Privacy Policy

Our company’s Privacy Policy is based on the GDPR. We aim to make our Privacy Policy easy to read and understand. To ensure this, we first explain the terms used:

Personal data refers to any information that identifies or makes a natural person (data subject) identifiable. A person is considered identifiable if they can be identified, directly or indirectly, by characteristics such as name, identification number, location data, online identifier, or specific characteristics. These characteristics may relate to physical, genetic, mental, economic, cultural, or social identity (Art. 4(1) GDPR).

A data subject is any identified or identifiable natural person whose personal data is processed by the controller.

Processing refers to all operations involving personal data—whether automated or not. This includes collecting, storing, organizing, adapting, retrieving, using, transmitting, disseminating, comparing, restricting, erasing, or destroying.

Restriction of processing is the marking of stored personal data with the aim of limiting its future processing.

Profiling is the automated processing of personal data to evaluate the personal characteristics of a natural person. This involves analyzing or predicting aspects such as work performance, financial situation, health, preferences, interests, behavior, or location.

Pseudonymization means that personal data is processed in such a way that it can no longer be attributed to a specific individual without additional information. This additional information is stored separately and protected by technical and organizational measures to prevent such attribution.

The controller is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.

A processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.

A recipient is a natural or legal person, public authority, agency, or other body to whom personal data is disclosed, regardless of whether or not that entity is a third party. However, public authorities that may receive personal data in the course of a specific investigative mandate under Union law or the law of the Member States are not considered recipients.

A “third party” is a natural or legal person, public authority, agency, or other entity other than the data subject, the controller, the processor, and the persons authorized to process the personal data under the direct responsibility of the controller or the processor.

Consent means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, expressed in the form of a statement or other unambiguous affirmative action, by which the data subject indicates that he or she consents to the processing of personal data relating to him or her.

Scope of Personal Data Processing

We process personal data only when necessary to provide our website, content, or services. This is generally done only with the user’s consent, unless prior consent is not possible for practical reasons and is permitted by law.

Legal Basis for the Processing of Personal Data

To the extent that we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the GDPR serves as the legal basis.

The processing of personal data to fulfill a contract with the data subject is based on Article 6(1)(b) of the GDPR. This also applies to data processing necessary for the implementation of pre-contractual measures.

To the extent that the processing of personal data is necessary to comply with a legal obligation to which our company is subject, Article 6(1)(c) of the GDPR serves as the legal basis.

In cases where the vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) of the GDPR serves as the legal basis.

If the processing is necessary to protect the legitimate interests of our company or a third party and the interests, rights, and freedoms of the data subject do not override those interests, it is based on Article 6(1)(f) of the GDPR.

Data Deletion and Retention Period

Personal data is deleted or blocked as soon as the purpose for which it was stored no longer applies. Longer retention is permitted only if provided for by European or national legislation in EU regulations, laws, or other provisions to which the controller is subject. The data will be deleted even after the statutory retention periods specified therein have expired, unless it is still required for the conclusion or performance of a contract.

A hosting service provider is used to operate this website; the website’s content is stored on the provider’s European servers.
The hosting service provider was carefully selected; and all necessary measures have been taken to ensure that data processing complies with data protection laws (for example, the conclusion of a data processing agreement). Each time our website is accessed, our system automatically collects data and information from the accessing computer’s system.

The following data is collected in this process:

- The user’s operating system
- The user’s Internet service provider
- The user’s IP address
- Date and time of access
- Websites from which the user’s system accesses our website
- Websites accessed by the user’s system via our website
- File accessed
- Amount of data transmitted

The data is also stored in our system’s log files. This data is not stored together with any other personal data of the user.

The legal basis for processing server log data is Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring the secure and functional operation of our website.

The “borlabs-cookie” set by Borlabs is stored for a period of 60 days. It contains information about the consent decisions you have made for service groups and individual services.

You can change or revoke your consent at any time via the cookie settings on our website, effective for the future.

Alternatively, you can delete the cookie set by Borlabs Cookie in your browser settings. The next time you visit our website, you will be asked to make your consent decision again.

The integration of Vimeo serves to make video content available to you directly on our website and to present it in a user-friendly manner.

We generally have no influence over the duration of Vimeo’s processing and storage of personal data. For information on the storage period and your options for restricting Vimeo’s processing of your data, please refer to Vimeo’s privacy policy (https://vimeo.com/privacy).

Regardless of this, you may revoke your consent to the use of Vimeo at any time with future effect via the cookie settings on our website.

Our website features a contact form that can be used to contact us electronically. If you use this option, the data you enter in the form will be transmitted to us and processed.

In particular, the following data may be processed:

• First and last name
• Company
• Phone number
• Email address
• Selected area of interest
• Project description

If you provide additional personal data as part of the project description, we will also process this information.

A reference to this privacy policy is provided during the submission process.

Alternatively, you may contact us via the email address we provide. In this case, the personal data transmitted with the email will be processed.

For the technical handling and processing of inquiries, service providers we engage may receive personal data as part of a data processing agreement.

The legal basis for the processing of personal data in connection with general contact inquiries is Article 6(1)(f) of the GDPR. Our legitimate interest lies in processing and responding to inquiries directed to us.

If the purpose of the contact is to enter into a contract or if it takes place within the framework of an existing contractual relationship, the legal basis for the processing is Article 6(1)(b) of the GDPR.

Personal data submitted via the contact form or by email is processed for the purpose of handling and responding to your inquiry, as well as for further communication with you.

Personal data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected and there are no statutory retention obligations or other legal grounds preventing its deletion.

For personal data transmitted when contacting us via the contact form or by email, this is generally the case once the respective inquiry has been fully processed and further retention is no longer necessary.

To the extent that processing is based on Article 6(1)(f) of the GDPR, you have the right, pursuant to Article 21 of the GDPR, to object at any time to the processing of your personal data for reasons arising from your particular situation.

We maintain corporate profiles on various social media platforms. We currently operate profiles on the following platforms:

• LinkedIn
• XING
• YouTube

For these information services, we rely on the technical platforms and services provided by the respective providers. Please note that you use our social media profiles and their features at your own risk. This applies in particular to the use of interactive features, such as commenting, sharing, or rating.

When you visit our social media pages, the respective platform operators may, among other things, collect your IP address and other information and use cookies or similar technologies on your device. The data collected in this way may be used by the platform operators, in particular, to provide their services, analyze user behavior, and compile statistical reports.

The data collected about you in this context is processed by the respective platform operators and, where applicable, may also be transferred to countries outside the European Union or the European Economic Area, in particular to the United States. To the extent that personal data is transferred to third countries, this is done, according to the respective providers, in compliance with the legal requirements set forth in Art. 44 et seq. of the GDPR. We have only limited influence over the nature, scope, and duration of data processing by the respective platform operators.

For more information on the processing of your personal data by the respective platform operators, please refer to their privacy policies:

• LinkedIn: https://de.linkedin.com/legal/privacy-policy
• XING: https://privacy.xing.com/de/datenschutzerklaerung
• YouTube/Google: https://policies.google.com/privacy

To the extent that we jointly determine, together with a platform operator, the purposes and means of certain processing of personal data in connection with our corporate presence, joint controllership may exist pursuant to Article 26 of the GDPR. Further information on this matter and on the respective data processing can be found in the privacy notices of the platform operators.

Data subjects may generally exercise their rights both with us and - where joint controllership applies - with the respective platform operator. Please note, however, that we have only limited influence over the data processing carried out by the platform operators. Inquiries regarding the processing of personal data carried out solely by the respective platform operator may be directed to that operator directly.

To the extent that comment functions are available on our social media channels and you use them, we may process the following data in particular:

• Content of the comment,
• Time of publication,
• Username and, if applicable, user ID,
• Reference to previous posts or comments.

We reserve the right to review and, if necessary, remove illegal or inappropriate content.

We do not disclose this data to third parties under any circumstances, unless we are legally required to do so or a corresponding official or court order has been issued.

You can contact us through our social media channels, for example via direct message or comment. In doing so, we process the personal data you voluntarily provide—in particular, your username and the content of your message—in order to handle your inquiry and communicate with you.

The legal basis for this is generally Article 6(1)(f) of the GDPR. Our legitimate interest lies in processing and responding to inquiries, as well as communicating with users. If the purpose of contacting us is to enter into a contract or if it takes place within the framework of an existing contractual relationship, the processing is based on Article 6(1)(b) of the GDPR.

To the extent that the operators of the respective social media platforms provide us with statistical analyses (“Insights”) regarding the use of our social media presence, we use these to better understand how our channels are used and to improve the information we provide.

In particular, we may be provided with statistical or aggregated information regarding reach, interactions, target audiences, and the use of our content.

Please refer to the privacy policies of the respective providers to learn which personal data is processed by them and for what purposes. We have only limited influence over the nature and scope of this data processing.

When users publish content publicly and we share these posts (“repost”) or respond to them, we process the information you have made publicly available - in particular, your username and the published content - in order to interact with you or draw attention to content related to our company.

The legal basis for this is Article 6(1)(f) of the GDPR. Our legitimate interest lies in public relations as well as in communicating and interacting with users of our social media platforms.

On our website, we use services provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (“Cloudflare”).

Cloudflare provides security features designed to protect our website from unauthorized access, bots, and other automated or malicious activities. To this end, requests may be transmitted to Cloudflare, and technical information regarding the access may be processed.

In particular, the following data may be processed:

• IP address,
• Information about the browser and device used,
• Date and time of access,
• URL accessed or information about the request,
• Technical information necessary to detect and prevent automated or unauthorized access.

Cloudflare generally processes personal data transmitted in connection with the services provided to customers as a data processor in accordance with the instructions of the respective customer.

Cloudflare is a company headquartered in the United States. Therefore, the processing of personal data in the United States cannot be ruled out. According to its own statements, Cloudflare is certified under the EU-U.S. Data Privacy Framework. In addition, Cloudflare relies on, among other measures, the European Commission’s Standard Contractual Clauses for international data transfers.

For more information on Cloudflare’s processing of personal data, please see Cloudflare’s Privacy Policy:

https://www.cloudflare.com/privacypolicy/

The legal basis for the processing of personal data in connection with the use of Cloudflare is Article 6(1)(f) of the GDPR.

Our legitimate interest lies in the secure and reliable provision of our website, as well as in protecting our IT systems from unauthorized, automated, or malicious access.

To the extent that accessing or storing information on the user’s device is absolutely necessary for the provision of the explicitly requested website, this is done on the basis of Section 25(2) of the German Telecommunications Data Protection Act (TDDDG).

Cloudflare is used to ensure the secure and reliable operation of our website. In particular, it is intended to detect and block automated and malicious access attempts and to ensure the security of our website and the underlying IT systems.

The duration of processing and storage depends on the type and scope of the Cloudflare services used in each case. To the extent that personal data is processed by Cloudflare, Cloudflare’s retention and deletion periods apply in addition.

To the extent that processing is based on Article 6(1)(f) of the GDPR, you have the right, pursuant to Article 21 of the GDPR, to object at any time to the processing of your personal data for reasons arising from your particular situation.

To the extent required by law, you have rights as a data subject with regard to the processing of your data. We would like to inform you about your data subject rights and how you can exercise them:

Right of Access (Art. 15 GDPR): You have the right to request information from us regarding what personal data we process about you and for what purpose. If a request for information is not submitted in writing via a contact address already on file in our systems, please understand that we may require you to provide proof that you are the person you claim to be.

Right to Rectification (Art. 16 GDPR) or Erasure (Art. 17 GDPR): You have the right to have inaccurate or incomplete personal data that we have stored about you rectified or erased if it is no longer needed or if its processing violates data protection regulations.

Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of the processing of your personal data if you contest the accuracy of the data, the processing is unlawful, or you have objected to the processing.

Right to Withdraw Consent Under Data Protection Law (Art. 7, para. 3 GDPR): You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal.

Right to data portability (Art. 20 GDPR): You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and to transmit it to another controller.

Automated decision-making, including profiling, pursuant to Art. 22 GDPR does not take place.

Right to lodge a complaint (Art. 77 GDPR): You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data, in particular in the Member State of your habitual residence, your place of work, or the place where the alleged infringement occurred.

We expressly point out that you have the right to

object

to the processing (Art. 21 GDPR) if the data processing was based on a legitimate interest and there are reasons related to your particular situation that oppose the data processing. We reserve the right to review your particular situation and the related data processing.

If data processing is carried out on the basis of our legitimate interest for the purpose of direct marketing, you may object to the processing at any time without providing a reason.

If you exercise your rights against us, we will process the data you provide to us in order to fulfill your request. After fulfilling your request, we will store the data you provided to us and the data we provided to you in return for documentation purposes until the expiration of the statute of limitations for administrative offenses (3 years).