Data Privacy
- Home >
- Data Privacy
Privacy Policy
Version: 01 October 2026
Table of Contents
Controller
Overview of Processing
Relevant Legal Bases
Security Measures
Transfer of Personal Data
General Information on Data Storage and Deletion
Rights of Data Subjects
Provision of the Online Offering and Web Hosting
Contact and Inquiry Management
Video Conferences, Online Meetings, Webinars and Screen Sharing
Social Media Presence
Plug-ins and Embedded Functions as well as Content
Changes and Updates
Controller
proISMS GmbH
Am Sandtorkai 77
20457 Hamburg
what3words: ///fixated.cares.count
| Authorized Representative: | Managing Director Sabrina Stephan |
| Email: | ed.smsi-orp@ztuhcsnetad |
| Legal Notice: | View |
Overview of Processing
The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects concerned.
Types of Data Processed
- Contact Data
- Content Data
- Contract Data
- Usage Data
- Meta, communication and procedural data
- Log Data
Categories of Data Subjects
- Service Recipients and Clients
- Prospective Customers
- Communication Partners
- Users
- Business and Contractual Partners
Purposes of Processing
- Provision of contractual services and fulfillment of contractual obligations
- Communication
- Security Measures
- Office and Organizational Procedures
- Organizational and Administrative Processes
- Feedback
- Provision and Optimization of Our Online Services
- Information Technology Infrastructure
- Public Relations
Relevant Legal Bases
Relevant legal bases according to the GDPR
The following provides an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country of residence or our country of residence. If more specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.
- Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR) - The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.
- Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR) - The processing is necessary for the performance of a contract to which the data subject is a party or in order to take pre-contractual measures at the request of the data subject.
- Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR) - The processing is necessary for compliance with a legal obligation to which the controller is subject.
- Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR) - the processing is necessary to safeguard the legitimate interests of the controller or a third party, provided that the interests, fundamental rights and freedoms of the data subject requiring the protection of personal data do not override them.
National data protection regulations in Germany
In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. This includes in particular the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains, in particular, special provisions regarding the right of access, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes and transfers, as well as automated decision-making in individual cases including profiling. State data protection laws of the individual federal states may also apply.
Notice regarding the applicability of the GDPR and Swiss FADP
These data protection notices serve both to provide information in accordance with the Swiss FADP and the General Data Protection Regulation (GDPR). For this reason, please note that, due to their broader territorial application and comprehensibility, the terms of the GDPR are used. In particular, instead of the terms “processing” of “personal data”, “predominant interest” and “particularly sensitive personal data” used in the Swiss FADP, the terms “processing” of “personal data”, “legitimate interest” and “special categories of data” used in the GDPR are used. However, the legal meaning of the terms continues to be determined under the Swiss FADP insofar as the Swiss FADP applies.
Security Measures
We take appropriate technical and organizational measures in accordance with the statutory requirements, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of processing, as well as the varying likelihood of occurrence and the extent of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.
The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access concerning the data, input, disclosure, safeguarding of availability and separation. Furthermore, we have established procedures that ensure the exercise of data subject rights, the deletion of data and responses to threats to data. We also take the protection of personal data into account already during the development or selection of hardware, software and procedures in accordance with the principle of data protection, through data protection by design and data protection-friendly default settings.
Securing online connections using TLS/SSL encryption technology (HTTPS)
In order to protect users’ data transmitted through our online services from unauthorized access, we rely on TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. If a website is secured by an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is transmitted securely and in encrypted form.
Transfer of Personal Data
As part of our processing of personal data, it may happen that this data is transferred to or disclosed to other bodies, companies, legally independent organizational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content integrated into a website. In such cases, we comply with the statutory requirements and, in particular, conclude corresponding contracts or agreements with the recipients that serve to protect your data.
Data transfer within the organization
We may transfer personal data to other departments or units within our organization or grant them access to it. If the data transfer is carried out for administrative purposes, it is based on our legitimate business and commercial interests or takes place, insofar as it is necessary to fulfill our contractual obligations, or if the data subject has given consent or a legal permission exists.
General Information on Data Storage and Deletion
We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consents are revoked or there are no longer any other legal bases for the processing. This applies in cases where the original purpose of processing no longer applies or the data is no longer required. Exceptions to this rule exist if statutory obligations or special interests require longer retention or archiving of the data.
In particular, data that must be retained for commercial or tax reasons or whose storage is necessary for legal enforcement or for protecting the rights of other natural or legal persons must be archived accordingly.
Our data protection notices contain additional information on the retention and deletion of data that specifically applies to certain processing activities.
If several retention periods or deletion deadlines are specified for a piece of data, the longest period always applies. Data that is no longer retained for the originally intended purpose but due to statutory requirements or other reasons is processed exclusively for the reasons justifying its retention.
Retention and deletion of data
The following general periods apply to the retention and archiving of data under German law:
6 Years
Other business documents: received commercial or business letters, reproductions of commercial or business letters sent, other documents insofar as they are relevant for taxation, e.g. hourly wage sheets, operating cost accounting sheets, calculation documents, price labels, but also payroll documents insofar as they are not already accounting documents and cash register strips (§ 147 para. 1 nos. 2, 3, 5 in conjunction with para. 3 AO, § 257 para. 1 nos. 2 and 3 in conjunction with para. 4 HGB).
3 Years
Data required to take into account potential warranty and damages claims or similar contractual claims and rights, as well as to process related inquiries, based on previous business experience and customary industry practices, is stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB).
Rights of Data Subjects
Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:
- Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or f GDPR; this also applies to profiling based on these provisions. If personal data concerning you is processed for the purpose of direct advertising, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is related to such direct advertising.
- Right to withdraw consent: You have the right to withdraw consent that you have given at any time.
- Right of access: You have the right to request confirmation as to whether relevant data is being processed and to obtain access to this data as well as further information and a copy of the data in accordance with the statutory requirements.
- Right to rectification: In accordance with the statutory requirements, you have the right to request the completion of data concerning you or the correction of inaccurate data concerning you.
- Right to deletion and restriction of processing: In accordance with the statutory requirements, you have the right to request that data concerning you be deleted immediately or, alternatively, to request restriction of the processing of the data in accordance with the statutory requirements.
- Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the statutory requirements, or to request that it be transmitted to another controller.
- Right to lodge a complaint with a supervisory authority: In accordance with the statutory requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State where you usually reside, the supervisory authority at your workplace or the place of the alleged infringement, if you believe that the processing of personal data concerning you violates the GDPR.
Provision of the Online Offering and Web Hosting
We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or end device.
- Types of data processed: Usage data (e.g. page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, persons involved); Log data (e.g. log files relating to logins or data retrieval or access times). Content data (e.g. textual or visual messages and contributions as well as information relating to them, such as authorship or time of creation).
- Data subjects: Users (e.g. website visitors, users of online services).
- Purposes of processing and legitimate interests: Provision of our online offering and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); Security measures.
- Retention and deletion: Deletion in accordance with the information in the section "General Information on Data Storage and Deletion".
- Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Further information on processing activities, procedures and services:
- Provision of online offering on rented storage space: To provide our online offering, we use storage space, computing capacity and software that we rent or otherwise obtain from an appropriate server provider (also known as a "web hoster"); Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
- Collection of access data and log files: Access to our online offering is recorded in the form of so-called "server log files". Server log files may include the address and name of the websites and files accessed, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited website) and, as a rule, IP addresses and the requesting provider. Server log files may be used for security purposes, e.g. to prevent server overload (especially in the event of abusive attacks, so-called DDoS attacks), and to ensure server utilization and stability; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR). Deletion of data: Log file information is stored for a maximum period of 30 days and then deleted or anonymized. Data whose further retention is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
- E-mail sending and hosting: The web hosting services we use also include the sending, receipt and storage of e-mails. For these purposes, the addresses of recipients and senders as well as further information relating to e-mail transmission (e.g. the providers involved) and the content of the respective e-mails are processed. The aforementioned data may also be processed for the purpose of detecting SPAM. Please note that e-mails are generally not sent in encrypted form over the Internet. As a rule, e-mails are encrypted during transmission, but (unless a so-called end-to-end encryption method is used) they are not encrypted on the servers from which they are sent and received. We therefore cannot assume any responsibility for the transmission path of e-mails between the sender and receipt on our server; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
- STRATO: Services in the area of providing information technology infrastructure and related services (e.g. storage space and/or computing capacities); Service provider: STRATO AG, Pascalstraße 10, 10587 Berlin, Germany; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.strato.de; Privacy policy: https://www.strato.de/datenschutz/. Data processing agreement: Provided by the service provider.
- WordPress.com: Hosting and software for creating, providing and operating websites, blogs and other online offerings; Service provider: Aut O’Mattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Pl, Dublin, D02 AY86, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://wordpress.com; Privacy policy: https://automattic.com/de/privacy/; Data processing agreement: https://wordpress.com/support/data-processing-agreements/. Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (provided by the service provider).
- Yoast SEO: Optimization of websites for search engines; Service provider: Yoast B.V., Don Emanuelstraat 3, 6602 GX Wijchen, Netherlands; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://yoast.com/; Privacy policy: https://www.newfold.com/privacy-center?currencyCode=EUR&langPref=de. Further information: Operation within our own hosting environment.
Contact and Inquiry Management
When contacting us (e.g. by post, contact form, e-mail, telephone or via social media) and in the context of existing user and business relationships, the information provided by the persons making inquiries is processed insofar as this is necessary to answer contact inquiries and any requested measures.
- Types of data processed: Contact data (e.g. postal and e-mail addresses or telephone numbers); Content data (e.g. textual or visual messages and contributions as well as information relating to them, such as authorship or time of creation); Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, persons involved). Usage data (e.g. page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
- Data subjects: Users (e.g. website visitors, users of online services).
- Purposes of processing and legitimate interests: Communication; Organizational and administrative procedures; Feedback (e.g. collecting feedback via online form); Provision of our online offering and user-friendliness. Office and organizational procedures.
- Retention and deletion: Deletion in accordance with the information in the section "General Information on Data Storage and Deletion".
- Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Further information on processing activities, procedures and services:
- Contact form: When contacting us via our contact form, by e-mail or through other communication channels, we process the personal data transmitted to us to answer and process the respective request. This generally includes information such as name, contact details and, where applicable, further information provided to us that is necessary for appropriate processing. We use this data exclusively for the stated purpose of contacting and communicating; Legal bases: Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
- Zeeg: Appointment booking and management, automatic synchronisation with calendars, customised booking pages, real-time notifications; Service provider: Zeeg GmbH, Friedrichstr. 155, 10117 Berlin, Germany; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: KI-Telefonassistent und Terminbuchungssoftware - Zeeg; Privacy policy: Datenschutzerklärung - Zeeg.
Video Conferences, Online Meetings, Webinars and Screen Sharing
We use platforms and applications provided by other providers (hereinafter referred to as “conference platforms”) for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as “conferences”). When selecting conference platforms and their services, we comply with legal requirements.
Data Processed by Conference Platforms:
When participating in a conference, the conference platforms process the following personal data of participants. The scope of processing depends, on the one hand, on which data is required for a specific conference (e.g. access data or real name) and which optional information is provided by participants. In addition to processing for the purpose of conducting the conference, participants’ data may also be processed by the conference platforms for security purposes or service optimisation. The data processed includes personal information (first name, surname), contact information (email address, telephone number), access data (access codes or passwords), profile pictures, information about professional position/function, the IP address of the internet connection, information about participants’ end devices, their operating system, browser and language settings, information about communication activities, i.e. entries in chats as well as audio and video data, and use of other available functions (e.g. surveys). Communication content is encrypted to the extent technically provided by the conference provider. If participants are registered as users with the conference platforms, additional data may be processed in accordance with the agreement with the respective conference provider.
- Logging and recordings: If text entries, participation results (e.g. survey results), or video or audio recordings are logged or recorded, participants will be informed transparently in advance and, where required, their consent will be requested.
- Data protection measures for participants: For details regarding the processing of your data by conference platforms, please refer to their privacy notices and select, within the settings of the conference platforms, the security and privacy settings that are appropriate for you. Please also ensure the protection of data and personal privacy in the background of your recording for the duration of a video conference (e.g. by informing people you live with, locking doors and, where technically possible, using the function for blurring the background). Links to conference rooms and access data must not be passed on to unauthorised third parties.
- Notes on legal bases: Where we process user data in addition to the conference platforms and ask users for their consent to the use of conference platforms or certain functions (e.g. consent to recording conferences), the legal basis for processing is this consent. Our processing may also be necessary to fulfil our contractual obligations (e.g. in participant lists or when processing meeting results). In other respects, user data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.
- Types of data processed: Master data (e.g. full name, residential address, contact information, customer number, etc.); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. textual or visual messages and contributions, as well as information relating to them, such as authorship or time of creation); usage data (e.g. page views and duration of visits, click paths, intensity and frequency of use, types of devices and operating systems used, interactions with content and functions); image and/or video recordings (e.g. photographs or video recordings of a person); audio recordings. Log data (e.g. log files relating to logins or retrieval of data or access times).
- Data subjects: Communication partners; users (e.g. website visitors, users of online services); persons depicted.
- Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; communication; office and organisational procedures.
- Retention and deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion”.
- Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Further information on processing activities, procedures and services:
- Zoom: Video conferences, online meetings, webinars, screen sharing, optional recording of sessions, chat function, integration with calendars and other apps; Service provider: Zoom Video Communications, Inc., 55 Almaden Blvd., Suite 600, San Jose, CA 95113, USA; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.zoom.com; Privacy policy: https://www.zoom.com/de/trust/privacy/privacy-statement/; Data processing agreement: https://media.zoom.com/download/assets/zoom-global-dpa.pdf/dd327ebea27e11efb613d6ba63ed4cee. Basis for third-country transfers: Data Privacy Framework (DPF), standard contractual clauses (https://media.zoom.com/download/assets/zoom-global-dpa.pdf/dd327ebea27e11efb613d6ba63ed4cee).
Plug-ins and Embedded Functions as well as Content
We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos or city maps (hereinafter collectively referred to as “content”).
The integration always requires the third-party providers of this content to process the users’ IP addresses, as they would not be able to send the content to their browsers without the IP address. The IP address is therefore required for the display of this content or functions. We endeavor to use only such content whose respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the users’ devices and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and further information about the use of our online offering, but may also be combined with such information from other sources.
Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for data processing is permission. Otherwise, user data is processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to refer you to the information on the use of cookies in this privacy policy.
- Types of data processed: Usage data (e.g. page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, persons involved).
- Data subjects: Users (e.g. website visitors, users of online services).
- Purposes of processing and legitimate interests: Communication; Organizational and administrative procedures; Feedback (e.g. collecting feedback via online form); Provision of our online offering and user-friendliness. Office and organizational procedures.
- Retention and deletion: Deletion in accordance with the information in the section "General Information on Data Storage and Deletion".
- Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
Further information on processing activities, procedures and services:
- Google Fonts (provision on own server): Provision of font files for user-friendly display of our online offering; Service provider: Google Fonts are hosted on our server; no data is transmitted to Google; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR).
- reCAPTCHA: We integrate the "reCAPTCHA" function to determine whether inputs (e.g. in online forms) are made by humans and not by automatically operating machines (so-called "bots"). The data processed may include IP addresses, information about operating systems, devices or browsers, language settings, location, mouse movements, keystrokes, duration of visits to websites, previously visited websites, interactions with ReCaptcha on other websites, cookies in some cases, and results of manual recognition processes (e.g. answering questions or selecting objects in images). Data processing is based on our legitimate interest in protecting our online offering from abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://cloud.google.com/security/products/recaptcha; Privacy policy: https://business.safety.google/privacy/; Data processing agreement: https://cloud.google.com/terms/data-processing-addendum. Basis for third-country transfers: Data Privacy Framework (DPF), Standard Contractual Clauses (https://cloud.google.com/terms/sccs/eu-c2p).
Changes and Updates
We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.
Where we provide addresses and contact information of companies and organisations in this Privacy Policy, please note that addresses may change over time and we ask you to verify the information before contacting the respective company or organisation.
Social Media Presence
We maintain online presences within social networks and process user data in this context in order to communicate with users active there or to provide information about us.
We point out that user data may be processed outside the European Union. This may result in risks for users because, for example, the enforcement of users’ rights could be made more difficult.
Furthermore, user data is generally processed within social networks for market research and advertising purposes. For example, user profiles may be created based on user behaviour and the resulting interests. These profiles may in turn be used to display advertisements within and outside the networks that are presumed to correspond to users’ interests. As a rule, cookies are stored on users’ computers in which user behaviour and interests are stored. Usage profiles may also contain data independently of the devices used by users, particularly if they are members of the respective platform and logged in there.
For a detailed description of the respective processing methods and opt-out options, please refer to the privacy policies and information provided by the operators of the respective networks.
Also in the case of requests for information and the exercise of data subject rights, we point out that these can be asserted most effectively directly with the providers. Only the providers have access to the respective user data and can directly take appropriate measures and provide information. If you nevertheless require assistance, you can contact us.
Further information on processing activities, procedures and services:
We have entered into a specific agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum”), which governs, among other things, the security measures that LinkedIn must observe and under which LinkedIn agrees to fulfil data subject rights (i.e. users may, for example, submit requests for access or deletion directly to LinkedIn). Users’ rights (in particular the right of access, erasure, objection and complaint to the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint responsibility is limited to the collection and transfer of data to LinkedIn Ireland Unlimited Company, a company based in the EU. Further processing is carried out exclusively by LinkedIn Ireland Unlimited Company, particularly with regard to the transfer to its parent company LinkedIn Corporation in the USA; Service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Basis for third-country transfers: Data Privacy Framework (DPF), standard contractual clauses (https://www.linkedin.com/legal/privacy-policy). Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.