Privacy policy

4.1 Provision of the website and processing of server log files

4.1.1 Description of the processing

When our website is accessed, the web server automatically processes technical information that is required for the provision of the website and for the secure and trouble-free operation of the IT systems. This information is temporarily stored in so-called server log files.

4.1.2 Categories of personal data

In particular, the following data may be processed in this context:

• IP address of the requesting device,
• date and time of access,
• page or file accessed,
• browser type and browser version,
• operating system used,
• referrer URL, insofar as it is transmitted,
• host name of the accessing device, insofar as it is transmitted or logged.

4.1.3 Purpose of the processing

The processing takes place in order to provide and deliver our website and to ensure the stability, functionality and security of our IT systems.

This includes, in particular, the detection, analysis and prevention of technical errors, abusive access, unauthorised access attempts and other attacks on our IT systems.

4.1.4 Legal basis

The processing is based on Art. 6 (1) (f) GDPR.

Our legitimate interest lies in the secure, stable and technically error-free provision of our website and in ensuring IT and information security.

4.1.5 Recipients

For the technical provision and operation of our website, we use hosting providers and, where applicable, further IT service providers. Insofar as these service providers process personal data on our behalf, the processing takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

4.1.6 Storage period

The data stored in server log files are generally deleted after 7 days at the latest, insofar as they are no longer required for the stated purposes.

Storage beyond this may take place in individual cases if there are specific indications of a security-relevant incident, abusive access or an attack on our IT systems. In this case, the data concerned are only stored for as long as is necessary to investigate and handle the respective incident.

4.1.7 Right to object

Pursuant to Art. 21 (1) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6 (1) (f) GDPR. Further information on this can be found in the section “Right to object under Art. 21 GDPR”.

4.2 Contacting us via contact form, email or phone

4.2.1 Description of the processing

If you contact us via the contact form provided on our website, by email or by phone, we process the personal data you transmit in order to handle your enquiry and for further communication with you.

When you use the contact form, the data you enter in the input fields provided for this purpose are transmitted to us. Which information is required is indicated by the input fields marked as mandatory in each case. In addition, you may provide further information on a voluntary basis.

If you contact us by email, we process the personal data transmitted with your message.

If you contact us by phone, we process the personal data you provide during the conversation and, where applicable, your phone number, insofar as it is technically transmitted.

4.2.2 Categories of personal data

Depending on the way in which you contact us, the following personal data in particular may be processed:

• Name
• Email address
• Phone number
• Service
• Your enquiry
• Content of your message
• further information voluntarily provided by you in the context of your enquiry,
• when using the contact form, where applicable, technical transmission data, insofar as these are required for the secure provision and processing of the form.

4.2.3 Purpose of the processing

The processing takes place in order to receive, handle and respond to your enquiry and for further communication with you.

Insofar as your contact is aimed at the conclusion of a contract or is related to an existing contractual relationship, the processing also takes place in order to carry out pre-contractual measures or to perform the contractual relationship.

4.2.4 Legal basis

Insofar as your enquiry is aimed at the conclusion of a contract or is related to an existing contractual relationship, the processing is based on Art. 6 (1) (b) GDPR.

In the case of other enquiries, the processing is based on Art. 6 (1) (f) GDPR.

Our legitimate interest lies in the proper handling of and response to enquiries addressed to us and in communication with prospective customers, customers, business partners and other contact persons.

4.2.5 Recipients

Within our company, the personal data transmitted when you contact us are only processed by those departments and persons who are involved in handling your enquiry.

For the provision and operation of our communication and IT systems, we may use external IT, hosting or communication service providers.

Insofar as these service providers process personal data on our behalf, they are used on the basis of a data processing agreement pursuant to Art. 28 GDPR.

4.2.6 Storage period

The personal data processed in connection with a contact are generally deleted as soon as your enquiry has been conclusively dealt with and no further storage is required.

Insofar as your enquiry leads to a contractual relationship or is related to an existing contractual relationship, the data may be stored further in accordance with the statutory retention and documentation obligations applicable to the contractual relationship.

Storage beyond this may take place insofar as this is necessary for the establishment, exercise or defence of legal claims or another statutory retention obligation exists.

4.2.7 Right to object

Insofar as the processing is based on Art. 6 (1) (f) GDPR, you have the right pursuant to Art. 21 (1) GDPR to object at any time, on grounds relating to your particular situation, to the processing of your personal data. Further information on this can be found in the section “Right to object under Art. 21 GDPR”.

4.3 Online applications via our website

4.3.1 Description of the processing

If you apply to us via our website, we process the personal data you provide in the course of the application procedure as well as the application documents you submit.

The processing takes place in order to carry out the application procedure, in particular to review your application, to communicate with you and to decide on the establishment of an employment, vocational training or internship relationship.

4.3.2 Categories of personal data

In the course of the application procedure, the following personal data in particular may be processed:

• first name and surname,
• address and contact details,
• date of birth, if provided,
• information on education, qualifications and professional career,
• certificates, credentials and other application documents,
• information on the desired position,
• information from the cover letter and CV,
• communication data and
• further information transmitted by you in the course of your application.

Insofar as you provide us with special categories of personal data within the meaning of Art. 9 (1) GDPR in the course of your application, these are only processed insofar as there is a legal basis under data protection law for doing so.

4.3.3 Purpose of the processing

Your personal data are processed in order to carry out the application procedure and to decide on the establishment of an employment, vocational training or internship relationship.

This includes, in particular, reviewing your application and your suitability for the respective position or activity, communicating with you and preparing and conducting job interviews and other necessary selection measures.

4.3.4 Legal basis

Insofar as it is necessary for the decision on the establishment of an employment relationship, the processing of your personal data in the course of the application procedure is based on Section 26 (1) sentence 1 BDSG and Art. 6 (1) (b) GDPR.

Insofar as special categories of personal data within the meaning of Art. 9 (1) GDPR are processed in individual cases, they are only processed if one of the conditions of Art. 9 (2) GDPR is additionally met and, where relevant, the conditions of Section 26 (3) BDSG are fulfilled.

Insofar as processing is based on consent in individual cases, it takes place on the basis of Art. 6 (1) (a) GDPR and, where applicable, Section 26 (2) BDSG. In the case of special categories of personal data, the conditions of Art. 9 (2) GDPR additionally apply.

4.3.5 Recipients

Within our company, your application data are only processed by those departments and persons who are involved in carrying out the application procedure and in the decision on filling the position.

These may include, in particular, the responsible employees of the human resources department, the respective specialist department and the managers responsible for the hiring decision.

Insofar as we use external IT, hosting or application management service providers and these process personal data on our behalf, they are used on the basis of a data processing agreement pursuant to Art. 28 GDPR.

4.3.6 Storage period

If the application procedure results in an employment, vocational training or internship relationship, the application data required for this purpose are transferred to the personnel file and further processed and stored in accordance with the statutory requirements applicable to the respective employment relationship.

If no such relationship is established, the application data are generally deleted no later than six months after the conclusion of the application procedure.

Storage beyond this only takes place insofar as it is necessary in an individual case for the establishment, exercise or defence of legal claims or another legal basis exists for further processing.

4.3.7 Applicant pool

If you give us your separate consent to this, we may store your application data in our applicant pool for a period of up to 24 months after the conclusion of the specific application procedure in order to consider you for positions to be filled in the future that may be suitable for you and, where applicable, to contact you in this regard.

Inclusion in the applicant pool is voluntary and has no influence on the ongoing application procedure.

The legal basis for this processing is your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with Section 26 (2) BDSG.

The data stored in the applicant pool are deleted after 24 months at the latest, unless you have previously consented to further storage or another legal basis exists for further processing.

4.3.8 Withdrawal of consent

Insofar as the processing of your application data is based on consent, you may withdraw this consent at any time with effect for the future.

The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected.

Further information on this can be found in the section “Withdrawal of consent”.

4.4 YouTube

4.4.1 Description of the processing

Videos from the YouTube service are embedded on our website.

YouTube is a service provided by Google. For users in the European Economic Area, the service is generally provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We use YouTube in enhanced privacy mode. In this mode, embedded videos are provided via the domain youtube-nocookie.com. According to Google, playbacks of videos in enhanced privacy mode are not used to personalise the viewing experience on YouTube or the advertising displayed outside our website.

Nevertheless, when an embedded YouTube video is loaded or played, personal data may be transmitted to Google and processed there. This may include, in particular, technical information about the device used, the IP address, information about the page accessed and information about the use of the embedded video.

If you are logged in to YouTube or Google, Google may be able to assign the use of the embedded video to your user account.

4.4.2 Categories of personal data

In connection with the embedding and use of YouTube, the following personal data in particular may be processed:

• IP address,
• page or URL accessed,
• device and browser information,
• date and time of access,
• information about interaction with the embedded video,
• where applicable, identification and usage data, in particular if you are logged in to a Google or YouTube account.

4.4.3 Purpose of the processing

The processing takes place in order to embed and display video content on our website and to provide our online offerings in a user-friendly and multimedia manner.

4.4.4 Legal basis

Insofar as information is stored on or read from your device in connection with the embedding of YouTube, this is done on the basis of your consent pursuant to Section 25 (1) TDDDG.

The associated processing of personal data is based on your consent pursuant to Art. 6 (1) (a) GDPR.

Consent is voluntary and may be withdrawn at any time with effect for the future.

4.4.5 Recipients

Recipients of the personal data processed in connection with YouTube may include, in particular, Google Ireland Limited as well as other companies of the Google group and service providers used by Google.

Further information on the processing of personal data by Google can be found in Google’s privacy notices.

4.4.6 Transfers to third countries

In connection with the use of YouTube, personal data may also be processed outside the European Union or the European Economic Area, in particular in the USA.

Insofar as personal data are transferred to third countries, the transfer takes place in accordance with Art. 44 et seq. GDPR and on the basis of the respective applicable transfer mechanisms under data protection law.

4.4.7 Storage period

The storage period of the personal data processed by YouTube or Google depends on the respective purposes of processing and on Google’s storage policies applicable to the service.

As a rule, we have no influence on the storage period of the data processed by Google under its own responsibility.

4.4.8 Withdrawal of consent

You may withdraw any consent given at any time with effect for the future via the consent or cookie settings provided on our website.

The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected.

Further information on this can be found in the section “Withdrawal of consent”.

4.5 Vimeo

4.5.1 Description of the processing

Videos from the Vimeo service are embedded on our website.

The provider is Vimeo.com, Inc., 555 West 18th Street, New York, New York 10011, USA.

We use Vimeo with the Do Not Track parameter (DNT) enabled. According to Vimeo, this setting prevents the embedded player from collecting session data and analytics.

When an embedded Vimeo video is loaded or played, a connection to Vimeo’s servers may nevertheless be established. In particular, the IP address, information about the page accessed and technical information about the device used may be transmitted to Vimeo and processed there.

Even with the DNT parameter enabled, technically necessary cookies may be set, in particular for security and protection functions of the Vimeo player. Vimeo cookies already stored in the browser beforehand may also be transmitted when a connection to Vimeo is established.

4.5.2 Categories of personal data

In connection with the embedding and use of Vimeo, the following personal data in particular may be processed:

• IP address,
• page or URL accessed,
• device and browser information,
• date and time of access,
• information about the use of or interaction with the embedded video,
• technically necessary cookie and identification data.

4.5.3 Purpose of the processing

The processing is carried out in order to embed and display video content on our website and to provide our online services in a user-friendly and multimedia manner.

4.5.4 Legal basis

Insofar as information is stored on or read from your device in connection with the embedding of Vimeo, this is done on the basis of your consent pursuant to Section 25 (1) TDDDG.

The associated processing of personal data is carried out on the basis of your consent pursuant to Art. 6 (1) (a) GDPR.

Consent is voluntary and may be withdrawn at any time with effect for the future.

4.5.5 Recipients

The recipient of the personal data processed in connection with Vimeo is, in particular, Vimeo.com, Inc. and, where applicable, service providers engaged by Vimeo.

Vimeo generally processes the personal data arising in connection with the embedded player as an independent controller under data protection law.

Further information on the processing of personal data by Vimeo can be found in Vimeo’s privacy notices.

4.5.6 Transfers to third countries

In connection with the use of Vimeo, personal data may be processed in the USA.

According to its own statements, Vimeo participates in the EU-U.S. Data Privacy Framework. Insofar as its requirements are met, personal data may be transferred to correspondingly certified US companies on the basis of the adequacy decision in place for this purpose.

Insofar as a different transfer mechanism is required for individual processing operations, the transfer is carried out in accordance with Art. 44 et seq. GDPR.

4.5.7 Storage period

The storage period of the personal data processed by Vimeo under its own responsibility depends on the respective purposes of the processing and on Vimeo’s storage rules applicable to the service.

As a rule, we have no influence on the storage period of the data processed by Vimeo under its own responsibility.

4.5.8 Withdrawal of consent

You may withdraw any consent you have given at any time with effect for the future via the consent or cookie settings provided on our website.

The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected.

Further information on this can be found in the section “Withdrawal of consent”.

4.6 Google Maps

4.6.1 Description of the processing

The map service Google Maps is embedded on our website.

Google Maps is a service provided by Google. For users in the European Economic Area, Google services are generally provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When an embedded Google map is loaded and used, personal data may be transmitted to Google and processed there. This may include, in particular, technical information about the device used, the IP address, information about the page accessed and details about the use of the embedded map function.

If you are logged in to Google, Google may, where applicable, associate the use of the service with your Google account.

4.6.2 Categories of personal data

In connection with the embedding and use of Google Maps, the following personal data in particular may be processed:

• IP address,
• page or URL accessed,
• device and browser information,
• date and time of access,
• information about the use of and interaction with the embedded map,
• where applicable, identification and usage data if you are logged in to a Google account.

4.6.3 Purpose of the processing

The processing is carried out in order to embed and display interactive maps and to provide location and directions information in a user-friendly manner.

4.6.4 Legal basis

Insofar as information is stored on or read from your device in connection with the embedding of Google Maps, this is done on the basis of your consent pursuant to Section 25 (1) TDDDG.

The associated processing of personal data is carried out on the basis of your consent pursuant to Art. 6 (1) (a) GDPR.

Consent is voluntary and may be withdrawn at any time with effect for the future.

4.6.5 Recipients

Recipients of the personal data processed in connection with Google Maps may be, in particular, Google Ireland Limited as well as other companies of the Google group and service providers engaged by Google.

Further information on the processing of personal data by Google can be found in Google’s privacy notices.

4.6.6 Transfers to third countries

In connection with the use of Google Maps, personal data may also be processed outside the European Union or the European Economic Area, in particular in the USA.

Google LLC is certified under the EU-U.S. Data Privacy Framework. Insofar as its requirements are met, personal data may be transferred to correspondingly certified US companies on the basis of the adequacy decision in place for this purpose.

Insofar as a different transfer mechanism is required for individual processing operations, the transfer is carried out in accordance with Art. 44 et seq. GDPR.

4.6.7 Storage period

The storage period of the personal data processed by Google under its own responsibility depends on the respective purposes of the processing and on Google’s storage rules applicable to the service.

As a rule, we have no influence on the storage period of the data processed by Google under its own responsibility.

4.6.8 Withdrawal of consent

You may withdraw any consent you have given at any time with effect for the future via the consent or cookie settings provided on our website.

The lawfulness of the processing carried out on the basis of the consent until its withdrawal remains unaffected.

Further information on this can be found in the section “Withdrawal of consent”.

4.7 Google reCAPTCHA

4.7.1 Description of the processing

On our website, we use Google reCAPTCHA to protect our forms and our IT systems against abusive, automated access, spam and other attacks.

reCAPTCHA analyses various technical and usage-related characteristics in the background in order to assess whether an entry or interaction is made by a natural person or automatically.

In the course of this check, personal data and technical information may be transmitted to Google and processed there.

4.7.2 Categories of personal data

In connection with the use of reCAPTCHA, the following data in particular may be processed:

• IP address,
• device and browser information,
• information about the operating system used,
• date and time of access,
• information about the page accessed or the usage process,
• technical information about interactions with our website,
• cookie and comparable identification data,
• information required to identify and assess a risk of abuse or a security risk.

Which data are processed in detail may depend on the reCAPTCHA version used and the specific technical configuration.

4.7.3 Purpose of the processing

The processing is carried out in order to protect our website and the forms provided on it against automated access, spam, abuse and other attacks, and to ensure the security of our IT systems.

4.7.4 Legal basis

The processing of personal data is carried out on the basis of Art. 6 (1) (f) GDPR.

Our legitimate interest lies in protecting our website, our forms and our IT systems against abusive or automated access and in preventing spam, fraud and other attacks.

Insofar as reCAPTCHA stores information on the device or accesses information already stored there for its security and risk analysis, and this access is strictly necessary for the use of the relevant function expressly requested by the user, its permissibility is governed by Section 25 (2) No. 2 TDDDG.

Insofar as access to information on the device does not fall under a statutory exception of Section 25 (2) TDDDG, such access only takes place on the basis of consent pursuant to Section 25 (1) TDDDG.

4.7.5 Recipients and processing on our behalf

In connection with the provision of reCAPTCHA, personal data are processed by Google.

According to Google, Google has been processing reCAPTCHA customer data as a processor since 2 April 2026. Pieron remains the controller under data protection law for the processing of the customer data collected via reCAPTCHA.

Since Google has been acting as a processor since the changeover, responsibility under data protection law for the use of reCAPTCHA, including the required balancing of interests under Art. 6 (1) (f) GDPR, lies entirely with Pieron. In view of the scope of the behavioural and device data processed in this context, we only use reCAPTCHA insofar as this is necessary to protect our website.

The processing by Google is carried out within the framework of the applicable contractual provisions on processing on our behalf.

4.7.6 Transfers to third countries

In connection with the provision of reCAPTCHA, personal data may also be processed outside the European Union or the European Economic Area.

Insofar as personal data are transferred to third countries, the transfer is carried out in compliance with the requirements of Art. 44 et seq. GDPR and on the basis of the relevant transfer mechanisms under data protection law.

4.7.7 Storage period

The personal data processed in connection with reCAPTCHA are only processed for as long as is necessary for security, fraud and abuse prevention and for the provision of the service.

Insofar as Google processes personal data on our behalf, the processing and erasure are governed by the applicable contractual agreements and the storage rules applicable to reCAPTCHA.

4.7.8 Objection and withdrawal

Insofar as the processing of personal data is based on Art. 6 (1) (f) GDPR, you have the right under Art. 21 (1) GDPR to object to the processing on grounds relating to your particular situation.

Insofar as processing is based on your consent, you may withdraw it at any time with effect for the future.

Further information can be found in the sections “Right to object under Art. 21 GDPR” and “Withdrawal of consent”.

4.8 Google Tag Manager

4.8.1 Description of the processing

On our website, we use Google Tag Manager.

Google Tag Manager is a service provided by Google that allows so-called tags to be managed and controlled centrally. Tags are code elements through which, in particular, analytics, marketing or other services can be embedded and triggered on a website.

Google Tag Manager itself serves primarily for the technical management and triggering of these tags. According to Google, Tag Manager itself does not collect, store or share any information about visitors to our website, such as the page URLs accessed, apart from standard HTTP log data and diagnostic data.

Which personal data are processed by the services embedded via Google Tag Manager depends on the respective service used. We provide separate information on this in the respective sections of this privacy policy.

4.8.2 Categories of personal data

In connection with the operation of Google Tag Manager, technical connection and log data in particular may be processed.

According to Google, the aggregated data on tag firing collected for diagnostic purposes do not contain any IP addresses or measurement identifiers associated with a particular person.

Personal data processed by services triggered via Google Tag Manager are described in the respective information on those services.

4.8.3 Purpose of the processing

The processing is carried out for the central management, control and technical triggering of the tags and services used on our website.

4.8.4 Legal basis

Insofar as Google Tag Manager is used exclusively for the technical management and control of tags and no information requiring consent is stored on or read from the device in this context, the associated processing of personal data is carried out on the basis of Art. 6 (1) (f) GDPR.

Our legitimate interest lies in the efficient, uniform and technically reliable management of the services and tags used on our website.

Insofar as services requiring consent are triggered via Google Tag Manager, these services are only activated in accordance with the consent given. The legal bases of the respective services are set out in the corresponding sections of this privacy policy.

4.8.5 Recipients and processing on our behalf

In connection with the provision of Google Tag Manager, personal data may be processed by Google.

Google provides data protection terms for processing on our behalf for Google Tag Manager. According to Google, for companies established in the European Economic Area the corresponding data processing terms form part of the terms of use.

4.8.6 Transfers to third countries

In connection with the provision of Google Tag Manager, personal data may also be processed outside the European Union or the European Economic Area.

Insofar as personal data are transferred to third countries, the transfer is carried out in compliance with the requirements of Art. 44 et seq. GDPR and on the basis of the relevant transfer mechanisms under data protection law.

4.8.7 Storage period

According to Google, data in the standard HTTP logs of Google Tag Manager are deleted within 14 days of receipt.

For data processed by services embedded via Google Tag Manager, the storage periods described for those respective services apply.

4.9 Google Analytics

4.9.1 Description of the processing

On our website, we use Google Analytics, a web analytics service provided by Google.

Google Analytics enables us to evaluate the use of our website statistically. For this purpose, information about the use of our website is collected and compiled into statistical evaluations.

According to Google, IP addresses are not logged or stored for users within the European Union. During data collection, the IP address is used, among other things, to derive approximate location information and is then discarded before the data is logged in Google Analytics.

Google Analytics is only used on our website for analytics purposes in accordance with the consent you have given.

4.9.2 Categories of personal data

In connection with the use of Google Analytics, the following data in particular may be processed:

information about pages and content accessed,

• date and time of access,
• information about the use of and interaction with our website,
• technical device and browser information,
• information about the operating system,
• approximate geographical location,
• referrer information,
• event and usage data,
• cookie or similar online identifiers, insofar as these are used in accordance with your consent.

According to Google, the IP address of users within the European Union is not logged or stored in Google Analytics.

4.9.3 Purpose of the processing

The processing is carried out for the statistical analysis of the use of our website.

The information obtained serves in particular to better understand the use of our website, to evaluate the reach and use of individual content and to optimise our online offering technically and in terms of content.

4.9.4 Legal basis

Insofar as information is stored on or read from your terminal device in connection with Google Analytics, this is done on the basis of your consent pursuant to Section 25 (1) TDDDG.

The associated processing of personal data is carried out on the basis of your consent pursuant to Art. 6 (1) (a) GDPR.

Consent is voluntary and may be withdrawn at any time with effect for the future.

4.9.5 Consent control

Google Analytics takes into account the consent signals transmitted via our consent management.

If analytics functions are not enabled, they are not activated for regular analytics purposes, in accordance with the consent settings made.

4.9.6 Recipients and processing on our behalf

In connection with Google Analytics, personal data is processed by Google.

According to its own information, Google generally processes Google Analytics data under the GDPR as a processor for the respective Google Analytics customer.

Recipients may in particular be Google Ireland Limited as well as other companies of the Google group of companies and service providers engaged by Google.

4.9.7 Transfers to third countries

In connection with the use of Google Analytics, personal data may also be processed outside the European Union or the European Economic Area.

Insofar as personal data is transferred to third countries, the transfer takes place in compliance with the requirements of Art. 44 et seq. GDPR and on the basis of the relevant data protection transfer mechanisms applicable in each case.

4.9.8 Storage period

The storage period of the data collected with Google Analytics depends on the settings made for the respective Google Analytics property and on the storage requirements applicable to the service.

Data whose retention period we can determine within Google Analytics is deleted or automatically removed in accordance with the retention period we have selected.

4.9.9 Withdrawal of consent

You may withdraw any consent you have given at any time with effect for the future via the consent or cookie settings provided on our website.

This does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Further information on this can be found in the section “Withdrawal of consent”.

4.10 Meta Pixel

4.10.1 Description of the processing

On our website, we use the Meta Pixel.

The Meta Pixel is an analytics service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

With the help of the Meta Pixel, we can track how visitors interact with our website and whether certain actions, for example accessing certain pages or other defined events, have taken place.

In the process, information about the use of our website may be transmitted to Meta and processed there. Meta may link this information with other data, in particular if you use Meta services such as Facebook or Instagram or are logged in there.

4.10.2 Categories of personal data

In connection with the use of the Meta Pixel, the following personal data in particular may be processed:

• IP address,
• device and browser information,
• information about the operating system used,
• pages or URLs accessed,
• date and time of access,
• referrer information,
• information about interactions and events on our website,
• cookie and similar online identifiers,
• where applicable, information that enables assignment to a Meta account.

4.10.3 Purpose of the processing

The processing is carried out to measure and analyse the use of our website and to evaluate the effectiveness of our online advertising measures.

Insofar as corresponding functions are used, the processing may also serve to create target groups for advertising measures and to display interest-based advertising to users of Facebook, Instagram or other Meta services.

4.10.4 Legal basis

Insofar as information is stored on or read from your terminal device in connection with the Meta Pixel, this is done on the basis of your consent pursuant to Section 25 (1) TDDDG.

The associated processing of personal data is carried out on the basis of your consent pursuant to Art. 6 (1) (a) GDPR.

The Meta Pixel is only activated in accordance with the consent you have given.

Consent is voluntary and may be withdrawn at any time with effect for the future.

4.10.5 Recipients and responsibility

The recipient of the personal data processed in connection with the Meta Pixel is in particular Meta Platforms Ireland Limited.

Insofar as Pieron and Meta jointly determine the purposes and means of certain processing operations, Pieron and Meta may be joint controllers pursuant to Art. 26 GDPR for this processing.

Meta is generally itself responsible for the further processing of personal data by Meta, in particular the combination with other information available to Meta and its use for Meta’s own purposes.

Further information on the processing of personal data by Meta can be found in Meta’s privacy notices.

4.10.6 Transfers to third countries

In connection with the use of the Meta Pixel, personal data may also be processed outside the European Union or the European Economic Area, in particular in the USA.

Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. Insofar as its requirements are met, personal data may be transferred to correspondingly certified US companies on the basis of the adequacy decision existing for this purpose.

Insofar as a different transfer mechanism is required for individual processing operations, the transfer takes place in accordance with Art. 44 et seq. GDPR.

4.10.7 Storage period

The storage period of the personal data processed by Meta under its own responsibility depends on the respective purposes of processing and on the storage requirements applicable to the Meta services.

As a rule, we have no influence on the storage period of the data processed by Meta under its own responsibility.

4.10.8 Withdrawal of consent

You may withdraw any consent you have given at any time with effect for the future via the consent or cookie settings provided on our website.

This does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Further information on this can be found in the section “Withdrawal of consent”.

4.11 Cookies and similar technologies

4.11.1 Description of the processing

On our website, we use cookies and similar technologies.

Cookies are small text files that can be stored on your terminal device. In addition, similar technologies may be used by means of which information is stored on or read from your terminal device.

Depending on the purpose, we distinguish in particular between technically necessary technologies and those used for preference, statistics or marketing purposes.

Cookies and similar technologies that are not technically necessary are only used in accordance with the consent you have given.

4.11.2 Categories of personal data

Depending on the cookie or technology used, the following data in particular may be processed:

cookie and similar identification data,

information about your consent decision,

device and browser information,

IP address, insofar as it is processed in connection with the respective service,

information about pages and content accessed,

usage and interaction data,

preference and settings information.

Which data is specifically processed depends on the respective cookie or the service used via it.

4.11.3 Purpose of the processing

Technically necessary cookies and similar technologies are used to provide basic functions of our website, to store your consent decisions and to ensure the security and functionality of the website.

Other cookies and similar technologies may – depending on your consent – serve in particular to

store settings and preferences you have chosen,

evaluate the use of our website statistically,

analyse the reach and use of our content,

measure marketing measures and

enable interest-based advertising.

4.11.4 Legal basis

Information is stored on your terminal device, or information stored there is accessed, without consent only insofar as the requirements of Section 25 (2) TDDDG are met.

This applies in particular if the storage or access is strictly necessary in order to provide a digital service expressly requested by you.

Insofar as the requirements of Section 25 (2) TDDDG are not met, information is stored on your terminal device, or information stored there is accessed, exclusively on the basis of your consent pursuant to Section 25 (1) TDDDG.

Insofar as personal data is processed in this context, the legal basis for the subsequent processing depends on the respective processing. In the case of statistics, analytics or marketing services requiring consent, the processing is generally carried out on the basis of Art. 6 (1) (a) GDPR.

4.11.5 Storage period

The storage period of the cookies and similar technologies used depends on their respective purpose and technical design.

Some cookies are deleted when the browser session ends, others may remain stored on your terminal device for a certain period of time.

More detailed information on the cookies and similar technologies used on our website, in particular on their purpose, provider, category and storage period, can be found in the cookie settings or the consent management provided on our website.

4.11.6 Managing your consents

You can make your choice regarding cookies and similar technologies that are not technically necessary via the cookie settings or the consent management provided on our website, and change or withdraw it at any time with effect for the future.

There you will also find more detailed information on the cookies and similar technologies used in each case.

Technically necessary cookies and similar technologies cannot be deactivated via the consent management insofar as they are strictly necessary for the provision of an expressly requested digital service.

4.12 Consent management

4.12.1 Description of the processing

On our website, we use a consent management tool through which you can make and manage your choice regarding cookies and similar technologies.

When you visit our website for the first time, you can decide whether you only wish to allow technically necessary technologies or also wish to consent to further categories, in particular preference, statistics or marketing technologies.

Your consent decision is stored so that the choice you have made can be taken into account and demonstrated on subsequent page views.

4.12.2 Categories of personal data

In connection with the consent management, the following data in particular may be processed:

your consent and refusal decisions,

time of the decision,

information about the selected categories or services,

technically necessary cookie or similar identification data,

where applicable, technical information about the browser and terminal device, insofar as this is necessary for storing and assigning the consent decision.

4.12.3 Purpose of the processing

The processing is carried out to obtain, store and manage your consent decisions and to demonstrate whether and to what extent consent was given or refused.

4.12.4 Legal basis

Insofar as the consent management stores on or reads from your terminal device information that is strictly necessary to store your consent decision and to provide the service you have requested in accordance with this decision, this is done on the basis of Section 25 (2) No. 2 TDDDG.

The processing of personal data for managing and demonstrating your consent decisions is carried out on the basis of Art. 6 (1) (c) GDPR, insofar as it serves to fulfil statutory obligations of proof and accountability, and additionally on the basis of Art. 6 (1) (f) GDPR.

Our legitimate interest lies in the legally compliant management and documentation of your consent decisions.

4.12.5 Recipients

Insofar as an external service provider is used to provide the consent management, this provider may process personal data in the course of the technical provision.

Insofar as processing is carried out on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.

4.12.6 Storage period

The data stored in connection with the consent management is only retained for as long as is necessary to manage and demonstrate your consent decision.

The specific storage period depends on the technical design of the consent management used and on the statutory requirements regarding proof and limitation periods.

4.12.7 Changing and withdrawing your choice

You can change or withdraw your consent decision at any time with effect for the future via the cookie settings provided on our website.

This does not affect the lawfulness of the processing carried out on the basis of your consent before its withdrawal.