain reasons, we may not be able to answer inquiries via messaging services. This applies, for example, where contract details require particular confidentiality or a reply via a messaging service would not meet formal requirements. In these cases, we recommend using more suitable communication channels.

Types of data processed: Contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, device types and operating systems used, and interactions with content and features). Metadata, communications data, and procedural data (e.g., IP addresses, time information, identification numbers, and persons involved).

Data subjects: Communication partners.

Purposes of processing: Communication.

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR); performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures, and services:

Apple iMessage and FaceTime: Sending and receiving text and voice messages. Video and audio calls via FaceTime. Holding group conversations. Sharing files, photos, videos, and locations. Securing communication through end-to-end encryption. Synchronizing messages across multiple devices; service provider: Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.apple.com/de/. Privacy policy: https://www.apple.com/legal/privacy/de-ww/.

Facebook Messenger: Sending and receiving text messages, making voice and video calls, creating group chats, sharing files and media, transmitting location information, synchronizing contacts, and encrypting messages; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.facebook.com; privacy policy: https://www.facebook.com/privacy/policy/. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://www.facebook.com/legal/EU_data_transfer_addendum); Switzerland - Data Privacy Framework (DPF), standard contractual clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).

Microsoft Teams: Chat, audio and video conferencing, file sharing, integration with Office 365 applications, real-time collaboration on documents, calendar functions, task management, screen sharing, and optional recording; service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.microsoft.com/de-de/microsoft-365; privacy policy: https://privacy.microsoft.com/de-de/privacystatement, security information: https://www.microsoft.com/de-de/trustcenter. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA); Switzerland - Data Privacy Framework (DPF), standard contractual clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).

LinkedIn messages: Sending messages via the LinkedIn social network; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.linkedin.com; privacy policy: https://www.linkedin.com/legal/privacy-policy. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF); Switzerland - Data Privacy Framework (DPF).

Xing: Social network; service provider: XING SE & Co. KG, Baumwall 7, 20459 Hamburg, Germany; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.xing.com/. Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

Artificial intelligence (AI)

We use ChatGPT and Claude as work tools, for example for writing, research, developing concepts, and writing program code. We do not enter personal information into these services as content to be processed. We use information from client projects for this purpose only after prior anonymization. This statement concerns the work content entered. It is separate from the processing of account and usage data associated with our own accounts with the providers (e.g., the user's name and email address, payment data, and device data). The providers process that data in accordance with their privacy notices.

We check the results of the AI tools before using them. We do not use AI to make automated decisions about individuals. We do not currently use other AI services, such as Microsoft Copilot.

Types of data processed: Master data of the persons using the services at our company (account with the providers). Usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, device types and operating systems used, and interactions with content and features).

Data subjects: Persons at our company who use the AI services.

Purposes of processing: Use of AI work tools for writing, research, developing concepts, and writing program code; management of our accounts.

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures, and services:

ChatGPT: AI-based service designed to understand and generate natural language and related input and data, analyze information, and make predictions ("AI," i.e., "artificial intelligence," is to be understood in the legal sense of the term applicable in each case); service provider: OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://openai.com/product; privacy policy: https://openai.com/de/policies/eu-privacy-policy. Option to object (opt-out): https://privacy.openai.com/policies?modal=select-subject.

Claude: AI assistant for texts, analyses, and software development; service provider: Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://claude.ai. Privacy policy: https://www.anthropic.com/legal/privacy.

We use platforms and applications of other providers (hereinafter referred to as "conference platforms") for the purpose of conducting video and audio conferences, webinars, and other types of video and audio meetings (hereinafter collectively referred to as "conference"). When selecting the conference platforms and their services, we observe the legal requirements.

Data processed by conference platforms: When you participate in a conference, the conference platforms process the participants' personal data listed below. The scope of processing depends on the data required for the specific conference (e.g., login details or real names) and the optional information participants provide. In addition to running the conference, platforms may process participants' data for security purposes or service optimization. The data processed includes personal details (first and last name), contact information (email address and telephone number), login details (access codes or passwords), profile pictures, professional position or role, the IP address of the internet connection, details of participants' devices and operating systems, the browser and its technical and language settings, communication content such as chat entries and audio and video data, and use of other available features (e.g., surveys). Communication content is encrypted to the extent technically provided by the conference providers. If participants are registered users of the conference platforms, further data may be processed in accordance with their agreement with the respective conference provider.

Logging and recordings: If text entries, participation results (e.g., from surveys), and video or audio recordings are logged, this will be communicated transparently to the participants in advance and they will be asked for consent where necessary.

Data protection measures for participants: Please consult the conference platforms' privacy notices for details of how they process your data and select the security and privacy settings that work best for you. During a video conference, also protect personal data and the rights of people in the background of your video image (e.g., by informing others in your household, locking doors, and using background blur where technically possible). Links to conference rooms and login details must not be shared with unauthorized third parties.

Information on legal bases: If, in addition to the conference platforms, we also process the users' data and ask the users for their consent to the use of the conference platforms or certain functions (e.g., consent to the recording of conferences), the legal basis for the processing is this consent. Furthermore, our processing may be necessary to fulfill our contractual obligations (e.g., in participant lists, in the case of follow-up on meeting results, etc.). Otherwise, users' data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, device types and operating systems used, and interactions with content and features); image and/or video recordings (e.g., photographs or video recordings of a person); audio recordings. Log data (e.g., log files concerning logins or the retrieval of data or access times).

Data subjects: Communication partners; users (e.g., website visitors and users of online services). Persons depicted.

Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; communication. Office and organizational procedures.

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Consent (Art. 6 (1) sentence 1 (a) GDPR), insofar as we obtain it, for example, for a recording; performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 (b) GDPR). Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures, and services:

Microsoft Teams: Audio and video conferencing, chat, file sharing, integration with Office 365 applications, real-time collaboration on documents, calendar functions, task management, screen sharing, and optional recording; service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.microsoft.com/de-de/microsoft-teams/; privacy policy: https://privacy.microsoft.com/de-de/privacystatement, security information: https://www.microsoft.com/de-de/trustcenter. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA); Switzerland - Data Privacy Framework (DPF), standard contractual clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).

Zoom: Video conferencing, online meetings, webinars, screen sharing, and optional recording of sessions, chat function, and integration with calendars and other apps; service provider: Zoom Communications, Inc., 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://zoom.us; privacy policy: https://explore.zoom.us/de/privacy/; data processing agreement: https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf); Switzerland - Data Privacy Framework (DPF), standard contractual clauses (https://explore.zoom.us/docs/doc/Zoom_GLOBAL_DPA.pdf).

Cloud services

We use software services that are accessible via the internet and run on the servers of their providers (so-called "cloud services," also referred to as "software as a service") for the storage and management of content (e.g., document storage and management, exchange of documents, content, and information with certain recipients, or publication of content and information).

In this context, personal data may be processed and stored on the providers' servers insofar as it forms part of communication processes with us or is otherwise processed by us as set out in this privacy policy. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes, and their content. The providers of the cloud services also process usage data and metadata, which they use for security purposes and service optimization.

If we use the cloud services to provide forms or other documents and content for other users or publicly accessible websites, the providers may store cookies on the users' devices for web analytics purposes or to remember users' settings (e.g., in the case of media controls).

Types of data processed: Master data (e.g., full name, residential address, contact information, customer number, etc.); contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, device types and operating systems used, and interactions with content and features). Image and/or video recordings (e.g., photographs or video recordings of a person).

Data subjects: Prospective customers; communication partners; business and contractual partners. Employees (e.g., salaried employees, temporary staff, and other personnel).

Purposes of processing: Office and organizational procedures; information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)). Provision of contractual services and fulfillment of contractual obligations.

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

The content we store in cloud services is governed by the legal bases of the respective processing, for example, for employee data, those stated in the section "Processing of data in the context of employment relationships." Our legitimate interests relate to the use of the services themselves.

Further information on processing operations, procedures, and services:

Adobe Creative Cloud: Cloud storage, cloud infrastructure services, and cloud-based application software, including for photo editing, video editing, graphic design, and web development; service provider: Adobe Systems Software Ireland Limited, 4-6, Riverwalk Drive, Citywest Business Campus, Brownsbarn, Dublin 24, D24 DCW0, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.adobe.com/de/creativecloud.html; privacy policy: https://www.adobe.com/de/privacy.html; data processing agreement: provided by the service provider. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (provided by the service provider); Switzerland - Data Privacy Framework (DPF), standard contractual clauses (provided by the service provider).

Microsoft cloud services: Cloud storage, cloud infrastructure services, and cloud-based application software; service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://microsoft.com/de-de; privacy policy: https://privacy.microsoft.com/de-de/privacystatement, security information: https://www.microsoft.com/de-de/trustcenter; data processing agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA); Switzerland - Data Privacy Framework (DPF), standard contractual clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).

Microsoft EU Data Boundary: For its cloud services for businesses (including Microsoft 365, Azure, Dynamics 365, and the Power Platform), Microsoft has committed to storing and processing customer data and personal data generally within the European Union (EU) and the European Free Trade Association (EFTA) (the so-called "EU Data Boundary"). This commitment applies to the services named by Microsoft and with the exceptions named by Microsoft.

The EU Data Boundary is not a commitment that all data remains in the EU or EFTA without exception. Microsoft describes cases in which data continues to be transferred outside this region or can be accessed from there, for example, for global security measures, certain support cases, or the operation of individual features (overview from Microsoft). Such transfers are subject to the bases stated in the section "International data transfers."

The EU Data Boundary covers all EU countries as well as the EFTA states (Liechtenstein, Iceland, Norway, and Switzerland). Microsoft operates data centers in several of these countries, including Germany, France, Ireland, the Netherlands, Sweden, Spain, and Switzerland. Further locations may be added. The specific data center in which data is stored depends on Microsoft's terms and settings.

In the course of operation, Microsoft automatically creates logs to ensure the security and functionality of its services. These logs mainly contain technical information but may in certain cases also include personal data, e.g., when user actions are documented.

Microsoft pseudonymizes personal data in these system-generated logs, for example, by encryption, masking, or tokenization (replacement with character strings without a direct reference to the person), before it is processed outside the EU Data Boundary. Pseudonymized data is still personal data. Separate Microsoft rules apply to controlled access to other customer data, for example, in a support case.

Further information on the EU Data Boundary and Microsoft's data protection measures can be found in the Microsoft EU Data Boundary Trust Center: https://www.microsoft.com/en-us/trust-center/privacy/eu-data-boundary.

We currently do not send a newsletter. Should this change, we will only send it with your consent and will adapt this privacy policy beforehand.

Promotional communication via email, mail, fax, or phone

We currently do not approach anyone for advertising purposes by email, phone, mail, or fax. Should this change, we will observe the legal requirements and adapt this privacy policy beforehand.

Surveys and polls

We currently do not conduct any surveys or polls. Should this change, we will adapt this privacy policy beforehand.

Customer reviews and rating procedures

We currently do not participate in any review or rating procedures and do not transmit any customer data to rating platforms. Should this change, we will adapt this privacy policy beforehand.

Digital badges

We currently do not issue any digital badges. Should this change, we will adapt this privacy policy beforehand.

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

We point out that user data may be processed outside the territory of the European Union. This may result in risks for users because, for example, it could make it more difficult to enforce users' rights.

Furthermore, user data within social networks is usually processed for market research and advertising purposes. For example, usage profiles can be created based on usage behavior and the resulting interests of the users. These profiles may in turn be used, for example, to place advertisements inside and outside the networks that presumably correspond to the users' interests. For this reason, cookies are usually stored on the users' computers, in which the usage behavior and interests of the users are stored. In addition, data may also be stored in the usage profiles regardless of the devices used by the users (in particular if they are members of the respective platforms and logged in there).

For a detailed description of the respective forms of processing and the options to object (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.

You can assert your rights with the providers and, insofar as we are joint controllers with them, also with us. The providers each have full access to the user data and can therefore often provide information or take action most quickly. We will be happy to assist you with this.

Types of data processed: Contact data (e.g., postal and email addresses or telephone numbers); content data (e.g., text or image messages and posts as well as information relating to them, such as details of authorship or time of creation). Usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, device types and operating systems used, and interactions with content and features).

Data subjects: Users (e.g., website visitors and users of online services).

Purposes of processing: Communication; feedback. Public relations.

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures, and services:

Facebook pages: Profiles within the social network Facebook - We are joint controllers with Meta Platforms Ireland Limited for the processing of data of visitors to our Facebook page (so-called "fan page") for the creation of Page Insights. This data includes information on the types of content users view or interact with, or the actions they take (see Meta's privacy policy: https://www.facebook.com/privacy/policy/), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, and cookie data; see Meta's privacy policy: https://www.facebook.com/privacy/policy/). As explained in Meta's privacy policy, Facebook also collects and uses information to provide analytics services, so-called "Page Insights," to page operators so that they can gain insights into how people interact with their pages and with the content associated with them. We have concluded a special agreement with Facebook ("Information about Page Insights," https://www.facebook.com/legal/terms/page_controller_addendum), which regulates in particular which security measures Facebook must observe and in which Facebook has agreed to fulfill the rights of data subjects (i.e., users can, for example, send requests for information or deletion directly to Facebook). You can also assert your rights with regard to the joint processing against us. The rights of users (in particular to access, erasure, objection, and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the "Information about Page Insights" (https://www.facebook.com/legal/terms/information_about_page_insights_data). The joint controllership covers the processing of personal data for the creation and provision of Page Insights. Meta Platforms Ireland Limited is solely responsible for the remaining processing, in particular the transfer of data to the parent company Meta Platforms, Inc. in the USA; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.facebook.com; privacy policy: https://www.facebook.com/privacy/policy/. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://www.facebook.com/legal/EU_data_transfer_addendum); Switzerland - Data Privacy Framework (DPF), standard contractual clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).

LinkedIn: Social network - Insofar as personal data is processed in connection with our LinkedIn company page for the creation and provision of Page Insights (statistics), we and LinkedIn Ireland Unlimited Company are joint controllers. This data includes information about the types of content users view or interact with and the actions they take. In addition, details about the devices used are collected, such as IP addresses, operating system, browser type, language settings, and cookie data, as well as information from user profiles, such as job function, country, industry, seniority level, company size, and employment status. Privacy information on the processing of user data by LinkedIn can be found in LinkedIn's privacy notices: https://www.linkedin.com/legal/privacy-policy.

The allocation of responsibilities is set out in the "Page Insights Joint Controller Addendum" (https://www.linkedin.com/legal/l/page-joint-controller-addendum). It regulates in particular which security measures LinkedIn must observe and that LinkedIn has agreed to fulfill the rights of data subjects (i.e., users can, for example, send requests for access or deletion directly to LinkedIn). The rights of users (in particular the right to access, erasure, objection, and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. We receive the Page Insights as aggregated statistics. In addition, LinkedIn processes personal data for its own purposes in accordance with its own privacy notices, for example, when transferring it to the parent company LinkedIn Corporation in the USA. You can also assert your data subject rights with regard to the joint processing against us; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.linkedin.com; privacy policy: https://www.linkedin.com/legal/privacy-policy; basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF), standard contractual clauses (https://legal.linkedin.com/dpa); Switzerland - Data Privacy Framework (DPF), standard contractual clauses (https://legal.linkedin.com/dpa). Option to object (opt-out): https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

XING: Social network for professional contacts; service provider: XING SE & Co. KG, Baumwall 7, 20459 Hamburg, Germany; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.xing.com/. Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.

Microsoft Learn: Public profile with certifications and learning activities; service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://learn.microsoft.com/. Privacy policy: https://privacy.microsoft.com/de-de/privacystatement.

Plug-ins, embedded features, and embedded content

We currently do not embed any functional or content elements from other providers on our website, such as videos, maps, fonts, or scripts from third-party servers. All content, including font files and icons, is loaded from our own web server. References to other websites, such as our profiles in social networks or the booking pages, are simple links. Only when you click on such a link are you taken to the respective provider.

Should we embed content from other providers in the future, we will obtain your consent beforehand where necessary and adapt this privacy policy.

Management, organization, and supporting tools

We use services, platforms, and software from other providers (hereinafter referred to as "third-party providers") for the purposes of organizing, administering, planning, and providing our services. When selecting the third-party providers and their services, we observe the legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. This may affect various data that we process in accordance with this privacy policy. This data may include, in particular, master data and contact data of users, data on transactions, contracts, other processes, and their content.

If users are referred to the third-party providers or their software or platforms in the context of communication, business, or other relationships with us, the third-party providers may process usage data and metadata for security purposes, service optimization, or marketing purposes. We therefore ask you to note the privacy notices of the respective third-party providers.

Types of data processed: Content data (e.g., text or image messages and posts as well as information relating to them, such as details of authorship or time of creation); usage data (e.g., page views and length of visit, click paths, intensity and frequency of use, device types and operating systems used, and interactions with content and features); metadata, communications data, and procedural data (e.g., IP addresses, time information, identification numbers, and persons involved); master data (e.g., full name, residential address, contact information, customer number, etc.). Contract data (e.g., subject matter of the contract, term, and customer category).

Data subjects: Communication partners; users (e.g., website visitors and users of online services). Business and contractual partners.

Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; security measures. Information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)).

Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion."

Legal bases: Legitimate interests (Art. 6 (1) sentence 1 (f) GDPR).

Further information on processing operations, procedures, and services:

Adobe Acrobat Sign: Electronically signing documents, sending documents for signature, tracking the status of documents, and storing signed documents; service provider: Adobe Systems Software Ireland Limited, 4-6, Riverwalk Drive, Citywest Business Campus, Brownsbarn, Dublin 24, D24 DCW0, Ireland; legal bases: legitimate interests (Art. 6 (1) sentence 1 (f) GDPR); website: https://www.adobe.com/de/sign.html; privacy policy: https://www.adobe.com/de/privacy.html. Basis for third-country transfers: EU/EEA - Data Privacy Framework (DPF); Switzerland - Data Privacy Framework (DPF).

Processing of data in the context of employment relationships

The employees of powerbunch GmbH are currently mini-jobbers (marginally employed persons) and the Managing Director. We process their data in order to establish, manage, and terminate the employment relationship, in particular for payroll accounting, statutory reporting, and the recording of working hours.

Types of data processed: Master data (name, address, and date of birth), tax identification number and wage tax withholding details, social security number and health insurance fund, bank details, contract data, working hours, remuneration, vacation, and periods of incapacity for work.

Special categories of personal data: We process health data only in the form of periods of incapacity for work (without diagnosis), insofar as they are required for continued payment of wages and reimbursement under the German Expenses Compensation Act (Aufwendungsausgleichsgesetz). We process religious affiliation only as a wage tax withholding detail, insofar as it is required for church tax. The legal basis for this is Art. 9 (2) (b) GDPR in conjunction with Section 26 (3) BDSG.

Data subjects: Employees (mini-jobbers and Managing Director).

Purposes of processing: Establishment, performance, and termination of employment relationships. Fulfillment of tax and social security obligations.

Legal bases: Performance of a contract (Art. 6 (1) sentence 1 (b) GDPR). Legal obligation (Art. 6 (1) sentence 1 (c) GDPR). For special categories, Art. 9 (2) (b) GDPR in conjunction with Section 26 (3) BDSG.

Sources of the data: We receive the data from the employees themselves. Where necessary, wage tax withholding details are retrieved from the Federal Central Tax Office (ELStAM) and periods of incapacity for work from the health insurance fund (electronic certificate of incapacity for work).

Recipients: Our tax advisor prepares the payroll. Where required by law, we transmit data to the Minijob-Zentrale or the health insurance funds, the tax authorities, and the statutory accident insurance provider. Our bank receives the necessary information for payment. We pass on names and business contact details of employees to customers or business partners only insofar as this is necessary for their tasks, for example, in emails. We transfer employee data to third countries only within the scope of the services named in the section "Cloud services" (see "International data transfers").

Obligation to provide data: The information is required for establishing and maintaining the employment relationship and for statutory reporting. Without it, we cannot maintain the employment relationship.

Deletion of employee data: We delete employee data as soon as it is no longer required for the purpose for which it was collected and no statutory retention obligation prevents this. The following periods apply in particular:

Working time records - For mini-jobbers, at least two years from the point in time relevant for the record (Section 17 (1) MiLoG).
Pay statements and other accounting vouchers - Eight years (Section 147 (1) no. 4 in conjunction with (3) AO, Section 257 (1) no. 4 in conjunction with (4) HGB).
Payroll accounts - Until the end of the sixth calendar year following the last recorded wage payment (Section 41 (1) sentence 9 EStG).
Remuneration records for social security - Until the end of the calendar year following the last audit by the pension insurance institution (Section 28f (1) SGB IV).
Payroll records for the statutory accident insurance - At least five years (Section 165 (4) SGB VII).
Employment contract and other personnel records - Only insofar as they are required for possible claims arising from the employment relationship, until the end of the regular limitation period (Sections 195, 199 BGB, see "General information on data storage and deletion"), unless one of the aforementioned periods applies.
Periods of incapacity for work - Only for as long as necessary for continued payment of wages and reimbursement, unless they form part of the payroll records subject to retention.

Publication: We do not publish any data of mini-jobbers on our website.

Job application procedures

We currently do not conduct any job application procedures. Should this change, we will update this privacy policy beforehand.

Changes and updates

Please review our privacy policy regularly. We update it as soon as changes in our data processing make this necessary. We will notify you as soon as those changes require action on your part (e.g., consent) or other individual notification.

Where we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time, and please check the information before contacting them.

Our supervisory authority:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2-4
40213 Düsseldorf, Germany

Phone: +49 211 38424-0
Fax: +49 211 38424-10
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

As of November 1, 2026

Preamble

Other online presences

Table of contents

Controller

Overview of processing operations

Types of data processed

Special categories of data

Categories of data subjects

Purposes of processing

Relevant legal bases

Security measures

Transfer of personal data

International data transfers

General information on data storage and deletion

Rights of data subjects

Business services

Business processes and procedures

Use of online platforms for offering and sales purposes

Providers and services used in the course of business

Provision of the online offering and web hosting

Blogs and publication media

Contact and inquiry management

Communication via messaging services

Artificial intelligence (AI)

Cloud services

Promotional communication via email, mail, fax, or phone

Surveys and polls

Customer reviews and rating procedures

Digital badges

Plug-ins, embedded features, and embedded content

Management, organization, and supporting tools

Processing of data in the context of employment relationships

Job application procedures

Changes and updates

Privacy policy

Preamble

Other online presences

Table of contents

Controller

Overview of processing operations

Types of data processed

Special categories of data

Categories of data subjects

Purposes of processing

Relevant legal bases

Security measures

Transfer of personal data

International data transfers

General information on data storage and deletion

Rights of data subjects

Business services

Business processes and procedures

Use of online platforms for offering and sales purposes

Providers and services used in the course of business

Provision of the online offering and web hosting

Blogs and publication media

Contact and inquiry management

Communication via messaging services

Artificial intelligence (AI)

Video conferences, online meetings, webinars, and screen sharing

Cloud services

Newsletters and electronic notifications

Promotional communication via email, mail, fax, or phone

Surveys and polls

Customer reviews and rating procedures

Digital badges

Presences on social networks (social media)

Plug-ins, embedded features, and embedded content

Management, organization, and supporting tools

Processing of data in the context of employment relationships

Job application procedures

Changes and updates