Privacy Policy

A.1 Controller

A.2 Data Protection Officer

Reachable at: [email protected]

A.3 Legal bases for data processing

The processing of personal data is based on:

• Article 6(1)(a) GDPR – where consent has been given
• Article 6(1)(b) GDPR – for the performance of a contract
• Article 6(1)(c) GDPR – compliance with legal obligations
• Article 6(1)(d) GDPR – protection of vital interests
• Article 6(1)(e) GDPR – performance of tasks carried out in the public interest
• Article 6(1)(f) GDPR – legitimate interests

A.4 Data deletion and retention period

Personal data is deleted once the purpose for storage no longer applies. Exceptions apply for statutory retention obligations (6–10 years for commercial and tax documents).

Where consent has been given: processing ends upon withdrawal of consent, unless another legal basis applies.

Where based on legitimate interests: storage continues until the interest no longer applies or until an effective objection has been made pursuant to Article 21 GDPR.

For the performance of a contract: storage until the contract has been performed and limitation periods have expired (typically 3 years, up to 30 years for damage claims).

A.5 Sources of data

Personal data primarily originates from:

• Users of the website (via browsers and end devices)
• Customers with customer accounts
• Prospects who request information material
• Business partners and suppliers
• In exceptional cases, from third parties acting on behalf of others

A.6 Recipients of personal data

Data is only disclosed where necessary and permitted. Categories of recipients: service providers, suppliers and business partners, tax advisors and accountants.

A.7 Purposes of data processing

User data: non-personal collection; only in exceptional cases on the basis of legitimate interests (security, error analysis, marketing, statistics).

Prospect data / press representatives: only on a voluntary basis for processing inquiries (Article 6(1)(b) and (a) GDPR).

Customer data: processing for the initiation and performance of contracts (Article 6(1)(b) GDPR) and, in the case of customer accounts, also based on consent (Article 6(1)(a) GDPR).

Supplier / business partner data: contract performance and pre-contractual measures (Article 6(1)(b) and (a) GDPR).

A.8 Contact via email, fax and telephone

The data transmitted when you contact us is stored to process your inquiry.

Legal basis: Article 6(1)(a) GDPR (consent through active contact) or Article 6(1)(b) GDPR (where a contract is the goal).

Retention period: email conversations are deleted after completion. Fax data after approx. 1–2 weeks; telephone data after approx. 3–4 months in a ring buffer. Statutory retention obligations may require longer storage.

Right to object: can be exercised at any time by informal notice via email. After withdrawal, all data will be deleted.

B.1 Hosting and provision of the website

This website is hosted via Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Cloudflare processes access data (including IP address) in order to deliver the website’s content. A Data Processing Agreement (DPA) is in place. Data processing takes place on servers within the EU; transfers to the USA are safeguarded by EU Standard Contractual Clauses (Article 46(2)(c) GDPR) and the EU–U.S. Data Privacy Framework.

Each time our website is accessed, the following data is automatically collected:

• Date and time of access
• URL of the referring website
• Pages visited
• Browser information (type, version)
• Operating system
• IP address (anonymised after no later than 7 days)
• Internet service provider

Purposes: delivery of website content, ensuring functionality, optimising the offering, security of IT systems.

Legal basis: Article 6(1)(f) GDPR (legitimate interests).

Retention period: session data is deleted at the end of the session. Log files after no later than 7 days; IP addresses are anonymised thereafter.

B.2 Cookies and local storage

Fonts, scripts and stylesheets are served exclusively from our own server. When merely visiting the site without consent, no storing access takes place on your device beyond what is necessary to operate the website.

For language selection (German/English), display preference (dark/light theme) and cookie consent status, the browser’s localStorage is used. This is a local storage technology that does not transmit any data to our servers.

Analytics and marketing cookies are only set with your consent – see sections B.3 to B.6.

Stored localStorage entries (strictly necessary):

• pace-lang – selected language (de/en)
• pace-theme – selected appearance (dark/light)
• pace-cookies – cookie consent status per category (Statistics, Marketing) in JSON format

Legal basis (strictly necessary storage): Article 6(1)(f) GDPR and Section 25(2)(2) TDDDG (strictly necessary storage).

User control: localStorage entries can be deleted at any time via your browser settings. You can also change or withdraw your cookie consent status at any time via the “Cookie settings” link in the footer.

B.3 Google Consent Mode v2 and cookie banner

Before any analytics or marketing cookies are set, we ask for your consent via a cookie banner. There you can consent to each category (Statistics, Marketing) individually, reject everything, or adjust your selection in detail.

We use Google Consent Mode v2. This means: as long as you have not given consent, no cookies for statistics or marketing are set, and no personal data is transmitted to Google or other third parties. Only aggregated, anonymous signals (so-called “cookieless pings”) may be transmitted to Google so that Google can build statistical models. These signals contain no cookies, no identifiers and no IP addresses that would allow conclusions to be drawn about individual persons.

As soon as you activate a category, the associated cookies and tags are loaded.

Legal basis for storage: Section 25(1) TDDDG (consent). Legal basis for data processing: Article 6(1)(a) GDPR (consent). Withdrawal: at any time via “Cookie settings” in the footer with effect for the future.

B.4 Google Analytics 4 (Statistics category)

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics is only activated if you consent to the “Statistics” category in the cookie banner.

Data collected: truncated IP address (anonymisation via the property setting “IP anonymisation”), page views, time spent on site, device and browser information, referrer, click events.

Cookies (only with consent):

• _ga – distinguishes users. Retention period: 2 years.
• _ga_* – session state per property. Retention period: 2 years.

Legal basis: Article 6(1)(a) GDPR (consent) and Section 25(1) TDDDG. Retention period: 14 months (default retention in GA4).

Recipients: Google Ireland Limited, Ireland; Google LLC, USA. A Data Processing Agreement (Data Processing Terms) is in place. The transfer of data to the USA is safeguarded by the EU–U.S. Data Privacy Framework and EU Standard Contractual Clauses.

Opt-out: in addition to withdrawing consent via the cookie settings, you can also prevent data collection by Google Analytics by installing the Google browser add-on.

B.5 Google Tag Manager

We use Google Tag Manager (GTM), a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. GTM is a tag management system: GTM itself does not set any cookies and does not collect any personal data. Through GTM, only other tags (e.g. Google Analytics and Google Ads) are delivered. The respective tags only take effect once you have consented to the corresponding cookie category.

For delivery, GTM transmits your IP address to Google. This connection takes place independently of consent – it is required to load the script from the Google network at all and is part of the provision of the website.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in efficient and secure tag management). Recipients: Google Ireland Limited, Ireland; Google LLC, USA. Third-country transfer: safeguarded by the EU–U.S. Data Privacy Framework and EU Standard Contractual Clauses.

B.6 Google Ads (Marketing category)

If you consent to the “Marketing” category in the cookie banner, we use Google Ads (Google Ireland Limited, Ireland) for conversion tracking and remarketing. This allows us to measure whether actions desired through our ads actually take place on the website, and to address visitors of the website with relevant ads at a later point if appropriate.

Data collected: cookie and device identifiers, click paths, conversion events, IP address, referrer.

Cookies (only with consent):

• _gcl_au – conversion linking. Retention period: 90 days.
• NID, IDE – ad serving control (Google domain). Retention period: up to 13 months.

Legal basis: Article 6(1)(a) GDPR (consent) and Section 25(1) TDDDG. Recipients: Google Ireland Limited, Ireland; Google LLC, USA. Third-country transfer: safeguarded by the EU–U.S. Data Privacy Framework and EU Standard Contractual Clauses. Withdrawal: at any time via “Cookie settings” in the footer.

B.7 Contact form

You can send us inquiries via the contact form on this website. The following data is collected:

• First and last name
• Email address
• Company (optional)
• Subject and message

Legal basis: Article 6(1)(b) GDPR (pre-contractual measures) or Article 6(1)(f) GDPR (legitimate interest in processing inquiries).

Retention period: data is deleted after the inquiry has been processed, unless statutory retention obligations apply.

B.8 SSL encryption

All data transmissions take place encrypted via HTTPS (TLS 1.2+). This includes accessing the website, using the contact form and any other interactions.

B.9 Transfer to third countries

Through hosting via Cloudflare Pages, Google Tag Manager (always active) and – subject to consent – Google Analytics and Google Ads, data may be transferred to the USA. Recipients are Cloudflare, Inc. (San Francisco, USA) and Google LLC (Mountain View, USA).

The data transfer is safeguarded in each case by:

• EU Standard Data Protection Clauses (Article 46(2)(c) GDPR),
• Data Processing Agreements pursuant to Article 28 GDPR,
• certification of the recipients under the EU–U.S. Data Privacy Framework.

Despite these protective measures, under the current legal situation it cannot be ruled out that US authorities may access data on the basis of US laws (e.g. CLOUD Act, FISA 702). By giving your consent in the cookie banner, you also expressly consent to this transfer to the USA (Article 49(1)(a) GDPR).

C.1 Right of access

You have the right to obtain free confirmation as to whether we are processing personal data concerning you, and to receive information about that data (Article 15 GDPR).

C.2 Right to rectification

You have the right to obtain rectification of inaccurate personal data (Article 16 GDPR).

C.3 Right to erasure

You have the right to have your personal data erased under the conditions of Article 17 GDPR.

C.4 Right to restriction of processing

You have the right to restriction of processing under certain conditions (Article 18 GDPR).

C.5 Right to notification

You have the right to be notified of any rectification, erasure or restriction (Article 19 GDPR).

C.6 Right to data portability

You have the right to receive your personal data in a structured, commonly used and machine-readable format (Article 20 GDPR).

C.7 Right to object

You have the right to object to processing based on legitimate interests, as well as to direct marketing (Article 21 GDPR).

C.8 Right to withdraw consent

You can withdraw any consent given at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal remains unaffected.

C.9 Automated decision-making

You have the right not to be subject to a decision based solely on automated processing (including profiling) (Article 22 GDPR).

C.10 Voluntary nature of provision

The provision of personal data is generally voluntary. However, legal or contractual requirements may make provision necessary.

C.11 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the Member State of your residence, place of work, or the place of the alleged infringement.