Privacy policy

Table of contents

1. Name and address of the data controller
2. Contact details of the data protection officer
3. General information on data processing
4. Rights of the data subject
5. Provision of the website and creation of log files
6. Use of cookies
7. Newsletter
8. Contact form
9. Application by email
10. Google company profile
11. Youtube company profile
12. Use of company profiles in job-orientated networks
13. Hosting
14. Provision of our podcast
15. Plugins used

I. Name and address of the data controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is

Betterspace GmbH
Oberpörlitzer Straße 2
98693 Ilmenau
Ilmenau, Germany

49 (0) 3677 7613100
info@betterspace360.com
https://betterspace360.com

II. Contact details of the data protection officer

The data protection officer of the controller is

DataCo GmbH
Dachauer Street 65
80335 Munich
Germany

49 89 7400 45840
www.dataguard.de

III. General information on data processing

1. Scope of the processing of personal data

We only process our users’ personal data to the extent necessary to provide a functional website and our content and services. The processing of our users’ personal data only takes place regularly with the user’s consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is required by law.

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 sentence 1 lit. a GDPR serves as the legal basis.

When processing personal data that is necessary for the fulfilment of a contract to which the data subject is a party, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.

Insofar as the processing of personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 sentence 1 lit. d GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for the processing.

3. Legal basis for the processing of data on your terminal equipment

The legal basis for the use of technically necessary cookies and related data processing is § 25 para. 2 TTDSG i.V.m. Art. 6 para. 1 lit. f) GDPR. The processing serves to make it easier for you to use our website and to be able to offer you our services as desired. Some functions of our website do not work without the use of these cookies and could therefore not be offered. Our legitimate interest in the processing of cookies arises from the aforementioned purposes. The cookies are deleted after the end of the session (e.g. logging out or closing the browser) or after the expiry of a specified duration.

The legal basis for the use of technically unnecessary cookies is your consent, which you give us via the cookie banner in accordance with § 25 para. 1 TTDSG i.V.m. Art. 6 para. 1 lit. a) GDPR. For these services, you can revoke your consent at any time with effect for the future or give it again at a later date by accessing your cookie and privacy settings online via our data protection information and configuring them accordingly. Alternatively, you can prevent the storage of cookies by selecting the appropriate settings in your browser software. Please note that the browser settings you make only apply to the browser you are using. Further detailed information can be found in the following descriptions.

4. Data erasure and storage duration

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.

IV. Your rights as a data subject

If we process your personal data, you can assert the following rights against us:

1. The right to information (Art. 15 GDPR)

You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have a right of access to this data and to the following information

• Processing purposes
• Categories of personal data
• Recipients or categories of recipients
• Planned storage duration or the criteria for determining this duration
• The existence of the rights to rectification, erasure, restriction or objection
• Right to lodge a complaint with the competent supervisory authority
• If applicable, origin of the data (if collected from a third party)
• If applicable, the existence of automated decision-making including profiling with meaningful information about the logic involved, the scope and the expected effects
• If applicable, transfer of personal data to a third country or international organisation

2. Right to rectification (Art. 16 GDPR)

If your personal data is incorrect or incomplete, you have the right to request that the personal data be corrected or completed without undue delay.

3. Right to erasure (“right to be forgotten”) (Art. 17 GDPR)

If one of the following reasons applies, you have the right to request the erasure of your personal data without undue delay

• Your data is no longer necessary for the processing purposes for which it was originally collected
• You withdraw your consent and there is no other legal basis for the processing
• You object to the processing and there are no overriding legitimate grounds for the processing or you object pursuant to Art. 21 (2) GDPR
• Your personal data is being processed unlawfully
• The deletion is necessary to fulfil a legal obligation under Union law or the law of the member state to which we are subject
• The personal data have been collected in relation to the offer of information society services referred to in Article 8(1)

Please note that the above reasons do not apply if the processing is necessary

• For exercising the right of freedom of expression and information
• For compliance with a legal obligation or for the performance of a task carried out in the public interest to which we are subject
• For reasons of public interest in the area of public health
• For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
• For the establishment, exercise or defence of legal claims

4. Right to restriction of processing (Art. 18 GDPR)

If one of the following conditions is met, you have the right to request that the processing of your personal data be restricted

1. You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data.
2. In the event of unlawful processing, you oppose the erasure of the personal data and request the restriction of their use instead.
3. We no longer need your personal data for the purposes of the processing, but you require your personal data for the establishment, exercise or defence of legal claims, or
4. After you have objected to the processing, for the duration of the examination as to whether our legitimate reasons outweigh your reasons.

5. Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format or to request that it be transferred to another controller.

6. Right to object to certain data processing (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR. This also applies to profiling based on these provisions.

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is associated with such direct marketing.

7. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

A list of the locally competent supervisory authorities in Germany can be found on the website of the Federal Commissioner for Data Protection at the following link: https: //www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

V. Provision of the website and creation of log files

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

The following data is collected:

• Information about the browser type and version used
• The user’s operating system
• The user’s internet service provider
• Date and time of access
• Websites from which the user’s system accesses our website
• Websites that are accessed by the user’s system via our website

This data is stored in the log files of our system. This does not affect the user’s IP addresses or other data that allow the data to be assigned to a user. This data is not stored together with other personal data of the user.

2. Purpose of data processing

Data is stored in log files to ensure the functionality of the website. We also use the data to optimise the website and to ensure the security of our information technology systems. The data is not analysed for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR.

3. Legal basis for data processing

The legal basis for the temporary storage of data is Art. 6 para. 1 sentence 1 lit. f GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

5. Objection and removal options

The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. The user can object to this. Whether the objection is successful must be determined as part of a weighing of interests.

VI. Use of cookies

1. Description and scope of data processing

Cookies are set when you visit our website. Cookies are files that are stored in the Internet browser or by the Internet browser on the user’s computer system. This storage of information on the user’s end device can take place using unique identifiers (UID), which enables us to identify or assign it to a natural person.

2. Purpose and legal basis of data processing

The provisions of the Telecommunications and Telemedia Data Protection Act (TTDSG) apply to the storage of information in the end user’s terminal equipment and/or access to information already stored in the end user’s terminal equipment. If the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, cookies are stored and accessed on your terminal equipment on the basis of Section 25 (2) No. 2 TTDSG. This storage and access to the information in your end device serves to make it easier for you to use our website and to be able to offer you our services as you have requested. Some functions of our website do not work without the use of these cookies and could therefore not be offered. Cookies are generally deleted at the end of the session (e.g. when you log out or close the browser) or after a specified period of time has elapsed. Information on different storage periods for cookies can be found in the following sections of this privacy policy.

If cookies are used that are not technically necessary, this is done on the basis of your express consent, which you can give via the cookie banner. The basis for the storage and access to information in this case is § 25 para. 1 TTDSG i.V.m. Art. 6 para. 1 lit. a), Art. 7 GDPR. You can revoke your consent at any time with effect for the future or subsequently grant it again by configuring your cookie settings accordingly. Alternatively, you can prevent the storage of cookies by making the appropriate settings in your browser software. Please note that the browser settings you make only apply to the browser you are using.

If personal data is processed following the storage of and access to the information on your end device, the provisions of the GDPR apply. Information on this can be found in the following sections of this privacy policy.

3. Cancellation

The user has the option to revoke their consent to the processing of personal data at any time.

VII. Newsletter

1. Description and scope of data processing

You can subscribe to a free newsletter on our website. When registering for the newsletter, the data from the input screen is transmitted to us.

1. E-mail address
2. Date and time of registration

No data is passed on to third parties in connection with the data processing for sending newsletters. The data is used exclusively for sending the newsletter.

2. Purpose of data processing

The purpose of collecting the user’s email address is to send the newsletter.

The collection of other personal data as part of the registration process serves to prevent misuse of the services or the e-mail address used.

3. Legal basis for data processing

The legal basis for the processing of data after the user has registered for the newsletter is Art. 6 para. 1 sentence 1 lit. a GDPR if the user has given consent.

4. Duration of storage

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. The user’s email address is therefore stored for as long as the subscription to the newsletter is active.

The other personal data collected during the registration process is generally deleted after a period of seven days.

5. Right of objection and cancellation

The subscription to the newsletter can be cancelled by the user concerned at any time. For this purpose, there is a corresponding link in every newsletter.

This also makes it possible to revoke consent to the storage of personal data collected during the registration process.

You can also revoke your consent by sending an informal email to datenschutz@betterspace360.com.

VIII. Contact form

1. Description and scope of data processing

There is a contact form on our website that can be used to contact us electronically. If a user makes use of this option, the data entered in the input mask will be transmitted to us and stored.

The following data is stored when the message is sent

1. E-mail address
2. Surname
3. First name
4. Telephone / mobile phone number
5. IP address of the calling computer
6. Date and time of contact
7. Hotel name, number of rooms, title, product interests, enquiry type, campaign ID, referrer page, lead status, page title, current URL

Alternatively, contact can be made via the e-mail address provided. In this case, the user’s personal data transmitted with the e-mail will be stored.

The data is used exclusively for processing the conversation.

2. Purpose of data processing

The processing of the personal data from the input mask serves us solely to process the contact. If contact is made by email, this also constitutes the necessary legitimate interest in processing the data.

The other personal data processed during the sending process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

3. Legal basis for data processing

The legal basis for the processing of data transmitted in the course of sending a contact form is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest is to answer your enquiry, which you send to us via the contact form, in the best possible way.

If the contact via the contact form is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. For the personal data from the input screen of the contact form and those sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

5. Objection and removal option

If the user contacts us by e-mail or contact form, they can object to the storage of their personal data at any time. The cancellation can be exercised by sending an informal email to datenschutz@betterspace360.com.

All personal data stored in the course of contacting us will be deleted in this case.

IX. Application by e-mail

1. Scope of the processing of personal data

You can send us your application by email. We will collect your email address and the data you provide in the email.

• Salutation
• First name
• Surname
• Email address

The following data is also processed on a voluntary basis:

• Address
• Telephone / mobile phone number
• Date and place of birth
• Information on education and schooling
• Language skills
• Curriculum vitae (including all the usual standard details of a curriculum vitae)
• References and certificates related to the professional activity
• Photo
• Residence status
• Salary expectations
• Earliest possible start date of employment
• Work samples (e.g. portfolio in the field of visual design)

2. Purpose of data processing

We process the personal data from your application email solely for the purpose of processing your application.

3. Legal basis for data processing

The legal basis for the processing of your data is the initiation of a contract at the request of the data subject, Art. 6 para. 1 sentence 1 lit. b Alt. 1 GDPR and § 26 para. 1 sentence 1 BDSG.

4. Duration of storage

After completion of the application process, the data will be stored for up to six months. Your data will be deleted after six months at the latest. In the event of a legal obligation, the data will be stored in accordance with the applicable provisions.

5. Right of objection and cancellation

The applicant has the option to object to the processing of personal data at any time. In such a case, the application can no longer be considered.

You can inform us of your cancellation at any time via the contact option provided at the beginning of this data protection notice(info@betterspace360.com).

All personal data stored in the course of electronic applications will be deleted in this case.

X. Google company profiles

We operate a Google company profile. If you find us in this way, we use the information service offered by Google and the services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as “Google”).

If you perform an action on our Google company profile (e.g. comments, posts, likes, direct messages, sharing, etc.), you may make personal data (e.g. real name or photo of your user profile) public. However, as we generally have no influence on the processing of your personal data by Google, we cannot provide any binding information on the purpose and scope of the processing of your data by Google. What information Google receives and how it is used is generally described by Google in its privacy policy: https://policies.google.com/privacy .

Our company presence on social networks is used for communication and information exchange with (potential) customers. In particular, we use the company’s presence for customer acquisition with optimised company profiles, including the possibility of contacting users and statistical evaluation.

Every user is free to publish personal data through activities.

The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in the provision of a corporate presence, customer acquisition and communication with customers and interested parties.

The data generated by the company website is not stored in our own systems.

You can find more information on the processing of your personal data by Google and the corresponding objection options here: https: //policies.google.com/privacy

XI. YouTube company profile

YouTube: YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, United States

We use our corporate presence on social networks to communicate and exchange information with (potential) customers. In particular, we use the company presence for
Presenting company information, product information, industry information, advice and tips for potential customers, experiences and opinions of our customers.

Publications on the company website may contain the following content:

• Information about products
• Information about services
• Advertising

Every user is free to publish personal data through activities.

Insofar as we process your personal data in order to evaluate your online behaviour, offer you competitions or carry out lead campaigns, this is done on the basis of your express declaration of consent, Art. 6 para. 1 sentence 1 lit. a, Art. 7 GDPR. The legal basis for the processing of personal data for the purpose of communicating with customers and interested parties is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest here is to respond to your enquiry in the best possible way or to be able to provide the requested information. If the contact is aimed at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.

The data generated by the company website is not stored in our own systems.

For the processing of your personal data in third countries, we have provided suitable guarantees in the form of standard data protection clauses in accordance with Art. 46 para. 2 lit. c GDPR. A copy of the standard data protection clauses can be requested from us.

YouTube: https://policies.google.com/privacy?gl=DE&hl=de

XII. Use of company presences in professional networks

1. Scope of data processing

We use the option of company presences on professional networks. We maintain a company presence on the following professional networks

LinkedIn:
LinkedIn, Unlimited Company Wilton Place, Dublin 2, Ireland

XING:
XING SE, Dammtorstraße 30, 20354 Hamburg, Germany

On our website, we provide information and offer users the opportunity to communicate.

The company website is used for job applications, information/PR and active sourcing.

We have no information on the processing of your personal data by the companies jointly responsible for the company website. Further information can be found in the privacy policy of

LinkedIn:
https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

XING:
https://privacy.xing.com/de/datenschutzerklaerung

If you carry out an action on our company website (e.g. comments, posts, likes, etc.), you may make personal data (e.g. real name or photo of your user profile) public.

2. Legal basis for data processing

The legal basis for the processing of your data in connection with the use of our company website is Art. 6 para. 1 sentence 1 lit. f GDPR.

3. Purpose of the data processing

The purpose of our company website is to inform users about our services. Every user is free to publish personal data through activities.

4. Duration of storage

We store your activities and personal data published via our company website until you withdraw your consent. In addition, we comply with the statutory retention periods.

5. Cancellation and removal options

You can object to the processing of your personal data that we collect as part of your use of our company website at any time and assert your rights as a data subject mentioned under IV. of this privacy policy. To do so, please send us an informal email to the email address stated in this privacy policy.

Further information on objection and removal options can be found here:

LinkedIn:
https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

XING:
https://privacy.xing.com/de/datenschutzerklaerung

XIII Hosting

The website is hosted on servers of a service provider commissioned by us.

Our service provider is:
Keyweb AG

The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The information stored is

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Date and time of the server enquiry
• IP address

This data is not merged with other data sources. This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website – the server log files must be recorded for this purpose.

The website server is geographically located in Germany.

An order processing contract has been concluded with the provider to ensure compliance with data protection regulations.

XIV Provision of our podcast

1. Description and scope of data processing

We make our podcast available on our website. Here we use the podcast hosting service provider Spotify for Podcasters, a service of Spotify AB, Regeringsgatan 19 111 53 Stockholm, Sweden.

When the podcast is played, we collect the following data

• Approximate location (federal state)
• Platform of the playback
• Playback devices (Windows, iPhone, Android, other)
• Gender (logged-in Spotify users)
• Age groups (logged-in Spotify users)
• IP address

When you play the podcast, a direct connection can be established between your browser and the Spotify server. Spotify receives the information that you have visited this website with your IP address. If you listen to the podcast while you are logged into your Spotify account, you can link the content of this website to your Spotify profile. This allows Spotify to associate your visit to this website with your user account.

2. Purpose of the data processing

Provision and playback of our podcast.

3. Legal basis for data processing

The legal basis for the processing of the data collected in the course of the podcast offer is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in the improvement and expansion of our offer through the podcast; the secure, efficient and user-friendly provision of the podcasts and the analysis and optimisation of our podcast offer.

4. Duration of storage

The data is only stored for as long as necessary to provide the service for the provision and operation of the podcast. The personal data will be deleted or anonymised by Spotify at the latest when the provision of the podcast ends.

5. Possibility of objection and removal

You can object to the processing of your personal data, which we collect in the context of your use of our company website, at any time and assert your rights as a data subject mentioned under IV. of this privacy policy. To do so, send us an informal email to the email address stated in this privacy policy. Further information on objection and removal options can be found here: https://www.spotify.com/de/legal/privacy-policy/

XV. plugins used

We use plugins for various purposes. The plugins used are listed below:

Use of Google Analytics

1. Scope of the processing of personal data

We use Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA and its representative in the Union Google Ireland Ltd, Gordon House, Barrow Street, D04 E5W5, Dublin, Ireland (hereinafter referred to as: Google). Google Analytics analyses, among other things, the origin of visitors, the time they spend on individual pages and the use of search engines, thereby enabling better monitoring of the success of advertising campaigns. Google places a cookie on your computer. This allows personal data to be stored and analysed, in particular the user’s activity (in particular which pages have been visited and which elements have been clicked on), device and browser information (in particular the IP address and operating system), data about the advertisements displayed (in particular which advertisements have been displayed and whether the user has clicked on them) and also data from advertising partners (in particular pseudonymised user IDs).

We use Google Analytics (Universal Analytics) to analyse your use of our online presence, to compile reports on your activities and to use other Google services associated with the use of our online presence and the use of the Internet.

We have requested the anonymisation of IP addresses, whereby Google shortens your IP address as soon as technically possible. However, it cannot be ruled out that your data will be transmitted to the servers of Google LLC based in the USA. On behalf of the operator of this online presence, Google will use this information to analyse your use of the online presence, to compile reports on the activities of the online presence and to provide the operator of the online presence with further services associated with the use of the online presence and the use of the Internet.

Further information on the processing of data by Google can be found here: https://policies.google.com/privacy?gl=DE&hl=de

2. Purpose of the data processing

We use Google Analytics (Universal Analytics) to analyse the use of our online presence and to display targeted advertising to people who have already shown an initial interest by visiting our website.

3. Legal basis for the processing of personal data

The legal basis for the processing of users’ personal data is generally the consent of the user in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

4. Duration of storage

Your personal information will be stored for as long as necessary to fulfil the purposes described in this privacy policy or until you exercise your right of withdrawal.

5. Right of cancellation

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

You can prevent the collection and processing of your personal data by Google by preventing the storage of third-party cookies on your computer, using the “Do Not Track” function of a supporting browser, deactivating the execution of script code in your browser or installing a script blocker such as NoScript (https://noscript.net/ ) or Ghostery (https://www.ghostery.com ) in your browser.

You can also prevent Google from collecting the data generated by the cookie and relating to your use of the online presence (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: https: //tools.google.com/dlpage/gaoptout?hl=de

You can use the following link to deactivate the use of your personal data by Google: https: //adssettings.google.de

Further information on objection and removal options vis-à-vis Google can be found at: https: //policies.google.com/privacy?gl=DE&hl=de

6. Risk warning

Your personal data will also be transferred to the USA. There is no adequacy decision for the USA pursuant to Art. 45 (3) GDPR. We would like to point out that data transfer without an adequacy decision harbours certain risks, which we would like to inform you about below:

US intelligence services use certain online identifiers (such as the IP address or unique identification numbers) as a starting point for monitoring individuals. In particular, it cannot be ruled out that these intelligence services have already collected information about you, with the help of which the data transmitted here can be traced back to you.

Providers of electronic communications services headquartered in the USA are subject to surveillance by US intelligence agencies pursuant to 50 U.S. Code § 1881a (“FISA 702”). Accordingly, providers of electronic communications services headquartered in the USA are obliged to make personal data available to the US authorities in accordance with 50 U.S. Code § 1881a, without possibly being entitled to legal remedies. Even encryption of the data in the data centres of the electronic communications service provider may not provide adequate protection, as an electronic communications service provider has a direct obligation to grant access to or disclose imported data in its possession, custody or control. This obligation may expressly extend to the cryptographic keys without which the data cannot be read.

The fact that this is not merely a “theoretical risk” is demonstrated by the ECJ ruling of 16 July 2020 (Case C 311/18, “Schrems-II”).

We have concluded guarantees with Google in the form of standard data protection clauses in accordance with Art. 46 para. 2 lit. c GDPR. A copy of the standard data protection clauses can be requested from us.

This privacy policy was created with the support of DataGuard.