PRIVACY POLICY

3. Legal basis of our data processing

The processing of personal data can be based on various legal bases. If we need your data to fulfill a contract with you or to answer your inquiries regarding a contract, the legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. b GDPR. If we obtain your consent for certain data processing, the legal basis is Art. 6 para. 1 sentence 1 lit. a GDPR. We carry out some data processing on the basis of our legitimate interest, whereby a balance is always struck between your interests worthy of protection and our legitimate interests. The legal basis for this is Art. 6 para. 1 lit. f GDPR. Insofar as the processing is necessary to fulfill a legal obligation to which we are subject, the legal basis is Art. 6 para. 1 sentence 1 lit. c GDPR.

Below we explain how we process personal data via our website.

3.1 Data processing when accessing the website

If you use the website for information purposes only, i.e. if you do not contact us via the online form or otherwise provide us with information, we collect the following technical information (log file data):

• Operating system of the terminal device with which you visit our website
• Browser (type, version & language settings)
• the amount of data retrieved
• the current IP address of the terminal device with which you visit our website
• Date and time of access
• the URL of the previously visited website (referrer)
• the URL of the (sub)page that you retrieve on the website
• the Internet service provider of the accessing system

The collection of this data is technically necessary in order to display our website to you and to ensure stability and security. We (and our service provider) do not know who is behind an IP address. We do not combine the data listed above with other data.

The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. Since the collection of data for the provision of the website and storage in log files is absolutely necessary for the operation of the website and to protect against misuse, our legitimate interest in data processing prevails at this point.

3.2 Contacting us by e-mail or contact form

When you contact us by e-mail or via a contact form, the data you provide (your e-mail address, your name and telephone number if applicable) will be stored by us in order to answer your questions and process your requests. The legal basis in this respect is Art. 6 para. 1 sentence 1 lit. f GDPR. If we request information via our contact form that is not required for contacting you, we have always marked this as optional. We use this information to specify your request and to improve the processing of your request. This information is provided expressly on a voluntary basis and with your consent, Art. 6 para. 1 sentence 1 lit. a GDPR. If this involves information on communication channels (e.g. email address, telephone number), you also consent to us contacting you via this communication channel in order to respond to your request. You can of course revoke this consent at any time for the future.

Your data that we have received in the course of contacting you will be deleted as soon as it is no longer required to achieve the purpose for which it was collected, your request has been fully processed and no further communication with you is necessary or desired by you.

4. Use of cookies

Cookies are data that are stored on your computer by a website that you visit and enable your browser to be reassigned. Cookies are used to transmit information to the site that sets the cookie. Cookies can store various information, such as your language setting, the duration of your visit to our website or the entries you make there. Cookies cannot execute programs or transfer viruses to your computer. They are used to make the website more user-friendly and effective overall.

4.1 Transient cookies

These cookies are automatically deleted when you close the browser. These include session cookies in particular. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This allows your computer to be recognized when you return to our website. The session cookies are deleted when you log out or close the browser.

4.2 Persistent cookies

These cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete the cookies in the security settings of your browser at any time.

5. Cookiebot

Cookiebot is a consent management platform that enables websites to protect user privacy and comply with the GDPR when it comes to cookies and tracking. “Cookiebot” is an offer from the provider Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark, hereinafter referred to as “Cybot”.

Through the “Cookiebot” function, we inform our website visitors about the use of cookies and other technologies on our website and enable them to make a decision about their use.

If the visitor consents to the use of cookies, the following data is automatically logged:

• The IP number of the user,
• Date and time of consent,
• User agent of the end user’s browser,
• the URL of the provider,
• the cookies authorized by the user (cookie status), which are required as proof of consent and
• an anonymous, random and encrypted key.

The encrypted key and the cookie status are stored on the user’s end device by means of a cookie in order to establish the corresponding cookie status on future page views. This cookie is automatically deleted after 12 months.

Further information on Cookiebot can be found at:
https://www.cookiebot.com/de/privacy-policy/

The legal basis is Art. 6 para. 1 lit. f) GDPR in conjunction with. § 25 para. 2 TTDSG. Our legitimate interest lies in the user-friendliness of the website and in fulfilling the legal requirements of the GDPR and the TTDSG (Telekommunikation-Telemedien-Datenschutz-Gesetz – German national law).

The user can prevent or terminate the installation of cookies and their storage, and thus his cookie consent, at any time by changing his Cookie settings.

Further information on Cookiebot and the option to adjust the settings can be found at the end of this statement in the cookie declaration.

6. Google Tag Manager

For reasons of transparency, we would like to point out that we use Google Tag Manager. This is a tag management system for managing JavaScript and HTML tags, which is used for the implementation of tracking and analysis tools. It is a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, US. The controller in the EU/EEA is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

The Google Tag Manager itself does not collect any personal data. The Tag Manager makes it easier for us to integrate and manage our tags. Tags are small code elements that are used, among other things, to measure traffic and visitor behaviour, to record the impact of online advertising and social channels, to set up remarketing and targeting and to test and optimize websites. If you have made a deactivation, this deactivation will be taken into account by Google Tag Manager.

The recipients of the data are:

• Google Ireland Limited, EU,
• Google LLC, USA,
• Alphabet Inc., USA.

This service may process data outside the European Union and the European Economic Area (EEA) and transfer it to a country that does not offer an adequate level of data protection. If the data is transferred to the US, there is a risk that your data may be processed by US authorities for control and monitoring purposes without you having any legal recourse.

The legal basis for this data processing is your consent. You have the option of revoking your consent with effect for the future by changing your cookie settings (More on this in the cookie declaration). The legality of the data processing until the revocation remains unaffected.

For more information about Google Tag Manager, please visit: https://www.google.com/intl/de/tagmanager/use-policy.html.

7. Microsoft Clarity

We use the “Microsoft Clarity” tool from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, US on our website. Microsoft Clarity is a so-called screen recording tool, which records the activities of a user on our websites during a session and processes them in a comprehensible manner for us. The recording and evaluation of website activities serves to improve the user-friendliness of our websites and to analyze errors.

In addition, your personal data will be processed for the following purposes:

• Tracking (e.g. interest/behavioral profiling, use of cookies),
• Remarketing and conversion measurement (measurement of the effectiveness of marketing measures),
• Interest-based and behavioral marketing,
• Profiling (creation of user profiles),
• range measurement (e.g. access statistics, recognition of returning users) and
• Cross-device tracking (cross-device processing of user data for marketing purposes).

As part of the use of Microsoft Clarity, various personal information is collected. This applies in particular to:

• Usage data (e.g. websites visited, interest in content, access times),
• Meta/communication data (e.g. information about the page view, UserID, SessionID),
• Location data (information on the geographical position of a device),
• Analysis data (information on user interactions on the website, e.g. clicking, scrolling, mouse movements) and
• Diagnostic data, e.g. script and image errors, incorrect interactions with buttons (deadclicks).

Further information on the information collected can be accessed via the following website: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data.

According to Microsoft, the information collected can also be used for marketing purposes.

Data processing is carried out by Microsoft Corporation, based in the US. Microsoft Corporation is certified according to the Data Privacy Framework, so that an adequacy decision of the European Commission within the meaning of Art. 45 GDPR is available for data transfers to Microsoft Corporation. The status of the certification can be accessed via the following website: https://www.dataprivacyframework.gov/s/.

The legal basis for the processing of your personal data for the stated purposes is your consent (§ 25 para. 1 TTDSG and Art. 6 para. 1 lit. a) GDPR). You can withdraw your consent at any time with effect for the future. To withdraw your consent, you can simply adjust your cookie settings accordingly via our privacy policy. You can also withdraw your consent to data processing from Microsoft at any time: https://choice.microsoft.com/de-DE/opt-out.

Further information on how the tool works can be found on the following website: https://clarity.microsoft.com/lang/de-de. Information on how Microsoft processes personal data can be found in Microsoft’s privacy policy: https://privacy.microsoft.com/de-de/privacystatement.

8. Google Analytics

If you have given your consent, we use Google Analytics, a web analytics service provided by Google LLC. The responsible service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics uses cookies to help the website analyze how users use the site. The information collected by the cookies about your use of this website is usually transferred to a Google server in the US and stored there.

We use Google Signals. This allows Google Analytics to collect additional information about users who have activated personalized ads (interests and demographic data) and ads can be delivered to these users in cross-device remarketing campaigns.

We use the ‘anonymizeIP’ function (so-called IP masking): Due to the activation of IP anonymization on this website, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the US and truncated there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

During your visit to the website, the following data is collected, among others:

• The pages you have accessed,
• Your “click path”,
• Achievement of “website goals” (conversions, e.g. newsletter registrations, downloads),
• Your user behavior (e.g. clicks, dwell time, bounce rates),
• Your approximate location (region),
• Your IP address (in abbreviated form),
• Technical information about your browser and the end devices you use (e.g. language setting, screen resolution),
• Your Internet provider and
• The referrer URL (via which website/advertising medium you came to this website).

On behalf of the operator of this website, Google will use this information to evaluate your pseudonymous use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyze the performance of our website and the success of our marketing campaigns.

The recipient of the data is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland as the processor. We have concluded a data processing agreement with Google for this purpose. Google LLC, based in California, US, and, if applicable, US authorities can access the data stored by Google.

The data sent by us and linked to cookies is automatically deleted after 14 months. Data that has reached the end of its retention period is automatically deleted once a month.

You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by selecting

• do not give your consent to the setting of the cookie or
• download and install a browser add-on to deactivate Google Analytics.

You can also prevent the storage of cookies by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may limit the functionality of this and other websites.

You can find more information on the terms of use of Google Analytics and on data protection at Google at https://marketingplatform.google.com/about/analytics/terms/de/ and at https://policies.google.com/?hl=de.

The legal basis for this data processing is your consent, Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TTDSG. You can revoke your consent at any time with effect for the future by opening the data protection settings and activate the settings there accordingly (more on this in the cookie declaration).

9. Google Ads

We use the Google Ads service. Google Ads is an online advertising program from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

This means that we place Google Ads ads and also use Google Remarketing and conversion tracking as part of this. The ads are displayed after search queries on websites in the Google advertising network. We also use Ads remarketing lists for search ads. This allows us to customize search ad campaigns for users who have already visited our website. The services allow us to combine our ads with certain search terms or to place ads for previous visitors that advertise, for example, services that visitors have viewed on our website. We can therefore display interest-based advertising to users of our website on other websites within the Google advertising network (as a “Google ad” as part of Google Search or on other websites).

An analysis of online user behavior is necessary for interest-related offers. Google uses cookies to carry out this analysis. When you click on an advertisement or visit our website, Google places a cookie on the user’s computer. These cookies have a duration of 90 days. The information collected by the respective cookie is used to target the visitor in a subsequent search query. Further information on the cookie technology used can also be found in Google’s notes on website statistics and in the privacy policy. With the help of this technology, Google and we as a customer receive information that a user has clicked on an advertisement and has been forwarded to our websites. The information obtained in this way is used exclusively for statistical analysis to optimize advertising. We do not receive any information with which visitors can be personally identified. Your IP address is transmitted to Google, but as we use Google’s IP masking function on this website as part of the use of Google Analytics, your IP address is anonymized. The statistics provided to us by Google include the total number of users who clicked on one of our ads and, if applicable, whether they were redirected to a page on our website with a conversion tag. Based on these statistics, we can see which search terms were clicked on our ad particularly often and which ads lead to the user contacting us via the contact form.

You can find more information on data protection in the context of Google Ads at: https://policies.google.com/technologies/ads?hl=de.

If you do not want this processing to take place, you can prevent the cookies required for these technologies from being saved, for example via your browser settings. In this case, your visit will not be included in the user statistics.

You also have the option of selecting the types of Google ads or deactivating interest-based ads on Google via the ad settings (https://adssettings.google.com/authenticated?hl=de). Alternatively, you can deactivate the use of cookies by third-party providers by calling up the deactivation help of the Network Advertising Initiative.

However, we and Google continue to receive statistical information about how many users have visited this site and when. If you do not wish to be included in these statistics either, you can prevent this with the help of additional programs for your browser (e.g. the Privacy Badger add-on).

The legal basis for this data processing is your consent, Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TTDSG. You can revoke your consent at any time with effect for the future, by accessing the cookie settings in our Consent Management Platform („cookie declaration“ at the bottom of the page) and changing your selection there.

10. Data transmission

Your data will not be transferred to third parties except in the cases mentioned, unless we are legally obliged to do so, or the transfer of data is necessary for the execution of the contractual relationship or you have previously expressly consented to the transfer of your data.

External service providers and partner companies such as online payment providers or the shipping company commissioned with the delivery will only receive your data if this is necessary to process your order. In these cases, however, the scope of the transmitted data is limited to the necessary minimum. Insofar as our service providers come into contact with your personal data, we ensure that they comply with the provisions of the data protection laws in the same way as part of order processing in accordance with Art. 28 GDPR. Please also note the respective data protection notices of the providers. The respective service provider is responsible for the content of external services, whereby we check the services for compliance with the legal requirements within the scope of reasonableness.

We attach great importance to processing your data within the EU/EEA. However, we may use service providers who process data outside the EU/EEA. In these cases, we ensure that an adequate level of data protection comparable to the standards within the EU is established at the recipient before your personal data is transferred.

11. Data security

We have taken extensive technical and operational precautions to protect your data from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security procedures are regularly reviewed and adapted to technological progress.

12. Your rights

You have the following rights vis-à-vis us with regard to your personal data. To exercise your aforementioned rights, please contact us by email at datenschutz(at)wista.de or by post at

WISTA Management GmbH
Rudower Chaussee 17
12489 Berlin

12.1 General rights

We will be happy to provide you with information as to whether personal data concerning you is being processed; if this is the case, you have a right to information about this personal data and to the information listed in detail in Art. 15 GDPR. In addition, you have the right to rectification (Art. 16 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to erasure (Art. 17 GDPR) and the right to data portability (Art. 20 GDPR) under the respective legal requirements.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

12.2 Rights in data processing according to the legitimate interest

Pursuant to Art. 21 para. 1 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 para. 1 sentence 1 lit. e GDPR (data processing in the public interest) or on Art. 6 para. 1 sentence 1 lit. f GDPR (data processing to safeguard a legitimate interest). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

13. Cookie Declaration