Privacy Policy

1. Introduction

The subsequent information is intended to provide you, as a ‘data subject’, with an overview of how we process your personal data and your rights under data protection legislation. In principle, it is possible to use our website without providing any personal data. However, if you wish to make use of specific services offered by our company via our website, the processing of personal data may be necessary. Where the processing of personal data is necessary and there is no legal basis for such processing, we will generally seek your consent.

The processing of personal data, such as your name, address or email address, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection regulations applicable to the “Institut für Holztechnologie Dresden gemeinnützige GmbH”. Through this privacy policy, we wish to inform you about the scope and purpose of the personal data we collect, use and process.

As the data controller, we have implemented numerous technical and organisational measures to ensure the most comprehensive possible protection of the personal data processed via this website. Nevertheless, internet-based data transmissions may, in principle, be subject to security vulnerabilities, meaning that absolute protection cannot be guaranteed. For this reason, you are free to provide us with personal data via alternative channels, such as by telephone or post.

You, too, can take simple and easy-to-implement measures to protect yourself against unauthorised access to your data by third parties. We would therefore like to provide you with some advice on how to handle your data securely:

• Protect your account (login, user or customer account) and your IT system (computer, laptop, tablet or mobile device) with secure passwords.
• Only you should be able to access your passwords.
• Ensure that you only ever use your passwords for a single account (login, user or customer account).
• Do not employ the same password for different websites, applications or online services.
• The following should be done in particular when using IT systems that are publicly accessible or shared with others: you should log out after every session on a website, application or online service.

2. Data Controller

The data controller within the meaning of the GDPR is:

3. Data Protection Officer

You can contact the Data Protection Officer as follows:

You can contact our Data Protection Officer directly at any time with any questions or suggestions regarding data protection.

4. Definitions

This privacy policy is based on the terminology employed by the European legislators and regulators when enacting the General Data Protection Regulation (GDPR). Our privacy policy is intended to be easy to read and understand for the general public as well as for our customers and business partners. To ensure this, we would like to explain the terminology employed in advance.

In this privacy policy, we employ the following terms, amongst others:

1. Personal data

Personal data is any information relating to an identified or identifiable natural person. A natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more features specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2. Data subject

A data subject is any identified or identifiable natural person whose personal data is processed by the data controller (our company).

3. Processing

Processing means any operation or sets of operations which is carried out on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution or any other form of disclosure, the comparison or linking, the restriction, erasure or destruction.

4. Restriction of processing

Restriction of processing means the marking of stored personal data with the aim of restricting its future processing.

5. Profiling

Profiling means any form of automated processing of personal data consisting of the employment of such personal data to perform an assessment of certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

6. Pseudonymisation

Pseudonymisation is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information , provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person.

7. Data processors

A data processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller.

8. Recipients

A recipient is a natural or legal person, public authority, agency or other body to whom personal data are disclosed, irrespective of whether or not they are a third party. However, public authorities which may receive personal data in the course of a specific investigation mandate under Union law or the law of the Member States shall not be regarded as recipients.

9. Third party

A third party is a natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons authorised to process the personal data under the direct responsibility of the controller or the processor.

10. Consent

Consent means any freely given, determined, informed and unambiguous indication of the data subject’s wishes, by a statement or by a clear affirmative action, by which the data subject indicates that they agree to the processing of personal data relating to them.

5. Legal basis for processing

Article 6(1)(a) of the GDPR (in conjunction with Section 25(1) of the TDDDG (formerly the TTDSG)) serves as the legal basis for our company’s processing operations where we obtain consent for a determined processing purpose.

Where the processing of personal data is necessary for the performance of a contract to which you are a party – as is the case, for example, with processing operations required for the delivery of goods or the provision of other services or consideration – the processing is based on Article 6(1)(b) of the GDPR.

The same applies to processing operations necessary for the implementation of pre-contractual measures, such as in cases of enquiries regarding our products or services.

Where our company is subject to a legal obligation requiring the processing of personal data, such as to fulfil tax obligations, the processing is based on Article 6(1)(c) of the GDPR.

In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were to be injured on our premises and their name, age, health insurance details or other vital information subsequently had to be disclosed to a doctor, a hospital or other third parties. In such cases, the processing would be based on Article 6(1)(d) of the GDPR.

Finally, processing operations may be based on Article 6(1)(f) of the GDPR. This legal basis applies to processing operations not covered by any of the aforementioned legal bases, where the processing is necessary to safeguard a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject do not override those interests. We are permitted to carry out such processing operations in particular because they have been specifically mentioned by the European legislator. In this regard, the legislator took the view that a legitimate interest could be assumed if you are a customer of our company (Recital 47, second sentence, of the GDPR).

Our services are generally aimed at adults. Persons under the age of 16 must not provide us with any personal data without the consent of their parents or legal guardians. We do not request, collect or indicate or report any personal data from children and young people to third parties.

6. Transfer of data to third parties

Your personal data will not be transferred to third parties unlike the purposes listed subsequently.

We will only indicate or report your personal data to third parties if:

1. you have given us your explicit consent to do so in accordance with Article 6(1)(a) of the GDPR,
2. the disclosure is permitted under Article 6(1)(f) of the GDPR to safeguard our legitimate interests, and there is no reason to believe that you have an overriding legitimate interest in preventing the disclosure of your data,
3. there is a legal obligation to disclose the data under Article 6(1)(c) of the GDPR, and
4. this is permitted by law and necessary under Article 6(1)(b) of the GDPR for the performance of contractual relationships with you.

To protect your data and, where necessary, to enable us to transfer data to third countries (outside the EU/EEA), we have entered into data processing agreements based on the European Commission’s Standard Contractual Clauses. Where the Standard Contractual Clauses are insufficient to ensure an adequate level of security, your consent pursuant to Article 49(1)(a) of the GDPR may serve as the legal basis for transfers to third countries. This does not apply, however, to data transfers to third countries for which the European Commission has issued an adequacy decision pursuant to Article 45 of the GDPR. Your personal data will not be transferred to third parties unlike the purposes listed subsequently.

As part of the processing operations described in this privacy policy, personal data may be transferred to the USA. Organisations in the USA are deemed to have an adequate level of data protection only if they have obtained certification under the EU-US Data Privacy Framework, in which case the European Commission’s adequacy decision pursuant to Article 45 of the GDPR applies. We have explicitly stated this in the privacy policy for the relevant service providers. To protect your data in all other cases, we have entered into data processing agreements based on the European Commission’s Standard Contractual Clauses. Where the Standard Contractual Clauses are insufficient to ensure an adequate level of security, your consent pursuant to Article 49(1)(a) of the GDPR may serve as the legal basis for the transfer to third countries. This does not apply, however, to data transfers to third countries for which the European Commission has issued an adequacy decision in accordance with Article 45 of the GDPR.

7. Techniques | Technology | Engineering

7.1 SSL/TLS encryption

This website uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as orders, login details or contact enquiries, which you send to us as the operator. You can recognise an encrypted connection by the fact that the browser’s address bar displays “https://” instead of “http://”, and by the padlock icon in your browser bar.

We use this technology to protect the data you send to us.

7.2 Data collection when visiting the website

When you use our website purely for information purposes – i.e. if you do not register, do not otherwise provide us with information, or do not indicate or report your consent to processing operations requiring consent – we collect only those data that are technically essential for the provision of the service. These are typically data that your browser transmits to our server (in so-called server log files). Our website records a range of general data and information each time you or an automated system accesses a page. This general data and information is stored in the server’s log files. The following may be recorded:

1. browser types and versions employed,
2. the operating system employed by the accessing system,
3. the website from which an accessing system reaches our website (known as a ‘referrer’),
4. the bottom sides on our website accessed via an accessing system,
5. the date and time of access to the website,
6. an Internet Protocol address (IP address) and,
7. the internet service provider of the accessing system.

Moreover, we do not draw any conclusions about your identity from the use of this general data and information. Moreover, this information is required to:

1. deliver the content of our website correctly,
2. optimise the content of our website and the advertising on it,
3. ensure the durable resistance of our IT systems and the technology underpinning our website, and
4. to provide law enforcement agencies with the information necessary for criminal prosecution in the event of a cyber attack.

We therefore analyse this collected data and information, on the one hand, for statistical purposes and, on the other, with the aim of enhancing data protection and data security within our organisation, ultimately to ensure an optimal level of protection for the personal data we process. The data from the server log files is stored separately from any personal data provided by a data subject.

The legal basis for data processing is Article 6(1), first sentence, point (f) of the GDPR. Our legitimate interest arises from the purposes of data collection listed above.

7.3 IHD Hosting

When you visit our website, personal data – in particular the IP address and technically necessary connection data – is processed on IHD’s servers. This processing is carried out solely for the purpose of securely providing and operating our website.

8. Cookies

8.1 General information on cookies

Cookies are small files that your browser creates automatically and which are stored on your IT system (laptop, tablet, smartphone, etc.) when you visit our website.

The cookie stores information relating to the relationship between the specific device you are using and your identity. However, this does not mean that we thereby gain direct knowledge of your identity.

We use cookies to make your experience of our website more convenient. For example, we use so-called session cookies to recognise that you have already visited individual pages on our website. These are automatically deleted when you leave our site.

Beyond this, for the purpose of optimisation of user-friendliness, we also use temporary cookies which are stored on your device for a determined period. If you visit our site again to use our services, the system automatically recognises that you have previously visited us and recalls the entries and settings you have made, so that you do not have to re-enter them.

We also use cookies to collect statistical data on the use of our website and to analyse our offering for the purpose of optimisation. These cookies enable us to automatically recognise that you have previously visited our website when you return. The cookies set in this way are automatically deleted after a defined period. The respective storage periods for the cookies can be found in the settings of the consent tool used.

8.2 Legal basis for the use of cookies

The data processed by the cookies, which is required for the website to function properly, is therefore necessary to safeguard our legitimate interests and those of third parties in accordance with Article 6(1)(f) of the GDPR.

For all other cookies, you have given your consent via our opt-in cookie banner in accordance with Article 6(1)(a) of the GDPR.

8.3 CCM19 (Consent Management Tool)

We use the ‘CCM19’ Consent Management Tool provided by Papoo Software & Media GmbH – Agentur, Auguststr. 4, 53229 Bonn, Germany. This service enables us to obtain and manage website users’ consent to data processing.

CCM19 uses cookies to collect data generated by end users who use our website. When an end user gives their consent, the subsequent data, amongst other things, is automatically logged:

• Cookie term,
• Cookie version,
• IP address,
• Choice made in the cookie banner,
• Browser used,
• Processor ID and Controller ID.

The consent status is also stored in the end user’s browser, so that the website can automatically read and honour the end user’s consent for all subsequent page requests and future end-user sessions for up to 12 months. Consent data (consent and withdrawal of consent) is stored for three years. The retention period corresponds to the standard limitation period in accordance with Section 195 of the German Civil Code (BGB). The data is then deleted immediately.

The functionality of the website cannot be guaranteed without the processing described above. The user has no right to object as long as there is a legal obligation to obtain the user’s consent to certain data processing operations, Article 7(1) and Article 6(1), first sentence, point (c) of the GDPR.

CCM19 is the recipient of your personal data and acts as a data processor on our behalf. Data processing takes place exclusively within the European Union.

Further information can be found at: https://www.papoo.de/datenschutzerklaerung.html.

9. Content of our website

9.1 Contacting us / Contact form

Personal data is collected when you contact us (e.g. via the contact form or by email). The specific data collected when using a contact form is set out in the relevant contact form. This data is stored and employed solely for the purpose of responding to your enquiry or for establishing contact and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your enquiry in accordance with Article 6(1)(f) of the GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. Your data will be deleted once your enquiry has been fully processed; this is the case when it is clear from the circumstances that the matter in question has been conclusively resolved and there are no statutory retention obligations preventing deletion.

9.2 Application management / Job board

In connection with your application, we process your personal data solely for the purpose of conducting and processing the application procedure and for deciding whether to enter into an employment relationship.

In particular, the following personal data may be processed:

• First name and surname,
• contact details, in particular email address and telephone number,
• CV and covering letter,
• certificates and evidence of qualifications,
• data and indications about your education and professional background, as well as any further information you provide to us as part of your application.

The legal basis for the processing of your personal data as part of the recruitment process is Section 26(1) of the German Federal Data Protection Act (BDSG) in conjunction with Article 6(1)(b) of the General Data Protection Regulation (GDPR).

Insofar as special categories of personal data within the meaning of Article 9(1) of the GDPR are processed as part of your application, such processing is carried out – where applicable – on the basis of Article 9(2) of the GDPR in conjunction with Section 26(3) of the BDSG.

Your data will be treated in strict confidence and will only be made available to those persons entrusted with conducting the application process and making the selection decision.

Where we engage external service providers as data processors as part of our applicant management process, this is done on the basis of a contract in accordance with Article 28 of the GDPR. We only use carefully selected service providers who are bound by data protection obligations.

We publish job vacancies via the Indeed platform, amongst other channels. The platform is provided by Indeed Ireland Operations Limited, Block B, Capital Dock, 80 Sir John Rogerson’s Quay, Dublin 2, Ireland.

If you apply directly via Indeed for a vacancy advertised by us, the personal data you provide as part of your application will first be processed by Indeed and subsequently transferred to us. The data transferred in this context may include, in particular, the applicant and contact details mentioned above, as well as the application documents you have provided.

We process the personal data received via Indeed exclusively for the purpose of conducting the recruitment process and deciding whether to enter into an employment relationship. The legal basis for this is also Section 26(1) of the German Federal Data Protection Act (BDSG) in conjunction with Article 6(1)(b) of the General Data Protection Regulation (GDPR).

Insofar as Indeed processes personal data for its own purposes in connection with the provision and use of the platform, this processing is carried out under Indeed’s own responsibility under data protection law. We generally have no influence over the nature and scope of this independent data processing by Indeed.

Further information on the processing of personal data by Indeed can be found in Indeed’s privacy policy.

9.2.1 Retention period

Your application documents will be stored for the duration of the selection process. Unless your application leads to an employment relationship, we will generally delete your personal data no later than six months after the conclusion of the application process, provided that no statutory retention obligations or other legitimate reasons preclude such deletion.

Any storage beyond this period, for example for inclusion in a candidate pool for future job vacancies, will only take place if there is a corresponding legal basis for this, in particular if you have expressly consented to longer-term storage.

9.2.2 Rights of the data subject

Subject to the statutory requirements, you have, in particular, the right to:

• access to your personal data in accordance with Article 15 of the GDPR,
• Rectification of inaccurate or incomplete data in accordance with Article 16 of the GDPR,
• erasure of your personal data in accordance with Article 17 of the GDPR,
• Restriction of processing in accordance with Article 18 of the GDPR,
• data portability in accordance with Article 20 of the GDPR; and
• Objection to processing in accordance with Article 21 of the GDPR, provided that the legal requirements for this are met.

We have appointed an external data protection officer. You can contact them via Vetter Consulting at www.vc-datenschutz.de or by email at info@vc-datenschutz.de.

10. Newsletter distribution

10.1 Promotional newsletters

On our website, you are given the opportunity to subscribe to our company’s newsletter. The personal data provided to us when you subscribe to the newsletter is determined by the form that is employed for this purpose.

We inform our customers and business partners about our offers at regular intervals via a newsletter. You can generally only receive our company’s newsletter if

1. you have a valid email address and
2. you have registered to receive the newsletter.

For legal reasons, a confirmation email will be sent to the email address you initially provided when registering for the newsletter, using the double opt-in procedure. This confirmation email serves to verify that you, as the owner of the email address, have authorised the receipt of the newsletter.

When you subscribe to the newsletter, we also store the IP address assigned by your Internet Service Provider (ISP) to the IT system you were employing at the time of subscription, as well as the date and time of your subscription. The collection of this data is necessary to enable us to trace any (potential) misuse of your email address at a later date and therefore serves to protect us legally.

The personal data collected when you subscribe to the newsletter is employed exclusively for the purpose of sending our newsletter. Furthermore, newsletter subscribers may be informed by email where this is necessary for the operation of the newsletter service or for registration purposes, as might be the case with changes to the newsletter content or alterations to the technical conditions. No personal data collected as part of the newsletter service will be passed on to third parties. You may cancel your subscription to our newsletter at any time. The consent you have given us to store personal data for the purpose of sending the newsletter may be withdrawn at any time. A link for withdrawing consent is provided in every newsletter. Furthermore, you may unsubscribe from the newsletter at any time directly on our website or notify us of this in another way.

The legal basis for data processing for the purpose of sending the newsletter is Article 6(1)(a) of the GDPR.

10.2 Brevo (formerly Sendinblue)

We use Brevo to send out newsletters. The provider is Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany.

Brevo is a service that can be used, amongst other things, to organise and analyse the sending of newsletters. The data you provide for the purpose of subscribing to the newsletter is stored on Sendinblue’s servers in Germany.

If you do not wish your data to be analysed by Brevo, you must unsubscribe from the newsletter. We provide a link for this purpose in every newsletter message. You can also unsubscribe from the newsletter directly on the website.

You may withdraw the consent you have given at any time. You can also prevent the processing of your data at any time by unsubscribing from the newsletter. You can also prevent the storage of cookies by adjusting the settings in your web browser accordingly. You can also prevent the storage and transmission of personal data by disabling JavaScript in your web browser or by installing a JavaScript blocker (e.g. https://noscript.net or https://www.ghostery.com). Please note that these measures may mean that not all functions of our website are available.

With the help of Brevo, we are able to analyse our newsletter campaigns. This allows us, e.g., to see whether a newsletter message has been opened and which links, if any, have been clicked. In this way, we can determine, amongst other things, which links have been clicked particularly frequently.

We can also see whether certain pre-defined actions were carried out after the newsletter was opened or a link was clicked (conversion rate). E.g., we can see whether you made a purchase after clicking a link in the newsletter.

Brevo also enables us to divide newsletter recipients into different categories (known as ‘clustering’). Newsletter recipients can be categorised, e.g. by age, gender or place of residence. This allows us to tailor the newsletters more effectively to the respective target groups.

For detailed information on Brevo’s functions, please refer to the subsequent link: https://www.brevo.com/de/features/.

Data processing is carried out on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw this consent at any time. The lawfulness of any data processing operations that have already taken place remains unaffected by the withdrawal.

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from both our servers and Brevo’s servers once you have unsubscribed. Data stored by us for other purposes (e.g. email addresses for the members’ area) remains unaffected by this.

You can view Brevo’s privacy policy at: https://www.brevo.com/de/datenschutz-uebersicht/.

11. Our activities on social media

To enable us to communicate with you on social media and keep you informed about our services, we maintain our own pages on these platforms. When you visit one of our social media pages, we are jointly responsible with the provider of the relevant social media platform for the processing operations triggered thereby, within the meaning of Article 26 of the GDPR.

We are not the original provider of these pages, but merely use them within the scope of the options offered to us by the respective providers.

We therefore wish to point out, as a precaution, that your data may also be processed outside the European Union or the European Economic Area. Using these platforms may therefore entail data protection risks for you, as it may be more difficult to exercise your rights – e.g. the right to access, erasure, objection, etc. – and processing on social networks is often carried out directly by the providers for advertising purposes or to analyse user behaviour, without us being able to affect this. Where the provider creates user profiles, cookies are often used, or your usage behaviour is linked to the member profile you have created on the social media platforms.

The processing of personal data described above is carried out in accordance with Article 6(1)(f) of the GDPR on the basis of our legitimate interest and the legitimate interest of the respective provider, in order to be able to communicate with you in a modern manner and to inform you about our services. If, as a user, you are required to give your consent to data processing with the respective providers, the legal basis is Article 6(1)(a) of the GDPR in conjunction with Article 7 of the GDPR.

As we do not have access to the providers’ data sets, we would like to point out that the best way to exercise your rights (e.g. to access, rectification, erasure, etc.) is directly with the relevant provider. We have provided further information on the processing of your data on social media platforms in the subsequent section, for each social media provider we use:

11.1 LinkedIn

(Joint) data controller in Europe:

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

Privacy policy: https://www.linkedin.com/legal/privacy-policy

11.2 YouTube

(Joint) data controller in Europe:

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Privacy Policy: https://policies.google.com/privacy

12. Web analytics

12.1 Matomo

We have integrated the Matomo component from the provider InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, into this website. Matomo is a software tool for web analytics, i.e. for the collection, gathering and analysis of data on the behaviour of website visitors. Among other things, data is collected on which website a data subject came from to reach a particular website (known as the ‘referrer’), which subpages of the website were accessed, and how often and for how long a subpage was viewed. This is used for optimisation of the website and to carry out a cost-benefit analysis of online advertising.

The software is operated on the data controller’s server; the log files, which are sensitive under data protection law, are stored exclusively on this server.

Matomo places a cookie on your IT system. The placement of this cookie enables us to analyse the use of our website. Each time you access one of the individual pages of this website, the Matomo component automatically instructs the web browser on your IT system to transmit data to our server for the purposes of online analysis. As part of this technical process, we obtain personal data, such as the data subject’s IP address, which enables us, amongst other things, to trace the origin of visitors and clicks.

The cookie is used to store personal information, such as the time of access, the location from which access originated and the frequency of visits to our website. Each time you visit our website, this personal data, including the IP address of the internet connection you are using, is transmitted to our server. We store this personal data. We do not indicate or report this personal data to third parties.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Article 6(1)(a) of the GDPR.

You can view Matomo’s privacy policy at: https://matomo.org/privacy/.

13. Plugins and other services

13.1 Use of HERE Maps (HERE Technologies)

Nature and scope of processing: We embed map content from the provider HERE Technologies (HERE Global B.V., Kennedyplein 222-242, 5611 ZT Eindhoven, Netherlands) on our website. [1]

Every time you visit a page containing a HERE Maps map, a direct connection is established between your browser and HERE’s servers. This provides HERE with the information that you have visited our site using your IP address. In addition, technical device data, location data (if enabled on your device) and interactions with the map (e.g. zooming, route calculations) may be transmitted to HERE and processed there. [1, 2]

Purpose and legal basis: The use of HERE Maps is in the interest of presenting our online offering in an appealing manner and to make it easy to locate the places listed on our website. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. Where consent has been sought

(e.g. via a cookie banner), processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR; consent may be withdrawn at any time with future effect. [1, 2]

Transfers to third countries: HERE Technologies operates globally. Data processing may therefore also take place on servers outside the European Union (e.g. in the USA). To safeguard these data transfers, HERE uses Standard Contractual Clauses recognised by the European Commission to guarantee an adequate level of data protection. [1, 2]

Retention period and right to object: We have no effect on the exact retention period of the data held by HERE Technologies. For details on data use and your rights vis-à-vis HERE, please refer directly to the HERE Technologies Privacy Policy and the supplementary information for map applications in the HERE SDK Privacy Policy. https://www.here.com/de-de/privacy/here-sdk-privacy-supplement

13.2 Google Photos

We employ the Google Photos service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, to store images embedded on our website.

Embedding refers to the integration of determined third-party content (text, video or image data) provided by another website (Google Photos) and subsequently displayed on our own website (our website). An ‘embed code’ is employed for embedding. If we have integrated an embed code, the external content from Google Photos is displayed by default as soon as one of our web pages is visited.

Through the technical implementation of the embed code, which enables images from Google Photos to be displayed, your IP address is transmitted to Google Photos. Furthermore, Google Photos records our website, the type of browser used, the browser language, the time and duration of the visit. Beyond that, Google Photos may collect information about which of our subpages you have visited and which links you have clicked on, as well as other interactions you have carried out whilst visiting our site. This data may be stored and analysed by Google Photos.

These processing operations are excluded unless explicit consent has been granted in accordance with Article 6(1)(a) of the GDPR.

This US company is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Article 45 of the GDPR is in place, meaning that personal data may be transferred even without further safeguards or additional measures.

You can view Google’s privacy policy at: https://www.google.com/policies/privacy/.

13.3 Google Web Fonts

Our website uses so-called web fonts to ensure a uniform display of typefaces. Google WebFonts are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies, headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

These processing operations take place exclusively upon the granting of explicit consent in accordance with Article 6(1)(a) of the GDPR.

The parent company, Google LLC, is a US company certified under the EU-US Data Privacy Framework. An adequacy decision in accordance with Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred even without further safeguards or additional measures.

Further information on Google WebFonts and Google’s privacy policy can be found at: https://developers.google.com/fonts/faq ; https://www.google.com/policies/privacy/.

13.4 Microsoft Teams

We use the “Microsoft Teams” (“MS Teams”) tool to carry out our communications, both in written form (chat) and in the form of telephone conferences, online meetings and video conferences. The service is operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”).

When using MS-Teams, the subsequent personal data is processed:

• Meetings, chats, voicemails, shared files, recordings and transcripts.
• Data shared about you. Examples include your email address, profile picture and telephone number.
• A detailed history of the telephone calls you make.
• Call quality data.
• Support/feedback data: information relating to troubleshooting tickets or feedback sent to Microsoft in a relationship with support tickets.
• Diagnostic and service data: Diagnostic data in relation to service usage.
• To enable video display and audio playback, data from your device’s microphone and video camera is processed for the duration of the meeting. You can switch off or mute the camera or microphone yourself at any time via the ‘Microsoft Teams’ application.

Where consent has been sought, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR. In the context of an employment relationship, such data processing is carried out on the basis of Section 26 of the German Federal Data Protection Act (BDSG). The legal basis for the use of “MS Teams” within the context of contractual relationships is Article 6(1)(b) of the GDPR. In all other cases, the legal basis for the processing of your personal data is Article 6(1)(f) of the GDPR. In this context, our legitimate interest lies in the effective conduct of online meetings.

If we record online meetings, we will inform you of this before the meeting begins and, where necessary, ask for your consent to the recording. Should you not wish this to happen, you may leave the online meeting.

As a cloud-based service, ‘MS Teams’ processes the aforementioned data as part of the provision of the service. To the extent that ‘MS Teams’ processes personal data in connection with Microsoft’s legitimate business operations, Microsoft is the independent data controller for this use and, as such, is responsible for compliance with applicable laws and the obligations of a data controller. Where you access the MS Teams website, Microsoft is responsible for data processing. Accessing the website is necessary to download the MS Teams software.

Microsoft generally processes data within the European Union within the framework of the so-called EU Data Boundary. In order to provide and secure the services, as well as to fulfil legal obligations, Microsoft Ireland may transfer personal data to affiliated companies of Microsoft Corporation (Redmond, Washington, USA). Intra-group data transfers are carried out on the basis of standard contractual clauses in accordance with Article 46(2)(c) of the GDPR, as well as supplementary technical and organisational measures, as specified in the Microsoft Data Protection Addendum.

Microsoft Corporation is also certified under the EU–U.S. Data Privacy Framework (DPF). This means that an adequacy decision pursuant to Article 45 of the GDPR is in place for data transfers to the US. Transfers of personal data to Microsoft in the US are therefore permitted even without further safeguards or additional measures.

Detailed information on data protection at Microsoft, in relation to ‘MS Teams’, can be found at: https://docs.microsoft.com/de-de/microsoftteams/teams-privacy.

13.5 YouTube (videos)

We have integrated YouTube components into this website. YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

YouTube is an online video portal that enables video publishers to upload video clips free of charge and allows other users to view, perform assessments on and comment on them, also free of charge. YouTube permits the publication of all types of videos, which is why complete films and television programmes, as well as music videos, trailers and user-generated videos, are available via the portal. Each time you access one of the individual pages of this website, which is operated by us and on which a YouTube component (YouTube video) has been integrated, the web browser on your IT system is automatically prompted by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. In addition, the services Google WebFonts, Google Video and Google Photos may be loaded from YouTube. Further information about YouTube can be found at https://www.youtube.com/yt/about/de/. As part of this technical process, YouTube and Google are informed of which specific subpage of our website you are visiting.

If you are logged in to YouTube at the same time, YouTube will recognise which specific subpage of our website you are visiting when you access a subpage containing a YouTube video. This information is collected by YouTube and Google and associated with your YouTube account.

YouTube and Google always receive information via the YouTube component that you have visited our website if you are logged into YouTube at the same time as you access our website; this occurs regardless of whether you click on a YouTube video or not. If you do not wish for this information to be transmitted to YouTube and Google, you can prevent this by logging out of your YouTube account before visiting our website.

These processing operations are excluded unless explicit consent has been granted in accordance with Article 6(1)(a) of the GDPR.

The parent company, Google LLC, is a US company certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Article 45 of the GDPR is in place, meaning that personal data may be transferred without the need for further safeguards or additional measures.

You can view YouTube’s privacy policy at https://www.google.de/intl/de/policies/privacy/.

13.6 YouTube videos in enhanced privacy mode (YouTube NoCookies)

Some subpages of our website contain links to YouTube’s services. As a general rule, we are not responsible for the content of websites to which links are provided. However, should you follow a link to YouTube, please note that YouTube stores its users’ data (e.g. personal information, IP address) in accordance with its own data usage policies and uses it for commercial purposes.

YouTube is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.

We also embed videos stored on YouTube directly on some subpages of our website. When this is done, content from the YouTube website is displayed in partial areas of a browser window. When you visit a (sub)page of our website that contains embedded YouTube videos, a connection is established with the YouTube servers and the content is displayed on the website via a request sent to your browser.

YouTube content is embedded only in ‘enhanced privacy mode’. YouTube provides this mode itself and thereby ensures that YouTube does not initially store any cookies on your device. However, when you visit the relevant pages, your IP address and, where applicable, other data are transmitted, thereby indicating, in particular, which of our web pages you have visited. This information cannot, however, be linked to you unless you have logged in to YouTube or another Google service before visiting the page, or are permanently logged in. As soon as you start playing an embedded video by clicking on it, YouTube, through the enhanced privacy mode, will only store cookies on your device that do not contain any personally identifiable data, unless you are currently logged in to a Google service. These cookies can be prevented by adjusting your browser settings and using browser extensions.

Requesting the video also constitutes your consent to the placement of the relevant cookie (Article 6(1), first sentence, point (a) of the GDPR).

This US company is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Article 45 of the GDPR is therefore in place, meaning that personal data may be transferred even without further safeguards or additional measures.

You can view YouTube’s privacy policy at: https://www.google.de/intl/de/policies/privacy/.

14. Your rights as a data subject

14.1 Right to confirmation

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

14.2 Right of access (Article 15 of the GDPR)

You have the right to receive, at any time and free of charge, information from us regarding the personal data we hold about you, as well as a copy of this data, in accordance with the statutory provisions.

14.3 Right to rectification (Article 16 of the GDPR)

You have the right to request the rectification of any inaccurate personal data concerning you. Furthermore, you have the right to request the completion of any incomplete personal data, taking into account the purposes of the processing.

14.4 Erasure (Article 17 of the GDPR)

You have the right to request that we erase personal data concerning you without undue delay, provided that one of the grounds laid down by law applies and insofar as the processing or storage is not necessary.

14.5 Restriction of processing (Article 18 of the GDPR)

You have the right to request that we restrict the processing of your personal data if one of the statutory conditions is met.

14.6 Data portability (Article 20 of the GDPR)

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller to whom the personal data has been provided, without hindrance from us, provided that the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability under Article 20(1) of the GDPR, you have the right to have the personal data transmitted directly from one controller to another, in so far as this is technically feasible and provided that this does not affect the rights and freedoms of others in any way.

14.7 Objection under Article 21 of the GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) (data processing in the public interest) or (f) (data processing based on a balancing of interests) of the GDPR.

This also applies to profiling based on these determinations within the meaning of Article 4(4) of the GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing serves to establish, exercise or defend legal claims.

In individual cases, we process personal data for the purposes of direct marketing. You may object at any time to the processing of your personal data for the purposes of such marketing. This also applies to profiling insofar as it is related to such direct marketing. If you object to us processing your personal data for direct marketing purposes, we will no longer process your personal data for these purposes.

Furthermore, you have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you which we carry out for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

You are free, in the relationship between the use of information society services and Directive 2002/58/EC, to exercise your right to object by means of automated procedures that employ technical specifications.

14.8 Withdrawal of consent under data protection law

You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.

14.9 Lodging a complaint with a supervisory authority

You have the right to lodge a complaint with the Saxon Data Protection and Transparency Commissioner regarding our processing of personal data. You can find the contact details and further information on the Saxon Data Protection and Transparency Commissioner’s website.

15. Validity and amendments to the privacy policy

This privacy policy is currently valid and is dated August 2026.

Due to the ongoing development of our website and services, or as a result of changes to legal or regulatory requirements, it may become necessary to amend this privacy policy. You can access and print the current version of the privacy policy at any time on the website at “https://www.ihd-dresden.de/de/en/privacy/”.

This Privacy Policy was created with the assistance of the data protection software: VC Data Security Manager.