Privacy Policy (Effective as of 03/30/2026)

This privacy policy is intended to provide an overview of what happens to your personal data (hereinafter also referred to as “data”) within our company and to inform you about your data protection claims and rights under the European General Data Protection Regulation (“GDPR”) and its national implementation in the Data Protection Act, Federal Law Gazette I No. 165/1999 (“DSG”). We therefore ask you to read this privacy policy and, if necessary, print or save it.

Personal data is any information that can be used to personally identify you. Your personal data may be processed for various purposes. In essence, the data processing operations carried out by Mobility Hub Parkservice Austria GmbH (hereinafter also “MH Parkservice” or “we”) can be divided into the following areas of application:

• General: General information on data protection, data processing operations, and the rights of data subjects, which apply to all data processing operations we carry out, can be found in Part A below.
• Our websites: In connection with our website www.mh-parkservice.at (hereinafter: “website”) or related external online presences, such as our social media profiles, our service portal (https://service.mh-parkservice.at/) or our post-payment service (https://parken.mh-parkservice.at/), from which we link to this privacy policy (website and external online presences hereinafter collectively also: “websites”), we process data from visitors that is exchanged between their internet-enabled devices and the server we operate, as well as data provided to us in the course of using the website. Details on this can be found in Part B.
• Parking users: For information on the processing of data from users of parking areas managed by us, for example in the context of payment transactions via the MHP Online Shop or our post-payment service, tracking of parking violations by MH Parkservice, or viewing details of parking violations via our service portal, please visit Part C.
• B2B: For the purpose of processing or initiating contracts, we process the necessary data of our business customers and prospective clients. Data of our business partners or supplier data is used exclusively for the direct placement, processing, or execution of orders. You can find more information on this in Part D.

Please visit the individual sections if you would like quick, context-specific information on certain processing situations.

‍

A. General information on data protection and data subject rights

I. Who is responsible for data processing and who can you contact if you have questions?

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection regulations, is:

Mobility Hub Parkservice Austria GmbH

Krottenseestraße 45

4810 Gmunden

Austria

Tel.: +43 72 011 69 48

Email: info@mh-parkservice.at

‍

If you have any questions regarding data protection, please feel free to contact our Data Protection Officer at the following contact details: datenschutz@mh-parkservice.at

II. What are your rights regarding your personal data?

If your personal data is being processed, you are a “data subject” within the meaning of the GDPR, which means you may be entitled to the rights described below. If you wish to exercise your rights against MH Parkservice as the controller, we recommend that you direct your request to our contact details provided above:

1. Right of access

Under Article 15 of the GDPR, you have the right to request confirmation from us as to whether we are processing your personal data and to ask for information regarding the extent to which we process your data.

2. Right to rectification

If the personal data concerning you is inaccurate or incomplete, you have the right to have it corrected and/or completed in accordance with Article 16 of the GDPR.

3. Right to erasure

Subject to the legal requirements of Article 17 of the GDPR, you may request that we delete your data if we are processing it unlawfully or if the processing disproportionately interferes with your legitimate interests. Please note that there may be reasons that prevent immediate deletion, such as statutory retention obligations.

Regardless of whether you exercise your right to erasure, we will delete your data promptly and completely once the purpose of processing has been fulfilled, provided there are no legal or contractual retention periods that prevent us from doing so.

4. Right to restriction of processing

You may request that we restrict the processing of your data in the cases specified in Article 18 of the GDPR. If you have restricted the processing of your personal data, these data may—with the exception of storage—only be processed with your consent, for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

5. Right to data portability

Under Article 20 of the GDPR, you have the right to receive the data you provided to us—which we process automatically based on your consent or in fulfillment of a contract—in a structured, commonly used, and machine-readable format, or to have it transmitted to a third party. If you request the direct transfer of data to another controller, this will only be done if it is technically feasible. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

6. Right to object

If we process your data based on a legitimate interest as defined in Article 6(1)(f) of the GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions (see Article 21 of the GDPR). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is for the establishment, exercise, or defense of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes. You can object to the processing of your data for direct marketing purposes at any time without providing a reason.

7. Right to withdraw consent under data protection law

Some data processing operations are only possible with your express consent as defined in Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect. The legality of any data processing carried out before your withdrawal remains unaffected. Please note that even after withdrawing consent, processing of the affected data may still be possible, in whole or in part, based on other legal grounds.

8. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the member state of your habitual residence, place of work, or the place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR (Article 77 of the GDPR in conjunction with Section 24 of the DSG).

If you believe that we have violated Austrian or European data protection law while processing your data, please contact us so that we can clarify any questions.

You also have the right to contact the supervisory authority responsible for our company headquarters:

Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Phone: +43 1 52 152-0, E-Mail: dsb@dsb.gv.at

‍

III. What personal data is processed and where does it come from?

1. Source of personal data

We primarily process data that you provide to us directly when initiating or maintaining a business relationship through our website (see also Part B Section VI).

Through our website and services, we process data that we receive during your visit or that you actively provide to us (e.g., when using our online shop). Other data is collected automatically by our IT systems when you visit the website or use our services. This is mainly technical data (e.g., internet browser, operating system, or the time a page was accessed). This data is collected automatically as soon as you enter our website or access one of our services. You can find more details on this in Part B.

In individual cases, we also process data that we have lawfully received or acquired from other third parties, such as credit agencies, creditor protection associations, or authorities, or that we have lawfully obtained or acquired from publicly accessible sources (e.g., telephone directories, company registers, the press, the internet, or other media).

2. Categories of personal data

The personal data we regularly process includes master/contact data such as: title, first and last name, form of address, date of birth, address, email address, telephone number, fax, and job title.

In addition, depending on the order, service, or other relationship with you, we process the following other personal data:

• Address data: street, house number, address supplements if applicable, postal code, city, country
• Contact data: telephone number(s), email address(es)
• Vehicle data: license plate number, vehicle owner
• Parking management data: photographs, date and duration of parking space usage, parking permits, bank details, payment information
• Registration data: information about the service you registered for; timestamps and technical information regarding registration, confirmation, and cancellation; data provided by you during registration
• Quote data
• Access data: date and time of your visit to our service; the page from which the accessing system reached our site; pages visited during use; session identification data (session ID); as well as the following information from the accessing computer system: internet protocol address (IP address) used, browser type and version, device type, operating system, and similar technical information.
• Information about the nature and content of our business relationship, such as contract data, order data, sales and receipt data, customer and supplier history, and consultation documents
• Marketing and sales data,
• Documentation data (e.g., consultation records, data from service calls or support cases)
• other data we have received from you as part of our business relationship (e.g., in customer meetings),
• documentation of consent declarations

‍

IV. For what purposes and on what legal basis is the data processed?

We process your data in accordance with the provisions of the GDPR and the applicable Data Protection Act, particularly on the following bases:

1. Fulfillment of (pre-)contractual obligations (Art. 6(1)(b) GDPR)

Personal data is processed on the basis of Art. 6(1)(b) GDPR to fulfill contractual obligations of MH Parkservice particularly in connection with the sale and distribution of our goods and services (hereinafter also referred to as "parking services") as well as all activities typically required for the operation or administration of MH Parkservice (e.g., customer and user management). Data may also be processed at the pre-contractual stage when initiating business with MH Parkservice, or when carrying out other contractual relationships with MH Parkservice .

Art. 6(1)(b) GDPR serves as the legal basis, for example, in the following cases:

• Creating and maintaining a partner or supplier account in our CRM system
• Creating and maintaining customer/prospect files or our customer/prospect database in our CRM system
• Sending information
• Offering and selling MH Parkservice products
• Offering and performing our services

Details regarding the purpose of this data processing can be found in the respective contract documents and terms and conditions.

2. Safeguarding legitimate interests (Art. 6(1)(f) GDPR)

Based on a balancing of interests, data processing may take place beyond the actual fulfillment of a contract to safeguard the legitimate interests of MH Parkservice or third parties. This is permitted provided that your interests or fundamental rights and freedoms, which require the protection of personal data, do not override them. Data processing to safeguard legitimate interests occurs, for example, in the following cases:

• Providing our online services, their functions, and content
• Using technically necessary cookies or similar technologies as defined by Section 165 (2) of the Telecommunications Act (TKG) 2021
• Responding to contact requests and communicating with users
• Transferring data to our affiliated companies and partners
• Processing payments via external service providers
• Engaging collection agencies and legal counsel to recover or enforce claims
• Asserting other legal claims and defending against legal disputes
• Advertising or marketing
• Market and opinion research
• Business management and service development measures
• Maintaining databases of customers, prospective clients, and service providers to improve our offerings
• Conducting due diligence for potential corporate restructuring, acquisitions, or sales
• Ensuring IT security and the operation of our company and services
• Building and facility security measures

3. Compliance with legal obligations (Art. 6 (1) (c) GDPR)

Processing your data may be necessary to fulfill various legal obligations and requirements to which we are subject, such as those arising from the German Commercial Code (HGB) or the Fiscal Code (AO).

4. Consent (Art. 6 (1) (a) GDPR, Section 165 (2) TKG 2021):

If a service we use stores information on a user's terminal device or accesses such information in any way, consent is required under Section 165 (2) TKG 2021. If the service functions without any access to the terminal device, the GDPR applies. Where we request your consent within the scope of the GDPR, this is done on the basis of Art. 6 (1) (a) in conjunction with Art. 7 GDPR.

If you have provided us with consent to process your data in a specific case, processing will be carried out in accordance with the purposes and scope defined in the declaration of consent. You may withdraw your consent at any time with future effect, for example, for receiving our newsletter. To do so, please use the contact details provided in Section A, Item I or Item II. Please note that processing that took place before the withdrawal is not affected by the withdrawal, and in some cases, data processing may continue to be possible, at least in part, on the basis of another legal ground.

‍

V. Who receives my data?

At MH Parkservice, your data is accessed by those employees or organizational units that require it to fulfill our contractual and legal obligations or to process and pursue our legitimate interests.

To initiate or execute a contractual relationship (e.g., the sale or provision of parking services) pursuant to Art. 6 (1) sentence 1 (b) GDPR, or based on our legitimate interests pursuant to Art. 6 (1) sentence 1 (f) GDPR—depending on the specific nature of the contract—your data will be shared with companies we regularly engage in connection with providing our services or handling contracts. This concerns the following recipients or categories of recipients:

• IT service providers (e.g., email service providers, web hosting companies)
  
  • Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA (Cloud storage provider)
  • Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (App function optimization)
  • Airparser, Sepapaja tn 6, Tallinn 11415, Estonia (Document management software provider)
  • Celonis SE, Theresienstr. 6, 80333 Munich, Germany (Integration platform provider)
  • Datadog Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (System security, monitoring)
  • Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA (AI platform operator and AI chat function provider)
  • Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA (Ticket system provider)
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (Email service provider)
  • HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA (CRM system provider)
  • LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam, Germany (Proofreading service provider)
  • Leaping AI UG (limited liability), Potsdamer Straße 72, 10785 Berlin, Germany (Provider of AI-supported call center software)
  • Octa Inc., 100 First Street, Floor 6, San Francisco, CA 94105, USA (Provider of Auth0 for system security)

• OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (AI model provider)

• Peter Park System GmbH, Balanstr. 71a, 81541 Munich, Germany (Provision of IT systems as managed services and parking management systems)
• sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany (Accounting software provider)
• Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (Shop system provider)
• Talkdesk Inc., 201 Spear Street, Suite 1100, San Francisco, CA 94105, USA (Contact center software provider)
• Trustpilot A/S, Pilestraede 58, 5th Floor, DK-1112 Copenhagen, Denmark (Review platform provider)
• UAB Baltsoft, Kosciuskos 26-17, Vilnius, LT-01100, Lithuania (Conversion software solutions provider)
• Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (Web hosting service provider for the website)
• Weglot, SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France (Translation service provider)

• Sales partners
• Advertising partners
• Insurance companies
• Banks
• Communication providers (telephone, fax)
• Payment service providers
  
  • Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands
  • Stripe Deutschland GmbH, Prielmayerstr. 3, 80335 Munich, Germany
  • Shopify International Limited (ShopifyPayments), Victoria Buildings, 2nd Floor
    1-2 Haddington Road, Dublin 4, D04 XN32, Ireland
  • secuPay AG, Goethestraße 6, 01896 Pulsnitz, Germany
• Shipping and logistics service providers
• Credit agencies
• Auditors
• Tax and legal advisors

When we engage a service provider as a data processor under Art. 28 GDPR, we remain responsible for the protection of your data. Where required by law, processors are contractually obligated to treat your data confidentially and to process it only within the scope of providing their services. The processors we engage receive your data only if they need it to perform their respective services.

Your data will only be transferred to government agencies and authorities, or collected for such purposes, if required by mandatory national legislation or if you have instructed us to do so.

‍

VI. How long will my data be stored?

Your personal data will only be used for the purpose for which you provided it or for which you have given your consent, and will only be stored until that purpose is fulfilled. Once the purpose is fully achieved or you have requested the deletion of your data, your data will only be stored for as long as required by statutory limitation or retention periods (particularly those under tax and commercial law). After these periods expire, the data will be deleted unless you have expressly consented to further or different use. You may exercise your rights, such as the blocking of your data, even during these retention periods. Please refer to Section A, Item II.

Your data will be deleted or blocked by us as soon as the purpose for storage no longer applies or you request its deletion.

As a general rule, we only process and store your data for as long as our business relationship lasts or until the applicable warranty, guarantee, and limitation periods have expired. For example, the limitation period under Section 1489 of the Austrian Civil Code (ABGB) is generally three years, though in certain cases it can be up to thirty years. Furthermore, it may be necessary to retain data until the final conclusion of any legal disputes in which the data is required as evidence.

We are also subject to statutory documentation and retention requirements (such as those under the Austrian Commercial Code, the Financial Markets Anti-Money Laundering Act, or the Federal Fiscal Code). The retention and documentation periods specified therein range from two to ten years. For instance, we may need to store your data after a contract with you has ended until the tax audit for the last calendar year in which you were our customer has been completed.

‍

VII. Is personal data transferred to a third country?

As part of our processing activities, personal data may be transferred to entities in so-called third countries outside the EU or EEA that have not yet been certified by the European Commission as having an adequate level of data protection, such as the USA. If such a transfer becomes necessary in an individual case, it will only take place on the basis of an adequacy decision by the European Commission, standard contractual clauses, appropriate safeguards for data protection compliance, or your explicit consent.

‍

B. Using our websites

You can generally visit and use our websites for informational purposes without having to provide any personal information (e.g., by registering, placing orders, or otherwise submitting personal details). In such cases, we only process personal data to the extent necessary to provide a functional website and our content and services, or if cookies or similar technologies used on the website transmit personal information to us during your visit. Information on our own cookies or similar technologies can be found in Section B, Item II. Other cookies or similar technologies may allow us, as well as our partners or third parties, to recognize your browser on your next visit. Please refer to Section B, Item III for information on such third-party cookies or similar technologies.

Furthermore, the processing of our users' personal data generally only takes place with the user's consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by law.

‍

I. Provision of the website and creation of log files

Description of data processing

Every time you access our website, our system automatically collects data and information from the computer system of the accessing device, which your internet browser automatically transmits to us or our web host (so-called log files). These server log files contain IP addresses or other data that can be associated with a user. This could be the case, for example, if the link to the website from which the user arrives at our site, or the link to the website the user navigates to, contains personal data. The following information is collected and stored by our hosting provider:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer and time of the server request
• IP address

The data is stored in our web host's log files. This data is not stored together with other personal data of the user.

We use Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (www.webflow.com) (hereinafter: “Webflow”) as our web host and software provider for the creation, provision, and operation of our website, online forms, and other web elements. Information on data protection at Webflow can be found at https://webflow.com/legal/eu-privacy-policy. We have concluded a data processing agreement with Webflow in accordance with Art. 28 GDPR (“Data Processing Addendum,” see https://webflow.com/legal/dpa). As part of the aforementioned services provided by Webflow, data may be transferred to the USA based on standard contractual clauses that Webflow has agreed upon with us in its Data Processing Addendum, or via an equivalent data protection guarantee as part of the commissioned processing.

Legal basis and purpose of data processing

The legal basis for the temporary storage of data and log files is Art. 6(1)(f) GDPR. The aforementioned information is also required to provide the service in accordance with Section 165(2) of the Telecommunications Act (TKG) 2021.

The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user's computer. To do this, the user's IP address must remain stored for the duration of the session.

Storage in log files is carried out to ensure the functionality of the website. In addition, the data helps us optimize the website and ensure the security of our information technology systems.

Storage duration / Right to object and removal

Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. When collecting data to provide the website, this occurs once the respective session has ended.

If data is stored in log files, this occurs after no more than 7 days.

Collecting data to provide the website and storing it in log files is strictly necessary for the operation of the website. Consequently, there is no option for the user to object.

‍

II. Use of cookies and similar technologies

Description of data processing

Our website uses cookies or similar methods (e.g., web beacons, local storage) to collect, process, and use usage data (e.g., access times, pages visited) or meta and communication data (IP address, device information), including personal data. For the sake of simplicity, we refer to these technical methods generally as "cookies" below.

Cookies are text files containing a unique string of characters that are stored in or by the internet browser on the user's computer system, allowing the browser to be uniquely identified when the site is revisited. When a user visits a website, a cookie may be stored on the user's operating system. A cookie contains a characteristic string of characters. These cookies are used to make our website more user-friendly, effective, and secure. When you visit a website that uses cookies, the data you enter is stored exclusively in the cookie on your computer. In this case, data is only transmitted to our servers when a page is requested.

Some cookies are deleted after the browser session ends when you close your browser (so-called session cookies). These cookies are technically necessary, for example, to allow you to log in to the application and stay logged in while navigating between pages during your visit.

Other cookies remain on your device for a set period, allowing us to recognize your browser on your next visit (so-called persistent or protocol cookies). The purpose of these cookies is to provide you with optimal user guidance, "recognize" you, and present you with a varied website and new content during repeat visits.

Cookies from partner companies or third parties may be used, for example, to collect information for advertising, customized content, or statistics ("third-party cookies"). Unless we identify cookies as originating from third-party providers, they originate from our own service ("first-party cookies"). We provide separate information about the third-party cookies or "tracking" technologies we use in the following sections of our privacy policy.

Flash cookies are stored as data elements on your computer by websites that run on Adobe Flash. Flash cookies have no time limit.

For more information on which cookies and similar technologies we use to design our website, their purpose, and what data is stored or transmitted to third parties, please refer to our Cookie management tool “CookieHub” provided by CookieHub ehf, Hafnargata 18, 230 Reykjanesbær, Iceland, which allows you to provide your consent to the use of cookies and similar technologies according to your preferences when visiting our website.

Our cookie management tool collects log file and consent data using JavaScript. This JavaScript allows us to inform the user about specific tags on our website and to obtain, manage, and document their consent. The cookie management tool saves the settings and consent you provided when entering the website and processes the following data:

• Consent data (anonymized logbook data (Consent ID, Processor ID, Controller ID), consent status, timestamp)
• Device data (including truncated IP addresses (IP v4, IP v6), device information, timestamp)
• User data (including email, ID, browser information, SettingIDs, changelog)

For this purpose, the cookie management tool stores a technically necessary cookie. Information on data protection at CookieHub can be found at: https://www.cookiehub.com/legal/privacy-policy

Further information on which cookies we use to design our website, their purpose, and what data is stored in them or transmitted to third parties can be found in the detailed information provided by CookieHub, which you can access there under “More options” or “Cookie declaration”. CookieHub automatically analyzes which cookies are set on the site. The list of methods used and the cookie declaration are then also updated automatically.

Legal basis and purpose of data processing

The legal basis for processing personal data using cookies and similar technologies is Art. 6(1)(f) GDPR, to protect our legitimate interests in the best possible functionality and security of the website, as well as a customer-friendly and effective design of your visit, provided we are not asking for your consent under Art. 6(1)(a) GDPR.

The legal basis for storing and reading other information is Section 25 (1) of the TDDDG for cookies and similar technologies that require consent, and Section 25 (2) no. 2 of the TDDDG for cookies that are strictly necessary for the website to function.

We have integrated CookieHub to obtain your consent. This makes it easier for users to provide or manage consent for the individual categories of cookies and similar technologies we use. CookieHub blocks all categories of cookies that are not essential for the proper functioning of the website, unless you provide your consent for the use of additional tools. When you visit our website, users are shown an interface for this purpose:

• By clicking the “Accept all” button, you can either allow all processes or decide individually via the “More options” button (by activating the individual selection toggles and clicking the final “Save settings” button) which cookies and/or cookie-based applications and subsequent data processing you wish to consent to.
• Alternatively, you can reject all non-essential cookies by clicking the “Only essential cookies” button and use the website exclusively with the cookies required for its operation.

The purpose of using technically necessary cookies is to simplify or improve the user experience on our website, which is required for providing the service under Section 165 (2) of the TKG (2021). Some features of our website cannot be offered without the use of cookies. For these, it is necessary for the browser to be recognized even after navigating to a different page.

Furthermore, the purpose of the cookies we use in the “Analytical cookies,” “Marketing cookies,” and “Necessary cookies” categories depends on the services used and subsequent data processing, which is explained in more detail in the following sections of the privacy policy and in CookieHub.

The legal basis for the data processed via our cookie management tool is Art. 6 (1) (c) GDPR regarding user consent data, and otherwise Art. 6 (1) (f) GDPR or Section 165 (2) of the TKG (2021). As website operators, we have a legitimate interest in providing legally compliant, user-specific, and user-friendly cookie consent management, as well as in designing our website in a legally compliant manner.

Storage duration / Right to object and removal

For details on the storage duration of our cookies, please refer to the information in CookieHub under the “Cookie Declaration” section.

Cookies are stored on the user's computer and transmitted to our site from there. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically.

If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.

Alternatively, you can use the features of the cookie consent tool we have integrated to withdraw your consent at any time or change your mind by clicking the “Cookie settings” button to access and adjust your preferences.

‍

III. Statistical analysis of the website / Reach enhancement

1. Google Analytics

Description of data processing

For our online services, we use features of the web analytics service Google Analytics. The provider in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”), a subsidiary of Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics also uses cookies. The information generated by a Google cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. Google processes the data, and we receive reports about your user behavior. These reports may include, among others:

• Audience reports: Through audience reports, we get to know our users better and know more precisely who is interested in our service.
• Behavior reports: Here we learn how you interact with our website. We can track the path you take on our site and which links you click.
• Real-time reports: Here we always know immediately what is happening on our website. For example, we can see how many users are currently reading this text.

Google Analytics uses a tracking code to create a random, unique ID that is linked to your browser cookie. This is how Google Analytics recognizes you as a new user. The next time you visit our site, you will be recognized as a “returning” user. All collected data is stored together with this user ID. This is the only way to evaluate pseudonymous user profiles.

Your interactions on our website are measured using identifiers such as cookies. Interactions are all types of actions you perform on our website. If you also use other Google systems (such as a Google account), data generated via Google Analytics can be linked to third-party cookies. Google does not share Google Analytics data unless we, as the website operator, authorize it. Exceptions may occur if required by law. You can find the cookies used by Google Analytics in the detailed information of our cookie management tool, CookieHub, which you can access there under “Cookie Declaration.”

Our website uses Google Analytics exclusively with the "anonymizeIp()" extension. This means your IP address is not stored in full; it is truncated by Google within member states of the European Union or other contracting states to the Agreement on the European Economic Area before being transmitted to the USA. Identifying individual website visitors is not possible. Only in exceptional cases is the full IP address sent to a Google server in the USA and truncated there. Below, we provide an overview of the most important data collected by Google Analytics:

• Heatmaps: Google creates so-called heatmaps. These show exactly which areas you click on, giving us insight into how you navigate our site.
• Session duration: Google defines session duration as the time you spend on our site without leaving. If you are inactive for 20 minutes, the session ends automatically.
• Bounce rate: A bounce occurs when you view only one page on our website and then leave.
• Account creation: If you create an account or place an order on our website, Google Analytics collects this data.
• Location: Your country and approximate location can be determined via your IP address. This process is also known as IP geolocation.
• Technical information: Technical information includes, among other things, your browser type, internet service provider, and screen resolution.
• Referral source: Google Analytics—and we ourselves—are naturally interested in which website or advertisement led you to our site.

This list is not exhaustive and serves only as a general guide to the data stored by Google Analytics. For more information on how Google processes data, please read Google's privacy policy: https://policies.google.com/privacy?hl=en

Legal basis and purpose of data processing

We use Google Analytics to evaluate the use of our website and services, to compile reports on activities on our website and services, and to provide us with other services related to the use of our website, services, and the internet. We also use Google Analytics to evaluate data from AdWords and the DoubleClick cookie for statistical purposes. As website and service operators, we have a strong interest in analyzing user behavior to optimize our website, our offerings, and our advertising. Therefore, we ask for your consent to use Google Analytics and store Google Analytics cookies based on Section 165 (2) of the Telecommunications Act (TKG) 2021.

The information generated by the cookie about your use of our website or services is generally transmitted to a Google server in the USA and stored there. If IP anonymization is activated, your IP address will be truncated by Google within member states of the European Union or other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. By consenting to the use of cookies by Google Analytics, you also agree, in accordance with Art. 49 (1) sentence 1 lit. a GDPR, that your data may be processed in the USA, provided the data transfer is not secured by EU standard contractual clauses. The European Court of Justice considers the USA to be a country with an inadequate level of data protection by EU standards. In particular, there is a risk that your data may be processed by US authorities for control and surveillance purposes, potentially without the possibility of legal recourse. If you click the "Reject All" button or make a limited selection without Google cookies, the described transmission to Google will not take place. You can revoke your consent at any time with effect for the future.

Google will use this information to evaluate your use of the website or services, to compile reports on website activity for us, and to provide other services related to website and internet usage. According to its own statements, Google may also transfer this information to third parties where required by law or where third parties process this data on Google's behalf. Google has contractually guaranteed that it will not associate your IP address with any other data held by Google. To ensure this, as well as the data processing performed on our behalf, we have entered into a data processing agreement with Google.

Storage duration / Right to object and removal

Cookies are stored on the user's computer and transmitted to our site. As a user, you therefore have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it is possible that not all functions of the website can be used to their full extent.

By installing the browser add-on to deactivate Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=en), you can object to the collection and use of your data by Google Analytics. This informs Google Analytics that no information about your website visit should be transmitted to them.

Furthermore, especially for mobile browsers, you can install an opt-out cookie on your device via this link https://developers.google.com/analytics/devguides/collection/gajs/?hl=en#disable to prevent future data collection by Google Analytics on our website. Please note that if you delete the cookies on your device, you will need to reinstall the opt-out cookie.

Alternatively, you can also set your cookie preferences using the Cookie Hub tool we have integrated.

‍

2. Google Tag Manager

Description of data processing

Google Tag Manager is a solution provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), which allows marketers to manage website tags via an interface. The Google Tag Manager itself (which implements the tags) is a cookie-free domain and does not collect any personal data. Google Tag Manager helps integrate and trigger other tags, code snippets, tracking codes, and conversion pixels on a website, which may in turn collect data. Google Tag Manager does not access this data. Google Tag Manager provides us with an easy-to-use user interface that does not require in-depth programming knowledge or modifications to the website's source code.

We use Google Tag Manager solely to display Google Ads (formerly Google AdWords) for our search engine marketing activities.

For more information on Google Tag Manager, see: https://www.google.com/intl/en/tagmanager/use-policy.html.

‍

3. Google Ads (formerly Google AdWords) & Google Ads Conversion Tracking

Description of data processing

We use Google Ads, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and in Europe by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, to display advertisements within our online services and to draw attention to our attractive offers using advertising materials on external websites.

This allows us to determine how successful individual advertising campaigns are. These advertisements are delivered by Google via so-called "AdServers." Google AdWords uses cookies for this purpose (see the general information above). Setting these cookies enables an analysis of how our websites are used. Each time you access one of the individual pages of our website that incorporates a Google Ads component, the internet browser on your IT system is automatically prompted by the respective Google Ads component to transmit data to Google for the purpose of online advertising and commission billing. As part of this technical process, Google receives personal data, such as your IP address, which Google uses, among other things, to track the origin of visitors and clicks, and subsequently to facilitate commission billing. The cookies used typically store the following information as analysis values: unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions), and opt-out information (indicating that the user no longer wishes to be targeted). These cookies allow Google to recognize your web browser. If you do not agree to cookies being stored on your computer, please follow the general instructions for this or the instructions at the end of this explanation.

In addition, Google Ads uses so-called web beacons (invisible graphics). These web beacons allow information such as visitor traffic on the pages of this service to be evaluated.

The information generated by cookies and web beacons about your use of our website, including your IP address and the delivery of ad formats, is transmitted to a Google server in the USA and stored there. This information may be shared by Google with its contractual partners (see https://support.google.com/admanager/answer/94149?visit_id=637060482444635472-69980806&rd=1). We have no influence over the data collected by Google, nor are we aware of the full scope of data collection or the storage duration. To our knowledge, however, Google will not merge your IP address with other data stored about you. If you are logged into a Google account, however, your data may be directly associated with it. If you do not want this association with your Google profile, please log out before using our online services.

Further information on data protection at Google Ads can be found at https://policies.google.com/privacy?hl=en, as well as https://policies.google.com/technologies/ads?hl=en

Legal basis and purpose of data processing

Google Ads cookies and web beacons are stored on the basis of Art. 6 (1) (a) GDPR. Furthermore, we use Google Ads based on our legitimate interest under Art. 6 (1) (f) GDPR. As a website operator, we have a legitimate interest in analyzing the reach of our services, displaying relevant and interesting ads, improving campaign performance reports, and achieving a fair calculation of advertising costs.

We have also entered into a data processing agreement with Google.

Right to object and removal

You can prevent the installation of Google Ads cookies in several ways: a) by adjusting your browser settings accordingly; in particular, blocking third-party cookies will ensure you do not receive ads from third-party providers; b) by deactivating interest-based ads on Google via the link www.google.de/ads/preferences, although this setting will be deleted if you clear your cookies; c) by deactivating interest-based ads from providers that are part of the "About Ads" self-regulatory campaign via the link www.aboutads.info/choices, although this setting will be deleted if you clear your cookies; d) by permanently deactivating them in your Firefox, Internet Explorer, or Google Chrome browser via the link www.google.com/settings/ads/plugin. Please note that if you do this, you may not be able to use all the features of our online services to their full extent.

Alternatively, you can also set your cookie preferences via the CookieHub cookie management tool we have integrated.

‍

4. Amplitude

Description of data processing

To optimize our online shop and our mobile payment app, we use the web analytics software Amplitude, a service provided by Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA ("Amplitude"). This process is used to evaluate and analyze user behavior and to compile reports on activities for us. Data is captured in near real-time as soon as the user performs a specific action (e.g., clicks a button, loads a page, or completes a purchase). The following data categories are affected:

• Usage data: clicks, pages visited, time spent, feature usage.
• Device data: operating system, browser type, device type, screen resolution.
• Identifiers: pseudonymized user IDs, Amplitude-internal IDs, IP address. A truncated IP address is processed in this context.

Cookies are also stored on your computer for this purpose.

The information generated in this way is transmitted to an Amplitude server in the USA and stored there. We have concluded a Data Processing Addendum with Amplitude, which includes the EU Standard Contractual Clauses as a mechanism for the transfer of personal data from the EU to the USA. Amplitude participates in the EU-US Data Privacy Framework, which mandates minimum standards for the protection of personal data of Europeans whose data is stored or processed in the USA.

Further information on data processing by Amplitude can also be found in Amplitude's privacy policy (https://amplitude.com/privacy).

Legal basis and purpose of data processing

We use Amplitude to evaluate how our services are used, to compile reports on activity within those services, and to better understand how our services are being utilized. This helps us identify areas for improvement and optimize our site performance and features. As a service provider, we have a legitimate interest in analyzing user behavior to improve our products, so we ask for your consent to use Amplitude and store cookies in accordance with Section 165 (2) of the TKG (2021).

Retention period / Right to object and removal

If you do not want cookies to be stored, you can adjust your browser settings to delete cookies, block all or specific cookies, or provide a warning before cookies are saved. You can also manage your cookie preferences using our integrated CookieHub management tool.

‍

IV. Further information on procedures, plugins, and tools used for website design

1. SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser's address line changes from “http://” to “https://” and by the lock symbol in your browser bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

‍

2. make.com

Description of data processing

To integrate various databases and web tools, we use make, a service provided by Celonis SE, Theresienstr. 6, 80333 Munich. make is a platform where different cloud-based software applications can be connected. Data required or processed in these linked applications is automatically transferred through these connections. The goal is to allow digital processes—especially standardized, recurring ones—to run independently, creating an automated data flow and efficient workflows.

Further information on data protection at Celonis can be found at https://www.make.com/en/privacy-notice and https://www.celonis.com/de/privacy-notice/ 

Legal basis and purpose of data processing

The use of make.com is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in efficiently automating processes, consolidating various services, and the associated import and export of personal and contact data.

‍

3. Language versions of the website (translations with Weglot) 

Description of data processing

On our website, we use the translation service Weglot, provided by Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France. Weglot is loaded when the website is accessed and allows you to set the website language using the corresponding language icons. By integrating the Weglot translation service, a connection is established between your browser and Weglot's servers when you visit our website, and your IP address and device information are transmitted to Weglot. The transmitted data is necessary for Weglot to function.  

Data processed through the use of Weglot is handled by Weglot as a data processor within the European Union, based on a data processing agreement in accordance with Art. 28 GDPR.

Information on how Weglot handles personal data can be found at https://www.weglot.com/privacy.

Legal basis and purpose of data processing

The legal basis for data processing in connection with Weglot is our legitimate interest under Art. 6(1)(f) GDPR in providing our website in multiple languages, including offering visitors the option to select their preferred language, provided that we have not requested separate consent under Art. 7 GDPR or Section 165(2) TKG (2021).

Right to object and removal

Using the Weglot service is strictly necessary to provide the website in different language versions.

If you would like your personal data to be deleted, you can exercise your right to object and removal as described in the general information in Part A.

‍

4. Integration of YouTube content

Description of data processing

We occasionally use content and services from the video platform YouTube to embed video content on our website via a plugin or to link to videos on our YouTube channel. YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, and is provided in Europe by Google Ireland Limited,
Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”).

We may process data you enter on our YouTube channel (specifically your username and content published under your account) if we respond to your posts or messages on our YouTube channel.

Otherwise, we only receive certain non-personal information from Google regarding post activity, such as the number of profile or media clicks and the watch time for a specific video. This data is viewable via our YouTube account. Beyond this, data processing is carried out by Google under its own responsibility; we have no way to prevent or disable the use of analysis tools and similar features by Google within YouTube.

If you wish to play embedded videos using this plugin (by clicking the play button), your IP address will be sent to YouTube, as YouTube cannot send the video content to your browser without it. The IP address is therefore necessary for display. Furthermore, information about which subpage of our website you visited is transmitted to the YouTube server. If you are logged into your YouTube account, playing our videos allows YouTube to associate your usage behavior directly with your personal profile. Further information on data processing by Google when using YouTube can be found in the privacy policy applicable to YouTube: https://policies.google.com/privacy?hl=en&gl=en

Legal basis and purpose of data processing

YouTube is used on the basis of our legitimate interests under Art. 6(1)(f) GDPR to provide or link to video content on our website and to handle inquiries or comments.

Storage duration / Right to object and removal

To prevent your activity from being associated with your user account, please log out of your YouTube profile before playing our video content. You must check Google’s settings or your YouTube user account for options to restrict the processing of your data by Google. For example, you can manage this in your Google account’s general settings under “Data & privacy.” Additionally, on mobile devices (smartphones, tablets), you can restrict Google’s access to contact and calendar data, photos, location data, etc., within the device settings, though this depends on the operating system you are using.

‍

5. Auth0

Description of data processing

We use the cloud-based identity management platform Auth0, provided by Okta Inc., 10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA, for registration and login in our online shop.

When users enter data into a form provided by Auth0, this information is exchanged directly between the user's browser and Auth0. The following data is processed for identity management, authentication (login/registration), and user account security:

• Account data: Email address, name, and profile picture (if using social login).
• Security data: Password hashes, two-factor authentication (MFA) data, and session tokens.
• Metadata: Login IP address, timestamps, and browser/device information (for fraud detection).

Data is collected exclusively during the login or registration process, as well as whenever a session is refreshed.

For more information on how Auth0 processes data, please visit https://www.okta.com/legal/privacy-policy/.

We have selected Europe as the server location for data storage. In cases where data transfer to the USA may be necessary, we rely on EU Standard Contractual Clauses, which we have incorporated into a data processing agreement.

Legal basis and purpose of data processing

We integrate Auth0 based on our legitimate interest under Art. 6(1)(f) GDPR to ensure that only authorized and identified individuals can access our services. Furthermore, Auth0 is necessary for providing the service as part of user account access under Section 165(2) of the Telecommunications and Telemedia Data Protection Act (TDDDG).

Storage duration / Right to object and erasure

If you do not want cookies to be stored, you can adjust your browser settings to delete cookies, block all or specific cookies, or receive a warning before cookies are saved. You can also manage your cookie preferences using our integrated CookieHub tool.

‍

6. Datadog

Description of data processing

We use DataDog, a service provided by DataDog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (“DataDog”), as a data processor in accordance with Art. 4(8) and Art. 28 GDPR.

We use DataDog to monitor system stability and analyze errors (such as unexpected deviations, anomalies, latency—i.e., the time delay in transmitting data to our servers—availability, and response times) on our websites and services, as well as for IT security purposes.

For this purpose, DataDog collects the following data on our behalf:

• Log data: Technical logs of server requests (including user IP addresses).
• Performance data: App response times, error rates, error details, and crash reports (stack traces, which show the application history leading to an error, as well as the time the error occurred).
• Metadata: System configurations (e.g., browser type and version, operating system) and anonymized user IDs to track errors across various microservices.

This data allows DataDog to help us detect, evaluate, and immediately resolve errors. The collected personal data may be transferred to and stored by DataDog in the USA. We have entered into a Data Processing Agreement with DataDog that includes EU Standard Contractual Clauses. Additionally, DataDog is certified under the EU-U.S. Data Privacy Framework, which serves as the basis for data transfers to certified companies and organizations in the USA.

For more information on how DataDog processes data, please see the DataDog Inc. privacy policy: https://www.datadoghq.com/legal/privacy/

Legal basis and purpose of data processing

After this period, only aggregated, non-personal data is retained.
We process this data based on our legitimate interest under Art. 6(1)(f) GDPR in ensuring the error-free and demand-oriented operation of our websites and services, as well as for error detection and resolution.
DataDog is therefore necessary for providing our websites and services within the scope of user account access pursuant to Section 165(2) TKG (2021).

Storage duration / Right to object and erasure

Data collected via DataDog is deleted or anonymized after the error analysis is complete.

‍

V. Links to third-party websites

Our website may contain links to other websites. We have no control over the content or design of third-party offerings. Therefore, these privacy notices do not apply to external providers whose content or offerings we merely link to.

If you are redirected to other sites via links on our pages, please inform yourself there about how your data is handled.

‍

VI. Online presence on social networks and platforms

Description of data processing

We maintain additional online presences on social networks or industry networks (such as Facebook, Xing, or LinkedIn) (hereinafter also referred to as "SN") and platforms (e.g., YouTube), which we link to from our website. By clicking on the respective buttons (identifiable by the logos of the social networks or platforms), you will be taken to the respective SN's online presence. The purpose of these online presences is to communicate with active customers, interested parties, and users, and to provide them with information about our services.

When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply.

Since the use of SN occurs outside of our website or services, we have no influence over it, unless otherwise stated below. However, please note that when using the aforementioned platforms and networks we link to, data may also be processed by these SN companies in the USA and may be used by the respective operators for market research and advertising purposes, including the creation of user profiles. If you are logged into the respective networks and platforms, they may also store cookies on your device that track your use of our platform or services, as well as other information about your usage behavior.

Unless otherwise stated in our privacy policy, we only process user data when they communicate with us within the social networks and platforms, e.g., by writing comments or sending us messages.

To make it easier for you to find information about the respective data processing and the opt-out options provided by the operators, we refer you to the privacy policies and information of the respective network operators below.

Legal basis and purpose of data processing

We only process your personal data when you contact us directly via the respective SN or interact with our presence or its content there. Unless otherwise stated in our privacy policy, we process user data based on our legitimate interests under Art. 6(1)(f) GDPR to effectively inform and communicate with users, provided they communicate with us within the social networks and platforms (e.g., when users post on our online presences or send us messages). If your contact is aimed at entering into a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR.

To the extent that personal data is processed in connection with our presence on an SN and the respective SN alone determines the purposes and means of processing, the respective SN is the sole controller for that processing. Please carefully consider which personal data you share with us via an SN presence. If you wish to avoid SNs processing personal data you transmit to us, please contact us through other means.

Storage duration / Right to object and erasure

If you are a member of one of the social networks where we maintain an online presence and do not want the network to collect data about you via our site and link it to your member profile, you must log out of the social network before visiting our site. For a detailed description of how data is processed, information on how long the respective network stores your data, and your opt-out options, please refer to the provider information linked below.

Please note that requests for information and the assertion of user rights are most effectively handled directly by the providers. Only the providers have access to user data and can take appropriate action or provide information. Should you still require assistance, you are welcome to contact us.

Facebook

We maintain a Facebook company page ("fan page") on the social network operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Facebook Ireland and we are joint controllers for the collection of data from visitors to our fan page. For this reason, we have entered into a joint controller agreement with Facebook in accordance with Art. 26 GDPR, as well as additional data processing terms:

• "Controller Addendum": https://www.facebook.com/legal/controller_addendum
• "Data Processing Terms": https://www.facebook.com/legal/terms/dataprocessing/update

We are responsible for providing data subjects with at least the information regarding our joint controllership with Facebook as set out above and below. The information required by Facebook under Article 13(1)(a) and (b) GDPR can be found in the Facebook Ireland Data Policy at https://www.facebook.com/about/privacy.

Facebook Inc., Menlo Park, California, USA (hereinafter: "Facebook Inc.") also collects and uses "Page Insights" for analytical purposes. Page Insights are summaries of data that allow both us and Facebook Inc. to gain insights into how users interact with our page. Page Insights may be based on personal data collected in connection with our users' visits or their interactions on our page. To this end, we have entered into a "Controller Addendum" with Facebook (see above), which specifically governs the security measures Facebook takes in the context of Page Insights and how Facebook responds to user inquiries. The purposes for which the collection and transmission of personal data—which constitute joint processing—take place are set out in detail in the terms of use referenced by the aforementioned Controller Addendum.

Data collected during visits to our "fan page" includes information about the types of content users view or interact with, or actions they take (see "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices users employ (e.g., IP addresses, operating system, browser type, language settings, and cookie data, as described in detail under "Device Information" in the Facebook Data Policy: https://www.facebook.com/policy).

However, by maintaining a Facebook company page, we share responsibility for Page Insights and have agreed with Facebook Ireland that Facebook Ireland is responsible for fulfilling the rights of data subjects under Articles 15-20 of the GDPR regarding the personal data stored by Facebook Ireland following joint processing. Therefore, we have a reporting obligation to Facebook if we receive data protection inquiries regarding Page Insights. Please note that we will forward inquiries regarding Page Insights to Facebook Ireland. Otherwise, please refer to the information on your rights as a data subject in Section A. For more information on how Facebook Ireland processes personal data, including the legal basis Facebook Ireland relies on and how you can exercise your rights against Facebook Ireland, please see the Facebook Ireland Data Policy at https://www.facebook.com/about/privacy

The analysis of data collected via Page Insights serves to improve our online presence and for advertising purposes. We maintain our Facebook fan page for the purpose of communication and to easily channel contact requests from Facebook users. The collection and further processing of this data is in our legitimate interest and the legitimate interest of Facebook Inc. pursuant to Art. 6(1)(f) GDPR.

Please be aware that we cannot enable or disable the Page Insights technology. We must therefore forward most such requests to Facebook Ireland, unless we have collected the data ourselves. If you do not want Facebook Inc. to collect your data, we ask that you do not use our Facebook company page and/or configure your browser to block cookies and/or log out of Facebook while using our site.

Privacy Policy:

https://www.facebook.com/about/privacy/, https://www.facebook.com/legal/terms/information_about_page_insights_data

Opt-out options:

https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com

LinkedIn

LinkedIn is a service provided by the LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA, operated in Europe by the LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is an internet-based social network that allows users to connect with existing business contacts and build new ones. With over 400 million registered members in more than 200 countries, LinkedIn is currently the largest platform for business contacts and one of the most visited websites in the world.

Every time you access our website, if it is equipped with a LinkedIn component (LinkedIn plug-in), this component prompts the browser you are using to download a corresponding representation of the component from LinkedIn. Further information on LinkedIn plug-ins can be found at https://developer.linkedin.com/plugins. As part of this technical process, LinkedIn receives information about which specific subpage of our website is being visited by the data subject.

If the data subject is logged into LinkedIn at the same time, LinkedIn recognizes which specific subpage of our website the data subject is visiting each time they access our site and for the entire duration of their stay. This information is collected by the LinkedIn component and assigned by LinkedIn to the data subject's respective LinkedIn account. If the data subject clicks on a LinkedIn button integrated into our website, LinkedIn assigns this information to the data subject's personal LinkedIn user account and stores this personal data.

Whenever you visit our website while logged into LinkedIn, the LinkedIn component automatically notifies LinkedIn that you have visited our site, regardless of whether you click on the LinkedIn component or not. If you do not want this information to be transmitted to LinkedIn, you can prevent it by logging out of your LinkedIn account before visiting our website.

LinkedIn provides the option to unsubscribe from email messages, SMS messages, and targeted ads, as well as to manage ad settings, at https://www.linkedin.com/psettings/guest-controls. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua, and Lotame, which may set cookies. You can opt out of such cookies at https://www.linkedin.com/legal/cookie-policy. LinkedIn's current privacy policy is available at https://www.linkedin.com/legal/privacy-policy. LinkedIn's cookie policy is available at https://www.linkedin.com/legal/cookie-policy.

Privacy Policy https://www.linkedin.com/legal/privacy-policy , 

Opt-out option:

https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out , 

XING

The operating company for Xing is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany ("XING").

Xing is an internet-based social network that allows users to connect with existing business contacts and build new ones. Users can create a personal profile on Xing. Companies can, for example, create company profiles or post job offers on Xing.

Each time you access one of the individual pages of this website operated by the controller, on which a Xing component (Xing plug-in) has been integrated, the internet browser on your information technology system is automatically prompted by the respective Xing component to download a display of the corresponding Xing component from Xing. Further information on Xing plug-ins can be found at https://dev.xing.com/plugins. As part of this technical process, Xing receives information about which specific subpage of our website you are visiting.

If you are logged into Xing at the same time, Xing recognizes which specific subpage of our website you are visiting each time you access our site and for the entire duration of your visit. This information is collected by the Xing component and assigned by Xing to your respective Xing account. If you click on one of the Xing buttons integrated into our website, such as the "Share" button, Xing assigns this information to your personal Xing user account and stores this personal data.

Whenever you visit our website while logged into Xing, the Xing component notifies Xing that you have visited our site, regardless of whether you click on the Xing component or not. If you do not want this information to be transmitted to Xing, you can prevent it by logging out of your Xing account before visiting our website.

The privacy policy published by Xing, which is available at https://www.xing.com/privacy, provides information about the collection, processing, and use of personal data by Xing. Furthermore, Xing has published privacy notices for the XING Share button at https://www.xing.com/app/share?op=data_protection .

Privacy Policy / Opt-out option:

https://privacy.xing.com/en/privacy-policy 

‍

VII. Active use of our website

1. Contact forms and email contact

Description of data processing

Our website includes a contact form that can be used for electronic communication. If a user takes advantage of this option, the data entered in the input fields is transmitted to us and stored. 

• Company/Municipality (required)
• First name (required)
• Last name (required)
• Email (required)
• Phone (optional)
• Message (optional)

When you send a message via one of our contact forms, the following data is also stored:

• the user's IP address
• date and time of registration

If you contact us via an email address we provide, the personal data you include in your email will be stored.

If you provide a mobile phone number to receive updates on the status of your payment request, we will use that number for this purpose.

We use HubSpot Forms on our website, a service provided by our CRM system, HubSpot, to integrate contact forms and process the data entered into them (see Part C, Section II). HubSpot Forms offers features for SEO, content creation, lead management, email marketing, and analytics. The data entered by users in these forms is stored in our customer relationship management system provided by HubSpot.

We use Google email services, provided via Google Workspace by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (hereinafter: "Google"). In addition to our CRM software, which serves as our central system for managing and processing inquiries, emails are also stored on Google's servers. We have selected the "Europe" region as our server location and have entered into a data processing agreement with Google. There is no transfer of these emails to third countries, particularly the USA, beyond this, which Google also contractually guarantees.

To channel and sort incoming inquiries, we use an interface to access AI-based services designed to understand and generate natural language and related inputs, analyze information, and make predictions:

• For this, we use the ChatGPT language model from OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We have agreed with OpenAI that our data will not be used to train their models or shared with OpenAI. You can view OpenAI's privacy policy at https://openai.com/de/policies/eu-privacy-policy. We have entered into a data processing agreement with OpenAI (see https://openai.com/policies/data-processing-addendum). Since data is transferred to the USA when using the OpenAI API, the Data Processing Addendum includes the EU Standard Contractual Clauses to ensure an adequate level of data protection even when data is transferred to a third country.
• In addition, we use the AI-powered system Google Gemini, offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Gemini was developed to provide advanced language and image processing capabilities. It uses machine learning to understand and generate natural language and analyze images, offering versatile applications in various fields. We use the Google Gemini model to pre-select emails and incoming documents. As a Google Workspace customer, Google ensures that data processed using Google Gemini is not used by Google to train its publicly available AI models.

To check the spelling of responses to incoming emails, we use the application LanguageTool, software from LanguageTooler GmbH
Karl-Liebknecht-Str. 37, 14482 Potsdam, a subsidiary of Learno Inc., which includes AI features for checking spelling and grammar as well as refining phrasing. You can find the provider's privacy policy for LanguageTool here: https://languagetool.org/de/legal/privacy. LanguageTool stores checked records and the errors found within them on its servers for up to 15 minutes (not on permanent storage media). This storage occurs without an IP address or other information that would allow the data to be linked to a specific person. However, if the text contains personal information, this will also be stored briefly. We have entered into a data processing agreement with Learno Inc. that includes the necessary EU Standard Contractual Clauses for data processing in the USA, by which the provider contractually commits to complying with applicable data protection regulations: https://languagetool.org/de/legal/dpa

To read attached PDF or Word files, we use the software solution Airparser, Sepapaja tn 6, Tallinn 11415, Estonia. Airparser uses AI technology to identify and extract structured data. We have entered into a data processing agreement with Airparser in accordance with Art. 28 GDPR, by which Airparser is contractually obligated to comply with applicable data protection regulations (see https://airparser.com/dpa/). You can view Airparser's privacy policy at https://airparser.com/gdpr/ .

Legal basis and purpose of data processing

The legal basis for processing data transmitted when sending a contact form inquiry or an email is Art. 6(1)(f) GDPR. If the contact form inquiry or email contact is aimed at concluding a contract, an additional legal basis for processing is Art. 6(1)(b) GDPR.

We process personal data from the input form to handle inquiries and contact you. In the case of contact via email, this also constitutes the necessary legitimate interest in processing the data. If you provide a mobile phone number for updates on the status of your payment request, we will use the number you provided for this purpose.

The use of AI-based services is based on our legitimate interest under Art. 6(1)(f) GDPR. Due to the high volume of incoming messages, we rely on such pre-selection and allocation to the appropriate departments within the company to ensure fast and targeted processing of these inquiries, which is in both our interest and the interest of the senders.

User information may also be stored in our customer relationship management system (CRM software) or similar inquiry management systems based on our legitimate interests.

Other personal data processed during the submission process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

Storage duration / Right to object and erasure

Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the contact form input field and data sent via email, this is the case when the respective conversation with the user has ended. The conversation is considered ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved and no legal requirements mandate longer storage.

Users have the right to withdraw their consent to the processing of their personal data at any time.

If a user contacts us via email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued unless we can base the processing on another legal ground or have an overriding interest in further data processing.

Alle personenbezogenen Daten, die im Zuge der Kontaktaufnahme gespeichert wurden, werden in diesem Fall gelöscht, sofern keine gesetzlichen Vorgaben eine längere Speicherung bedingen.

‍

2. Telefon-Hotline

Beschreibung der Datenverarbeitung

Nimmt ein Nutzer die Möglichkeit wahr uns unter einer auf unseren Internetauftritten angegebenen Rufnummer telefonisch zu kontaktieren, erfassen wir die eingehende Rufnummer des Anrufers sowie weitere technische Informationen aus dem Telefonsystem (Gesprächsbeginn und Gesprächsdauer), die entweder dort erzeugt oder durch Übermittlung der Telefongesellschaft bereitgestellt wurden und halten den wesentlichen Gesprächsinhalt sowie gegenüber unseren Mitarbeitern von den Betroffenen angegebene Informationen (Name, Anliegen, Kontaktmöglichkeiten für Rückfragen etc.) fest. 

Für eine Vorqualifizierung der bei uns eingehenden Anrufe benutzen wir eine KI-gestütze Softwarelösung des Anbieters Leaping AI UG (haftungsbeschränkt), Potsdamer Straße 72, 10785 Berlin mit der die für die Einordnung des Anrufs und Weiterleitung an die richtige Fachstelle bzw. Beantwortung der Nutzeranliegen erforderlichen Daten (insb. unser Vorgangszeichen, Kennzeichen, Name des Anrufenden) abgefragt werden und bestimmte Kundenanliegen automatisiert abgewickelt werden können. Hierfür wurde mit Leaping AI eine Vereinbarung zur Verarbeitung von Daten im Auftrag nach Art. 28 DSGVO geschlossen.

Sie werden von uns gefragt, ob Sie einer Aufnahme Ihres Gesprächs zustimmen. Soweit der Anrufer in eine Gesprächsaufzeichnung des Telefonats einwilligt, speichern wir den kompletten Gesprächsinhalt und erstellen automatisiert ein Transkript des Gesprächs. Wir verwenden Gesprächsaufzeichnungen und Transkripte zu Schulungs- und Trainingszwecken unserer Servicekräfte, Aufklärung von Kundenbeschwerden, sowie zur Erstellung von anonymisierten internen Auswertungen (Klassifizierung von Anrufen, Erstellung von Statistiken von Gründen für Anrufe) sowie zu Nachweiszwecken im Zusammenhang mit der Geltendmachung von uns zustehenden Rechtsansprüchen oder der Abwehr gegen uns gerichteter Rechtsansprüche.

Wir nutzen hierfür die Cloud-Contact-Center-Plattform Talkdesk des Anbieters Talkdesk Inc. 201 Spear Street, Suite 1100, San Francisco, CA 94105 USA (im Weiteren: „Talkdesk“) abgeschlossen. Wir haben mit Talkdesk eine Vereinbarung zur Auftragsverarbeitung gemäß Art. 28 DSGVO nebst den EU-Standardvertragsklauseln der EU für Datentransfers in Drittstaaten abgeschlossen, womit Talkdesk vertraglich verpflichtet, die geltenden datenschutzrechtlichen Bestimmungen einzuhalten. Wir haben mit Talkdesk ferner vereinbart, dass unsere Talkdesk-Instanz in einer Region in Europa bereitgestellt wird und damit unsere Daten standardmäßig in einer regionalen Cloud innerhalb der europäischen Union verarbeitet werden.

Rechtsgrundlage und Zweck der Datenverarbeitung

Wir erfassen bei Annahme des Gesprächs automatisiert zum Zwecke der Automatisierung und effizienteren Abwicklung von bestimmten Kundenanliegen bzw. Interaktionsbestandteile die für die Anrufabwicklung erforderlichen Daten (insb. unser Vorgangszeichen, Kennzeichen, Name des Anrufenden) auf Grundlage von Art. 6 Abs. 1 lit. f DSGVO. Hat das Telefonat Bezug zu unseren Leistungen und ein mit dem Anrufer bestehendes, beendetes oder geplantes Vertragsverhältnis, so ist zusätzliche Rechtsgrundlage für die Verarbeitung Art. 6 Abs. 1 lit. b DSGVO.

Wir speichern während des Gesprächs das Anliegen des Anrufers manuell in unserem System und speichern diese Gesprächsnotiz mit Gesprächsende ab. Eine Gesprächsaufzeichnung findet dabei nicht statt. Rechtsgrundlage für die Verarbeitung dieser Daten ist Art. 6 Abs. 1 lit. f DSGVO. Hat das Telefonat Bezug zu unseren Leistungen und ein mit dem Anrufer bestehendes, beendetes oder geplantes Vertragsverhältnis so ist zusätzliche Rechtsgrundlage für die Verarbeitung Art. 6 Abs. 1 lit. b DSGVO.

Gesprächsaufzeichnungen und Transkriptionen werden ausschließlich auf Basis einer vom Nutzer zuvor abgegebenen Einwilligung gemäß Art. 6 Abs. 1 lit. a DSGVO angefertigt und weiter verarbeitet.

Die Angaben der Nutzer können ferner auf Basis unserer Berechtigten Interessen in unserem Customer-Relationship-Management-System (CRM-Software) oder vergleichbarer Anfragenorganisation gespeichert werden.

Dauer der Speicherung / Widerspruchs- und Beseitigungsmöglichkeit

Die Daten werden gelöscht, sobald sie für die Erreichung des Zweckes ihrer Erhebung nicht mehr erforderlich sind. Dies dann der Fall, wenn die jeweilige Konversation mit dem Nutzer beendet ist. Beendet ist die Konversation dann, wenn sich aus den Umständen entnehmen lässt, dass der betroffene Sachverhalt abschließend geklärt ist und keine gesetzlichen Vorgaben eine längere Speicherung bedingen.

Sofern keine gesetzliche Speicherfrist für Aufzeichnungen vorgegeben ist, orientiert sich die Dauer der Speicherung von Gesprächsaufnahmen und Gesprächsnotizen an den gesetzlichen Verjährungsfristen (in Deutschland beträgt die regelmäßige Verjährungsfrist drei Jahre). Transkripte von Gesprächsaufnahmen werden nach 6 Monaten gelöscht.

Der Nutzer hat jederzeit die Möglichkeit, seine Einwilligung zur Verarbeitung der personenbezogenen Daten zu widerrufen. Willigt ein Anrufer in die Aufnahme des Gesprächs, dessen Transkription und Speicherung dieser Aufnahme und des Transkripts ein, kann er diese Einwilligung jederzeit widerrufen. In einem solchen Fall werden die Aufnahmen bzw. Transkripte umgehend gelöscht, sofern keine gesetzlichen Vorgaben uns zu einer längeren Speicherung zwingen.

‍

3. Ticket-System

Beschreibung der Datenverarbeitung

We use Freshdesk as our ticketing system, a software solution provided by Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA. Freshdesk is a customer service platform that makes it easier to handle customer inquiries and requests across various channels. We use Freshdesk to receive and manage contact requests. If you send us a request via a contact form on our website, or contact us by email or phone, the information you provide, the content of our conversation, and any data we collect (see sections VII. 2 and VII. 3 above) will be stored and organized in the ticketing system to ensure chronological processing and improve your service experience.

The stored information is kept on Freshdesk's servers. To organize and process requests, we collect personal data based on what you provide—at a minimum, your first name, last name, and email address—which is then transmitted to, stored by, and accessed via Freshdesk. We have opted to have this data processed on servers located within the EU. This is intended to ensure, from a technical standpoint, that the data remains within the European Union and cannot be accessed by US authorities.

For more information on data protection at Freshdesk, please visit https://www.freshworks.com/privacy/ .

Legal basis and purpose of data processing

We process information collected via Freshdesk based on our legitimate interest in providing efficient customer service and answering your requests as quickly as possible, in order to support our customers and users (Art. 6(1)(f) GDPR). This is done in conjunction with a data processing agreement concluded with Freshdesk in accordance with Art. 28 GDPR, which ensures data protection and prohibits unauthorized disclosure to third parties.

Should a transfer of data to the USA be necessary in an individual case, it will be based on the EU Commission's standard contractual clauses.

Storage duration / Right to object and erasure

We store your data for the duration of our contractual relationship with you or until the respective conversation has been fully resolved.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

‍

4. Chat function

Description of data processing

The chat function provided on our website uses an AI-powered chatbot from Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA (hereinafter: "Decagon"). Decagon operates an AI platform that automates customer service processes using "agents." You can use the chat function to ask and receive answers to frequently asked or general questions about our parking system or specific parking areas we manage (e.g., opening hours, rates), or to report issues at a parking area so they can be forwarded to our customer support team.

As soon as you enter a question into the chat's text field (known as a prompt), Decagon automatically analyzes the question and provides a text-based response from the agent. Generally, we do not need any personal information from you (such as names, email addresses, phone numbers, addresses, or license plate numbers) for this. Please refrain from voluntarily entering such personal data about yourself or others into the input field. We only collect and store such data if you provide it to us voluntarily.

For the purpose of displaying and technically operating the chat function, the following technically necessary data is processed as part of log files when you use it:

• IP address
• Metadata regarding API requests
• Date and time of access

Processing by the chat function is fully automated and only begins once you send data into the chat. The agent operates independently within clearly defined boundaries and does not make independent decisions that affect your rights or access to our services. If a request requires human judgment or falls outside the AI agent's scope, it will be forwarded to one of our human agents via a supervised process and stored outside of Decagon in our CRM or ticketing system for further processing.

Decagon has contractually guaranteed that user data provided via the chat function will not be used to train other AI models.

For more information on data protection at Decagon, please visit https://decagon.ai/legal/privacy.

Legal basis and purpose of data processing

The purpose of this processing is to support our customers and users by answering general questions or support requests. We process the information collected via Decagon based on our legitimate interest in managing our customer service efficiently and responding to your request as quickly as possible (Art. 6(1)(f) GDPR) in conjunction with a data processing agreement concluded with Decagon in accordance with Art. 28 GDPR, which ensures data protection and prohibits unauthorized disclosure to third parties.

Furthermore, we have agreed with Decagon that data will be processed exclusively within the EU during the normal operation of the chat function (EU data residency). Should a data transfer to the USA be necessary for technical support of the chat function in individual cases and be authorized by us, this will be based on the EU Commission's standard contractual clauses.

Storage duration / Right to object and erasure

We store personal data exchanged during chats for the duration of the legal relationship between us and the data subjects or until the respective conversation has been concluded.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

‍

C. Data processing in connection with the use of MHP parking spaces

1. Use of the MHP Online Shop

Description of data processing

Via our MHP online shop (hereinafter: "Online Shop"), you have the option to book and pay for the parking services described there for parking areas managed by us, based on the applicable General Terms and Conditions. For example, you can pay your parking fees online.

We use cookies to make our online shop more user-friendly. Some elements of our website require the browser to be identified even after a page change. These cookies store the user's language and region.

In addition, cookies enable an analysis of browsing behavior in the online shop. This allows the following data to be transmitted: search terms entered, frequency of page views, and use of website functions.

To book parking services, you must fill out and submit the respective booking form. You must enter your vehicle license plate number in the designated input mask, and if applicable, select your desired parking area and/or provide a file number or reference. We require the license plate number and other information to assign the correct parking fee to the respective parking process or service.

Data processed during the booking process includes license plate data, the amount to be paid, and other communication, contract, and payment data of our customers, prospective customers, and other business partners. Processing is carried out for the purpose of providing contractual services as part of the operation of our online shop, billing, delivery, and customer service. During the booking process, we specifically process the information provided in the respective input forms, such as name, company, address, email, and telephone number. Mandatory fields are generally marked with an asterisk (*) or labeled as "optional" and include the information necessary for providing and billing the ordered service, as well as contact information to allow for follow-up or to notify you of important information regarding your order (e.g., mandatory legal information, schedule changes, etc.).

We process and use the data collected here to enable you to select, book, and pay for our parking services. We also process the data to handle and, if necessary, ship the booking you have placed. Further details on the legal and organizational framework can be found in the underlying General Terms and Conditions. Details on the payment service providers we use can be found in Section 2 of this Part C below.

For our online shop, we use the e-commerce solution provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, an affiliate of Shopify Inc., 126 York Street, Suite 200, Ottawa, ON, Canada, K1N 5T5 (Shopify Group companies hereinafter collectively: "Shopify"). Shopify is the provider and operator of the e-commerce platform of the same name. All data collected via the online shop is processed for these purposes on Shopify's servers.

In the event of data transfer to Shopify Inc. in Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission. As part of the aforementioned services provided by Shopify, data may in individual cases also be transferred to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments, or Shopify (USA) Inc. as part of further processing on our behalf.

We share the data collected via our online shop with Shopify to the extent necessary for Shopify to provide its services in connection with the shop system. In addition, Shopify directly processes the data that our customers provide when shopping or paying in order to process orders and offer our customers a user-friendly shopping experience in the shop. Specifically, Shopify collects or receives name, email address, shipping and billing address, payment data, company name, telephone number, IP address, information about outgoing orders, information about the Shopify-supported merchant shops you visit, as well as information about the device and browser used.

The data entered into our shop system may also be forwarded to Shopify's servers or other service providers that Shopify integrates for its services, particularly in the USA, and processed there. Further information can be found in Shopify's privacy policy at https://www.shopify.de/legal/datenschutz.

Legal basis and purpose of data processing

The legal basis for processing data collected during a booking is Art. 6(1)(b) GDPR, as it is necessary for the performance of a contract. Additionally, we process data under Art. 6(1)(f) GDPR to detect and prevent harmful behavior, uncover and stop other negative experiences, maintain the integrity of our online shop, and promote safety and security. Both we and other users of our services have a legitimate interest in preventing, detecting, or investigating illegal activities, fraud, or security breaches. The information above is also required to provide the service in accordance with Section 165(2) TKG (2021).

We process the personal data entered into the input form to manage your booking and provide the respective parking service.

Data entered in our online shop may also be processed based on your consent (Art. 6(1)(a) GDPR) if we have requested it. You can withdraw your consent at any time. The lawfulness of any data processing that occurred prior to your withdrawal remains unaffected. Please note that if you withdraw your consent, we may be unable to provide the full booking process, and your booking may no longer be able to be completed.

We use Shopify based on our legitimate interests under Art. 6(1)(f) GDPR to sell our products online quickly, easily, and securely, and to simplify the use of our shop and make your visit more engaging. Shopify helps us understand how our website is used so we can continuously optimize our offerings and better tailor them to your needs and interests. Cookies from Shopify that are not technically necessary are processed based on your consent under Art. 6(1)(a) GDPR and Section 165(2) TKG (2021). If you do not accept cookies, the functionality of the online shop may be limited.

Storage duration / Right to object and erasure

Data is deleted as soon as it is no longer required for the purpose for which it was collected. For personal data from the booking form, this is generally once the contract for our parking services has been fulfilled and the service has been fully provided. However, we typically retain contract-related data until the statutory warranty period has expired. In cases where there is a legal obligation to archive data, it will be deleted once that period has ended.

‍

2. Use of payment providers for order processing ("Payment Services")

Description of data processing

If you are required to provide us with your payment details (e.g., account number for direct debit) after entering into a paid contract for parking services, this data is necessary for processing the payment.

To ensure modern, simple, and secure payment processing, we offer our customers various payment methods, for which we use banks, credit institutions, and other payment service providers (hereinafter collectively referred to as "Payment Service Providers").

Payments made via standard methods (e.g., Visa/MasterCard) are processed exclusively via an encrypted SSL or TLS connection. You can identify an encrypted connection by the change in the browser address bar from "http://" to "https://" and the padlock icon in your browser bar.
With encrypted communication, your payment details transmitted to us cannot be read by third parties.

If you choose a specific Payment Service Provider for your payment, they provide their services based on a contract between you and them, subject to their own terms and conditions. The data processing carried out by these providers is their responsibility, and we have no influence over it. Consequently, if you wish to exercise your data subject rights in this context, you must contact the respective Payment Service Provider. The provider may ask for additional consent, for example, to perform identity or credit checks. Personal data processed by Payment Service Providers typically includes your first and last name, address, date of birth, gender, email address, IP address, phone number, and data necessary for payment processing related to your order, such as the number of items, item numbers, invoice amount, tax percentages, and bank details required for the transaction (e.g., account or credit card numbers, passwords, TANs, checksums), as well as contract, total, and recipient-related information.

The Payment Service Provider processes this data to offer the selected payment method and, where necessary, to perform identity and/or credit checks, manage payments, and prevent fraud.

Legal basis and purpose of data processing

Your data is transmitted to the Payment Service Providers we use based on Art. 6(1)(b) GDPR (processing for the performance of a contract) for data collected during an order, as well as based on our legitimate interests (Art. 6(1)(f) GDPR), unless we have requested your consent under Art. 6(1)(a) GDPR.

You have the option to withdraw your consent for data processing by payment providers at any time with future effect. A withdrawal does not affect the validity of past data processing operations.

5.1. American Express

The provider is American Express Europe S.A., Theodor-Heuss-Allee 112, 60486 Frankfurt am Main, Germany. You can find information on data protection at American Express here: https://www.americanexpress.com/de/legal/online-datenschutzerklarung.html

5.2. Apple Pay

The provider is Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. You can find information on data protection for Apple Pay at: https://www.apple.com/legal/privacy/de-ww/

5.3. Giropay

The provider is giropay GmbH, An der Welle 4, 60322 Frankfurt, Germany. You can find information on data protection for Giropay at: https://www.giropay.de/rechtliches/datenschutzerklaerung/

5.4. Google Pay

The provider of Google Pay in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, an affiliate of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. You can find information on data protection at: https://policies.google.com/privacy

5.5. Mastercard

The provider is Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium. You can find information on data protection at: https://www.mastercard.de/de-de/datenschutz.html.

5.6. PayPal

We offer the option of processing payments via the payment service provider PayPal (PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). You can find information on data protection at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

5.7. Visa

The provider is Visa Europe Services Inc., London Branch, 1 Sheldon Square, London W2 6TT, UK. You can find information on data protection at: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

‍

Adyen

For certain payment methods, we use the payment service provider Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands (hereinafter: "Adyen"). If a payment via Adyen is selected, personal data is automatically transmitted to Adyen. The personal data transmitted to Adyen generally includes the card type (e.g., Visa or Mastercard), cardholder name, card number, security code, and expiration date. Adyen's role is to request authorization for the transaction from the respective payment system, such as Mastercard or Visa, and to send this authorization to the buyer's bank for approval. If the bank approves, Adyen is notified by the relevant payment system and processes the payment to our bank. Adyen processes your data for payment processing as well as for identity and credit checks. In this case, Adyen processes your personal data as a data controller. We therefore have no influence on Adyen's data processing.

You can find Adyen's privacy policy at: https://www.adyen.com/de_DE/privacy-policy, and for transaction processing at https://www.adyen.com/de_DE/privacy-policy/transaction.

‍

Stripe

For the online processing of payments for services we provide, we use Stripe, an online payment service provided by the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe").

If you have chosen Stripe as your payment method, the information provided during the ordering process, along with details about your order and information required depending on the payment method (name, address, email address, customer number, order number, bank, account number, sort code, credit card number if applicable, credit card expiration date, credit card security code (CVC), invoice amount, currency, transaction number, date and time of the transaction, location, provider name), will be shared with Stripe. This data is shared exclusively for the purpose of payment processing with Stripe and only to the extent necessary. We cannot process payments via Stripe without the transmission of your personal data.

Stripe acts in a dual role as both a data controller and a (sub-)processor for data processing activities. As a controller, Stripe uses your transmitted data based on its applicable terms and conditions to fulfill the contractual relationship between you and Stripe regarding payment processing and to comply with regulatory obligations. We have no influence over this process. You can find Stripe's privacy policy with further information here: https://stripe.com/de/privacy

Als Auftragsverarbeiter fungiert Stripe, um Transaktionen innerhalb der Zahlungsnetzwerke abschließen zu können. Im Rahmen des Auftragsverarbeitungsverhältnisses wird Stripe ausschließlich nach unserer Weisung tätig und wurde im Sinne des Art. 28 DSGVO vertraglich verpflichtet, die datenschutzrechtlichen Bestimmungen einzuhalten. 

‍

Shop Pay (auch “Shopify Payments”)

Wir binden auf unserem Online-Shop Shop Pay, einen Zahlungsdienst des Payment-Service-Providers Shopify Payments, 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. 

Wenn Sie sich für eine über den Payment-Service-Provider Shopify Payments angebotene Zahlungsart entscheiden, erfolgt die Zahlungsabwicklung über den Online-Bezahldienst des technischen Dienstleister Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Irland („Stripe“). 

Wenn Sie sich als Kunde bei für Shopify Pay anmelden, speichert und verwendet Shopify diese Angaben in eigener Verantwortung, um Checkout-Informationen für den Shopify Pay Bezahlprozess auf Basis der Shopify Pay Geschäftsbedingungen (https://www.shopify.de/legal/terms-payments-de) vorauszufüllen. Shopify nutzt diese Informationen nach eigenen Angaben, um den Besuch eines Händler-Shops anzupassen und zu verbessern, indem Shopify weitere Waren und Dienstleistungen präsentiert, die für den Kunden wahrscheinlich von Interesse sind. Bei sämtlichen Transaktionen über Shopify Pay tritt Shopify als Vermittler zur Abwicklung des Bezahlvorgangs auf. Die Durchführung der Transaktion erfolgt ausschließlich im Verhältnis zwischen dem Nutzer und der Ausgangswebsite durch Belastung des bei Shopify Pay hinterlegten Zahlungsmittels. Wenn Sie sich daher für eine über Shopify Pay angebotene Zahlungsart entschieden haben, werden die im Rahmen des Bestellvorgangs mitgeteilten Informationen nebst den Informationen über Ihre Bestellung und je nach Zahlungsart erforderlichen Informationen (Name, Anschrift, E-Mail-Adresse, Kundennummer, Bestellnummer, Bankinstitut, Kontonummer, Bankleitzahl, evtl. Kreditkartennummer, Gültigkeitsdauer der Kreditkarte, Prüfnummer der Kreditkarte (CVC), Rechnungsbetrag, Währung und Transaktionsnummer, Datum und Uhrzeit der Transaktion, Ort, Name des Anbieters) an Stripe weitergeben. Die Weitergabe der Daten erfolgt ausschließlich zum Zweck der Zahlungsabwicklung mit Stripe und nur insoweit, als sie hierfür erforderlich ist. Ohne die Übermittlung Ihrer personenbezogenen Daten können wir eine Zahlung über Stripe nicht durchführen. 

Stripe nimmt bei Datenverarbeitungstätigkeiten eine Doppelrolle als Verantwortlicher und (Unter-)Auftragsverarbeiter ein. Als Verantwortlicher verwendet Stripe Ihre übermittelten Daten zur Erfüllung regulatorischer Verpflichtungen. 

Weitere Einzelheiten zum Datenschutz bei Shopify Pay entnehmen Sie bitte: https://www.shopify.de/legal/datenschutz sowie https://pay.shopify.com/tos-privacy-policy#privacy-policy.

‍

secuPay

Wir bieten auf unserem Online-Shop bargeldlose Bezahlverfahren der secupay AG (Goethestr. 6, 01896 Pulsnitz; „secupay“) ein. Secupay ist ein Zahlungsinstitut im Sinne des Zahlungsdiensteaufsichtsgesetz (ZAG) und bei der Bundesanstalt für Finanzdienstleistungsaufsicht (Graurheindorfer Str. 108, 53117 Bonn; „BaFin“) registriert (Registernummer: 126737) und ermöglicht eine bargeldlose Zahlung von Produkten und Dienstleistungen im Internet.Bei Verwendung von secupay als Bezahlverfahren, wird Kaufpreisforderung an secupay abgetreten. So werden Online-Shop-Betreiber in die Lage versetzt, Waren, Dienstleistungen oder Downloads sofort nach der Bestellung an den Kunden auszuliefern. Wird während eines Bestellvorgangs als Zahlungsmöglichkeit über secupay „Lastschrift", „Rechnungskauf" oder „Kreditkarte" ausgewählt, werden automatisiert Daten von Ihnen an secupay übermittelt. Bei der Zahlungsababwicklung über secupay werden die Zahlungsmitteldaten an secupay übermittelt. secupay führt sodann eine technische Überprüfung des Zahlungsausfallrisikos durch. Im Anschluss wird uns das Transaktionsergebnis automatisiert mitgeteilt. Bei den mit secupay ausgetauschten personenbezogenen Daten handelt es sich um Vorname, Nachname, Adresse, E-Mail-Adresse, IP-Adresse, Telefonnummer oder andere Daten, die zur Zahlungsabwicklung notwendig sind. 

Die zwischen secupay und uns ausgetauschten personenbezogenen Daten werden von secupay unter Umständen an Wirtschaftsauskunfteien übermittelt. Diese Übermittlung bezweckt die Identitäts- und Bonitätsprüfung. secupay gibt die personenbezogenen Daten gegebenenfalls an verbundene Unternehmen und Leistungserbringer oder Subunternehmer weiter, soweit dies zur Erfüllung der vertraglichen Verpflichtungen erforderlich ist oder die Daten im Auftrag verarbeitet werden sollen. Diese Datenverarbeitungen erfolgen in eigener Verantwortlichkeit von secupay. Wir haben hierauf keinen Einfluss. Sie haben die Möglichkeit, gegenüber secupay abgegebene Einwilligungen zum Umgang mit personenbezogenen Daten jederzeit gegenüber secupay zu widerrufen. Ein Widerruf wirkt sich nicht auf personenbezogene Daten aus, die von uns zwingend zur (vertragsgemäßen) Zahlungsabwicklung verarbeitet, genutzt oder übermittelt werden müssen. Die geltenden Datenschutzbestimmungen von secupay können unter https://www.secupay.com/de/datenschutz abgerufen werden.

‍

3. Nutzung von Bewertungen des MHP Online Shop

Beschreibung der Datenverarbeitung

Wir nutzen Leistungen des Bewertungsportals „Trustpilot“ der TrustPilot A/S, Pilestraede 58, 5th Floor, 1112 Kopenhagen, Dänemark. Trustpilot bietet Nutzern die Möglichkeit, unsere Produkte und Leistungen zu bewerten. 

Wenn eine unserer Parkleistungen über unseren Shop online gekauft und der Beleg anschließend per E-Mail versendet wird, hinterlegen wir in dieser E-Mail einen Trustpilot-Button, mit einem von Trustpilot erstellten einzigartigen Link. Hierfür unterhalten wir mit Trustpilot eine Schnittstelle („API“) zur Erstellung dieser Einladungslinks. Mit Klick auf diesen Linkt werden Sie direkt zur Bewertungsplattform Trustpilot weitergeleitet. Wenn Sie auf den Button mit dem Einladungslink klicken, wird außerdem das Formular bei Trustpilot automatisch mit Ihren Daten befüllt und die von Ihnen gewünschte Bewertung kann auf dem Bewertungsportal abgegeben werden. Die Verifizierung der Bewertung erfolgt dabei auf Basis der Referenznummer durch den erzeugten Link. Die Abgabe einer Bewertung ist freiwillig.

Hierfür übermitteln wir folgende Daten an Trustpilot:

• E-Mail-Adresse 
• Name, Vorname 
• Referenznummer 
• sprach- und länderspezifische Domain unseres Shops, Zugriffsdaten (einschließlich IP-Adresse)
• gewählte Parkleistung

Hierfür setzen wir Trustpilot als Auftragsverarbeiter ein und haben Trustpilot im Rahmen einer Vereinbarung zur Auftragsverarbeitung vertraglich zum datenschutzkonformen Umgang mit Ihren Daten verpflichtet. 

Please note that you need a Trustpilot user account to submit a review. Once you submit your review and agree to Trustpilot's terms and conditions, Trustpilot becomes the controller for the further processing of your review, particularly its publication. For details on data protection at Trustpilot, please visit https://de.corporate.trustpilot.com/legal/for-businesses/privacy-policy.

Legal basis and purpose of data processing

Data is processed for the purpose of creating an invitation link and verifying the authenticity of the shop usage for Trustpilot to conduct the review process. This, along with collecting user feedback to improve our services, constitutes a legitimate interest under Art. 6 (1) (f) GDPR.

Storage duration / Right to object and erasure

Invitation data for Trustpilot is stored for a period of one year.

‍

4. Use of parking areas managed by MH Parkservice

Description of data processing

When using the parking areas, the following data is automatically recorded: vehicle license plate including the front and/or rear of the vehicle, entry/exit time, date and location stamp, and the amount and payment method of the parking fee.

Before leaving the parking area, you must enter your license plate number at the pay station, unless you have a permanent parking permit. If the entered license plate is found in our database, the parking fee is calculated and paid by the user. Details on data processing for payments via our online shop can be found in Section C, items 1 and 2 and the applicable terms and conditions.

In the event of violations of the General Terms and Conditions of Use, all personal data of the vehicle owner and the driver relevant for the legal pursuit of the violation—specifically the collection of a forfeited contractual penalty and/or the assertion of possession and property rights ("follow-up")—will also be processed.

If you receive a demand letter as the registered owner of a vehicle involved in a parking violation, your license plate was previously transmitted by us to the responsible district administrative authority or state police directorate. If you are not the registered owner of the vehicle, your data was provided to us by the vehicle owner or another third party (e.g., vehicle rental or leasing company) who confirmed to us that you were the driver at the time of the parking violation. If you no longer reside at the address registered in the central vehicle registry, we obtained your data through the person currently registered at that address, a credit agency, or a collection agency.

To process the collective documents received from the responsible authorities containing owner data and to split datasets by owner, we use the ConvertAPI platform provided by UAB Baltsoft, Kosciuskos 26-17, Vilnius, LT-01100, Lithuania. This tool is used to process PDF files and, if necessary, to convert files into other formats (e.g., PDF to DOCX). In this process, the personal data contained in the documents—usually the name and address of the registered owner—is processed on the provider's servers. The data streams exchanged between us and ConvertAPI are fully encrypted. ConvertAPI has committed to us to comply with applicable data protection standards https://www.convertapi.com/static/docs/compliance/PP_DPA.pdf and has been ISO 27001 certified by TÜV Thüringen (https://www.convertapi.com/compliance).

Legal basis and purpose of data processing / Data recipients

Processing of the collected data is necessary to safeguard the legitimate interests of the parties in operating the parking area and related standard administrative activities (Art. 6 (1) (f) GDPR), as well as for the contractual fulfillment of services according to the General Terms and Conditions (e.g., calculating and billing parking fees, checking for parking permits, verifying app payments, verifying online portal payments, and determining compliance with maximum parking durations, free parking periods, or grace periods) (Art. 6 (1) (b) GDPR).

Owner-related data (specifically name and address) is queried by forwarding the license plate to the responsible district administrative authority, state police directorate, or foreign inquiry offices for vehicles registered abroad ("owner inquiry"). Driver data is requested, if necessary, via the identified vehicle owner, vehicle rental, or leasing company and may also be passed on to third parties for the aforementioned purposes (e.g., lawyers, collection agencies). For the technical operation of parking technology and software, as well as for following up on violations of the General Terms and Conditions, data is processed by MHP GmbH and its contractors (Peter Park System GmbH (operation of parking technology and software) and Amazon Web Services EMEA SARL (data storage)). The legal basis is Art. 6 (1) (b) GDPR, insofar as processing is for contract performance, and otherwise Art. 6 (1) (f) GDPR for pursuing legitimate interests in protecting the possession and property rights of MHP GmbH and third parties, as well as their legitimate interest in ensuring the proper operation of the parking areas and accelerating vehicle processing.

Storage duration / Obligation to provide data / Right to object and erasure

The personal data we collect will be deleted after all existing claims arising from and in connection with the use of the parking area have been settled and after all statutory retention or limitation periods have expired. If there is no violation of the General Terms and Conditions of the parking area and the user leaves the parking area within the grace period applicable from entry, the user's data will be automatically deleted 48 hours after exiting the parking area, provided there are no statutory retention obligations to the contrary.

Providing your data when using the parking lots we manage is contractually stipulated according to the respective General Terms and Conditions or is strictly necessary for the conclusion of the contract. Without providing your data, it would not be possible to carry out the underlying legal relationship and the services provided within the scope of parking management. However, we do not use your data for automated decision-making, including profiling. Since the collection and further processing of the data is strictly necessary, there is consequently no right for users to object. As license plate recording occurs upon entry to the parking area, it is generally possible—provided the structural conditions allow—to turn around early to avoid data collection.

‍

5. Activation of parking permits

Description of data processing

For some of the parking areas we manage, you can apply for parking permits via terminals or online booking forms (on the MHP website, online, or at local retail stores or institutions, for example). These permits may be for designated parking spaces for specific groups (such as employees, visitors, or customers) and/or for free parking periods, in accordance with the terms applicable to the specific parking area.

To do this, you must enter the information requested in the relevant input form. Your license plate number is always required. You may also need to provide additional details to verify your eligibility for a specific group, such as employee ID numbers. This information may be shared with our clients or their customers to verify your eligibility, or cross-referenced with data they have provided.

Legal basis and purpose of data processing / Data recipients

If cross-referencing with additional data is necessary to validate your eligibility, or if we process additional information provided in the form, we do so based on your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time. The lawfulness of any data processing that has already taken place remains unaffected by your withdrawal. Please note that if you withdraw your consent, we may no longer be able to provide the full booking process, and any booking you have made may no longer be valid.

The legal basis for processing data collected during the booking process is the intent to enter into a contract (Art. 6(1)(b) GDPR), and otherwise Art. 6(1)(f) GDPR, for the purpose of effectively managing parking permits and supporting the provision of the respective parking service.

Storage duration / Obligation to provide data / Right to object and erasure

Data is deleted as soon as it is no longer required for the purpose for which it was collected. For personal data from the input form, this is the case once the parking service has been fully provided following the conclusion of a contract. As a rule, however, we retain contract-related data until the statutory warranty periods have expired. In the event of a statutory archiving obligation, the affected data will be deleted after the relevant period has expired.

‍

6. Parking areas with free parking for people with disabilities

Description of data processing

For some of the parking areas we manage, we offer a special arrangement allowing people with disabilities to park for free in designated spaces during their stay. To use this, eligible users must provide us with proof of a disability parking permit (e.g., the blue EU disability parking card).

Specifically, you must provide proof of eligibility in accordance with the conditions posted at the parking area where this free parking option is offered. This can be done, for example, by scanning a QR code on the sign, visiting our website, and uploading your parking permit via the input form provided there.

‍

Legal basis and purpose of data processing

Rechtsgrundlage für die Verarbeitung der Daten, die im Zuge einer Buchung erhoben werden, ist aufgrund eines angestrebten Abschlusses eines Vertrages Art. 6 Abs. 1 lit. b DSGVO, im Übrigen Art. 6 Abs. 1 lit. f DSGVO zum Zwecke der effektiven Bearbeitung von Parkberechtigungen und zur Unterstützung der Erbringung der jeweiligen Parkleistung, im Fall von Gesundheitsdaten in Verbindung mit Art. 9 Abs. 2 Buchst. e bzw. Buchst. f DSGVO.

‍

Storage duration / Obligation to provide data / Right to object and erasure

Proof of a disability parking permit is checked exclusively for the purpose of verifying eligibility and is deleted immediately after the parking process has been completed.

‍

7. Nutzung des MH Parkservice Serviceportal

Beschreibung der Datenverarbeitung

Wir bieten Nutzern von durch uns betreuten Parkplätzen die Möglichkeit, über unser Serviceportal (https://service.mh-parkservice.at/) Supportanfragen an uns zu stellen (Rückfragen, Widersprüche zu Zahlungsaufforderung oder Klärung sonstiger Anliegen), Informationen zu Parkverstößen einschließlich Belegbilder und Zahlungsmöglichkeiten einzusehen, oder Zugriff auf sonstige kundenspezifische Informationen zunehmen. 

Das Portal kann mittels eines den Nutzern überlassenen QR-Code (z.B. im Rahmen einer Zahlungsaufforderung) über unsere Webseite erreicht werden. Nach Authentifizierung können Sie Zugriff auf das Serviceportal nehmen. Im Rahmen des Authentifizierungsprozesses werden vom Nutzer folgende personenbezogenen Daten bereitgestellt:

• Aktenzeichen
• Kennzeichen

Technisch bedingt werden bei jedem Zugriff auf das Portal eine begrenzte Anzahl an Daten (sogenannte Verbindungsdaten) erhoben. Diese Daten sind technisch erforderlich, um eine Verbindung zwischen dem Endgerät des Nutzers und unseren Servern aufzubauen und durchzuführen. Weiterhin sind diese Daten erforderlich, um die Sitzung nach einer Anmeldung aufrechtzuerhalten und unautorisierte Zugriffe auf diese Sitzung zu verhindern. Im Rahmen eines jeden Anmeldeprozesses sowie der Nutzung des Kundenportals oder des Portals speichern wir bzw. der von uns eingesetzte Hosting-Dienstleister die IP-Adresse und den Zeitpunkt der jeweiligen Nutzerhandlung (Timestamp), Internetservice-Provider, verwendeter Webbrowser und Betriebssystem bzw. die jeweiligen Versionsinformationen, Spracheinstellungen, Referrer-URL sowie den Namen der aufgerufenen Webseite. 

Nach der Anmeldung im Serviceportal wird ein Cookie gesetzt, der zur Aufrechterhaltung der Sitzung und zum Schutz der Sitzung erforderlich ist. Für die Nutzung des Portals müssen Sie dieses Cookie in Ihrem Web-Browser zulassen.

Wenn eine Lösung für ein über das Serviceportal gemeldetes Problem oder eine Antwort auf eine Frage nur unter Einbeziehung anderer Partner oder Dienstleister möglich ist, geben wir die mit der Anfrage / dem Vorfall verbundenen Informationen an diese weiter.

Rechtsgrundlage und Zweck der Datenverarbeitung

Rechtsgrundlage für die Verarbeitung der Daten, die im Zuge der Nutzung des PCN-Portals sowie darüber gestellter Anfragen oder in Anspruch genommener Downloads, verarbeitet werden, ist im Rahmen der Durchführung mit dem Nutzer bestehenden Vertrages über die Nutzung des Parkplatzes Art. 6 Abs. 1lit. b DSGVO. Im Übrigen ist Art. 6 Abs. 1 lit. f DSGVO einschlägig, da die Verarbeitung der personenbezogenen Daten im Zusammenhang mit unserem Portal dazu dient, eine effektive Möglichkeit zur Kontaktanfrage und Kommunikation mit unseren jeweils zuständigen Supportteams zu ermöglichen, sowie der Verwaltung, Bearbeitung und Lösung der darüber einlaufenden Anfragen, sowie der sicheren Verbindung zwischen den Endgeräten der Nutzer und unseren Servern.

Dauer der Speicherung / Widerspruchs- und Beseitigungsmöglichkeit

Die Daten werden gelöscht, sobald sie für die Erreichung des Zweckes ihrer Erhebung nichtmehr erforderlich sind. Für die personenbezogenen Daten aus der Eingabemaske der Anmeldung ist dies in der Regel dann der Fall, wenn der jeweilige Nutzungsvorgang beendet ist. 

Alle personenbezogenen Daten, die im Zuge einer Kontaktaufnahme durch den Nutzer gespeichert wurden, werden spätestens dann gelöscht, wenn keine gesetzlichen Vorgaben eine längere Speicherung bedingen (beispielsweise gesetzliche Gewährleistungsfristen im Zusammenhang mit Supportanfragen).

‍

8. Rechnungstellung

Beschreibung der Datenverarbeitung

Für die Erstellung und Versand von Rechnungen und zu deren Dokumentation und buchhalterischen Erfassung nutzen wir die cloudbasierte Buchhaltungssoftware sevDesk der Firma sevDesk GmbH, Hauptstraße 115, 77652 Offenburg. Mit sevDesk werden in diesem Fall die Kontaktdaten des Rechnungsempfängers verarbeitet. Die Datenschutzhinweise von sevDesk können unter https://sevdesk.de/datenschutz/ eingesehen werden.

Rechtsgrundlage und Zweck der Datenverarbeitung

Wir verwenden sevDesk auf Basis von Art. 6 Abs. 1 lit. c und Art. 6 Abs. 1 S. 1 lit. b und lit. f DSGVO zu den zuvor genannten Zwecken für die Erfüllung unserer gesetzlichen Pflichten, zu Vertragszwecken und unseres berechtigten Interesses an einem effizienten Rechnungswesen. Wir haben mit sevDesk eine Vereinbarung zur Verarbeitung von personenbezogenen Daten gemäß Art. 28 DSGVO abgeschlossen, die sevDesk zur Einhaltung der geltenden datenschutzrechtlichen Anforderungen verpflichtet. 

Storage duration / Right to object and erasure

We store your data for the duration of our contractual relationship and until the end of the statutory retention periods for accounting-related documents.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

‍

D. Contractual relationships with customers and business partners

‍

I. Am I required to provide data?

When you contact us with questions about our services, enter into contract negotiations, accept one of our offers, or enter into other contractual agreements with us, we process the personal data you provide in this context. The specific data processed depends largely on the relevant items or services you are requesting or receiving from us. In this context, processing your data is generally mandatory for the preparation, conclusion, and execution of the contract. If you do not provide this data, we may have to decline to enter into a contract, refuse to carry out an order, or be unable to fulfill an existing contract.

When we use data in the context of initiating or fulfilling a contract with a business customer, business partner, or cooperation partner, our interest in handling your data lies in enabling and maintaining communication with that customer or partner, typically as part of a contractual or other relationship. If you act as a contact person—typically in your capacity as an employee of these companies—you generally do not have an overriding interest to the contrary, provided this interaction is part of your job responsibilities, meaning a right to object usually does not apply.

However, you are not required to provide consent for data processing regarding information that is not relevant to the fulfillment of the contract or not legally required.

‍

II. HubSpot

Description of data processing

This website uses features from the customer relationship management (CRM) system HubSpot. HubSpot is a software solution provided by HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, and offered in Europe by HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. HubSpot is an integrated software solution that we use to manage various aspects of our online marketing. This includes, among other things: email marketing, social media publishing & reporting, analytics, contact management (e.g., user segmentation & CRM), landing pages, and contact forms.

We use HubSpot to manage and implement inbound marketing in connection with various features of our online presence. The stored information is kept on HubSpot's servers. We may use the processed data to gain detailed insights into how our online presence is used, to get in touch with website visitors, and to determine which of our company's services are of interest to them.

HubSpot uses "web beacons" (invisible graphics or code) and cookies that are embedded in websites or emails and stored on the user's device. This collects the IP address, geographic location, browser type, duration of the visit, and the pages accessed.

Furthermore, HubSpot collects data entered by the user when they (a) subscribe to our newsletter or (b) fill out one of our contact forms.

For more information on data protection at HubSpot, please visit https://legal.hubspot.com/de/privacy-policy.

Legal basis and purpose of data processing

The storage of HubSpot cookies and web beacons is based on Art. 6(1)(a) GDPR. We use the information collected via HubSpot based on our legitimate interests in optimizing our marketing, analyzing the use of our online presence, and continuously improving it to make it more user-friendly, as well as to provide our users with more targeted information (Art. 6(1)(f) GDPR).

Right to object and removal

You can prevent cookies from being stored by adjusting your browser settings. If you would like your other personal data to be deleted, you can exercise your right to object and removal as described in the General Information section under A.

Alternatively, you can manage your cookie preferences using our integrated CookieHub management tool.

‍

III. Communication

Generally, we collect the necessary data directly from you during personal contact. However, you are welcome to contact us by phone, fax, mail, or via the email address provided (see Legal Notice) or any other email addresses of our staff you may have. In the latter case, the personal data transmitted with the email will be stored. Please note that communication via email is unencrypted for technical reasons.

Your data is used to process the conversation and follow up on the respective inquiries or meeting topics. Your data is processed based on Art. 6(1)(b) GDPR, provided the communication is related to the fulfillment of a contract or is necessary for pre-contractual measures.

In all other cases, processing is based on our legitimate interests (Art. 6(1)(f) GDPR) in effectively handling the inquiries directed to us.

In this context, data is not shared with third parties unless it is necessary to pursue our claims or legitimate interests (Art. 6(1)(f) GDPR) or if there is a legal obligation to do so (Art. 6(1)(c) GDPR).

‍

IV. Data processing in the context of sales

Personal data is processed based on Art. 6(1)(b) GDPR to provide the services you have commissioned, in particular for the execution of our contracts or pre-contractual measures, as well as all activities necessary for the operation and administration of MH Parkservice .

The resulting purposes of data processing are primarily based on the specific activities and individual services agreed upon with you and may include, among other things, consulting activities or activities related to managing sales processes (e.g., compiling documents, sending MH Parkservice product or event information, providing services through MH Parkservice) or supporting sales negotiations and contract conclusions.

Further details regarding the scope, purpose of data processing, and recipients of your data can be found in the respective contract documents and associated terms and conditions.

Where necessary for our operational processes, we process your data in connection with our services beyond the actual fulfillment of the contract to protect our legitimate interests (Art. 6(1)(f) GDPR).

In connection with the offer or provision of our services, we may be subject to specific legal obligations, such as requirements under tax law. The purposes of processing your data may therefore include, among other things, fulfilling tax-related control and reporting obligations, customs or export regulations, as well as assessing and managing risks. The data processing required for this is based on Art. 6(1)(c) GDPR.

‍

V. Newsletter

Description of data processing

We would like to keep our customers and interested parties regularly informed via email or other electronic notifications about our services and other products, services, webinars, updates, or news from MH Parkservice (hereinafter referred to as the “Newsletter”). For this, we require your email address. In the respective newsletter registration forms, additional information may be requested to provide you with personalized content tailored to your interests.

You can sign up for our newsletters by using the relevant form on our website or by checking a box during the registration process (known as an opt-in). We provide various options on our websites and within our registration or order interfaces for you to sign up for our (sometimes topic-specific) newsletters. The specific content of each newsletter is described in the corresponding sign-up form. This description is what your consent is based on.

After you sign up, you will receive an email asking you to confirm your subscription (a process known as double opt-in). This confirmation is necessary to ensure that no one else has misused your email address to sign up for our newsletter without your knowledge. Your email address will only be added to our mailing list once you click the link provided in that email.

To manage registrations and send out our newsletters, we use MailChimp, a service provided by the US company The Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA (hereinafter “MailChimp”), which allows us to easily and conveniently automate the registration process and the necessary email delivery. Since MailChimp’s IT systems are located in the USA, the data entered into our forms is transferred to and processed in the USA. To ensure that your data is handled appropriately, we have entered into a data processing agreement with MailChimp in accordance with Article 28 of the GDPR, which includes EU standard contractual clauses for data transfers to third countries. You can find more information about how MailChimp handles personal data here: https://mailchimp.com/legal/privacy/.

For verification purposes, we store your email address, name, IP address, and the date and time of your registration (timestamp) when you sign up for our newsletter.

Legal basis and purpose of data processing / Data recipients

The legal basis for sending newsletters is the consent you provide as a recipient (Art. 6(1)(a) GDPR, Art. 7 GDPR in conjunction with Section 174(3) of the 2021 Telecommunications Act (TKG)), or, if consent is not required for existing customers under Section 174(3) and (4) of the 2021 TKG, our legitimate interest in direct marketing activities pursuant to Art. 6(1)(f) GDPR in conjunction with Section 174(3) and (4) of the 2021 TKG.

The logging of the registration process is based on our legitimate interests under Art. 6(1)(f) GDPR in maintaining a secure and effective newsletter system that meets both our business sales interests and the expectations and needs of our recipients, as well as our need to provide proof of the consent given.

Storage duration / Right to object and withdraw consent

You can object to receiving our newsletter at any time or withdraw your consent, either in full or in part. You will find an unsubscribe link at the bottom of every newsletter. You can also contact us directly using the contact details provided at the beginning of this notice.

Unsubscribing from the newsletter will not affect your business communications with us. If your data is required for the purpose of fulfilling a contract, it will remain stored. Furthermore, we reserve the right to store the necessary records to prove that our newsletter distribution is compliant with the law until the statutory limitation periods have expired.

‍

VI. Data transfer

Depending on the scope of the services provided, your data or documents may be shared with public authorities, private service providers, or individuals with whom we regularly work during the inquiry, proposal, or contract execution phases (see Part A, Section V).

‍

E. Other

As we continue to develop our website, services, and other offerings, or due to changes in legal or regulatory requirements, it may become necessary to update this privacy policy. You can access and print the current version of our privacy policy on our website at any time.

‍

Privacy Notice (Effective as of 30 March 2026)

This Privacy Notice is intended to provide you with an overview of what happens to your personal data (hereinafter also: “data”) within our company and to inform you of the data protection claims and rights to which you are entitled under the General Data Protection Regulation (“GDPR”) and its national implementation in the Data Protection Act, Federal Law Gazette I No. 165/1999 (“DSG”, Austria). Please read this Privacy Notice carefully and feel free to print or save it for your records.

Personal data means any information by which you can be personally identified. We may process your personal data for various purposes. In essence, the data processing operations carried out by Mobility Hub Parkservice Austria GmbH (hereinafter also “MH Parkservice” or “we”) can be divided into the following areas of application:

• General: General information on data protection, processing operations, and data subject rights that applies to all processing operations carried out by us can be found in Part A below.
• Our online presences: In connection with our website www.mh-parkservice.at (hereinafter: “Website”) and related external online presences—such as our social media profiles, our service portal (https://service.mh-parkservice.at/) or our post-payment service (https://parken.mh-parkservice.at/)—from which we refer to this Privacy Notice (Website and external online presences jointly also: “Online Presences”), we process data of visitors that is exchanged between their internet-enabled end devices and the server operated by us, as well as data provided to us in the course of using the Website. Details can be found in Part B.
• Parking users: For information on the processing of data of users of parking areas managed by us—e.g., in connection with payment processes via the MHP online shop or our post-payment service, the enforcement of parking violations by MH Parkservice, or access to details of parking violations via our service portal—please refer to Part C.
• B2B: For the purpose of initiating and performing contracts, we process the data required for this of our business customers and prospective customers. Data of our business partners and supplier data is used exclusively for the direct placement, processing, and performance of orders. More information can be found in Part D.

Please consult the individual sections if you wish to obtain information quickly and in context regarding specific processing situations.

A. General information on data protection and data subject rights

I. Who is responsible for data processing and whom can you contact with questions?

The controller within the meaning of the GDPR and other national data protection laws of the Member States, as well as other data protection provisions, is:

Mobility Hub Parkservice Austria GmbH
Krottenseestraße 45
4810 Gmunden
Austria
Tel.: +43 72 011 69 48
E-mail: info@mh-parkservice.at

For questions regarding data protection, you may contact our data protection officer at: datenschutz@mh-parkservice.at

II. What rights do you have regarding your personal data?

If your personal data is processed, you are a “data subject” within the meaning of the GDPR and may be entitled to the rights described below. If you wish to exercise rights vis-à-vis MH Parkservice as controller, we recommend sending your request to the contact details stated above.

1. Right of access
In accordance with Art. 15 GDPR, you may request confirmation as to whether personal data concerning you is being processed by us and, if so, request information about the extent to which we process your data.

2. Right to rectification
If personal data concerning you is inaccurate or incomplete, you have a right to rectification and/or completion pursuant to Art. 16 GDPR.

3. Right to erasure
Where the statutory requirements of Art. 17 GDPR are met, you may request the erasure of your data, for example if we process it unlawfully or if the processing disproportionately infringes your legitimate interests requiring protection. Please note that there may be reasons preventing immediate erasure, e.g., statutory retention obligations.
Irrespective of the exercise of your right to erasure, we will delete your data promptly and completely once the purpose of processing no longer applies, provided no contractual or statutory retention period prevents this.

4. Right to restriction of processing
In the cases listed in Art. 18 GDPR, you may request restriction of the processing of your data. Where you have obtained restriction of processing, such data may—apart from being stored—be processed only with your consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

5. Right to data portability
Pursuant to Art. 20 GDPR, you have the right to receive data you have provided to us that we process by automated means on the basis of your consent or for the performance of a contract, in a commonly used, machine-readable format, and to transmit it to yourself or to a third party. If you request direct transmission to another controller, this will be done only insofar as technically feasible.
The right to data portability does not apply to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

6. Right to object
Where we process your data on the basis of a legitimate interest pursuant to Art. 6(1)(f) GDPR, you may object to such processing at any time on grounds relating to your particular situation; this also applies to profiling based on those provisions (see Art. 21 GDPR). If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
Where your personal data is processed for the purposes of direct marketing, you have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes. You may object to processing for direct marketing at any time without stating reasons.

7. Right to withdraw consent under data protection law
Certain processing operations are possible only with your express consent within the meaning of Art. 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out up to the time of withdrawal remains unaffected. Please note that, even after withdrawal, processing of the data concerned may still be possible in whole or in part on the basis of other legal grounds.

8.Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority—particularly in the Member State of your habitual residence, your place of work, or the place of the alleged infringement—if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR in conjunction with § 24 DSG).
If you believe that we have violated Austrian or European data protection law when processing your data, we ask you to contact us so that we can clarify the matter.
You also have the right to contact the supervisory authority responsible for us at our registered office:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Telephone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at

III. Which personal data is processed and from which sources does it originate?

1. Sources of personal data

We primarily process data that we receive from data subjects during the initiation or maintenance of a business relationship, or data provided directly to us when using our website (see also Part B, Section VI).

Through our website and services, we process data received during your visit or actively provided by you when using our services (e.g., when using our online shop). Other data is collected automatically by our IT systems when you visit the website or use our services. This is primarily technical data (e.g., internet browser, operating system, or time of access). Such data is collected automatically as soon as you enter our website or access one of our services. Details can be found in Part B.

In individual cases, we also process data that we lawfully obtain from third parties such as credit agencies, creditor protection associations, or authorities, or that we lawfully extract, receive, or acquire from publicly accessible sources (e.g., telephone directories, company registers, the press, the internet, or other media).

2. Categories of personal data

The personal data we regularly process includes master and contact data such as: title, first and last name, salutation, date of birth, address, e-mail address, telephone number, fax number, and job title.

Depending on the mandate, service, or other relationship with you, we may also process the following categories of personal data:

• Address data: street, house number, address additions (if applicable), postal code, city, country
• Contact data: telephone number(s), e-mail address(es)
• Vehicle data: vehicle license plate, vehicle owner/registered keeper
• Parking management data: photographs, date and period of use of a parking area, parking entitlements, bank details, payment details
• Registration data: information about the service for which you registered; times and technical information on registration, confirmation, and deregistration; data provided by you during registration
• Offer data
• Access data: date and time of visiting our service; the page from which the accessing system reached our page; pages accessed during use; session identification data (session ID); and information about the accessing computer system such as IP address, browser type and version, device type, operating system, and similar technical information
• Information on the nature and content of our business relationship: contract data, order data, revenue and receipt data, customer and supplier history, consultation documents
• Marketing and sales data
• Documentation data (e.g., consultation notes, data from service calls or support cases)
• Other data that we receive from you in the course of our business relationship (e.g., in customer conversations)
• Documentation of consent declarations

IV. For what purposes and on what legal basis is data processed?

We process your data in accordance with the GDPR and the DSG as applicable, in particular on the following legal bases:

1. Performance of (pre-)contractual obligations (Art. 6(1)(b) GDPR)

We process personal data on the basis of Art. 6(1)(b) GDPR to perform contractual obligations of MH Parkservice, in particular in connection with the sale and distribution of our goods and services (hereinafter also “parking services”) as well as all activities required for operating and managing MH Parkservice in line with industry practice (e.g., customer and user administration). Data may also be processed at the pre-contractual stage in the context of initiating business relations with MH Parkservice or when performing other contractual relationships with MH Parkservice.
Art. 6(1)(b) GDPR is the legal basis, for example, in the following cases:

• creation and maintenance of a partner or supplier account in our CRM system
• creation and maintenance of customer/prospect files and our customer/prospect database in our CRM system
• sending information
• offering and selling MH Parkservice products
• offering and providing our services

Details on the purposes of such processing can be found in the relevant contract documents and terms and conditions.

2. Protection of legitimate interests (Art. 6(1)(f) GDPR)

‍
Following a balancing of interests, processing may take place beyond performance of a contract to protect legitimate interests of MH Parkservice or third parties. This is permissible provided that your interests or fundamental rights and freedoms requiring the protection of personal data do not prevail.
Processing for the protection of legitimate interests occurs, for example, in the following cases:

• providing the online offering, its functions and content
• use of technically necessary cookies or comparable technologies within the meaning of § 165(2) TKG (2021)
• responding to contact requests and communicating with users
• transfer of data to affiliated companies and partners
• performing payment transactions via external service providers
• engaging debt collection service providers and lawyers to collect and/or enforce claims in court
• asserting other legal claims and defending legal disputes
• advertising or marketing
• market and opinion research
• measures for business management and further development of our services
• maintaining databases of customers/prospects or service providers to improve our offering
• conducting risk reviews (due diligence) in connection with corporate restructuring or a company purchase/sale
• ensuring IT security and IT operations for our company and services
• measures for building and facility security

3. Compliance with legal obligations (Art. 6(1)(c) GDPR)

We may process your data in part to comply with various statutory obligations and requirements to which we are subject, e.g., under commercial and tax law.

4. Consent (Art. 6(1)(a) GDPR; § 165(2) TKG (2021))

If a service we use stores information on your terminal equipment or accesses information stored there, consent is required under § 165(2) TKG (2021). If the service functions without any access to the terminal equipment, the GDPR applies. Where we request your consent within the scope of the GDPR, processing takes place on the basis of Art. 6(1)(a) in conjunction with Art. 7 GDPR.
If you have granted consent in an individual case, processing will be carried out in accordance with the purposes set out in the consent declaration and to the extent agreed therein. Consent (e.g., for sending a newsletter) may be withdrawn at any time with effect for the future. Please contact us using the contact details stated in Section A, items I and II. Please note that processing carried out prior to withdrawal is not affected by the withdrawal and that processing may still be possible in whole or in part on the basis of another legal basis.

V. Who receives my data?

Within MH Parkservice, those employees and organizational units receive your data who require it to fulfill our contractual and statutory obligations or to process or pursue our legitimate interests.

For the initiation or performance of a contractual relationship (e.g., sale/provision of parking services) on the basis of Art. 6(1)(b) GDPR and—depending on the specific contractual relationship—also on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR, your data is transferred in particular to companies that we regularly use in connection with providing our services or to process contracts. This includes the following recipients and categories of recipients:

• IT service providers (e.g., e-mail service providers, web hosting companies)
  
  • Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA (cloud storage provider)
  • Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (optimization of app functions)
  • Airparser, Sepapaja tn 6, Tallinn 11415, Estonia (document management software provider)
  • Celonis SE, Theresienstr. 6, 80333 Munich, Germany (integration platform provider)
  • Datadog Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (system security, monitoring)
    
    • Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA (AI platform operator and provider of an AI chat function)
  • Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA (ticket system provider)
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (e-mail service provider)
  • HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA (CRM system provider)
  • LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam, Germany (proofreading service provider)
  • Leaping AI UG (limited liability), Potsdamer Straße 72, 10785 Berlin, Germany (provider of AI-supported call center software)
  • Okta Inc., 100 First Street, Floor 6, San Francisco, CA 94105, USA (provider of Auth0; system security)
  • OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (AI model provider)
  • Peter Park System GmbH, Balanstr. 71a, 81541 Munich, Germany (provision of IT systems as managed services and parking management systems)
  • sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany (accounting software provider)
  • Talkdesk Inc., 201 Spear Street, Suite 1100, San Francisco, CA 94105, USA (contact center software provider)
  • Trustpilot A/S, Pilestraede 58, 5th Floor, DK-1112 Copenhagen, Denmark (review process provider)
  • UAB Baltsoft, Kosciuskos 26-17, Vilnius, LT-01100, Lithuania (conversion software solutions provider)
  • Webflow, Inc., 398 11th Street, San Francisco, CA 94103, United States (web hosting service provider for the Website)
  • Weglot, SAS, 138, rue Pierre Joigneaux, Bois-Colombes 92270, France (translation service provider)
• Sales partners
• Advertising partners
• Insurance companies
• Banks
• Communication providers (telephone providers, fax providers)
• Payment service providers, including:
  • Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ Amsterdam, Netherlands
  • Stripe Deutschland GmbH, Prielmayerstr. 3, 80335 Munich, Germany
  • secuPay AG, Goethestraße 6, 01896 Pulsnitz, Germany
• Shipping and logistics service providers
• Credit agencies
• Auditors
• Tax and legal advisors

Where we engage processors within the meaning of Art. 28 GDPR, we remain responsible for protecting your data. Where required by law, processors are contractually obliged by a data processing agreement to treat your data confidentially and process it only for the provision of services. Processors engaged by us receive your data only insofar as they require it to perform their respective services.

Your data is disclosed to governmental bodies and authorities or collected for such purposes only within the framework of mandatory national law or if you instruct us to do so.

VI. How long will my data be stored?

Your personal data will be used only for the purpose for which you provided it to us or for which you consented to processing, and only stored for as long as necessary to fulfill that purpose. After full fulfillment of the purpose and/or once you request deletion, your data will be stored only for as long as required by statutory limitation periods or retention obligations (in particular under tax and commercial law). At the latest upon expiry of these periods, the data will be deleted unless you have expressly consented to further or different use. During retention periods, you may also exercise rights, such as requesting the blocking of your data; see Section A, item II.

We delete or block your data once the purpose of storage no longer applies or you request deletion.

As a rule, we process—especially store—your data at most until the end of the business relationship or until the expiry of applicable guarantee, warranty, and limitation periods. For example, the limitation period under § 1489 ABGB (Austrian Civil Code) is generally three years, but in certain cases may be up to thirty years. In addition, it may be necessary to retain data until the legally binding conclusion of any legal disputes in which the data is required as evidence.

We are also subject to statutory documentation and retention obligations (e.g., under the Austrian Commercial Code, the Financial Markets Anti-Money Laundering Act, or the Federal Fiscal Code). The retention/documentation periods specified there range from two to ten years. For example, we may be required to store your data even after termination of a contract with you until the completion of the tax audit for the last calendar year in which you were our customer.

VII. Is personal data transferred to a third country?

In the course of our processing activities, personal data may, for certain transactions or areas of activity, be transferred to recipients in so-called third countries outside the EU/EEA for which the European Commission has not determined an adequate level of data protection, for example the USA. If such a transfer becomes necessary in an individual case, it will take place only on the basis of an adequacy decision of the European Commission, standard contractual clauses, appropriate safeguards, or your explicit consent.

B. Use of our Online Presences

In principle, you can visit our Online Presences and use them for informational purposes without providing personal information (e.g., without registering, placing orders, or otherwise transmitting information about yourself). In this case, we process personal data of our users only insofar as necessary to provide a functional Website and our content and services, or insofar as cookies or similar technologies used on the Website transmit personal information when the Website is visited.

Information on our own cookies and similar technologies can be found in Section B, item II. Other cookies and similar technologies may also enable our partner companies or third parties to recognize your browser upon your next visit. For information on such third-party cookies and similar technologies, please see Section B, item III.

Beyond this, we generally process personal data only with the user’s consent. An exception applies where obtaining prior consent is not possible for factual reasons and the processing is permitted by law.

I. Provision of the Website and creation of log files

Description of processing

Each time our Website is accessed, our system automatically collects data and information from the computer system of the accessing device which your internet browser automatically transmits to us or to our web host (so-called log files). These server log files contain IP addresses or other data that may allow an allocation to a user. This may be the case, for example, if the link to the website from which the user accesses our Website, or the link to the website to which the user switches, contains personal data.

Our hosting provider collects and stores the following information:

• browser type and version
• operating system
• referrer URL
• hostname of the accessing computer
• time of the server request
• IP address

This data is stored in our web host's log files. It is not stored alongside any of your other personal information.

We use Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (www.webflow.com) as our web host and software provider to build, host, and run our website, online forms, and other web features (“Webflow”). You can find details on Webflow’s privacy practices here: https://webflow.com/legal/eu-privacy-policy. We have signed a data processing agreement with Webflow in accordance with Art. 28 GDPR (https://webflow.com/legal/dpa). As part of Webflow’s services, data may be transferred to the USA based on the standard contractual clauses included in their data processing agreement or other equivalent safeguards.

Legal basis and purpose of processing

The legal basis for the temporary storage of this data and the log files is Art. 6(1)(f) GDPR. This information is also required to provide our services as per § 165(2) TKG (2021).

We need to store your IP address temporarily so we can deliver the website to your device. Your IP address must remain stored for the duration of your session for this to work.

Storing data in log files helps us keep the website running smoothly. It also allows us to improve the site and keep our IT systems secure.

Retention period and opt-out options

We delete this data as soon as it is no longer needed for the purpose for which it was collected. For data used to provide the website, this happens once your session ends.

Data stored in log files is deleted after no more than 7 days.

Collecting this data and storing it in log files is essential for the website to function, so you cannot opt out of this.

II. Cookies and similar technologies

How we process your data

Our website uses cookies and similar methods (like web beacons or local storage) to collect, process, and use usage data (such as access times and pages viewed) or metadata and communication data (like your IP address and device info), including personal data. For simplicity, we refer to all these technical methods as “cookies.”

Cookies are small text files containing a unique string of characters. They are stored by your browser on your computer, allowing it to be uniquely identified when you return to our site. When you visit a website, a cookie may be saved to your operating system. These cookies help make our website more user-friendly, effective, and secure. If you visit a site that uses cookies, any data you enter is stored only in the cookie on your computer. Data is only sent to our servers when you request a page.

Some cookies are deleted as soon as you close your browser (these are called session cookies). These are technically necessary, for example, to keep you logged in as you move between pages during your visit.

Other cookies stay on your device for a set period, allowing us to recognize your browser the next time you visit (these are called persistent or protocol cookies). These help us guide you through the site, recognize you, and show you new or different content when you return.

Cookies from partners or third parties may be used to collect information for advertising, personalized content, or statistics (“third-party cookies”). Unless we specify that a cookie is from a third party, it is one of our own (“first-party cookies”). We provide separate details about third-party cookies and tracking technologies in the sections below.

Flash cookies are data elements stored on your computer by websites using Adobe Flash. These cookies do not have an expiration date.

For more information on the cookies and similar technologies we use, why we use them, and what data is stored or shared with third parties, please use our cookie management tool, CookieHub, provided by CookieHub ehf, Hafnargata 18, 230 Reykjanesbær, Iceland. When you visit our website, CookieHub lets you choose your preferences and give consent for the use of cookies and similar technologies.

CookieHub uses JavaScript to collect log files and consent data. This allows us to inform you about the tags used on our website and to obtain, manage, and document your consent. CookieHub saves your chosen settings and the consent you provided when you first visited the site, and it processes the following data:

• Consent data: anonymized logbook data (consent ID, processor ID, controller ID), consent status, timestamp
• Device data: shortened IP addresses (IPv4, IPv6), device information, timestamp
• User data: email, ID, browser information, setting IDs, changelog

To do this, CookieHub stores a technically necessary cookie. You can find CookieHub’s privacy policy here: https://www.cookiehub.com/legal/privacy-policy.

You can also find detailed information about the cookies we use, their purposes, and the data stored or shared via the “More options” / “Cookie declaration” section in CookieHub. CookieHub automatically scans the site to identify which cookies are in use, and the list of methods and the cookie declaration are updated automatically.

Legal basis and purpose of processing

We process personal data using cookies and similar technologies based on Art. 6(1)(f) GDPR to ensure our website functions correctly, remains secure, and provides a user-friendly experience, unless we have requested your consent under Art. 6(1)(a) GDPR.

The legal basis for storing and reading other information is § 25(1) TDDDG for cookies and similar technologies that require consent, and § 25(2) no. 2 TDDDG for cookies that are essential for the website to function.

CookieHub helps us obtain and manage your consent, making it easier for you to choose which categories of cookies and similar technologies you want to allow. CookieHub blocks all non-essential cookies unless you explicitly consent to them. You will see a prompt for this when you first visit our website.

By clicking “Accept all,” you allow all methods. Alternatively, you can use “More options” to decide individually which cookies or cookie-based applications you consent to by toggling them on and clicking “Save settings.”

You can also reject all non-essential cookies by clicking “Essential cookies only,” which means you will only use the website with the cookies required for it to function.

Technically necessary cookies are used to simplify and improve your experience and are required to provide our service under § 165(2) TKG (2021). Some features of our website won't work without them, as the browser needs to recognize you even after you navigate to a different page.

For other cookie categories (e.g., “Analytical cookies,” “Marketing cookies,” “Necessary cookies”), the purposes depend on the specific services used. These are explained in this Privacy Notice and in more detail within CookieHub.

The legal basis for data processed via our cookie management tool is Art. 6(1)(c) GDPR for user consent data, and otherwise Art. 6(1)(f) GDPR and/or § 165(2) TKG (2021). As the website operator, we have a legitimate interest in managing cookie consent in a lawful, user-specific, and user-friendly way, and in ensuring our online presence is compliant.

Storage period / objection and removal options

You can find details on how long our cookies are stored in the “Cookie declaration” section of CookieHub.

Cookies are stored on your computer and sent to our site from there. This means you have full control over their use. You can disable or restrict cookies by changing your browser settings. You can also delete cookies that have already been stored at any time, and this can even be automated. Please note that if you disable cookies for our website, some features may not work as intended.

You can also use the cookie consent tool to withdraw your consent at any time or change your preferences by clicking “Cookie settings.”

III. Statistical website analysis / increasing reach

1. Google Analytics

Description of processing

We use Google Analytics to help us understand how our online services are being used. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), a subsidiary of Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics uses cookies to collect information. The data generated by these cookies about your use of our website is typically sent to a Google server in the USA and stored there. Google processes this information to provide us with reports on user behavior, including audience, behavior, and real-time analytics.

Google Analytics uses a tracking code to assign a unique, random ID to your browser cookie. This allows the system to recognize you as a new user or as a returning visitor on subsequent visits. All data collected is linked to this user ID, which helps us analyze pseudonymous user profiles.

We use markers like cookies to measure interactions on our website. If you use other Google services (such as a Google account), data from Google Analytics may be linked with third-party cookies. Google does not share this data unless we, as the website operator, authorize it, or if required by law. You can find a list of the cookies used by Google Analytics in the “Cookie declarations” section of CookieHub.

Our website uses Google Analytics exclusively with the “anonymizeIp()” extension. This means your IP address is never stored in full; it is shortened within EU/EEA member states before being sent to the USA, making it impossible to identify individual visitors. Only in rare, exceptional cases is the full IP address sent to a Google server in the USA and shortened there.

Google Analytics collects various types of data, including heatmaps, session duration, bounce rates, account creation, location, technical details, and traffic sources. This list is just a general guide and is not exhaustive.

You can find more information in Google’s privacy policy: https://policies.google.com/privacy?hl=en

Legal basis and purpose of processing

We use Google Analytics to evaluate how our website and services are used, to generate activity reports, and to access other services related to website and internet usage. We also use it to analyze data from AdWords and the DoubleClick cookie for statistical purposes.

As the operator of this website and these services, we have a legitimate interest in analyzing user behavior to improve our offerings and advertising. Therefore, we ask for your consent to use Google Analytics and store its cookies, in accordance with § 165(2) TKG (2021).

Information generated by the cookie about your usage is usually transmitted to and stored on a Google server in the USA. If IP anonymization is enabled, Google shortens your IP address within the EU/EEA before transmission. In exceptional cases, the full IP address may be transmitted and then shortened in the USA.

By consenting to Google Analytics cookies, you also agree under Art. 49(1) sentence 1(a) GDPR to the processing of your data in the USA, provided the transfer is not protected by EU standard contractual clauses. The Court of Justice of the European Union considers the USA to have an insufficient level of data protection by EU standards. Specifically, there is a risk that US authorities could access your data for surveillance purposes without you having effective legal recourse.

If you click “Reject all” or choose a selection that excludes Google cookies, the data transfer described above will not occur. You can withdraw your consent at any time, effective for the future.

Google uses this information to evaluate your usage, create reports for us, and provide other services related to website and internet activity. Google may share this information with third parties if required by law or if those third parties process the data on Google’s behalf. Google has contractually guaranteed that it will not associate your IP address with any other data it holds. We have signed a data processing agreement with Google to ensure your data is handled correctly.

Storage period / objection and removal options

You can manage or delete cookies through your browser settings. Please note that if you disable cookies, some features of our website may not work as intended.

You can opt out of Google Analytics data collection by installing the browser add-on available here: http://tools.google.com/dlpage/gaoptout?hl=en.

You can also install an opt-out cookie (especially on mobile browsers) via https://developers.google.com/analytics/devguides/collection/gajs/?hl=en#disable to prevent future data collection. Keep in mind that if you clear your cookies, you will need to reinstall the opt-out cookie.

Alternatively, you can manage your cookie preferences through CookieHub.

2. Google Tag Manager

Description of processing

Google Tag Manager is a solution provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), which allows marketers to manage website tags through an interface. Google Tag Manager itself (which implements the tags) is a cookie-less domain and does not collect personal data. It supports the integration and triggering of other tags, code snippets, tracking codes, and conversion pixels that may themselves collect data. Google Tag Manager does not access this data. It provides a user interface that does not require advanced programming knowledge or source code changes.

We use Google Tag Manager only to display Google Ads (formerly Google AdWords) for search engine marketing.

Further information: https://www.google.com/intl/en/tagmanager/use-policy.html

3. Google Ads (formerly Google AdWords) & Google Ads Conversion Tracking

Description of processing

We use Google Ads, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and offered in Europe by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, to integrate ads into our website and draw attention to our offers on external sites.

This helps us determine the success of our advertising efforts. Ads are delivered by Google via ad servers. Google Ads uses cookies. When a cookie is set, your use of our pages can be analyzed. When you visit a page on our website that includes a Google Ads component, your browser automatically sends data to Google for online advertising and commission billing. Google collects personal data, including your IP address, which helps it track the origin of visitors and clicks and enables commission settlement.

The cookie typically stores the following analysis values: a unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions), and opt-out information. Google Ads also uses web beacons (invisible graphics) to analyze visitor traffic.

Information generated by cookies and web beacons, including your IP address and ad format delivery, is transmitted to and stored on a Google server in the USA. This information may be shared with Google’s partners (see https://support.google.com/admanager/answer/94149?...). We have no control over the data collected by Google, the full scope of that collection, or the retention periods. To the best of our knowledge, Google does not merge your IP address with other data stored about you. If you are logged into a Google account, your data may be assigned to your profile; if you prefer to avoid this, please log out before using our website.

Further information: https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/ads?hl=en

Legal basis and purpose of processing

Google Ads cookies and web beacons are stored based on Art. 6(1)(a) GDPR. Additionally, we use Google Ads based on our legitimate interest under Art. 6(1)(f) GDPR. We have a legitimate interest in analyzing the reach of our website, displaying relevant ads, improving campaign performance reports, and ensuring the fair calculation of advertising costs.

We have entered into a data processing agreement with Google.

Objection and removal options

You can prevent the installation of Google Ads cookies in several ways, such as by adjusting your browser settings (to block third-party cookies), by disabling interest-based ads via www.google.com/ads/preferences, via www.aboutads.info/choices, or via www.google.com/settings/ads/plugin. Please note that if you do this, you may not be able to use all the features of our website.

Alternatively, you can manage your cookie preferences via CookieHub.

4. Amplitude

Description of processing

We use Amplitude analytics software to optimize our online shop and our mobile payment app, a service provided by Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (“Amplitude”). The purpose is to evaluate and analyze usage and compile reports for us. Data is collected in near real time when a user performs an action (e.g., clicking a button, loading a page, completing a purchase).

Affected data categories include:

• Usage data: clicks, pages visited, time spent, feature usage
• Device data: operating system, browser type, device type, screen resolution
• Identifiers: pseudonymized user IDs, Amplitude internal IDs, IP address (processed in shortened form)

Cookies are also stored on your computer. The information generated in this way is transmitted to and stored on an Amplitude server in the USA.

We have concluded a data processing addendum with Amplitude that includes the EU standard contractual clauses as a transfer mechanism for personal data from the EU to the USA. Amplitude is certified under the EU–US Data Privacy Framework.

Further information: https://amplitude.com/privacy

Legal basis and purpose of processing

We use Amplitude to evaluate use of our services, compile reports, and better understand usage. This helps us identify improvement potential and optimize performance and functions. Because we have a strong interest in this analysis for product improvement, we request your consent for the use of Amplitude and the storage of cookies on the basis of § 165(2) TKG (2021).

Storage period / objection and removal options

If you do not want cookies stored, please set your browser to delete cookies, block all or certain cookies, or warn before cookies are stored. You can also manage your cookie preferences via CookieHub.

IV. Further information on procedures, plugins, and tools used to design the Website

1. SSL/TLS encryption

This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us. You can recognize an encrypted connection by the change from “http://” to “https://” in the browser’s address bar and by the lock symbol. When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

2. make.com

Description of processing

We use make to integrate different databases and web tools, a service of Celonis SE, Theresienstr. 6, 80333 Munich, Germany. make is a platform on which various cloud-based software applications can be connected. Data required or processed in the linked applications is automatically transferred through the connections. The aim is to enable digital processes to run autonomously, particularly standardized, recurring processes, creating automated data flows and efficient procedures.

Further information: https://www.make.com/en/privacy-notice and https://www.celonis.com/de/privacy-notice/

Legal basis and purpose of processing

We use make.com on the basis of Art. 6(1)(f) GDPR. We have an interest in efficient process automation, consolidation of various services, and the associated import and export of personal and contact data.

3. Language versions of the Online Presences (translations with Weglot)

Processing details

We use the Weglot translation service, provided by Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France. Weglot loads when you visit our site, allowing you to switch languages using the language icons. By integrating Weglot, your browser connects to their servers, and your IP address and device details are shared with them. This data is essential for the service to function.

Weglot processes this data on our behalf as a processor, in accordance with a data processing agreement under Art. 28 GDPR, within the European Union.

Learn more here: https://www.weglot.com/privacy

Legal basis and purpose

We process this data based on our legitimate interest under Art. 6(1)(f) GDPR to offer our website in multiple languages and provide a selection option for our visitors, provided no additional consent is required under Art. 7 GDPR or § 165(2) TKG (2021).

How to object or opt out

Weglot is essential for providing our website in different languages. If you would like your personal data deleted, you can exercise your rights as outlined in Part A.

4. YouTube content

Processing details

We occasionally embed videos from YouTube on our website or link to our YouTube channel. YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and is provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

If you interact with our YouTube channel, we may process the information you provide, such as your username and any content you post, when we reply to your comments or messages.

Otherwise, we only receive non-personal data from Google regarding activity, such as click counts or video watch times, which we can view through our YouTube account. Google processes this data independently, and we are unable to disable their analytics tools on YouTube.

When you click play on an embedded video, your IP address is sent to YouTube so they can deliver the content. YouTube also learns which page of our site you are visiting. If you are logged into your YouTube account, they may link this activity directly to your personal profile.

Learn more here: https://policies.google.com/privacy?hl=en&gl=en

Legal basis and purpose

We use YouTube based on our legitimate interests under Art. 6(1)(f) GDPR to share video content on our site and to engage with your questions or comments.

Retention and opt-out options

To avoid your activity being linked to your account, please log out of YouTube before playing any videos. You can manage how Google processes your data through your Google or YouTube account settings. Depending on your mobile device's operating system, you can also restrict Google’s access to things like your contacts, calendar, photos, or location.

5. Auth0

Processing details

We use the cloud-based identity management platform Auth0, provided by Okta Inc. (10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA), to handle registrations and logins for our online shop.

When you enter information into an Auth0 form, that data is sent directly between your browser and Auth0. The following data is processed to manage identities, handle authentication (login/registration), and ensure account security:

• Account/master data: email address, name, and profile picture (if using social login)
• Security data: password hashes, multi-factor authentication (MFA) details, and session tokens
• Metadata: login IP address, timestamps, and browser/device info (for fraud detection)

Data is only collected during login, registration, and whenever a session is refreshed.

More info: https://www.okta.com/legal/privacy-policy/

We have chosen Europe as the server location for storing data. If data needs to be transferred to the USA in specific cases, we use EU standard contractual clauses as part of a data processing agreement.

Legal basis and purpose

We integrate Auth0 based on our legitimate interest under Art. 6(1)(f) GDPR to ensure that only authorized and identified individuals can access our services. Auth0 is also necessary for providing services related to user account access under § 165(2) TKG (2021).

Retention period / opting out

If you prefer not to have cookies stored, you can adjust your browser settings to delete, block, or warn you about them. You can also manage your cookie preferences through CookieHub.

6. Datadog

Processing details

We use Datadog, a service provided by Datadog, Inc. (620 8th Avenue, 45th Floor, New York, NY 10018, USA), as a processor as defined by Art. 4(8) and Art. 28 GDPR.

We use Datadog to monitor system stability, analyze errors (such as deviations, anomalies, latency, availability, and response times) on our websites and services, and for IT security. To do this, Datadog collects log data (which may include user IP addresses), performance data (including stack traces and error times), and metadata (system configurations and anonymized user IDs) on our behalf.

Personal data collected may be transferred to and stored by Datadog in the USA. We have a data processing agreement in place that includes EU standard contractual clauses. Datadog is also certified under the EU–US Data Privacy Framework.

More info: https://www.datadoghq.com/legal/privacy/

Legal basis and purpose

Once the applicable period ends, only aggregated, non-personal data is kept. We process this data based on our legitimate interest under Art. 6(1)(f) GDPR to ensure our websites and services run smoothly, meet user needs, and allow us to detect and fix errors. Datadog is necessary for providing our websites and services in connection with user account access under § 165(2) TKG (2021).

Retention period / opting out

Data collected via DataDog is deleted or anonymized after error analysis.

V. Links to other websites

Our online presence may contain links to other websites. We have no control over the content or design of third-party sites. This Privacy Notice does not apply to external providers we link to. If you are redirected to another website, please review that provider’s data practices.

VI. Social media and platform presence

How we process your data

We maintain a presence on various social networks (e.g., Facebook, Xing, LinkedIn) and platforms (e.g., YouTube), which we link to from our website. Clicking on these logos will take you directly to our profile on that platform. We use these channels to connect with customers, prospective clients, and users to keep you updated on our services.

When you visit these networks and platforms, their specific terms and data processing policies apply.

Since your activity on these platforms happens outside our website, we have no control over how they handle your data. Please be aware that these companies may process data in the USA and use it for market research and advertising, including building user profiles. If you are logged into your account on these platforms, they may store cookies on your device to track your activity.

Unless otherwise stated, we only process data when you interact with us directly on these platforms (e.g., by sending messages or leaving comments). For more details, please check the privacy policies and opt-out options provided by the platform operators.

Legal basis and purpose

We only process your personal data when you contact us or interact with our content on these platforms. Unless otherwise noted, this is based on our legitimate interest in effective communication under Art. 6(1)(f) GDPR. If your inquiry relates to a potential contract, we may also process your data under Art. 6(1)(b) GDPR.

When a social network processes your data for its own purposes, it acts as the sole controller. Please be mindful of the information you share with us on these platforms. If you prefer that these networks do not process your data, please reach out to us through a different channel.

Storage, objections, and removal

If you have an account on a social network and don't want them to link your activity on our site to your profile, please log out before visiting our pages. For details on how long data is stored and how to opt out, please refer to the platform’s own privacy policy. Requests regarding your data rights are usually most effective when sent directly to the platform provider, as they have direct access to your account data. If you need help, feel free to contact us.

Facebook

We operate a Facebook business page (“fan page”) managed by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Facebook Ireland and we are joint controllers for the collection of visitor data on our fan page. We have entered into a joint processing agreement under Art. 26 GDPR, along with the following terms:
“Controller Addendum”: https://www.facebook.com/legal/controller_addendum
“Data Processing Terms”: https://www.facebook.com/legal/terms/dataprocessing/update

You can find the information required under Art. 13(1)(a) and (b) GDPR in Facebook’s Data Policy: https://www.facebook.com/about/privacy.

Facebook Inc. (USA) also collects and uses “Page Insights” for analysis. These are aggregated statistics that show how users interact with our page, potentially based on personal data from your visits. The Controller Addendum outlines security measures and how Facebook handles user requests. The purposes of this joint processing are detailed in the terms linked within the Controller Addendum.

Data collected during your visit includes information about the content you view or interact with, your actions (see “Things you and others do and provide” in Facebook’s Data Policy), and device information like your IP address, operating system, browser type, language settings, and cookie data (see “Device information” in their Data Policy).

We share responsibility for Page Insights. We have agreed with Facebook Ireland that Facebook Ireland is responsible for fulfilling data subject rights under Arts. 15–20 GDPR regarding personal data stored by Facebook Ireland in the context of joint processing. Therefore, if data protection requests regarding Page Insights reach us, we are obliged to notify Facebook; we will forward such requests to Facebook Ireland.

Further details about Facebook’s processing (including legal basis and options to exercise rights) can be found at https://www.facebook.com/about/privacy.

We note that we cannot enable/disable Page Insights. Requests must therefore largely be forwarded to Facebook Ireland unless we have ourselves collected data. If you do not want Facebook Inc. to collect your data, please do not use our Facebook business page and/or configure your browser to block cookies and/or log out of Facebook while using our page.

Privacy information: https://www.facebook.com/about/privacy/ and https://www.facebook.com/legal/terms/information_about_page_insights_data
Opt-out options: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com

LinkedIn

LinkedIn is a service of LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA, operated in Europe by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is an internet-based social network enabling users to connect with business contacts.

Each time you access a page of our Website equipped with a LinkedIn component (LinkedIn plugin), the component causes your browser to download a corresponding display from LinkedIn. Further information: https://developer.linkedin.com/plugins. LinkedIn thereby learns which specific subpage you visited.

If you are logged into LinkedIn at the same time, LinkedIn recognizes which subpages you visit during your stay and assigns this information to your LinkedIn account. If you click a LinkedIn button integrated on our Website, LinkedIn assigns this to your account and stores this personal data.

LinkedIn receives information about your visit to our Website whenever you are logged into LinkedIn, regardless of whether you click the LinkedIn component. If you do not want this transmission, you can prevent it by logging out of LinkedIn before accessing our Website.

LinkedIn offers settings for unsubscribing from messages and targeted advertising and managing ad settings at https://www.linkedin.com/psettings/guest-controls. LinkedIn also uses partners that may set cookies; such cookies can be rejected via https://www.linkedin.com/legal/cookie-policy. LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.

Privacy policy: https://www.linkedin.com/legal/privacy-policy
Opt-out options: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

XING

XING is operated by XING AG, Dammtorstraße 29–32, 20354 Hamburg, Germany (“XING”). XING is an internet-based social network enabling business connections.

Each time you access a page of our Website with a XING component (XING plugin), your browser downloads a display from XING. Further information: https://dev.xing.com/plugins. XING thereby learns which specific subpage you visited.

If you are logged into XING, XING recognizes which subpages you visit. This information is collected and assigned to your XING account. If you click a XING button (e.g., “Share”), XING assigns this to your account and stores the personal data.

XING receives information about your visit whenever you are logged in, regardless of clicking the component. If you do not want this, log out of XING before accessing our Website.

XING’s privacy policy: https://www.xing.com/privacy
Information for the XING share button: https://www.xing.com/app/share?op=data_protection
Privacy statement / opt-out: https://privacy.xing.com/de/datenschutzerklaerung

VII. Active use of our Website

1. Contact forms and e-mail contact

Description of processing

Our website provides a contact form you can use to get in touch with us electronically. If you use this option, the data you enter into the form is transmitted to us and stored:

• company/municipality (required)
• first name (required)
• last name (required)
• e-mail (required)
• telephone (optional)
• message (optional)

When you send us a message using one of our contact forms, the following data is also stored at the time of submission:

• the user’s IP address
• date and time of submission

If you contact us via an e-mail address we provide, any personal data included in your e-mail will be stored.

If you provide a mobile phone number to receive updates on the status of your payment request, we will use that number for that purpose.

We use HubSpot Forms (a service within our HubSpot CRM) to embed contact forms and process the data entered there (see Part C, item II). Data entered into these forms is stored in our HubSpot CRM.

We use Google e-mail services via Google Workspace, provided by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (“Google”). Consequently, e-mails are also stored on Google servers. We have selected the “Europe” region as our server location and have entered into a data processing agreement with Google. No additional transfer of these e-mails to third countries, particularly the USA, takes place; Google provides contractual assurances for this.

To organize and sort incoming requests, we use AI-based services via an interface designed to understand and generate natural language, analyze information, and make predictions.

We use the ChatGPT language model provided by OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We have agreed with OpenAI that our data will not be used to train their models and will not be shared with OpenAI. You can find OpenAI’s privacy information here: https://openai.com/de/policies/eu-privacy-policy. We have signed a data processing addendum (https://openai.com/policies/data-processing-addendum). Because data is transferred to the USA when using the OpenAI API, this addendum includes the EU standard contractual clauses to ensure an adequate level of protection for transfers to third countries.

We also use the AI-based system Google Gemini, offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to pre-sort incoming e-mails and documents. As Google Workspace customers, we have the assurance that data processed via Google Gemini is not used to train Google’s generally available AI models.

For spelling and grammar checks in our replies, we use LanguageTool, a software product from LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam, Germany, a subsidiary of Learno Inc., which includes AI features. Privacy information: https://languagetool.org/de/legal/privacy. LanguageTool stores checked text and detected errors on its servers for up to 15 minutes (not permanently). This storage occurs without an IP address or other information that would allow the data to be linked to a specific person. However, if the text contains personal information, it may be stored briefly. We have entered into a data processing agreement with Learno Inc. that includes the EU standard contractual clauses required for processing in the USA: https://languagetool.org/de/legal/dpa.

To read attached PDF or Word files, we use Airparser, Sepapaja tn 6, Tallinn 11415, Estonia. Airparser uses AI technology to recognize and extract structured data. We have entered into a data processing agreement in accordance with Art. 28 GDPR (https://airparser.com/dpa/). Airparser privacy information: https://airparser.com/gdpr/.

Legal basis and purpose of processing

The legal basis for processing data transmitted via contact forms or e-mail is Art. 6(1)(f) GDPR. If the request is aimed at concluding a contract, an additional legal basis is Art. 6(1)(b) GDPR.

We process the personal data entered into the form to handle your inquiry and contact you. Processing via e-mail is also based on our legitimate interest in managing such communications. If you provide a mobile number for updates on your payment request, we use it for that purpose.

The use of AI-based services is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. Due to the high volume of incoming messages, we rely on this pre-selection and routing to the appropriate teams to ensure fast, targeted processing, which is in both our interest and the interest of the sender.

User information may also be stored in our CRM or a similar inquiry management system based on our legitimate interests.

Other personal data processed during submission is used to prevent misuse of the contact form and to ensure the security of our IT systems.

Storage period / right to object and erasure

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data sent via contact forms or email, this is usually when the conversation has ended. A conversation is considered over when it’s clear that the matter has been fully resolved and there are no legal requirements for further storage.

You can withdraw your consent at any time. If you contact us by email, you can object to the storage of your personal data whenever you like. In that case, we won't be able to continue the conversation unless we have another legal basis or an overriding interest in continuing to process your data.

Any personal data stored while contacting us will be deleted in such cases, unless we are legally required to keep it for longer.

2. Telephone hotline

How we process your data

If you call us using a number listed on our website, we log the incoming number and technical details from our phone system (like when the call started and how long it lasted). We also note the main points of the call and any information you provide, such as your name, your inquiry, and how we can reach you for follow-up.

To help route your call, we use an AI-powered tool from Leaping AI UG (limited liability), Potsdamer Straße 72, 10785 Berlin, Germany. It asks for the details needed to classify and direct your call—like our reference number, your license plate, or your name—and can handle some customer requests automatically. We have a data processing agreement in place with Leaping AI as required by Art. 28 GDPR.

We’ll ask if you consent to having the call recorded. If you agree, we store the full recording and generate an automatic transcript. We use these to train our service team, resolve complaints, create anonymous internal reports (like call categories and statistics), and for legal purposes if we ever need to defend or assert a claim.

We use Talkdesk, a cloud contact center platform provided by Talkdesk Inc., 201 Spear Street, Suite 1100, San Francisco, CA 94105, USA. We have a data processing agreement that includes EU standard contractual clauses for international transfers. We’ve also set up our Talkdesk instance to run in a European region, so your data is processed within the EU by default.

Legal basis and purpose

When you call, we automatically collect the data needed to handle your request (like our reference number, your license plate, or your name) to help us manage your inquiry efficiently, based on Art. 6(1)(f) GDPR. If your call relates to our services or an existing, past, or planned contract, Art. 6(1)(b) GDPR also applies.

During the call, we manually save notes about your inquiry, which are stored once the call ends; we do not record the call in these instances. This is based on Art. 6(1)(f) GDPR, and where applicable, Art. 6(1)(b) GDPR.

Recordings and transcripts are only created and processed if you have given your prior consent, as per Art. 6(1)(a) GDPR.

We may also store your information in our CRM or similar inquiry management system based on our legitimate business interests.

How long we keep your data / How to object

Data is deleted as soon as it’s no longer needed, which is generally once the conversation has ended and there are no legal requirements to keep it longer.

If there’s no specific legal retention period, we keep recordings and call notes based on statutory limitation periods (in Germany, this is typically three years). Transcripts are deleted after 6 months.

You can withdraw your consent at any time. If you withdraw your consent for recording, transcription, or storage, we will delete those files immediately, unless we are legally required to keep them.

3. Ticket system

How we process your data

We use Freshdesk, a software solution from Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA, as our ticketing system. Freshdesk is a customer service platform that helps manage customer inquiries across multiple channels. We use it to receive and handle your requests. If you contact us via our contact form, email, or phone, the information you provide, the content of our conversation, and any data we collect (see sections VII.2 and VII.3 above) are stored and organized in the ticketing system to ensure we can process your request chronologically and provide you with better service.

Data is stored on Freshdesk servers. Depending on what you share with us, personal information such as your first and last name and email address may be collected, transmitted to Freshdesk, and stored there. We have opted to have this data processed on servers within the EU to ensure it remains within the EU and to technically prevent access by US authorities.

More information: https://www.freshworks.com/privacy/

Legal basis and purpose of processing

We process information captured via Freshdesk based on our legitimate interest in providing efficient customer service and responding to your requests as quickly as possible (Art. 6(1)(f) GDPR). This is supported by a data processing agreement with Freshdesk under Art. 28 GDPR, which protects your data and prohibits unauthorized disclosure to third parties.

If a transfer to the USA becomes necessary in a specific case, it is based on the EU Commission’s standard contractual clauses.

Storage period / objection and removal options

We store your data for the duration of our contractual relationship or until the specific conversation is concluded. If you would like your personal data deleted, you can exercise your rights as described in Part A.

4. Chat function

Description of processing

The chat function on our website is powered by an AI chatbot from Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA (“Decagon”). Decagon operates an AI platform that automates customer service using “agents.” You can use the chat to ask general questions about our parking system or specific parking locations (e.g., opening hours, rates) or to report issues at a parking site so they can be forwarded to our customer support team.

Once you enter a question in the chat field (“prompts”), Decagon automatically analyzes it and provides a text-based response. Generally, we do not need personal information from you (such as your name, email, phone number, address, or license plate). Please avoid entering such personal data about yourself or others unless specifically requested. We only collect and store this information if you provide it voluntarily.

For display and technical operation, the following necessary log data is processed:

• IP address
• metadata about API requests
• date and time of access

Processing is fully automated by the chat function and only begins once you submit data. The agent operates within strictly defined limits and does not make independent decisions that affect your rights or your access to our services. If a request requires human judgment or falls outside the agent’s scope, it is forwarded through a supervised process to one of our human support agents and stored for further processing outside of Decagon in our CRM or ticketing system.

Decagon has contractually guaranteed that user data provided via the chat function is not used to train other AI models. More information: https://decagon.ai/legal/privacy

Legal basis and purpose of processing

The purpose of this processing is to support our customers and users by answering general questions or support requests. We process information captured via Decagon based on our legitimate interest in providing efficient customer service and fast responses (Art. 6(1)(f) GDPR), in conjunction with a data processing agreement with Decagon under Art. 28 GDPR that prohibits unauthorized disclosure to third parties.

We have also agreed with Decagon that data is processed exclusively within the EU during normal operations (EU data residency). If a transfer to the USA is required for technical support and is authorized by us, it is based on the EU Commission’s standard contractual clauses.

Storage period / objection and removal options

Personal data exchanged in chats is stored for the duration of our legal relationship with the data subjects or until the conversation is finished. If you would like your personal data deleted, you can exercise your rights as described in Part A.

C. Data processing in connection with the use of MHP parking facilities

1. Use of the MHP online shop

Description of processing

Through our MHP online shop (“Online Shop”), you can book and pay for parking services at facilities we manage, based on our applicable general terms and conditions. For example, you can pay your parking fees online.

We use cookies to make the Online Shop easier to use. Some features require the browser to be identified even after you navigate to a new page. Cookies store details like your language and region. They also allow us to analyze browsing behavior in the Online Shop, such as search terms used, how often pages are viewed, and how website features are used.

To book parking services, you must fill out and submit the booking form. You will need to enter your vehicle license plate in the provided field, and potentially select your desired parking area or enter a reference/file number. We need your license plate and other details to link the parking fee to the correct parking session or service.

Data processed during booking includes your license plate, the amount due, and other communication, contract, and payment details from customers, prospective customers, and business partners. This processing is necessary to fulfill our contractual obligations, including operating the Online Shop, billing, delivery, and customer support. During the booking process, we collect the information shown in the forms, such as your name, company, address, email, and phone number. Mandatory fields are generally marked with an * or labeled “optional,” and include the information required to provide and bill for the service, as well as contact details for coordinating with you or sending important order updates.

We process and use this data to allow you to select, book, and pay for our parking services. We also process data to manage your booking and send you a confirmation. Further details are covered in our general terms and conditions. Information regarding payment service providers can be found in Part C, item 2.

We use the e-commerce solution provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland, an affiliate of Shopify Inc., 126 York Street, Suite 200, Ottawa, ON, Canada, K1N 5T5 (collectively “Shopify”). Shopify operates the e-commerce platform, and all data collected via the Online Shop is processed on Shopify’s servers for these purposes.

Where data is transferred to Shopify Inc. in Canada, an adequate level of protection is ensured by an adequacy decision from the European Commission. As part of Shopify’s services, data may also be transferred for further processing on behalf of Shopify Inc. to Shopify Data Processing (USA) Inc., Shopify Payments, or Shopify (USA) Inc.

We share data collected through our Online Shop with Shopify as necessary for them to provide their shop system services. Shopify also processes data provided by customers during shopping or payment to fulfill orders and ensure a smooth shopping experience. Specifically, Shopify collects or receives: name, email address, shipping and billing address, payment details, company name, phone number, IP address, order information, details about Shopify-supported merchant shops you visit, and information about your device and browser.

Data you enter may be forwarded to Shopify servers and other service providers used by Shopify, including those in the USA, and processed there. Further details: https://www.shopify.de/legal/datenschutz

Legal basis and purpose of processing

The legal basis for processing data collected during booking is Art. 6(1)(b) GDPR (contract initiation/performance). Additionally, Art. 6(1)(f) GDPR applies to identifying and combating harmful behavior, detecting and preventing negative experiences, and maintaining the integrity, security, and protection of the Online Shop. We and other users have a legitimate interest in preventing, detecting, or investigating illegal activities, fraud, or security incidents. The information above is also required for service provision under § 165(2) TKG (2021).

Processing personal data entered into the form is necessary to manage your booking and provide the relevant parking service.

Processing may also be based on your consent (Art. 6(1)(a) GDPR) if we request it. You can withdraw your consent at any time, effective for the future. The lawfulness of any processing done prior to withdrawal remains unaffected. Please note that withdrawing consent may mean we cannot complete the booking process, and your booking may no longer be possible.

We use Shopify based on our legitimate interests under Art. 6(1)(f) GDPR to sell our products online quickly, easily, and securely, to simplify shop usage, and to make your visit more engaging. Shopify helps us understand how our website is used so we can optimize our offerings to better suit your needs and interests. Non-essential Shopify cookies are processed based on your consent under Art. 6(1)(a) GDPR and § 165(2) TKG (2021). If you do not accept these cookies, the functionality of the Online Shop may be limited.

Storage period / objection and removal options

Data is deleted once it is no longer needed. For booking data, this is generally once the contract is concluded and the parking service has been fully provided. As a rule, we keep contract-related data until the statutory warranty period expires. If statutory archiving obligations apply, we will delete the data after the retention period has ended.

2. Using payment providers for order processing (“payment services”)

How we process your data

If you need to provide payment details (such as an account number for direct debit) after entering into a paid parking contract, we use this information to process your payment.

We offer various payment options and work with banks, credit institutions, and other payment service providers (“payment service providers”). All transactions made via standard methods (like Visa or Mastercard) are processed using encrypted SSL/TLS connections.

When you select a specific payment provider, they deliver their services based on a contract between you and them, subject to their own terms and conditions. The provider handles this data under their own responsibility, and we have no influence over their processes. For this reason, you should contact the provider directly regarding your data subject rights in this context. The provider may also ask for additional consent, for example, to perform identity or credit checks.

Personal data processed by payment providers typically includes your first and last name, address, date of birth, gender, email address, IP address, phone number, and any payment-related data required to complete the transaction and order.

Legal basis and purpose

We transfer your data to payment providers based on Art. 6(1)(b) GDPR (performance of a contract) to process data collected during your order, and based on our legitimate interests (Art. 6(1)(f) GDPR) where we do not require your consent under Art. 6(1)(a) GDPR.

You can withdraw your consent for processing by payment providers at any time, effective for the future. This withdrawal does not affect any processing that has already taken place.

Payment methods/providers (examples):

• American Express (American Express Europe S.A.) – https://www.americanexpress.com/de/legal/online-datenschutzerklarung.html
• Apple Pay (Apple Inc.) – https://www.apple.com/legal/privacy/de-ww/
• Giropay (giropay GmbH) – https://www.giropay.de/rechtliches/datenschutzerklaerung/
• Google Pay (Google Ireland Limited) – https://policies.google.com/privacy
• Mastercard (Mastercard Europe SA) – https://www.mastercard.de/de-de/datenschutz.html
• PayPal (PayPal (Europe) S.à.r.l. et Cie, S.C.A.) – https://www.paypal.com/de/webapps/mpp/ua/privacy-full
• Visa (Visa Europe Services Inc.) – https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html

Adyen

If you choose to pay via Adyen, personal data is transmitted to Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ Amsterdam, Netherlands (“Adyen”). This typically includes your card type, cardholder name, card number, security code, and expiry date. Adyen processes this data for payment processing and identity/credit checks, acting as a controller. Privacy information: https://www.adyen.com/de_DE/privacy-policy and for transaction processing: https://www.adyen.com/de_DE/privacy-policy/transaction.

Stripe

If you choose Stripe, your order and transaction data is shared with Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”) solely for payment processing and only as necessary. Stripe acts in a dual role as both a controller and a (sub-)processor. Privacy information: https://stripe.com/de/privacy. As a processor, Stripe acts on our instructions under a data processing agreement in accordance with Art. 28 GDPR.

Shop Pay (“Shopify Payments”)

If you select a payment method offered through Shopify Payments, your payment is processed via Stripe. If you register for Shop Pay, Shopify stores and uses your data under its own responsibility to prefill checkout information according to Shopify’s terms. Further details: https://www.shopify.de/legal/datenschutz and https://pay.shopify.com/tos-privacy-policy#privacy-policy.

secuPay

If you use secuPay, data may be transmitted to secupay AG, Goethestraße 6, 01896 Pulsnitz, Germany (“secupay”) for payment processing and risk assessment. secuPay may also involve credit agencies for identity and credit checks. Privacy information: https://www.secupay.com/de/datenschutz.

3. Using reviews for the MHP online shop (Trustpilot)

Description of processing

We use the review platform Trustpilot, operated by Trustpilot A/S, Pilestraede 58, 5th Floor, 1112 Copenhagen, Denmark. If you purchase a parking service through our shop and receive a receipt via email, we include a Trustpilot button with a unique link generated by Trustpilot. Clicking this link takes you to Trustpilot, where the form may already be pre-filled. Verification is handled via your reference number. Submitting a review is entirely voluntary.

We share the following data with Trustpilot: email address, first and last name, reference number, language- and country-specific shop domain, access data (including IP address), and the parking service you selected.

We use Trustpilot as a data processor and have contractually required them to handle your information in compliance with data protection laws. Please note that you need a Trustpilot account to post a review and that Trustpilot acts as the controller for any further processing of your review, including its publication. Details: https://de.corporate.trustpilot.com/legal/for-businesses/privacy-policy

Legal basis and purpose of processing

Processing is used to create the invitation link and verify that the shop was actually used for the review process. Collecting feedback to improve our services is a legitimate interest under Art. 6(1)(f) GDPR.

Storage period / objection and removal options

Invitation data for Trustpilot is stored for one year.

4. Use of parking areas managed by MH Parkservice

Description of processing

When you use our parking areas, the following data is automatically recorded: vehicle license plate (including front and rear views), entry and exit times, date and location stamps, and the amount and method of payment for the parking fee.

Before leaving the parking area, users without a permanent parking permit must enter their license plate at the payment machine. If found in our database, the parking fee is calculated and can be paid. Details regarding payments made via our Online Shop are provided in Part C, items 1 and 2, and under the applicable terms of use.

If the general terms of use are violated, we also process all personal data necessary for legal enforcement, particularly for collecting contractual penalties and/or asserting possessory and property rights (“enforcement”), including the personal data of the registered keeper and the driver.

If you receive a payment demand as the registered keeper of a vehicle involved in a parking violation, your license plate was previously provided to us by the relevant district administrative authority and/or state police directorate. If you are not the registered keeper, we obtained your data from the vehicle owner or another third party (such as a rental or leasing company) who identified you as the driver at the time. If you no longer live at the address recorded in the Central Vehicle Registration Register, we obtained your data from the person currently registered at that address, a credit agency, or a debt collection company.

To process bulk documents received from authorities containing registered keeper data and to split datasets, we use ConvertAPI by UAB Baltsoft, Kosciuskos 26-17, Vilnius, LT-01100, Lithuania. This tool processes PDF files and can convert them to other formats (e.g., PDF to DOCX). Personal data within these documents (usually names and addresses) is processed on the provider’s servers. All data streams are fully encrypted. ConvertAPI has committed to complying with applicable data protection standards (https://www.convertapi.com/static/docs/compliance/PP_DPA.pdf) and is ISO 27001 certified (https://www.convertapi.com/compliance).

Legal basis and purpose of processing / recipients

Processing is necessary to protect our legitimate interests in operating the parking area and managing it (Art. 6(1)(f) GDPR) and to perform contractual services under our general terms of use (Art. 6(1)(b) GDPR), such as calculating and billing fees, verifying permits, checking app/portal payments, and ensuring compliance with maximum/free parking periods and grace periods.

Keeper-related data (specifically name and address) is obtained by submitting the license plate to the relevant district administrative authority, state police directorate, or foreign vehicle registration offices (“keeper inquiry”). Driver information may be requested from the identified keeper, rental company, or leasing company and may be shared with third parties for these purposes (e.g., lawyers, debt collection agencies).

For the technical operation of parking technology/software and for enforcement, data is processed by MHP GmbH and its contractors (Peter Park System GmbH for technology/software operation and Amazon Web Services EMEA SARL for data storage). The legal basis is Art. 6(1)(b) GDPR where processing is for contract performance; otherwise, it is Art. 6(1)(f) GDPR for our legitimate interests in protecting possessory/property rights, ensuring the proper operation of parking areas, and streamlining vehicle processing.

Storage period / obligation to provide data / objection and removal options

We delete personal data once all claims related to your parking session are settled and statutory retention and limitation periods have expired. If no violation occurs and you leave within the grace period, your data is automatically deleted 48 hours after exit, unless legal retention requirements apply.

Providing your data is a contractual requirement or strictly necessary to set up your parking session. Without this data, we cannot provide our parking management services. We do not use your data for automated decision-making or profiling. Because this data collection is essential, there is no right to object. Since your license plate is captured upon entry, you may be able to turn around immediately (if the layout allows) to avoid data capture.

5. Activating parking entitlements

How we process your data

For certain parking areas, you can request parking entitlements or free parking time via terminals or online booking forms (on the MHP website or through local retailers/institutions), depending on local conditions. You will need to enter the requested information, including your license plate number. We may also ask for additional details, like an employee ID, to verify your eligibility. This data may be shared with our clients or their customers to confirm your status or cross-reference it with their own records.

Legal basis, purpose, and recipients

If we need to cross-reference your data to verify eligibility, we process it based on your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time; however, this won't affect previous processing and may mean we can no longer complete your booking.

Otherwise, we process your data based on Art. 6(1)(b) GDPR (to fulfill our contract) and Art. 6(1)(f) GDPR (to manage entitlements efficiently and support our parking services).

Storage, data provision, and your rights

We delete your data as soon as it is no longer needed. For data entered in our forms, this happens once the parking service has been fully provided and the contract is complete. Contract-related data is kept until statutory warranty periods expire, or until the end of any mandatory archiving periods.

6. Free parking for persons with disabilities

How we process your data

In some parking areas, people with disabilities can park for free in designated spaces. To use this, you must provide proof of your disability parking entitlement (e.g., the blue EU disability parking card). Depending on the site, you can document your eligibility by scanning a QR code on a sign, visiting our website, and uploading your proof through the form provided.

Legal basis and purpose

We process this data based on Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR to manage entitlements and support our parking services. Any health-related data is processed in accordance with Art. 9(2)(e) or (f) GDPR.

Storage, data provision, and your rights

We only check your proof to confirm eligibility, and it is deleted immediately after your parking session ends.

7. Using the MH Parkservice portal

How we process your data

We provide a service portal (https://service.mh-parkservice.at/) where you can submit support requests (such as questions or payment disputes), view details about parking violations—including photos and payment options—and access other customer-specific information.

The portal can be accessed via a QR code provided to users (e.g., in a payment request) via our website. After authentication, you can access the service portal. During authentication, the following personal data is provided:

• reference/file number
• license plate

For technical reasons, a limited amount of connection data is collected on each access. This is required to establish and maintain the connection and session and to prevent unauthorized access. During each login process and portal use, we (or our hosting provider) store the IP address and timestamp of the user action, internet service provider, web browser and operating system (and version), language settings, referrer URL, and the name of the accessed website.

After login, a cookie is set that is required to maintain and protect the session. You must allow this cookie in your browser to use the portal.

If resolving an issue reported via the portal or answering a question requires the involvement of other partners/service providers, we disclose the information connected with the request/incident to them.

Legal basis and purpose of processing

The legal basis for processing data in connection with the use of the portal, requests submitted via it, and downloads is Art. 6(1)(b) GDPR (performance of the contract for use of the parking facility). In addition, Art. 6(1)(f) GDPR applies because processing enables effective contact and communication with our support teams, management and resolution of requests, and secure connections between user devices and our servers.

Storage period / objection and removal options

Data is deleted once it is no longer necessary. Login data is typically deleted when the usage process ends. Personal data stored through user contact is deleted at the latest when no statutory requirements necessitate longer retention (e.g., statutory warranty periods in connection with support inquiries).

8. Invoicing

Description of processing

To create and send invoices and for documentation and accounting purposes, we use the cloud-based accounting software sevDesk provided by sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany. In this context, contact data of the invoice recipient is processed. Privacy information: https://sevdesk.de/datenschutz/

Legal basis and purpose of processing

We use sevDesk on the basis of Art. 6(1)(c) GDPR and Art. 6(1)(b) and (f) GDPR for the purposes described above to meet legal obligations, for contractual purposes, and based on our legitimate interest in efficient accounting. We have concluded a data processing agreement with sevDesk under Art. 28 GDPR.

Storage period / objection and removal options

We store your data for the duration of the contractual relationship and until the end of statutory tax retention obligations for accounting-relevant documents. If you want your personal data deleted, you can exercise your rights as described in Part A.

D. Contractual relationships with customers and business partners

I. Am I obliged to provide data?

If you contact us with questions about our services, enter into contract negotiations, accept an offer, or have other contractual arrangements with us, we process the personal data you provide in this context. The specific data processed depends on the relevant subject matter and the services you obtain or request. In this context, processing is generally strictly necessary to prepare, conclude, and perform the contract. If you do not provide this data, we may have to refuse to conclude the contract or perform the order, or we may no longer be able to perform an existing contract.

Where we use data in the context of initiating or performing a contract with a business customer, business partner, or cooperation partner, our interest lies in enabling and maintaining communication, typically in connection with a contractual or other relationship. If you act as a contact person (typically in your capacity as an employee), you generally do not have an overriding opposing interest where interaction falls within your responsibilities, so a right to object is generally excluded.

However, you are not obliged to consent to the processing of data that is not relevant to contract performance or not legally required.

II. HubSpot

Description of processing

This website uses features from the HubSpot CRM system. HubSpot is a software solution provided by HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, and offered in Europe by HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. HubSpot is an integrated platform used for various aspects of our online marketing, including email marketing, social media publishing and reporting, analytics, contact management (such as segmentation and CRM), landing pages, and contact forms.

We use HubSpot to manage and implement inbound marketing across our online presence. Information is stored on HubSpot’s servers. We use the processed data to gain detailed insights into how our website is used, to contact visitors, and to determine which of our services are of interest to them.

HubSpot uses web beacons and cookies that are embedded in our website or emails and stored on your device. This allows us to record your IP address, geographic location, browser type, duration of your visit, and the pages you access.

HubSpot also records data you enter if you (a) subscribe to our newsletter or (b) complete one of our contact forms.

For more information, visit: https://legal.hubspot.com/de/privacy-policy

Legal basis and purpose of processing

HubSpot cookies and web beacons are stored based on Art. 6(1)(a) GDPR. We use the information collected via HubSpot for our legitimate interests under Art. 6(1)(f) GDPR to optimize our marketing, analyze usage, continuously improve our online presence, and provide a more user-friendly experience with targeted information.

Objection and removal options

You can prevent cookies from being stored by adjusting your browser settings. If you would like us to delete other personal data, you can exercise your rights as described in Part A. Alternatively, you can manage your cookie preferences via CookieHub.

III. Communication

Generally, we collect necessary data directly from you during personal interactions. You may also contact us by phone, fax, mail, or via the email addresses provided (see our imprint) or the email addresses of our employees you may already have. In these cases, any personal data sent via email is stored. Please note that email communication is not encrypted for technical reasons.

Your data is used to process your inquiry and follow up on the conversation. The legal basis is Art. 6(1)(b) GDPR when the communication relates to contract performance or is required for pre-contractual measures.

In all other cases, processing is based on our legitimate interests (Art. 6(1)(f) GDPR) in efficiently handling inquiries sent to us.

We do not share this data with third parties unless it is necessary to pursue our claims or legitimate interests (Art. 6(1)(f) GDPR) or if we are legally required to do so (Art. 6(1)(c) GDPR).

IV. Data processing in the context of sales

We process personal data based on Art. 6(1)(b) GDPR to provide the services you have engaged us for, specifically to perform our contracts or pre-contractual measures, and for all activities required to operate and manage MH Parkservice.

The purposes of processing are primarily determined by the specific activities and individual services agreed upon with you. This may include consulting services, managing sales processes (such as compiling documents, sending product or event information, or providing services), or supporting sales negotiations and contract finalization.

Further details on scope, purpose, and recipients can be found in the relevant contract documents and terms and conditions.

Where required for operational processes, we process your data beyond contract performance to protect our legitimate interests (Art. 6(1)(f) GDPR).

We may be subject to specific legal obligations in connection with offering or providing our services (e.g., tax law requirements). Processing necessary for such purposes is based on Art. 6(1)(c) GDPR.

V. Newsletter

Description of processing

We like to keep our customers and prospective customers updated on our services and other products, webinars, innovations, or news from MH Parkservice via email or other electronic notifications (“Newsletter”). For this, we need your email address. We may ask for additional information in our subscription forms to help us provide content tailored to your interests.

You can sign up using a subscription form or by checking an opt-in box during registration or checkout. We offer various ways on our websites to sign up for our newsletters, which may be topic-specific. The specific content of each newsletter is detailed in its respective subscription form and is what you are consenting to.

After signing up, you will receive an email asking you to confirm your subscription (double opt-in). This step is necessary to prevent anyone else from using your email address. Your address will only be added to our newsletter list once you click the link in that email.

We use MailChimp, a service provided by the US company Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA (“MailChimp”), to manage our mailing lists and send emails. Since MailChimp’s systems are based in the USA, your subscription data is transferred to and processed there. We have signed a data processing agreement in accordance with Art. 28 GDPR, which includes EU standard contractual clauses for transfers to third countries. You can find more information here: https://mailchimp.com/legal/privacy/.

To verify your subscription, we store your email address and name, along with your IP address and the date and time of registration (timestamp).

Legal basis, purpose of processing, and recipients

The legal basis for sending our newsletter is your consent (Art. 6(1)(a) GDPR, Art. 7 GDPR) in conjunction with § 174(3) TKG 2021. Where consent is not required for existing customers under § 174(3) and (4) TKG 2021, we rely on our legitimate interest in direct marketing pursuant to Art. 6(1)(f) GDPR in conjunction with § 174(3) and (4) TKG 2021.

We log the subscription process based on our legitimate interest (Art. 6(1)(f) GDPR) in maintaining a secure, effective newsletter system and keeping a record of consents.

Storage period and how to opt out

You can opt out of the newsletter or withdraw your consent at any time. There is an unsubscribe link at the bottom of every newsletter. You are also welcome to contact us directly using the details provided at the beginning of this notice.

Unsubscribing does not affect your business communications with us. If your data is still needed for contract fulfillment, it will remain stored. We reserve the right to keep records necessary to prove that our newsletter delivery was lawful until the relevant statutory limitation periods have expired.

VI. Disclosure of data

Depending on the services involved, we may need to share your data or documents with public authorities or private service providers we work with regularly, both during the inquiry/offer stage and while fulfilling your contract (see Part A, Section V).

E. Miscellaneous

As we continue to develop our website, services, and other offerings, or as legal and regulatory requirements change, we may need to update this Privacy Notice. You can always find the current version on our website and print it out if you wish.

‍