Privacy Policy (Effective as of 03/30/2026)

‍

This privacy policy provides an overview of how your personal data (hereinafter referred to as “data”) is handled by our company. It also informs you about your rights under the European General Data Protection Regulation (“GDPR”), the German Federal Data Protection Act (“BDSG”), and the German Telecommunications-Digital Services Data Protection Act (“TDDDG”). Please take a moment to read through this policy and feel free to print or save it for your records.

Personal data includes any information that can be used to identify you personally. Your data may be processed for various purposes. In essence, the data processing activities carried out by Mobility Hub Parkservice GmbH (hereinafter referred to as “MH Parkservice” or “we”) can be categorized as follows:

• General: General information regarding data protection, processing activities, and the rights of data subjects, which applies to all our data processing, can be found in Part A.
• Our websites: In connection with our website https://www.mh-parkservice.de/ (hereinafter: “website”) or related external online platforms, such as our social media profiles, our service portal (https://service.mh-parkservice.de/), or our post-payment service (https://parken.mh-parkservice.de/), which link to this privacy policy (the website and external online platforms are collectively referred to as “online platforms”), we process data exchanged between your internet-enabled devices and our servers, as well as data provided to us while using the website. For details, please see Part B.
• Parking users: For information on how we process data from users of parking facilities we manage—for example, during payment transactions via the MHP Online Shop or our post-payment service, the processing of parking violations by MH Parkservice, or viewing parking violation details via our service portal—please visit Part C.
• B2B: We process the necessary data of our business clients and prospective customers for the purpose of initiating or fulfilling contracts. Data from our business partners and suppliers is used exclusively for direct order placement, processing, and fulfillment. You can find more information on this in Part D.

Please visit the individual sections if you would like quick, context-specific information regarding certain processing situations.

‍

A. General information on data protection and data subject rights

I. Who is responsible for data processing, and who can you contact with questions?

The controller responsible for compliance with the General Data Protection Regulation, other national data protection laws of the member states, and other data protection provisions is:

Mobility Hub Parkservice GmbH

Nördliche Münchner Straße 27a

82031 Grünwald

Tel.: +49 89 2778299 51

Email: info@mh-parkservice.de

‍

If you have any questions regarding data protection, please feel free to contact our Data Protection Officer using the following details:

Richard Metz

External Data Protection Officer (TÜV certified)/Attorney

LLP Data Protect GmbH

Würmtalstraße 20a (Mailing address)

81375 Munich

Email: datenschutz@mh-parkservice.de 

II. What are your rights regarding your personal data?

If your personal data is being processed, you are a "data subject" as defined by the GDPR, which means you may have the rights described below. If you wish to exercise your rights against MH Parkservice as the controller, we recommend that you send your request to our contact details provided above:

1. Right of access

In accordance with Art. 15 GDPR, you can ask us to confirm whether we are processing your personal data and request information about the extent to which we are processing your data.

2. Right to rectification

If your personal data is incorrect or incomplete, you have the right to have it corrected and/or completed in accordance with Art. 16 GDPR.

3. Right to erasure

Subject to the legal requirements of Art. 17 GDPR, you can request that we delete your data if we are processing it unlawfully or if the processing disproportionately interferes with your legitimate interests. Please note that there may be reasons that prevent immediate deletion, such as statutory retention obligations.

Regardless of whether you exercise your right to erasure, we will delete your data completely and immediately once the purpose of processing has been fulfilled, provided there are no legal or contractual retention periods to the contrary.

4. Right to restriction of processing

You can request that we restrict the processing of your data in the cases specified in Art. 18 GDPR. If you have restricted the processing of your personal data, this data may—apart from its storage—only be processed with your consent, for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

5. Right to data portability

Under Art. 20 GDPR, you have the right to receive the data you provided to us—which we process automatically based on your consent or in fulfillment of a contract—in a common, machine-readable format, or to have it transferred to a third party. If you request the direct transfer of data to another controller, this will only be done if it is technically feasible. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

6. Right to object

If we process your data based on a legitimate interest as defined in Art. 6(1)(f) GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions (see Art. 21 GDPR). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is for the establishment, exercise, or defense of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes. You can object to the processing of your data for direct marketing purposes at any time without providing a reason.

7. Right to withdraw consent under data protection law

Some data processing operations are only possible with your explicit consent in accordance with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with future effect. However, the lawfulness of any data processing carried out before your withdrawal remains unaffected. Please note that even after you withdraw your consent, we may still be permitted to process the affected data, in whole or in part, based on other legal grounds.

8. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR (Art. 77 GDPR in conjunction with Section 19 BDSG). A list of data protection officers and their contact details can be found at the following link: www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

If you believe that we have violated German or European data protection law while processing your data, please contact us so that we can clarify any questions you may have.

You also have the right to contact the supervisory authority responsible for our company headquarters:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach; Fax: +49 (0) 981 180093-800; Email: poststelle@lda.bayern.de; www.lda.bayern.de

‍

III. Which personal data is processed and where does it come from?

1. Origin of personal data

We primarily process data that we receive directly from the individuals concerned when they use our website during the initiation or course of a business relationship (see also Part B Section VI).

Through our website and services, we process data that we receive during your visit or that you actively provide to us (e.g., when using our online shop). Other data is collected automatically by our IT systems when you visit the website or use one of our services. This primarily includes technical data (e.g., internet browser, operating system, or the time a page was accessed). This data is collected automatically as soon as you enter our website or access one of our services. You can find details on this in Part B.

In individual cases, we also process data that we have lawfully received or acquired from other third parties, such as credit agencies, creditor protection associations, or authorities, or that we have lawfully obtained or acquired from publicly accessible sources (e.g., telephone directories, company registers, the press, the internet, or other media).

2. Categories of personal data

The personal data we regularly process includes master/contact data such as: title, first and last name, form of address, date of birth, address, email address, telephone number, fax, and job title.

In addition, depending on the order, service, or other relationship with you, we process the following personal data:

• Address data: street, house number, address supplements if applicable, postal code, city, country
• Contact details: telephone number(s), email address(es)
• Vehicle data: license plate number, vehicle owner
• Parking management data: photographs, date and duration of parking space usage, parking permits, bank details, payment information
• Registration data: information about the service you registered for; timestamps and technical information regarding registration, confirmation, and cancellation; data provided by you during registration
• Offer data
• Access data: date and time of your visit to our service; the page from which the accessing system reached our site; pages visited during use; session ID data; as well as the following information from the accessing computer system: IP address, browser type and version, device type, operating system, and similar technical information.
• Information about the nature and content of our business relationship, such as contract data, order data, sales and receipt data, customer and supplier history, and consultation documents
• Marketing and sales data,
• Documentation data (e.g., consultation records, data from service calls or support cases)
• other data we have received from you in the course of our business relationship (e.g., in customer meetings),
• documentation of consent declarations

‍

IV. For what purposes and on what legal basis is the data processed?

We process your data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) in their current versions, particularly on the following grounds:

1. Fulfillment of (pre-)contractual obligations (Art. 6 (1) (b) GDPR)

Personal data is processed in accordance with Art. 6(1)(b) GDPR to fulfill contractual obligations of MH Parkservice specifically in connection with the sale and distribution of our goods and services (hereinafter also referred to as "parking services") as well as all activities typically required for the operation or administration of MH Parkservice (e.g., customer and user management). Data may also be processed at the pre-contractual stage as part of business initiation with MH Parkservice, or during the execution of other contractual relationships with MH Parkservice .

Art. 6(1)(b) GDPR serves as the legal basis in the following cases, for example:

• Setting up and maintaining a partner or supplier account in our CRM system
• Setting up and maintaining customer/prospect files or our customer/prospect database in our CRM system
• Sending information
• Offering and selling MH Parkservice products
• Offering and providing our services

Details regarding the purpose of this data processing can be found in the respective contract documents and terms and conditions.

2. Protection of legitimate interests (Art. 6(1)(f) GDPR)

Based on a balancing of interests, data processing may occur beyond the actual fulfillment of a contract to protect the legitimate interests of MH Parkservice or third parties. This is permitted provided that your interests or fundamental rights and freedoms, which require the protection of personal data, do not override them. Data processing to protect legitimate interests occurs, for example, in the following cases:

• Providing the online offering, its functions, and content
• Use of technically necessary cookies or comparable technologies within the meaning of Section 25(2) TDDDG
• Responding to contact inquiries and communicating with users
• Transmitting data to our affiliated companies and partners
• Processing payments via external service providers
• Using collection agencies and lawyers to collect and/or judicially enforce claims
• Asserting other legal claims and defense in legal disputes
• Advertising or marketing
• Market and opinion surveys
• Measures for business management and further development of our services
• Maintaining databases of customers/prospects or service providers to improve our offering
• Conducting risk assessments (due diligence) in the context of potential corporate restructuring or the purchase or sale of a company
• Ensuring IT security and the IT operation of our company and our services
• Measures for building and facility security

3. Fulfillment of legal obligations (Art. 6(1)(c) GDPR)

Processing of your data may be necessary for the purpose of fulfilling various legal obligations and requirements to which we are subject, e.g., under the German Commercial Code (HGB) or the Fiscal Code (AO).

4. Consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG):

If a service we use stores information on the user's terminal device or accesses such information in any way, consent is required under Section 25(1) sentence 1 TDDDG. If the service functions without any access to the terminal device, the GDPR applies. If we request your consent within the scope of the GDPR, this is done on the basis of Art. 6(1)(a) in conjunction with Art. 7 GDPR.

If you have given us your consent to process your data in individual cases, processing will take place in accordance with the purposes and to the extent specified in the declaration of consent. Consent once given, e.g., for sending a newsletter, can be revoked at any time with effect for the future. Please contact us using the contact details provided in Section A. Item I or Item II. Please note that processing that took place before the revocation is not affected by the revocation, and under certain circumstances, data processing may continue to be possible, at least in part, on the basis of another legal foundation.

V. Who receives my data?

At MH Parkservice , those employees or organizational units receive your data that need it to fulfill our contractual and legal obligations or to process or pursue our legitimate interests.

For the initiation or execution of a contractual relationship (e.g., sale or provision of parking services) pursuant to Art. 6(1) sentence 1(b) GDPR or – depending on the nature of the specific contractual relationship – as well as on the basis of our legitimate interests pursuant to Art. 6(1) sentence 1(f) GDPR, your data will be forwarded in particular to companies that we regularly use in connection with the provision of our services or for contract processing. This concerns the following recipients or categories of recipients:

• IT service providers (e.g., email service providers, web hosting companies)
  
  • Amazon Web Services, Inc., 410 Terry Avenue North
    Seattle WA 98109, USA (Cloud storage provider)
  • Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (Optimization of app functions)
  • Airparser, Sepapaja tn 6, Tallinn 11415, Estonia (Document management software provider)
  • Celonis SE, Theresienstr. 6 80333 Munich (Integration platform provider)
  • Datadog Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (System security, monitoring)
  • Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114 USA (AI platform operator and provider of an AI chat function)
  • Deutsche Post Adress GmbH & Co. KG, Am Anger 33, 33332 (Address verification).
  • Freshworks, Inc., 2950 S. Delaware Street, Suite 201 in San Mateo, CA 94403 USA (Ticket system provider)
  • Google Ireland Limited, Gordon House, Barrow Street
    Dublin 4, Ireland
  • Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (Email service provider)
  • HubSpot Inc. 25 First Street, 2nd Floor, Cambridge, MA 02141 USA (CRM system provider)
  • LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam (Proofreading service provider)
  • Leaping AI UG (limited liability), Potsdamer Straße 72, 10785 Berlin (Provider of AI-supported call center software)
  • Octa Inc., 100 First Street, Floor 6, San Francisco, CA 94105, USA (Provider of Auth0 for system security)
  • OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (AI model provider)
  • Peter Park System GmbH, Balanstr. 71a, 81541 Munich, Germany (Provision of IT systems as managed services and parking space management systems)
  • sevDesk GmbH, Hauptstraße 115, 77652 Offenburg (Accounting software provider)
  • Talkdesk Inc. 201 Spear Street, Suite 1100, San Francisco, CA 94105 USA (Contact center software provider)
  • Trustpilot A/S, Pilestraede 58, 5th floor, DK-1112 Copenhagen, Denmark (Review platform provider)
  • Webflow, Inc., 398 11th Street, San Francisco, CA 94103, United States (Web hosting service provider for the website)
  • Weglot, SAS, 138, rue Pierre Joigneaux in Bois-Colombes 92270 France (Translation service provider)
• Sales partners
• Advertising partners
• Insurances
• Banks
• Communication providers (telephone providers, fax providers)
• Payment service providers
  
  • Adyen N.V. Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands
  • Stripe Deutschland GmbH, Prielmayerstr. 3, 80335 Munich
  • secuPay AG, Goethestraße 6, 01896 Pulsnitz
• Shipping and logistics service providers
• Credit agencies
• Auditors
• Tax and legal advisors

If we use a service provider for data processing on our behalf pursuant to Art. 28 GDPR, we remain responsible for the protection of your data. As required by law, processors are contractually obligated via a data processing agreement to treat your data confidentially and to process it only within the scope of providing the service. The processors commissioned by us receive your data if they need the data to fulfill their respective services.

A transfer of your data to state institutions and authorities or the collection of such data for this purpose only occurs within the framework of mandatory national legal provisions or if you instruct us to do so.

‍

VI. How long will my data be stored?

Your personal data will only be used for the purpose for which you provided it or for which you have consented to its processing, and will only be stored until that purpose has been fulfilled. Once the purpose is fully achieved or you have requested the deletion of your data, your information will only be retained for as long as required by statutory limitation or retention periods (particularly those related to tax and commercial law). Your data will be deleted once these periods expire, unless you have explicitly consented to further or different use. You may exercise your rights, such as requesting the restriction of your data, even during these retention periods. Please refer to Section A. Item II.

We will delete or restrict your data as soon as the purpose for storage no longer applies or you request its deletion.

In general, we process and store your data only until the end of our business relationship or until the expiration of applicable warranty, guarantee, or limitation periods. For example, the limitation period under Sections 195 et seq. of the German Civil Code (BGB) is generally three years, though in certain cases it can be up to thirty years. Furthermore, it may be necessary to retain data until the final resolution of any legal disputes in which the data is required as evidence.

We are also subject to statutory documentation and retention requirements (such as those from the German Commercial Code (e.g., Section 257 HGB), the Money Laundering Act, or the Fiscal Code (e.g., Section 147 AO)). The retention and documentation periods specified therein range from two to ten years. For instance, we may need to store your data after the termination of a contract with you until the conclusion of the tax audit for the last calendar year in which you were our customer.

‍

VII. Is personal data transferred to a third country?

As part of our processing operations, personal data may be transferred to entities in so-called third countries outside the EU or the EEA that have not yet been certified by the European Commission as having an adequate level of data protection, such as the USA. If such a data transfer becomes necessary in an individual case, it will only take place on the basis of an adequacy decision by the European Commission, standard contractual clauses, appropriate safeguards for data protection compliance, or your explicit consent.

‍

B. Use of our websites

In principle, you can visit and use our websites for informational purposes without having to provide any personal information (e.g., registering, placing orders, or otherwise submitting personal details). In such cases, we only process personal data of our users to the extent necessary to provide a functional website and our content and services, or if cookies or similar technologies used on the website transmit personal information to us when you visit. Information about our own cookies or similar technologies can be found in Section B Item II. Other cookies or similar technologies may allow us, and potentially our partner companies or third parties, to recognize your browser on your next visit. Please refer to Section B Item III for information on such third-party cookies or similar technologies.

The processing of our users' personal data generally occurs only after the user has given their consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the processing of the data is permitted by legal regulations.

I. Provision of the website and creation of log files

Description of data processing

Every time you access our website, our system automatically collects data and information from the computer system of the accessing device, which your internet browser automatically transmits to us or our web host (so-called log files). These server log files contain IP addresses or other data that allow for identification of a user. This could occur, for example, if the link to the website from which the user arrives at our site, or the link to the website the user navigates to, contains personal data. The following information is collected and stored by our hosting provider:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer, time of the server request
• IP address

The data is stored in our web host's log files. This data is not stored together with other personal data of the user.

We use Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (www.webflow.com) (hereinafter: "Webflow") as our web host and software provider for the creation, provision, and operation of our website, online forms, and other web elements. Information on data protection at Webflow can be found at https://webflow.com/legal/eu-privacy-policy. We have concluded a data processing agreement with Webflow in accordance with Art. 28 GDPR ("Data Processing Addendum," see https://webflow.com/legal/dpa). As part of the aforementioned services provided by Webflow, data may be transferred to the USA based on standard contractual clauses that Webflow has agreed upon with us in its Data Processing Addendum, or via an equivalent data protection guarantee within the scope of commissioned processing.

‍

Legal basis and purpose of data processing

The legal basis for the temporary storage of data and log files is Art. 6(1)(f) GDPR. The aforementioned information is also necessary for the provision of the service pursuant to Section 25(2) No. 2 TDDDG.

The system needs to temporarily store your IP address to deliver the website to your computer. For this to work, your IP address must be stored for the duration of your session.

We store data in log files to ensure the website functions correctly. We also use this data to optimize our site and keep our IT systems secure.

Retention period / Right to object and erasure

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. When it comes to providing the website, this happens once your session ends.

If data is stored in log files, it is deleted after no more than 7 days.

Collecting this data to provide the website and storing it in log files is essential for the site to operate. Consequently, users cannot opt out of this.

‍

II. Use of cookies and similar technologies

Description of data processing

Our website uses cookies and similar technologies (e.g., web beacons, local storage) to collect, process, and use usage data (e.g., access times, pages visited) or meta and communication data (IP address, device information), including personal data. For simplicity, we refer to all these technical methods as "cookies" from here on.

Cookies are text files containing a unique string of characters that are stored on your computer by your internet browser. They allow your browser to be uniquely identified when you return to our site. When you visit a website, a cookie may be saved to your operating system. This cookie contains a specific string of characters. These cookies help make our website more user-friendly, effective, and secure. When you visit a site that uses cookies, the data you enter is stored exclusively in the cookie on your computer. In this case, data is only transmitted to our servers when you request a page.

Some cookies are deleted after your browser session ends and you close your browser (these are called session cookies). These are technically necessary, for example, to allow you to log in and stay logged in as you move between pages on our site.

Other cookies remain on your device for a set period, allowing us to recognize your browser the next time you visit (these are called persistent or log cookies). These cookies help us provide a better user experience, "recognize" you, and offer you a more varied and fresh experience each time you return.

Cookies from partners or third parties may be used to collect information for advertising, personalized content, or statistics ("third-party cookies"). Unless we identify a cookie as coming from a third party, it is a "first-party cookie" from our own site. We provide separate information about the third-party cookies or tracking technologies we use in the following sections of this privacy policy.

Flash cookies are data elements stored on your computer by websites that use Adobe Flash. Flash cookies have no expiration date.

For more information on the cookies and similar technologies we use to build our website, their purpose, and what data is stored or shared with third parties, please check our Cookie management tool “CookieHub” provided by CookieHub ehf, Hafnargata 18, 230 Reykjanesbær, Iceland. You can use this tool to give your consent to the use of cookies and similar technologies based on your preferences when you visit our site.

Our cookie management tool collects log file and consent data using JavaScript. This JavaScript allows us to inform you about specific tags on our website, and to obtain, manage, and document your consent. The tool saves the settings and consent you provided when entering the site and processes the following data:

• Consent data (anonymized log data: Consent ID, Processor ID, Controller ID, consent status, timestamp)
• Device data (including truncated IP addresses (IPv4, IPv6), device information, timestamp)
• User data (including email, ID, browser information, setting IDs, changelog)

To do this, the cookie management tool stores a technically necessary cookie. You can find information about CookieHub's data protection practices here: https://www.cookiehub.com/legal/privacy-policy

For more details on the cookies we use, their purpose, and what data is stored or shared with third parties, please see the detailed information provided by CookieHub, which you can access under “More options” or “Cookie declaration”. CookieHub automatically analyzes which cookies are set on the site. The list of technologies used and the cookie declaration are then updated automatically.

Legal basis and purpose of data processing

The legal basis for processing personal data using cookies and similar technologies is Art. 6(1)(f) GDPR, which allows us to pursue our legitimate interests in ensuring the best possible functionality and security of our website, as well as providing a user-friendly and effective browsing experience, provided we are not asking for your consent under Art. 6(1)(a) GDPR.

The legal basis for storing and accessing other information is Section 25(1) TDDDG for cookies and similar technologies that require consent, and Section 25(2) no. 2 TDDDG for cookies that are strictly necessary for the website to function.

We use CookieHub to manage consent. This makes it easier for users to provide or manage their consent for the various categories of cookies and similar technologies we use. CookieHub blocks all categories of cookies that are not essential for the proper functioning of the website unless you provide your consent for the use of additional tools. When you visit our website, you will see the following interface:

• By clicking the "Accept all" button, you can either allow all processes or make individual choices by clicking "More options" (by toggling the individual switches and clicking the final "Save settings" button) to specify which cookies and/or cookie-based applications and subsequent data processing you consent to.
• Alternatively, you can reject all non-essential cookies by clicking the "Only essential cookies" button and use the website with only those cookies required for its operation.

The purpose of using technically necessary cookies is to simplify or improve the user experience on our website, which is required for providing our service under Section 25(2) no. 2 TDDDG. Some features of our website cannot be offered without the use of such cookies. In particular, these features require the browser to recognize the user even after navigating to a different page.

Otherwise, the purpose of the cookies we use in the "Analytical Cookies," "Marketing Cookies," and "Necessary Cookies" categories depends on the specific services used and the subsequent data processing, which is explained in more detail in the following sections of this privacy policy and within CookieHub.

The legal basis for data processed via our cookie management tool is Art. 6(1)(c) GDPR regarding user consent data, and otherwise Art. 6(1)(f) GDPR or Section 25(2) no. 2 TDDDG. As a website operator, we have a legitimate interest in providing legally compliant, user-specific, and user-friendly cookie consent management, as well as ensuring our website is designed in a legally compliant manner.

Storage duration / Right to object and removal

For details on how long our cookies are stored, please refer to the information in CookieHub under the "Cookie Declaration" section.

Cookies are stored on the user's device and transmitted to our website. As a user, you therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing your internet browser settings. Cookies that have already been saved can be deleted at any time. This can also be done automatically.

If cookies are disabled for our website, it is possible that not all functions of the website will be fully available.

Alternatively, you can use the features of our integrated cookie consent tool to withdraw your consent at any time or change your preferences by clicking the "Cookie settings" button (located in the bottom left corner of our website) to access and adjust your settings.

‍

III. Statistical analysis of the website / Increasing reach

1. Google Analytics

Description of data processing

For our online services, we use features of the web analytics service Google Analytics. The provider in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), a subsidiary of Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics also uses cookies. The information generated by a Google cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. Google processes the data, and we receive reports about your user behavior. These reports may include, among others:

• Audience reports: Audience reports help us get to know our users better and understand exactly who is interested in our service.
• Behavior reports: These show us how you interact with our website. We can track the path you take on our site and which links you click.
• Real-time reports: These let us see immediately what is happening on our website at any given moment. For example, we can see how many users are currently reading this text.

Google Analytics uses a tracking code to create a random, unique ID associated with your browser cookie. This is how Google Analytics recognizes you as a new user. The next time you visit our site, you will be recognized as a "returning" user. All collected data is stored along with this user ID, which is what makes it possible to evaluate pseudonymous user profiles.

Your interactions on our website are measured using identifiers such as cookies. Interactions are any type of action you perform on our website. If you also use other Google systems (such as a Google account), data generated via Google Analytics can be linked to third-party cookies. Google does not share Google Analytics data unless we, as the website operator, authorize it. Exceptions may occur if required by law. You can find the cookies used by Google Analytics in the detailed information provided by our cookie management tool, CookieHub, which you can access under "Cookie Declarations."

Our website uses Google Analytics exclusively with the "anonymizeIp()" extension. This means your IP address is not stored in full; it is truncated by Google within member states of the European Union or other contracting states to the Agreement on the European Economic Area before being transmitted to the USA. Identifying website visitors is therefore excluded. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Below, we provide an overview of the most important data collected by Google Analytics:

• Heatmaps: Google creates so-called heatmaps. Heatmaps show exactly which areas you click on, giving us information about where you are "moving" on our site.
• Session duration: Google defines session duration as the time you spend on our site without leaving. If you are inactive for 20 minutes, the session ends automatically.
• Bounce rate: A bounce occurs when you view only one page on our website and then leave.
• Account creation: If you create an account or place an order on our website, Google Analytics collects this data.
• Location: Your country and approximate location can be determined via your IP address. This process is also known as IP geolocation.
• Technical information: Technical information includes, among other things, your browser type, your internet service provider, or your screen resolution.
• Source of origin: Google Analytics—and we ourselves—are naturally interested in which website or advertisement led you to our site.

This list is not exhaustive and serves only as a general guide to data storage by Google Analytics. For more information on how Google processes data, please read Google's privacy policy: https://policies.google.com/privacy?hl=en

Legal basis and purpose of data processing

We use Google Analytics to evaluate the use of our website and services, to compile reports on activities on our website and services, and to provide us with other services related to the use of our website, services, and internet usage. We also use Google Analytics to evaluate data from AdWords and the DoubleClick cookie for statistical purposes. Since we, as the website and service operator, have a strong interest in analyzing user behavior to optimize both our website and the offers and advertising placed there, we ask for your consent to use Google Analytics and store Google Analytics cookies based on Section 25 (2) of the TDDDG.

The information generated by the cookie about your use of our website or services is generally transmitted to a Google server in the USA and stored there. If IP anonymization is activated, however, your IP address will be truncated by Google beforehand within member states of the European Union or other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. By consenting to the use of cookies by Google Analytics, you also agree, in accordance with Art. 49 (1) sentence 1 lit. a GDPR, that your data may be processed in the USA, provided the data transfer is not secured on the basis of EU standard contractual clauses. The USA is considered by the European Court of Justice to be a country with an inadequate level of data protection according to EU standards. In particular, there is a risk that your data may be processed by US authorities for control and surveillance purposes, possibly without the possibility of legal recourse. If you click the "Reject All" button or make a limited selection without Google cookies, the described transmission to Google will not take place. You can revoke your consent at any time with effect for the future.

Google will use this information to evaluate your use of the website or services, to compile reports on website activity for us, and to provide other services related to website and internet usage. According to its own statements, Google may also transfer this information to third parties where required by law or where third parties process this data on Google's behalf. Google has contractually guaranteed that it will not associate your IP address with any other data held by Google. To secure this, as well as the data processing performed on our behalf, we have concluded a data processing agreement with Google.

Storage duration / Right to object and removal

Cookies are stored on the user's computer and transmitted to our site. As a user, you therefore have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.

By installing the browser add-on to deactivate Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=en), you can object to the use of your data and its collection by Google Analytics. This informs Google Analytics that no information about your website visit should be transmitted to Google Analytics.

Furthermore, especially for browsers on mobile devices, you can install an opt-out cookie via this link https://developers.google.com/analytics/devguides/collection/gajs/?hl=en#disable on your device to prevent future data collection by Google Analytics on our website. Please note that if you delete the cookies on your device, you will need to reinstall the opt-out cookie.

Alternatively, you can also set your cookie preferences via the Cookie Hub tool we have integrated.

‍

2. Google Tag Manager

Description of data processing

Google Tag Manager is a solution from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), which allows marketers to manage website tags via an interface. Google Tag Manager itself (which implements the tags) is a cookie-free domain and does not collect any personal data. Google Tag Manager helps with the integration and triggering of other tags, code snippets, tracking codes, and conversion pixels on a website, which may in turn collect data. Google Tag Manager does not access this data. Google Tag Manager provides us with an easy-to-use user interface that does not require in-depth programming knowledge or modifications to the website's source code.

We use Google Tag Manager solely to display Google Ads (formerly Google AdWords) for our search engine marketing activities.

For more information on Google Tag Manager, see: https://www.google.com/intl/en/tagmanager/use-policy.html.

‍

3. Google Ads (formerly Google AdWords) & Google Ads Conversion Tracking

Description of data processing

We use Google Ads, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and in Europe by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, to display advertisements within our online services and to draw attention to our attractive offers using advertising materials on external websites.

This allows us to determine how successful individual advertising measures are. These ads are delivered by Google via so-called "ad servers." Google AdWords uses cookies for this purpose (see the general information above). Placing these cookies enables an analysis of how our websites are used. Each time you access one of the individual pages of our website that we operate and on which a Google Ads component has been integrated, the internet browser on your IT system is automatically prompted by the respective Google Ads component to transmit data to Google for the purpose of online advertising and commission billing. As part of this technical process, Google receives personal data, such as your IP address, which Google uses, among other things, to track the origin of visitors and clicks and subsequently to enable commission settlements. The cookies used typically store the following information as analysis values: unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions), and opt-out information (indicating that the user no longer wishes to be targeted). These cookies allow Google to recognize your web browser. If you do not agree to cookies being stored on your computer, please follow the general instructions for this or see the end of this explanation.

In addition, Google Ads uses so-called web beacons (invisible graphics). These web beacons allow information such as visitor traffic on the pages of this service to be evaluated.

The information generated by cookies and web beacons about your use of our website, including your IP address and the delivery of ad formats, is transmitted to a Google server in the USA and stored there. This information may be passed on by Google to its contractual partners (see https://support.google.com/admanager/answer/94149?visit_id=637060482444635472-69980806&rd=1). We have no influence over the data collected by Google, nor are we aware of the full extent of the data collection or the storage duration. To our knowledge, however, Google will not merge your IP address with other data stored about you. If you are logged into a Google account, your data may be directly associated with it. If you do not want this association with your Google profile, please log out before using our online services.

Further information on data protection at Google Ads can be found at https://policies.google.com/privacy?hl=en, as well as https://policies.google.com/technologies/ads?hl=en

Legal basis and purpose of data processing

Google Ads cookies and web beacons are stored on the basis of Art. 6(1)(a) GDPR. Furthermore, we use Google Ads based on our legitimate interest under Art. 6(1)(f) GDPR. As a website operator, we have a legitimate interest in analyzing the reach of our services, displaying relevant and interesting ads, improving campaign performance reports, and achieving fair calculation of advertising costs.

We have also entered into a data processing agreement with Google.

Right to object and removal

You can prevent the installation of Google Ads cookies in several ways: a) by adjusting your browser settings accordingly; in particular, blocking third-party cookies will ensure you do not receive ads from third-party providers; b) by deactivating interest-based ads on Google via the link www.google.de/ads/preferences, though this setting will be deleted if you clear your cookies; c) by deactivating interest-based ads from providers that are part of the "About Ads" self-regulatory campaign via the link www.aboutads.info/choices, though this setting will be deleted if you clear your cookies; d) by permanently deactivating them in your Firefox, Internet Explorer, or Google Chrome browser via the link www.google.com/settings/ads/plugin. Please note that if you do this, you may not be able to use all the features of our online services to their full extent.

Alternatively, you can also set your cookie preferences using the CookieHub cookie management tool we have integrated.

‍

4. Amplitude

Description of data processing

To optimize our online shop and our mobile payment app, we use the web analytics software Amplitude, a service provided by Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA ("Amplitude"). This process is used to evaluate and analyze user behavior and to compile reports on activities for us. Data is captured in near real-time as soon as the user performs a specific action (e.g., clicking a button, loading a page, or completing a purchase). The following data categories are affected:

• Usage data: clicks, pages visited, time spent, feature usage.
• Device data: operating system, browser type, device type, screen resolution.
• Identifiers: pseudonymized user IDs, Amplitude-internal IDs, IP address. A truncated IP address is processed for this purpose.

Cookies are also stored on your computer for this purpose.

The information generated in this way is transmitted to an Amplitude server in the USA and stored there. We have entered into a Data Processing Addendum with Amplitude, which includes the EU Standard Contractual Clauses as a mechanism for transferring personal data from the EU to the USA. Amplitude is certified under the EU-US Data Privacy Framework, which sets minimum standards for the protection of personal data of Europeans whose data is stored or processed in the USA.

Further information on how Amplitude processes data can also be found in Amplitude's privacy policy (https://amplitude.com/privacy).

Legal basis and purpose of data processing

We use Amplitude to evaluate the use of our services, to compile reports on activities on the relevant services, and to better understand how our services are used. This helps us identify opportunities for improvement and optimize our site performance and features. As we have a strong interest as a service provider in analyzing user behavior for the purpose of product improvement, we ask for your consent to use Amplitude and store cookies based on Section 25 (2) of the TDDDG.

Storage duration / Right to object and removal

If you do not want cookies to be stored, please adjust your internet browser settings to delete cookies, block all or specific cookies, or provide a warning before cookies are saved. You can also set your cookie preferences using our integrated CookieHub management tool.

‍

IV. Further information on procedures, plugins, and tools used for website design

1. SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser's address line changes from “http://” to “https://” and by the lock symbol in your browser bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

‍

2. make.com

Description of data processing

To integrate various databases and web tools, we use make, a service provided by Celonis SE, Theresienstr. 6, 80333 Munich. make is a platform where different cloud-based software applications can be linked together. Data required or processed in such linked applications is automatically transferred via these connections. The goal is to allow digital processes to run independently, especially standardized, recurring processes. This creates an automated data flow and efficient workflows.

Further information on data protection at Celonis can be found at https://www.make.com/en/privacy-notice and https://www.celonis.com/de/privacy-notice/

Legal basis and purpose of data processing

The use of make.com is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in the efficient automation of processes, the integration of various services, and the associated import and export of personal and contact data.

‍

3. Language versions of the websites (translations with Weglot)

Description of data processing

We use the translation service Weglot, provided by Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France, on our website. Weglot is loaded when the website is accessed and allows you to change the website's language using the corresponding language icons. By integrating the Weglot translation service, a connection is established between your browser and Weglot's servers when you visit our website, and your IP address and device information are transmitted to Weglot. The transmitted data is necessary for Weglot to function.

Data processed in connection with the use of Weglot is handled by Weglot as a data processor within the European Union, based on a data processing agreement in accordance with Art. 28 GDPR.

Information on how Weglot handles personal data can be found at https://www.weglot.com/privacy.

Legal basis and purpose of data processing

The legal basis for data processing in connection with Weglot is our legitimate interest under Art. 6(1)(f) GDPR in providing our website in multiple languages, including a selection option for website visitors, provided that we have not requested any further consent under Art. 7 GDPR or Section 25 TDDDG.

Right to object and removal

The use of the Weglot service is strictly necessary to provide the website in different language versions.

If you would like your personal data to be deleted, you can exercise your right to object and removal as described in the general information in Part A.

‍

4. Integration of YouTube content

Description of data processing

From time to time, we use content or services from the video platform YouTube to embed video content on our website via a plugin or to link to videos on our YouTube channel. YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, and is provided in Europe by Google Ireland Limited,
Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").

We may process data you enter on our YouTube channel (specifically your username and content published under your account) if we respond to your posts or messages via our YouTube channel.

Otherwise, we only receive certain non-personal information from Google regarding post activity, such as the number of profile or media clicks and the watch time for a specific video. This data can be viewed via our YouTube account. Beyond this, data processing is carried out by Google under its own responsibility; we have no way to prevent or disable the use of analysis tools and similar features by Google within YouTube.

If you wish to play embedded videos using this plugin (by clicking the play button), your IP address will be sent to YouTube, as YouTube cannot send the video content to your browser without it. The IP address is therefore required for display. Furthermore, information about which subpage of our website you visited is transmitted to the YouTube server. If you are logged into your YouTube account as a member, you allow YouTube to associate your usage behavior directly with your personal profile when you play our videos. Further information on data processing by Google when using YouTube can be found in the privacy policy applicable to YouTube: https://policies.google.com/privacy?hl=en&gl=en

Legal basis and purpose of data processing

YouTube is used on the basis of our legitimate interests under Art. 6(1)(f) GDPR to provide or link to video content on our website and to process inquiries or comments.

Storage duration / Right to object and removal

To prevent your activity from being associated with your user account, log out of your YouTube profile before playing our video content. You must inform yourself about ways to restrict the processing of your data by Google via Google or within your YouTube user account. For example, you can do this in the general settings of your Google account under "Privacy and personalization." Additionally, on mobile devices (smartphones, tablets), you can restrict Google's access to contact and calendar data, photos, location data, etc., in the device settings. However, this depends on the operating system you are using.

‍

5. Auth0

Description of data processing

For registration and login in our online shop, we use the cloud-based identity management platform Auth0, provided by Okta Inc., 10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA.

When users enter data into a form provided by Auth0, this information is exchanged directly between the user's browser and Auth0. The following data is processed for identity management, authentication (login/registration), and user account security:

• Account data: Email address, name, and profile picture (if using social login).
• Security data: Password hashes, two-factor authentication (MFA) data, and session tokens.
• Metadata: Login IP address, timestamps, and browser/device used (for fraud detection).

Data is collected exclusively during the login or registration process, as well as whenever a session is refreshed.

For more information on how Auth0 processes data, please visit https://www.okta.com/legal/privacy-policy/.

We have selected Europe as the server location for data storage. In cases where data transfer to the USA may be necessary, we rely on EU Standard Contractual Clauses, which we have implemented alongside a data processing agreement.

Legal basis and purpose of data processing

We integrate Auth0 based on our legitimate interest under Art. 6(1)(f) GDPR to ensure that only authorized and identified individuals can access our services. Furthermore, Auth0 is required for providing the service as part of user account access under Section 25(2) No. 2 TDDDG.

Storage duration / Right to object and erasure

If you do not wish for cookies to be stored, please adjust your browser settings to delete cookies, block all or specific cookies, or provide a warning before cookies are saved. You can also manage your cookie preferences using our integrated CookieHub tool.

‍

6. Datadog

Description of data processing

We use DataDog, a service provided by DataDog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (“DataDog”), as a data processor in accordance with Art. 4 No. 8 and Art. 28 GDPR.

We use DataDog to monitor system stability and perform error analysis (such as unexpected deviations, anomalies, latency—i.e., the time delay in data transmission to our servers—availability, and response times) for our websites and services, as well as for IT security purposes.

For this purpose, DataDog collects the following data on our behalf:

• Log data: Technical logs of server requests (including user IP addresses).
• Performance data: App response times, error rates, error details, and crash reports (stack traces, which show the application path leading to an error, as well as the time the error occurred).
• Metadata: System configurations (e.g., browser type and version, operating system) and anonymized user IDs to track errors across various microservices.

This data allows DataDog to detect, analyze, and immediately resolve errors. The personal data collected may be transferred to and stored by DataDog in the USA. We have entered into a Data Processing Agreement with DataDog that includes the EU Standard Contractual Clauses. Furthermore, DataDog is certified under the EU-US Data Privacy Framework, which serves as the basis for data transfers to certified companies and organizations in the USA.

For more information on how DataDog processes data, please refer to the DataDog Inc. privacy policy: https://www.datadoghq.com/legal/privacy/

Legal basis and purpose of data processing

After this period, only aggregated, non-personal data is retained.
This data is processed based on our legitimate interest under Art. 6(1)(f) GDPR in ensuring the error-free and needs-based operation of our websites and services, as well as for error detection and resolution.
DataDog is therefore necessary for providing our websites and services in the context of accessing your user account pursuant to Section 25(2) No. 2 TDDDG.

Storage duration / Right to object and erasure

Data collected via DataDog is deleted or anonymized once the error analysis is complete.

‍

V. Links to third-party websites

Our website may contain links to other websites. We have no control over the content or design of third-party offerings. Therefore, these privacy notices do not apply to external providers whose content or offerings we merely link to.

If you are redirected to other sites via links on our pages, please inform yourself there about how your data is handled.

‍

VI. Online presence on social networks and platforms

Description of data processing

We maintain additional online presences on social networks or industry networks (e.g., Facebook, Xing, or LinkedIn) (hereinafter referred to as "SN") and platforms (e.g., YouTube), which we link to from our website. By clicking on the respective buttons (recognizable by the logos of the social networks or platforms), you will be taken to the respective online presence of the SN. The purpose of these online presences is to communicate with active customers, interested parties, and users, and to provide information about our services.

When you access these networks and platforms, the terms and conditions and data processing guidelines of the respective operators apply.

Since the use of SN occurs outside of our website or services, we have no influence over it, unless otherwise stated below. However, please note that when using the aforementioned platforms and networks we link to, data may also be processed by these SN companies in the USA and may be used by the respective operators for market research and advertising purposes, including the creation of user profiles. If you are logged into these networks and platforms, they may also store cookies on your device to track your use of our platform or services, as well as other information about your usage behavior.

Unless otherwise stated in our privacy policy, we only process user data when they communicate with us within these social networks and platforms, for example, by writing comments or sending us messages.

To make it easier for you to find information about the respective data processing and the opt-out options provided by the operators, we have provided links to the privacy policies and information of the respective network operators below.

Legal basis and purpose of data processing

We only process your personal data when you contact us directly via the respective SN or interact with our presence or content there. Unless otherwise stated in our privacy policy, we process user data based on our legitimate interests under Art. 6(1)(f) GDPR to effectively inform and communicate with users, provided they interact with us within the social networks and platforms (e.g., when users post on our pages or send us messages). If your contact is aimed at entering into a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR.

If any personal data is processed in connection with our presence on a social network and the respective network is solely responsible for the purposes and means of processing, that network is the sole controller for such processing. Please carefully consider which personal data you share with us via a social network profile. If you wish to avoid having your personal data processed by a social network when you interact with us, please contact us through other channels.

Storage duration / Right to object and erasure

If you are a member of one of the social networks where we maintain an online presence and do not want the network to collect data about you via our site and link it to your member profile, you must log out of the social network before visiting our site. For detailed information on the respective processing, the duration of data storage by the social network, and your opt-out options, please refer to the provider links provided below.

Please note that requests for information and the assertion of user rights are most effectively handled directly by the providers. Only the providers have access to user data and can take appropriate action or provide information. Should you still require assistance, you are welcome to contact us.

Facebook

We maintain a Facebook company page ("fan page") on the social network operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Facebook Ireland and we are joint controllers for the collection of data from visitors to our fan page. For this reason, we have entered into an agreement on the joint processing of personal data with Facebook in accordance with Art. 26 GDPR, as well as additional data processing terms:

• “Controller Addendum”: https://www.facebook.com/legal/controller_addendum
• “Data Processing Terms”: https://www.facebook.com/legal/terms/dataprocessing/update

We are responsible for providing data subjects with at least the information regarding joint controllership with Facebook as set out above and below. The information required by Facebook under Article 13(1)(a) and (b) of the GDPR can be found in the Facebook Ireland Data Policy at https://www.facebook.com/about/privacy.

Facebook Inc., Menlo Park, California, USA (hereinafter: Facebook Inc.) also collects and uses "Page Insights" for analytical purposes. Page Insights are summaries of data that allow both us and Facebook Inc. to gain insights into how users interact with our page. Page Insights may be based on personal data collected in connection with our users' visits or their interactions on our page. For this purpose, we have entered into a "Controller Addendum" with Facebook (see above), which specifically regulates the security measures Facebook takes in the context of Page Insights and how Facebook responds to user inquiries. The purposes for which the collection and transmission of personal data constitute joint processing are set out in detail in the terms of use referenced by the aforementioned Controller Addendum.

Data collected during visits to our "fan page" includes information about the types of content users view or interact with, or actions they take (see "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data, as described in detail under "Device Information" in the Facebook Data Policy: https://www.facebook.com/policy).

However, by maintaining a Facebook company page, we share responsibility for Page Insights and have agreed with Facebook Ireland that Facebook Ireland is responsible for fulfilling the rights of data subjects under Articles 15-20 of the GDPR regarding personal data stored by Facebook Ireland following joint processing. Therefore, we have a reporting obligation to Facebook if we receive data protection inquiries regarding Page Insights. Please note that we will forward inquiries regarding Page Insights to Facebook Ireland. Otherwise, please refer to the information on your rights as a data subject in Section A. For further information on how Facebook Ireland processes personal data, including the legal basis on which Facebook Ireland relies and how to exercise your rights against Facebook Ireland, please refer to the Facebook Ireland Data Policy at https://www.facebook.com/about/privacy

The analysis of data collected via Page Insights is used to improve our online presence and for advertising purposes. We maintain our Facebook fan page for the purpose of communication and to easily channel contact requests from Facebook users. The collection and further processing of this data is in our legitimate interest and the legitimate interest of Facebook Inc. pursuant to Art. 6(1)(f) GDPR.

Please note that we cannot enable or disable the Page Insights technology. We must therefore forward such requests to Facebook Ireland, unless we have collected the data ourselves. If you do not want Facebook Inc. to collect your data, please do not use our Facebook company page and/or configure your browser to block cookies and/or log out of Facebook while using our site.

Privacy Policy:

https://www.facebook.com/about/privacy/, https://www.facebook.com/legal/terms/information_about_page_insights_data

Opt-out option:

https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com

LinkedIn

LinkedIn is a service provided by the LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA, operated in Europe by the LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is an internet-based social network that allows users to connect with existing business contacts and establish new ones. Over 400 million registered individuals use LinkedIn in more than 200 countries. This makes LinkedIn currently the largest platform for business contacts and one of the most visited websites in the world.

Every time you access our website, which includes a LinkedIn component (LinkedIn plug-in), this component prompts your browser to download a corresponding representation of the component from LinkedIn. You can find more information about LinkedIn plug-ins at https://developer.linkedin.com/plugins. Through this technical process, LinkedIn learns which specific subpage of our website you are visiting.

If you are logged into LinkedIn at the same time, LinkedIn recognizes which specific subpage of our website you are visiting each time you access our site and for the entire duration of your visit. This information is collected by the LinkedIn component and associated with your LinkedIn account. If you click on a LinkedIn button integrated into our website, LinkedIn assigns this information to your personal LinkedIn user account and stores this personal data.

The LinkedIn component always informs LinkedIn that you have visited our website if you are logged into LinkedIn at the time you access our site; this happens regardless of whether you click on the LinkedIn component or not. If you do not want this information to be transmitted to LinkedIn, you can prevent it by logging out of your LinkedIn account before accessing our website.

LinkedIn provides the option to opt out of email messages, SMS messages, and targeted ads, as well as to manage ad settings, at https://www.linkedin.com/psettings/guest-controls. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua, and Lotame, which may set cookies. You can reject such cookies at https://www.linkedin.com/legal/cookie-policy. LinkedIn's current privacy policy is available at https://www.linkedin.com/legal/privacy-policy. LinkedIn's cookie policy is available at https://www.linkedin.com/legal/cookie-policy.

Privacy Policy https://www.linkedin.com/legal/privacy-policy ,

Opt-out option:

https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out ,

XING

The operating company for Xing is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany ("XING").

Xing is an internet-based social network that allows users to connect with existing business contacts and make new ones. Individual users can create a personal profile on Xing. Companies can, for example, create company profiles or post job offers on Xing.

Every time you access one of the individual pages of this website operated by the controller, which has a Xing component (Xing plug-in) integrated into it, your internet browser is automatically prompted by the respective Xing component to download a representation of the corresponding Xing component from Xing. You can find more information about Xing plug-ins at https://dev.xing.com/plugins. Through this technical process, Xing learns which specific subpage of our website you are visiting.

If you are logged into Xing at the same time, Xing recognizes which specific subpage of our website you are visiting each time you access our site and for the entire duration of your visit. This information is collected by the Xing component and associated with your Xing account. If you click on one of the Xing buttons integrated into our website, such as the "Share" button, Xing assigns this information to your personal Xing user account and stores this personal data.

The Xing component always informs Xing that you have visited our website if you are logged into Xing at the time you access our site; this happens regardless of whether you click on the Xing component or not. If you do not want this information to be transmitted to Xing, you can prevent it by logging out of your Xing account before accessing our website.

The privacy policy published by Xing, which is available at https://www.xing.com/privacy, provides information about the collection, processing, and use of personal data by Xing. Furthermore, Xing has published privacy notices for the XING Share button at https://www.xing.com/app/share?op=data_protection .

Privacy Policy / Opt-out option:

https://privacy.xing.com/en/privacy-policy

‍

VII. Active use of our website

1. Contact forms and email contact

Description of data processing

Auf unserer Internetseite ist ein Kontaktformular vorhanden, welche für die elektronische Kontaktaufnahme genutzt werden kann. Nimmt ein Nutzer diese Möglichkeit wahr, so werden die in der Eingabemaske eingegeben Daten an uns übermittelt und gespeichert. 

• Company/Municipality (required)
• First name (required)
• Last name (required)
• Email (required)
• Phone (optional)
• Message (optional)

Im Zeitpunkt der Absendung Ihrer Nachricht über eines unserer Kontaktformulare werden zudem folgende Daten gespeichert:

• The user's IP address
• Date and time of registration

Erfolgt eine Kontaktaufnahme über eine von uns bereitgestellte E-Mail-Adresse, werden die mit der E-Mail übermittelten personenbezogenen Daten des Nutzers gespeichert. 

Wenn Sie eine Mobiltelefonnummer zum Erhalt von Updates zum Status Ihrer Zahlungsaufforderung angeben, nutzen wir die von Ihnen angegebene Nummer zu diesem Zweck.

Wir verwenden auf unserer Webseite HubSpot Forms, einen Dienst unseres CRM-Systems HubSpot, um Kontaktformulare einzubinden und die dort eingegebenen Daten weiterzuverarbeiten. (siehe Teil C, Ziff. II). HubSpot Forms bietet Funktionalitäten für SEO, Content-Erstellung, Lead Management, E-Mail-Marketing und Auswertungen an. Die in den Formularen eingegebenen Daten der Nutzer werden in unserem von HubSpot bereitgestellten Customer-Relationship-Management-System gespeichert. 

Wir nutzen Google E-Mail-Dienste, die über Google Workspace durch die Firma Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Irland (im Weiteren: „Google“) angeboten werden. Neben unserer CRM-Software als unsere zentrale Software zu Verwaltung und Bearbeitung von Anfragen, werden E-Mails somit auch auf Servern von Google gespeichert. Dabei haben wir als Serverstandort die Region "Europa" gewählt und eine Vereinbarung zur Auftragsverarbeitung mit Google abgeschlossen. Eine darüberhinausgehende Übertragung dieser E-Mails an Drittstaaten, insbesondere in die USA findet dabei nicht statt, was Google auch vertraglich zusichert. 

Zur Kanalisierung und Sortierung eingehender Anfragen greifen wir über eine Schnittstelle auf sogenannte KI-basierte Dienste zurück, die darauf ausgelegt sind, natürliche Sprache und zugehörige Eingaben zu verstehen und zu generieren, Informationen zu analysieren und Vorhersagen zu treffen. : 

• For this, we use the ChatGPT language model from OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We have agreed with OpenAI that our data will not be used for training models or shared with OpenAI. OpenAI's privacy policy can be viewed at https://openai.com/de/policies/eu-privacy-policy. We have entered into a data processing agreement ("Data Processing Addendum," see https://openai.com/policies/data-processing-addendum) with OpenAI. Since data is transferred to the USA when using the OpenAI API, the Data Processing Addendum includes the application of EU Standard Contractual Clauses to ensure an adequate level of data protection even when data is transferred to a third country.

• Daneben greifen wir auf das KI-gestützte System Google Gemini, angeboten von Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland zurück. Google Gemini wurde entwickelt wurde, um fortschrittliche Sprach- und Bildverarbeitungsfunktionen bereitzustellen. Es nutzt maschinelles Lernen, um natürliche Sprache zu verstehen, zu generieren und Bilder zu analysieren, und bietet damit vielseitige Anwendungsmöglichkeiten in verschiedenen Bereichen. Wir nutzen das Modell von Google Gemini um E-Mails und eingehende Schriftstücke vorzuselektieren. Als Google Workspace-Kunden gewährleistet Google, dass die bei Verwendung von Google Gemini nicht von Google zum Training von dessen allgemeinverfügbaren KI-Modellen verwendet wird. 

For spell-checking responses to incoming emails, we use the LanguageTool application, software from LanguageTooler GmbH,
Karl-Liebknecht-Str. 37, 14482 Potsdam, a subsidiary of Learno Inc., which includes AI features for checking spelling and grammar as well as refining phrasing. You can find the provider's privacy policy for LanguageTool at: https://languagetool.org/de/legal/privacy. LanguageTool stores checked records and the errors found within them on its servers for up to 15 minutes (not on permanent storage media). This storage occurs without an IP address or other information that would allow the data sets to be linked to an individual. However, if the text contains personal information, this is also stored temporarily. We have entered into a data processing agreement with Learno Inc. that includes the EU Standard Contractual Clauses required for data processing in the USA, by which the provider contractually commits to complying with applicable data protection regulations: https://languagetool.org/de/legal/dpa

‍

To read attached PDF or Word files, we use the software solution Airparser, Sepapaja tn 6, Tallinn 11415, Estonia. Airparser uses AI technology to identify and extract structured data. We have entered into a data processing agreement with Airparser in accordance with Art. 28 GDPR, by which Airparser is contractually obligated to comply with applicable data protection regulations (see https://airparser.com/dpa/). You can view Airparser's privacy information at https://airparser.com/gdpr/ .

Rechtsgrundlage und Zweck der Datenverarbeitung

Rechtsgrundlage für die Verarbeitung der Daten, die im Zuge einer Übersendung einer Kontaktformularanfrage oder einer E-Mail übermittelt werden, ist Art. 6 Abs. 1 lit. f DSGVO. Zielt die Kontaktformularanfrage oder der E-Mail-Kontakt auf den Abschluss eines Vertrages ab, so ist zusätzliche Rechtsgrundlage für die Verarbeitung Art. 6 Abs. 1 lit. b DSGVO .

Die Verarbeitung der personenbezogenen Daten aus der Eingabemaske dient uns zur Bearbeitung von Anfragen, sowie der Kontaktaufnahme. Im Falle einer Kontaktaufnahme per E-Mail liegt hieran auch das erforderliche berechtigte Interesse an der Verarbeitung der Daten. Wenn Sie eine Mobiltelefonnummer für Updates zum Status Ihrer Zahlungsaufforderung hinterlassen, nutzen wir die von Ihnen angegebene Nummer zu diesem Zweck.

Die Nutzung von KI-basierten Diensten erfolgt auf Basis unseres berechtigten Interesses nach Art. 6 Abs. 1 lit. f DSGVO. Aufgrund der hohen Anzahl von eingehenden Nachrichten sind wir für eine schnelle und zielgerichtete Bearbeitung dieser Anfragen, die sowohl in unserem und auch im Interesse der Anfragenden bzw. Versender von an uns gerichteten Nachrichten liegt, auf eine solche Vorselektierung und Zuteilung auf die jeweils zuständigen Stellen im Unternehmen angewiesen.

Die Angaben der Nutzer können ferner auf Basis unserer Berechtigten Interessen in unserem Customer-Relationship-Management-System (CRM-Software) oder vergleichbarer Anfragenorganisation gespeichert werden.

Die sonstigen während des Absendevorgangs verarbeiteten personenbezogenen Daten dienen dazu, einen Missbrauch des Kontaktformulars zu verhindern und die Sicherheit unserer informationstechnischen Systeme sicherzustellen.

Storage duration / Right to object and erasure

Data is deleted as soon as it is no longer required for the purpose for which it was collected. For personal data from the contact form input mask and data sent via email, this is the case when the conversation with the user has ended. A conversation is considered ended when it is clear from the circumstances that the matter in question has been fully resolved and there are no legal requirements for further storage.

Users have the right to withdraw their consent to the processing of their personal data at any time.

If a user contacts us via email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued unless we have another legal basis for processing or an overriding interest in continuing to process the data.

In this case, all personal data stored during the contact process will be deleted, provided there are no legal requirements for longer storage.

‍

2. Telephone hotline

Description of data processing

If a user chooses to contact us by phone using a number provided on our websites, we collect the caller's phone number and other technical information from the telephone system (start time and duration of the call), which is either generated there or provided by the telephone company. We also record the essential content of the conversation and any information provided by the caller to our staff (name, reason for the call, contact details for follow-up, etc.).

To pre-qualify incoming calls, we use an AI-supported software solution from Leaping AI UG (limited liability), Potsdamer Straße 72, 10785 Berlin. This software is used to request the data necessary for classifying the call, routing it to the correct department, or answering user inquiries (e.g., our reference number, license plate, caller's name) and allows certain customer requests to be handled automatically. We have entered into a data processing agreement with Leaping AI in accordance with Art. 28 GDPR.

We will ask you if you consent to your call being recorded. If the caller consents to a recording, we store the entire content of the conversation and automatically generate a transcript. We use call recordings and transcripts for training our service staff, investigating customer complaints, creating anonymized internal reports (classifying calls, generating statistics on reasons for calls), and for evidentiary purposes in connection with asserting or defending against legal claims.

We use the cloud contact center platform Talkdesk, provided by Talkdesk Inc., 201 Spear Street, Suite 1100, San Francisco, CA 94105, USA (hereinafter: "Talkdesk"). We have concluded a data processing agreement with Talkdesk in accordance with Art. 28 GDPR, along with the EU Standard Contractual Clauses for data transfers to third countries, which contractually obligates Talkdesk to comply with applicable data protection regulations. Furthermore, we have agreed with Talkdesk that our Talkdesk instance is hosted in a European region, ensuring that our data is processed by default in a regional cloud within the European Union.

Legal basis and purpose of data processing

When a call is answered, we automatically collect the data required for call processing (e.g., our reference number, license plate, caller's name) for the purpose of automating and efficiently handling specific customer requests or interaction components, based on Art. 6(1)(f) GDPR. If the call relates to our services and an existing, terminated, or planned contractual relationship with the caller, the additional legal basis for processing is Art. 6(1)(b) GDPR.

During the call, we manually record the caller's request in our system and save this note once the call ends. No call recording takes place in this instance. The legal basis for processing this data is Art. 6(1)(f) GDPR. If the call relates to our services and an existing, terminated, or planned contractual relationship with the caller, the additional legal basis for processing is Art. 6(1)(b) GDPR.

Call recordings and transcriptions are created and processed exclusively based on prior consent given by the user in accordance with Art. 6(1)(a) GDPR.

User information may also be stored in our customer relationship management system (CRM software) or similar inquiry management systems based on our legitimate interests.

Storage duration / Right to object and erasure

Data is deleted as soon as it is no longer required for the purpose for which it was collected. This is the case when the conversation with the user has ended. A conversation is considered ended when it is clear from the circumstances that the matter in question has been fully resolved and there are no legal requirements for further storage.

Unless a specific legal retention period applies to recordings, the storage duration for call recordings and notes is based on statutory limitation periods (in Germany, the standard limitation period is three years). Transcripts of call recordings are deleted after 6 months.

You can withdraw your consent to the processing of your personal data at any time. If a caller consents to the recording of a conversation, its transcription, and the storage of both, they may revoke this consent at any time. In such cases, the recordings and transcripts will be deleted immediately, unless we are required by law to retain them for a longer period.

‍

3. Ticket System

Description of data processing

We use Freshdesk as our ticket system, a software solution provided by Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA. Freshdesk is a customer service platform that makes it easier to handle customer inquiries and requests across various channels. We use Freshdesk to receive and manage contact requests. If you submit a contact request via our website using a contact form, or if you contact us by email or phone, the information and conversation content provided, as well as any data we collect (see sections VII. 2 and VII. 3 above), will be stored and organized in the ticket system to ensure chronological processing and improve your service experience.

The stored information is kept on Freshdesk's servers. To organize and process requests, personal data is collected based on what you provide—at a minimum, your first name, last name, and email address—which is then transmitted to, stored, and processed by Freshdesk. We have opted to have the data processed on servers located within the EU. This is intended to technically ensure that the data remains within the European Union and cannot be accessed by US authorities.

For more information on data protection at Freshdesk, please visit https://www.freshworks.com/privacy/ .

Legal basis and purpose of data processing

We process information collected via Freshdesk based on our legitimate interest in efficiently managing our customer service and responding to your requests as quickly as possible, in order to support our customers and users (Art. 6(1)(f) GDPR). This is in conjunction with a data processing agreement concluded with Freshdesk in accordance with Art. 28 GDPR, which ensures data protection and prohibits unauthorized disclosure to third parties.

Should a transfer of data to the USA be necessary in individual cases, it will be based on the EU Commission's standard contractual clauses.

Storage duration / Right to object and erasure

We store your data for the duration of our contractual relationship with you or until the respective conversation has been resolved.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A .

‍

4. Chat function

Description of data processing

The chat function provided on our website uses an AI-powered chatbot from Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA ("Decagon"). Decagon operates an AI platform that automates customer service processes using "agents." You can use the chat function to ask and receive answers to frequently asked or general questions about our parking system or specific parking areas we manage (e.g., opening hours, rates), or to report issues at a parking area we manage so they can be forwarded to our customer support team.

As soon as you enter a question into the chat's text field (known as prompts), Decagon automatically analyzes the question and provides a text-based response from the agent. Generally, we do not need any personal information about you (such as names, email addresses, phone numbers, addresses, or license plate numbers) for this. Please refrain from voluntarily entering such personal data about yourself or others into the input field. We only collect and store such data if you provide it to us voluntarily.

For the purpose of displaying and technically operating the chat function, the following technically necessary data is processed as part of log files when you use it:

• IP address
• Metadata regarding API requests
• Date and time of access

The chat function processes data fully automatically, starting only once you send your information into the chat. The agent operates independently within clearly defined boundaries and does not make autonomous decisions that affect your rights or access to our services. If a request requires human judgment or falls outside the AI agent's scope, it is forwarded to one of our human agents through a supervised process and stored outside of Decagon in our CRM or ticketing system for further handling.

Decagon has contractually guaranteed that user data provided via the chat function will not be used to train other AI models.

For more information on data protection at Decagon, please visit https://decagon.ai/legal/privacy.

Legal basis and purpose of data processing

The purpose of this processing is to support our customers and users by answering general questions or support requests. We process the information collected via Decagon based on our legitimate interest in providing efficient customer service and responding to your request as quickly as possible (Art. 6(1)(f) GDPR), in conjunction with a data processing agreement concluded with Decagon in accordance with Art. 28 GDPR, which ensures data protection and prohibits unauthorized disclosure to third parties.

Furthermore, we have agreed with Decagon that data will be processed exclusively within the EU during the normal operation of the chat function (EU data residency). If, in individual cases, data transfer to the USA is necessary for the technical support of the chat function and has been authorized by us, it will be based on the EU Commission's standard contractual clauses.

Storage duration / Right to object and erasure

We store personal data exchanged during chats for the duration of the legal relationship between us and the affected parties, or until the respective conversation has been concluded.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

‍

C. Data processing in connection with the use of MHP parking facilities

1. Using the MHP Online Shop

Description of data processing

Through our MHP Online Shop (hereinafter: “Online Shop”), you have the option to book and pay for the parking services described there for facilities managed by us, based on the applicable General Terms and Conditions. For example, you can pay your parking fees online.

We use cookies to make our online shop more user-friendly. Some elements of our website require the browser to be identified even after a page change. These cookies store the user's language and region.

In addition, cookies enable an analysis of browsing behavior in the online shop. This allows the following data to be transmitted: search terms entered, frequency of page views, and use of website functions.

To book parking services or pay for your use of the parking facility, you must enter your vehicle license plate number into the designated input field, and if applicable, select your desired parking area and/or provide a file number or reference. We require the license plate and other details to assign the correct parking fee to the respective parking session or service.

Data processed during the booking process includes license plate information, the amount to be paid, and other communication, contract, and payment data of our customers, prospective customers, and other business partners. Processing is carried out for the purpose of providing contractual services within the scope of operating our online shop, billing, delivery, and customer service. During the booking process, we specifically process the information provided in the respective input forms, such as name, company, address, email, and telephone number. Mandatory fields are generally marked with an asterisk (*), while others are labeled "optional." These include the information necessary to provide and bill for the ordered service, as well as contact information to allow for follow-up or to notify you of important order-related information (such as mandatory legal notices, schedule changes, etc.).

We process and use the data collected here to enable you to select, book, and pay for our parking services. We also process the data to handle and, if necessary, ship your booking. Further details on the legal and organizational framework can be found in the underlying General Terms and Conditions. Details on the payment service providers we use can be found in Section 2 of this Part C below.

‍

Legal basis and purpose of data processing

The legal basis for processing data collected during a booking is Art. 6(1)(b) GDPR, as it is necessary for the performance of a contract. Furthermore, Art. 6(1)(f) GDPR applies for the purpose of detecting and combating harmful behavior, uncovering and preventing other negative experiences, maintaining the integrity of the online shop, and promoting protection and security. Both we and other users of our services have a legitimate interest in preventing, detecting, or investigating illegal activities, fraud, or security breaches. The aforementioned information is also required to provide the service in accordance with Section 25(2) No. 2 TDDDG.

We process the personal data from the input form to manage your booking and provide the respective parking service.

Data entered in the online shop may also be processed based on your consent (Art. 6(1)(a) GDPR) if we have requested it. You can withdraw your consent at any time. The lawfulness of data processing carried out prior to the withdrawal remains unaffected. Please note that as a result of your withdrawal, we may no longer be able to provide the full booking process, and your booking may potentially not be completed.

Storage duration / Right to object and erasure

Data is deleted as soon as it is no longer required for the purpose for which it was collected. For personal data from the booking form, this is the case once the contract for our parking services has been concluded and the service has been fully provided. As a rule, however, we retain contract-related data until the expiry of statutory warranty obligations. In the event of a statutory archiving obligation, the affected data will be deleted after the relevant period has expired.

‍

2. Use of payment providers in order processing ("Payment Services")

Description of data processing

If you are required to provide us with your payment details (e.g., account number for direct debit) after concluding a paid contract for parking services, this data is necessary for payment processing.

To ensure modern, simple, and secure payment processing, we offer our customers various payment options for which we use banks, credit institutions, and other payment service providers (hereinafter collectively: "Payment Service Providers").

Payment transactions via common payment methods (e.g., Visa/MasterCard) are processed exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the padlock symbol in your browser bar.
With encrypted communication, your payment data transmitted to us cannot be read by third parties.

If you have chosen the payment services of a specific Payment Service Provider as a payment option, they provide their services based on a contract concluded between you and the Payment Service Provider, in accordance with their respective valid terms and conditions. The data processing carried out by them is their responsibility; we have no influence over this. Accordingly, if you wish to assert data subject rights in this context, we must refer you to the respective Payment Service Provider. The Payment Service Provider may ask you for additional consent, e.g., for identity or credit checks. Personal data processed by Payment Service Providers generally includes first and last name, address, date of birth, gender, email address, IP address, telephone number, as well as data necessary for processing the payment related to the order, such as the number of items, item number, invoice amount, and taxes in percent, or bank details required to carry out the transaction, such as account or credit card numbers, passwords, TANs, and checksums, as well as contract, total, and recipient-related information.

The Payment Service Provider processes this data for the purpose of offering the respective payment method, as well as for any necessary identity and/or credit checks, payment administration, and fraud prevention.

Legal basis and purpose of data processing

The transmission of your data to the Payment Service Providers we use is based on Art. 6(1)(b) GDPR (processing for the performance of a contract) for data collected during an order, as well as on our legitimate interests (Art. 6(1)(f) GDPR) insofar as we do not ask for your consent under Art. 6(1)(a) GDPR.

You have the option to withdraw your consent for data processing by payment providers at any time with effect for the future. A withdrawal does not affect the validity of past data processing operations.

‍

Adyen

For certain payment methods, we use the payment service provider Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands (hereinafter: "Adyen"). If a payment via Adyen is selected, personal data is automatically transmitted to Adyen. The personal data transmitted to Adyen generally consists of the card type (e.g., Visa or Mastercard), cardholder name, card number, security code, and expiration date. Adyen's role is to request authorization for the transaction from the respective payment system, such as Mastercard or Visa, and to send this authorization to the buyer's bank for approval. If the bank approves, Adyen is notified by the relevant payment system and processes the payment to our bank. Adyen processes your data for payment processing as well as for identity and credit checks. In this case, Adyen processes your personal data as the data controller. We therefore have no influence over Adyen's subsequent data processing.

You can find Adyen's data protection information here: https://www.adyen.com/de_DE/privacy-policy, and for transaction processing at https://www.adyen.com/de_DE/privacy-policy/transaction.

‍

Stripe

For the online processing of payments for services we provide, we use Stripe, an online payment service provided by the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe").

If you have chosen Stripe as your payment method, the information provided during the ordering process, along with information about your order and any details required depending on the payment method (name, address, email address, customer number, order number, bank, account number, sort code, credit card number if applicable, credit card expiry date, credit card security code (CVC), invoice amount, currency and transaction number, date and time of the transaction, location, name of the provider), will be shared with Stripe. This data is shared exclusively for the purpose of processing payments via Stripe and only to the extent necessary. We cannot process payments via Stripe without the transmission of your personal data.

Stripe acts in a dual role as both a controller and a (sub-)processor for data processing activities. As a controller, Stripe uses your transmitted data based on its applicable terms and conditions to fulfill the contractual relationship between you and Stripe regarding payment processing and to comply with regulatory obligations. We have no influence over this process. You can find Stripe's privacy policy with further information here: https://stripe.com/de/privacy

Stripe acts as a processor to complete transactions within payment networks. Within the scope of the data processing agreement, Stripe acts solely on our instructions and has been contractually obligated to comply with data protection regulations in accordance with Art. 28 GDPR.

‍

secuPay

We offer cashless payment methods from secupay AG (Goethestr. 6, 01896 Pulsnitz; "secupay") in our online shop. Secupay is a payment institution as defined by the Payment Services Supervision Act (ZAG) and is registered with the Federal Financial Supervisory Authority (Graurheindorfer Str. 108, 53117 Bonn; "BaFin") (registration number: 126737), enabling cashless payment for products and services on the internet. When using secupay as a payment method, the purchase price claim is assigned to secupay. This allows online shop operators to deliver goods, services, or downloads to the customer immediately after the order is placed. If "direct debit," "invoice," or "credit card" is selected as a payment option via secupay during the checkout process, your data is automatically transmitted to secupay. When processing payments via secupay, payment data is transmitted to secupay. Secupay then performs a technical check of the payment default risk. The transaction result is then automatically communicated to us. The personal data exchanged with secupay includes your first name, last name, address, email address, IP address, telephone number, or other data necessary for payment processing.

The personal data exchanged between secupay and us may be transmitted by secupay to credit agencies. The purpose of this transmission is identity and credit verification. Secupay may pass on personal data to affiliated companies and service providers or subcontractors if this is necessary to fulfill contractual obligations or if the data is to be processed on our behalf. This data processing is carried out under secupay's own responsibility. We have no influence over this. You have the option to revoke any consent given to secupay regarding the handling of personal data at any time. A revocation does not affect personal data that we are legally required to process, use, or transmit for contractual payment processing. The applicable data protection provisions of secupay can be accessed at https://www.secupay.com/de/datenschutz.

‍

3. Use of MHP Online Shop reviews

Description of data processing

We use the services of the review portal "Trustpilot," operated by TrustPilot A/S, Pilestraede 58, 5th Floor, 1112 Copenhagen, Denmark. Trustpilot offers users the opportunity to rate our products and services.

When one of our parking services is purchased online via our shop and the receipt is subsequently sent by email, we include a Trustpilot button in this email with a unique link created by Trustpilot. For this purpose, we maintain an interface ("API") with Trustpilot to generate these invitation links. Clicking this link will take you directly to the Trustpilot review platform. When you click the button with the invitation link, the form on Trustpilot is automatically populated with your data, and you can submit your desired review on the portal. The review is verified based on the reference number via the generated link. Submitting a review is voluntary.

For this purpose, we transmit the following data to Trustpilot:

• Email address
• First name, last name
• Reference number
• Language- and country-specific domain of our shop, access data (including IP address)
• Selected parking service

We use Trustpilot as a data processor for this purpose and have contractually obligated Trustpilot to handle your data in compliance with data protection laws through a data processing agreement.

Please note that you need a user account with Trustpilot to submit a review, and that after your review and your agreement to Trustpilot's terms of use, Trustpilot becomes the controller for the further processing of your review, particularly its publication. Details on data protection at Trustpilot can be found at https://de.corporate.trustpilot.com/legal/for-businesses/privacy-policy.

Rechtsgrundlage und Zweck der Datenverarbeitung

Die Verarbeitung der Daten erfolgt zu Zwecke der Erstellung eines Einladungslinks und zur Verifizierung der Authentizität der Shop-Nutzung für Trustpilot für die Durchführung des Bewertungsverfahrens. Dies und die Einholung von Nutzerfeedback zur Verbesserung unserer Leistungen ist ein berechtigtes Interesse nach Art. 6 Abs. 1 lit. f DSGVO.

Dauer der Speicherung / Widerspruchs- und Beseitigungsmöglichkeit

Die Einladungsdaten zu Trustpilot werden für die Dater von einem Jahr gespeichert.

‍

4. Nutzung von durch MH Parkservice verwalteten Parkflächen

Beschreibung der Datenverarbeitung

Im Rahmen der Nutzung der Parkflächen werden folgende Daten automatisiert erfasst: Kfz-Kennzeichen einschließlich Front- bzw. Heckpartie des Fahrzeugs, Ein-/Ausfahrzeit, Datum und Ortsstempel, Höhe und Zahlungsmethode des Parkentgelts. 

Bevor Parkplatznutzer die Parkfläche verlassen, müssen Sie, sofern Sie keine dauerhafte Parkberechtigung besitzen, Ihr Kfz-Kennzeichen am Kassenautomaten eingeben. Wenn das eingegebene Kfz-Kennzeichen in unserer Datenbank gefunden wird, wird die Parkgebühr berechnet und vom Parkplatznutzer entrichtet. Einzelheiten zur Datenverarbeitung bei Zahlungen über unseren Online-Shop finden Sie unter Abschnitt C, Ziffn. 1 und 2 und den jeweils geltenden Nutzungsbedingungen.

Bei Verstößen gegen die Allgemeinen Nutzungsbedingungen werden zusätzlich alle für die rechtliche Verfolgung des Verstoßes, insbesondere der Beitreibung einer verwirkten Vertragsstrafe und/oder Geltendmachung von Besitz- und Eigentumsschutzrechten („Nachverfolgung“) relevanten personenbezogenen Daten des Fahrzeughalters sowie des Fahrers des Fahrzeugs verarbeitet.

Wenn Sie ein Forderungsschreiben als Halter des einen Parkverstoß verursachenden Fahrzeugs erhalten, wurde Ihr Kennzeichen zuvor durch uns an das Kraftfahrt-Bundesamt übermittelt. Wenn Sie nicht Halter des Fahrzeugs sind, wurden uns Ihre Daten vom Fahrzeughalter oder einem sonstigen Dritten (z.B. Fahrzeugvermieter oder Leasingunternehmen) überlassen, der uns gegenüber bestätigt hat, dass Sie zum Zeitpunkt des Parkverstoßes Fahrer des Fahrzeugs waren. Sofern Sie nicht mehr an der beim Kraftfahrt-Bundesamt hinterlegten Adresse wohnhaft sind, haben wir Ihre Daten durch die aktuell an dieser Adresse gemeldete Person, eine Auskunftei oder ein Inkassounternehmen erhalten.

Im Fall von Postrückläufern greifen wir ferner auf die Leistungen der Deutsche Post Adress GmbH & Co. KG, Am Anger 33, 33332 Gütersloh zurück. Über eine Schnittstelle behalten wir uns vor, nach Rücklauf von mindestens zwei Briefen, die aktuelle Postadresse abzufragen. Hierfür übermitteln wir uns bekannte Angaben zur Person und er bisherigen Adresse. 

Rechtsgrundlage und Zweck der Datenverarbeitung / Datenempfänger

Die Verarbeitung der erhobenen Daten ist zur Wahrung berechtigter Interessen der Parteien am Betrieb der Parkfläche und den damit zusammenhängenden branchenüblichen Verwaltungstätigkeiten (Art. 6 Abs. 1 lit. f DSGVO) sowie zur vertragsgemäßen Abwicklung der zu erbringenden Leistungen gemäß den Allgemeinen Nutzungsbedingungen (z.B. Ermittlung und Abrechnung des Parkentgelts, Abgleich auf hinterlegte Parkberechtigungen, Abgleich auf Zahlungen per App, Abgleich auf Zahlung via Online-Portal, Ermittlung der Einhaltung der zulässigen Höchstparkdauer oder Freiparkdauer bzw. Karenzzeit) erforderlich (Art. 6 Abs. 1 lit. b DSGVO).

Halterbezogene Daten (insbesondere Name und Adresse) werden unter Weiterleitung des Kennzeichens beim Kraftfahrt-Bundesamt oder ausländischen Auskunftstellen abgefragt („Halterabfrage“). Daten des Fahrers werden gegebenenfalls über den ermittelten Fahrzeughalter, Fahrzeugvermietungs- oder Leasingunternehmen angefordert und zu den vorgenannten Zwecken auch an Dritte weitergegeben (z.B. Rechtsanwälte, Inkassounternehmen). Zum technischen Betrieb der Parkraumtechnik und -software sowie zur Durchführung der Nachverfolgung von Verstößen gegen die Allgemeinen Nutzungsbedingungen werden Daten durch die MHP GmbH und deren Auftragnehmer verarbeitet (Peter Park System GmbH (Betrieb Parkraumtechnik und -software) und Amazon Webservices EMEA SARL (Datenspeicherung)). Rechtsgrundlage ist Art. 6 Abs. 1 lit. b DSGVO, soweit die Verarbeitung zur Vertragsdurchführung erfolgt, im Übrigen Art. 6 Abs. 1 lit. f DSGVO zur Verfolgung der berechtigten Interessen an der Wahrung der Besitz- und Eigentumsrechte der MHP GmbH sowie Dritter und deren berechtigten Interesse an der Sicherstellung des ordnungsgemäßen Betriebs der Parkflächen sowie zur Beschleunigung der Fahrzeugabfertigung auf der Parkfläche.

Dauer der Speicherung / Verpflichtung zur Bereitstellung/ Widerspruchs- und Beseitigungsmöglichkeit

Die von uns erhobenen personenbezogenen Daten werden nach Abwicklung aller bestehenden Ansprüche aus und im Zusammenhang mit der Nutzung der Parkfläche und nach Ablauf aller gesetzlichen Aufbewahrungs- bzw. Verjährungsfristen gelöscht. Liegt kein Verstoß gegen die Allgemeinen Nutzungsbedingungen der Parkfläche vor, verlässt der Benutzer die Parkfläche innerhalb der ab der Einfahrt geltenden Karenzzeit, werden die Daten der Benutzer 48 Stunden nach Ausfahrt von der Parkfläche automatisiert gelöscht, soweit keine gesetzlichen Aufbewahrungspflichten entgegenstehen.

Die Bereitstellung Ihrer Daten bei Nutzung der von uns betreuten Parkplätzen ist nach den jeweiligen Allgemeinen Nutzungsbedingungen vertraglich vorgesehen oder für den Vertragsschluss zwingend erforderlich. Ohne die Bereitstellung Ihrer Daten wäre die Durchführung des zugrunde liegenden Schuldverhältnisses und der Leistungen im Rahmen der Parkraumbewirtschaftung nicht möglich. Wir verwenden Ihre Daten jedoch nicht im Rahmen einer automatisierten Entscheidungsfindung einschließlich Profiling. Da die Erfassung der Daten und deren weitere Verarbeitung zwingend erforderlich ist, besteht folglich seitens der Nutzer keine Widerspruchsmöglichkeit. Da die Kennzeichenerfassung bei Einfahrt auf die Parkfläche erfolgt, ist - sofern es die baulichen Begebenheiten zulassen - grundsätzlich ein vorzeitiges Umdrehen möglich, um der Datenerfassung zu entgehen.

‍

5. Freischaltung von Parkberechtigungen

Description of data processing

For some of the parking areas we manage, you can request parking permits via terminals or online booking forms (on the MHP website, online, or at local retail stores or institutions, for example). This applies to designated parking spaces for specific groups (such as employees, visitors, or customers) and/or free parking periods, in accordance with the terms and conditions applicable to the respective parking area.

To do this, you must enter the information required in the respective input form. Providing your license plate number is always mandatory. In some cases, additional information may be required to verify your eligibility for a specific group, such as employee ID numbers. This information may be shared with our clients or their customers to verify eligibility or cross-referenced with data they have provided.

‍

Legal basis, purpose of data processing, and data recipients

If cross-referencing additional data is necessary to validate your eligibility, or if we process extra information provided in the form, we do so based on your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time. The lawfulness of any data processing carried out prior to your withdrawal remains unaffected. Please note that if you withdraw your consent, we may be unable to provide the full booking process, and your booking may no longer be able to be completed.

The legal basis for processing data collected during the activation process is Art. 6(1)(b) GDPR, as it is necessary for the performance of a contract. Otherwise, it is based on Art. 6(1)(f) GDPR for the purpose of effectively managing parking permits and supporting the provision of the respective parking services.

‍

Storage duration, obligation to provide data, and options for objection and removal

Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the input form, this occurs once a contract for our parking services has been concluded and the respective service has been fully provided. As a rule, we retain contract-related data until the statutory warranty period expires. In the event of a statutory archiving obligation, the affected data will be deleted after the relevant period has elapsed.

‍

6. Parking areas with free parking options for people with disabilities

Description of data processing

For some of the parking areas we manage, we offer a special arrangement allowing people with disabilities to park for free in designated spaces during their stay. To use this, eligible users must provide us with proof of a disability parking permit with the codes H/aG/Bl (e.g., the blue EU disability parking card).

Specifically, you must verify your eligibility for this service according to the conditions posted at the parking area where this free parking option is offered. This can be done, for example, by scanning a QR code on the relevant sign, visiting our website, and submitting your parking permit via the input form provided there.

‍

Legal basis and purpose of data processing

The legal basis for processing data collected during a booking is Art. 6(1)(b) GDPR, as it is necessary for the performance of a contract. Otherwise, it is based on Art. 6(1)(f) GDPR for the purpose of effectively managing parking permits and supporting the provision of the respective parking services. In the case of health-related data, this is in conjunction with Art. 9(2)(e) or (f) GDPR.

‍

Storage duration, obligation to provide data, and options for objection and removal

Proof of eligibility for a disabled parking permit is checked exclusively to verify that the permit exists and is deleted immediately after the parking process is completed.

‍

7. Using the MH Parkservice portal

Description of data processing

We offer users of the parking lots we manage the option to use our service portal (https://service.mh-parkservice.de/) to submit support requests (such as follow-up questions, disputes regarding payment notices, or other inquiries), view information about parking violations—including evidence photos and payment options—or access other customer-specific information.

The portal can be accessed via our website using a QR code provided to users (e.g., as part of a payment notice). Once authenticated, you can access the service portal. During the authentication process, the user provides the following personal data:

• Case number
• License plate

For technical reasons, a limited amount of data (connection data) is collected every time the portal is accessed. This data is technically necessary to establish and maintain a connection between the user's device and our servers. Furthermore, this data is required to maintain the session after login and to prevent unauthorized access to that session. During every login process and while using the customer portal, we or our hosting provider store the IP address, the timestamp of the user action, the internet service provider, the web browser and operating system used (including version information), language settings, the referrer URL, and the name of the page accessed.

After logging into the service portal, a cookie is set to maintain and protect your session. You must allow this cookie in your web browser to use the portal.

If a solution to a problem reported via the service portal or an answer to a question requires the involvement of other partners or service providers, we will share the information related to the request or incident with them.

Legal basis and purpose of data processing

The legal basis for processing data during the use of the service portal, as well as for requests submitted or downloads made through it, is Art. 6(1)(b) GDPR, as it relates to the performance of the contract with the user regarding the use of the parking lot. Otherwise, Art. 6(1)(f) GDPR applies, as the processing of personal data in connection with our portal serves to provide an effective way to contact and communicate with our support teams, to manage, process, and resolve incoming requests, and to ensure a secure connection between users' devices and our servers.

Storage duration / Right to object and erasure

Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data entered during the login process, this is generally the case once the specific usage session has ended.

All personal data stored when a user contacts us will be deleted no later than when no legal requirements necessitate further storage (such as statutory warranty periods related to support requests).

‍

8. Invoicing

Description of data processing

To create, send, document, and account for invoices, we use the cloud-based accounting software sevDesk, provided by sevDesk GmbH, Hauptstraße 115, 77652 Offenburg. In this context, the contact details of the invoice recipient are processed by sevDesk. You can view the sevDesk privacy policy at https://sevdesk.de/datenschutz/.

Legal basis and purpose of data processing

We use sevDesk based on Art. 6(1)(c), Art. 6(1)(b), and Art. 6(1)(f) of the GDPR for the aforementioned purposes of fulfilling our legal obligations, for contractual purposes, and for our legitimate interest in efficient accounting. We have entered into a data processing agreement with sevDesk in accordance with Art. 28 of the GDPR, which obligates sevDesk to comply with applicable data protection requirements.

Storage duration / Right to object and erasure

We store your data for the duration of our contractual relationship and until the end of the statutory retention periods for accounting-related documents.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

‍

D. Contractual relationships with business customers and partners

‍

I. Am I required to provide data?

If you contact us with questions about our services, enter into contract negotiations with us, accept one of our offers, or have other contractual agreements with us, we process the personal data you provide in this context. The specific data processed depends largely on the relevant items or services you purchase or inquire about. In this context, processing your data is generally essential for the preparation, conclusion, and execution of the contract. If you do not provide this data, we may have to decline to enter into a contract or perform an order, or we may be unable to carry out an existing contract.

When we use data in the context of initiating or fulfilling a contract with a business customer, business partner, or cooperation partner, our interest in handling your data lies in enabling and maintaining communication with the business customer or the respective business or cooperation partner, typically as part of a contractual or other relationship. If you act as a contact person—typically in your capacity as an employee of these companies—you generally do not have an overriding interest to the contrary, provided that this interaction with us is part of your job responsibilities, meaning a right to object is usually not applicable.

However, you are not required to provide consent for data processing regarding information that is not relevant to the fulfillment of the contract or not legally required.

‍

II. CRM system ("HubSpot")

Description of data processing

We use features of the Customer Relationship Management (CRM) system HubSpot. HubSpot is a software solution from HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, which is provided in Europe by HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. HubSpot is an integrated software solution that we use to cover various aspects of our online marketing. These include, among other things: email marketing, social media publishing & reporting, analytics, contact management (e.g., user segmentation & CRM), landing pages, and contact forms.

We use HubSpot to manage and implement inbound marketing in connection with various features of our online presence. The stored information is kept on HubSpot's servers. We can use the processed data to gain detailed insights into how our online presence is used, to get in touch with visitors to our website, and to determine which of our company's services are of interest to them.

HubSpot uses "web beacons" (invisible graphics or code) and cookies that are embedded in websites or emails and stored on users' devices. This collects the IP address, geographic location, browser type, duration of the visit, and the pages accessed.

Furthermore, HubSpot collects data entered by the user when they (a) subscribe to our newsletter or (b) fill out one of our contact forms.

For more information on data protection at HubSpot, please visit https://legal.hubspot.com/privacy-policy.

Legal basis and purpose of data processing

HubSpot cookies and web beacons are stored based on Article 6(1)(a) GDPR. We also use the information collected via HubSpot based on our legitimate interest in optimizing our marketing, analyzing the use of our online presence, ensuring its continuous improvement and user-friendly design, and providing our users with more targeted information (Article 6(1)(f) GDPR).

Right to object and removal

You can prevent cookies from being stored by adjusting your browser settings accordingly. If you would like your other personal data to be deleted, you can exercise your right to object and removal as described in the General Information section under A.

Alternatively, you can also manage your cookie preferences using our integrated CookieHub management tool.

‍

III. Communication

Generally, we collect the necessary data directly from you during personal contact. However, you are also welcome to contact us by phone, fax, mail, or via the email address provided (see Legal Notice) or any other email addresses of our staff you may have. In the latter case, the personal data transmitted with the email will be stored. Please note that communication via email is unencrypted for technical reasons.

Your data is used to process the conversation and follow up on the respective inquiry or meeting content. Your data is processed based on Article 6(1)(b) GDPR if the communication is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures.

In all other cases, processing is based on our legitimate interests (Article 6(1)(f) GDPR) in effectively handling the inquiries directed to us.

In this context, data is not shared with third parties unless it is necessary to pursue our claims or legitimate interests (Article 6(1)(f) GDPR) or if there is a legal obligation to do so (Article 6(1)(c) GDPR).

‍

IV. Data processing in sales

Personal data is processed based on Article 6(1)(b) GDPR to provide the services you have commissioned, in particular for the execution of our contracts or pre-contractual measures, as well as all activities necessary for the operation and administration of MH Parkservice .

The resulting purposes of data processing are primarily based on the specific activities and individual services agreed upon with you and may include, among other things, consulting activities or tasks related to managing sales processes (e.g., compiling documents, sending MH Parkservice product or event information, providing services through MH Parkservice) or supporting sales negotiations and contract conclusions.

Further details regarding the scope, purpose of data processing, and recipients of your data can be found in the respective contract documents and associated terms and conditions.

Where necessary for our operational processes, we process your data in connection with our services beyond the actual fulfillment of the contract to safeguard our legitimate interests (Article 6(1)(f) GDPR).

In connection with the offer or provision of our services, we may be subject to specific legal obligations, such as requirements under tax law. The purposes of processing your data may therefore include, among other things, compliance with tax-related control and reporting obligations, customs or export regulations, as well as the assessment and management of risks. The data processing required for this is based on Article 6(1)(c) GDPR.

‍

V. Newsletter

Description of data processing

We would like to keep our business customers and interested parties updated with promotional messages about our services, products, webinars, and the latest news from MH Parkservice via email or other electronic notifications (hereinafter referred to as the “newsletter”). To do this, we need your email address. The newsletter sign-up forms may ask for additional information so we can send you personalized content tailored to your interests.

You can sign up for our newsletters by using the relevant sign-up form or by checking a box (opt-in) during the registration process. We provide various ways on our website and within our registration or order interfaces for you to sign up for our (sometimes topic-specific) newsletters. The specific content of each newsletter is described in its respective sign-up form. This description is what your consent applies to.

After signing up, you will receive an email asking you to confirm your subscription (the double opt-in process). This confirmation is necessary to ensure that no one else has misused your email address to sign up for our newsletter without your permission. Your email address will only be added to our mailing list once you click the link in that email.

We use MailChimp, a service provided by the US company Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA (hereinafter “MailChimp”), to manage registrations and send out our newsletters. This service allows us to easily automate the registration process and the necessary email delivery. Since MailChimp’s IT systems are located in the USA, the data you enter in our forms is transferred to and processed in the USA. To ensure your data is handled appropriately, we have entered into a data processing agreement with MailChimp in accordance with Art. 28 GDPR, which includes EU standard contractual clauses for data transfers to third countries. You can find more information about how MailChimp handles personal data here: https://mailchimp.com/legal/privacy/.

For verification purposes, we store your email address, name, IP address, and the date and time of your registration (timestamp) when you sign up for our newsletter.

Legal basis, purpose of data processing, and recipients

The legal basis for sending newsletters is your consent as the recipient (Art. 6(1)(a) GDPR, Art. 7 GDPR in conjunction with Section 7(2) No. 3 of the German Act Against Unfair Competition (UWG)). If consent is not required for existing customers under Section 7(3) UWG, we process this data based on our legitimate interest in direct marketing under Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG.

We log the registration process based on our legitimate interests under Art. 6(1)(f) GDPR to maintain a secure and effective newsletter system that meets both our business sales goals and the needs of our recipients, as well as to provide proof of the consent given.

Storage duration and right to object or withdraw consent

You can object to receiving our newsletter at any time or withdraw your consent, either in full or in part. You will find an unsubscribe link at the bottom of every newsletter. You can also contact us directly using the contact details provided at the beginning of this document.

Unsubscribing from the newsletter will not affect your other business communications with us. If your data is still required for contract fulfillment, it will remain stored. Furthermore, we reserve the right to store the necessary records to prove that our newsletter distribution is compliant with the law until the statutory limitation periods have expired.

‍

VI. Data transfer

Depending on the scope of the services provided, your data or documents may be shared with public authorities, private service providers, or individuals we work with regularly during the inquiry, proposal, or contract execution phases (see Part A, Section V).

‍

E. Other

As we continue to develop our website, services, and other offerings, or due to changes in legal or regulatory requirements, it may become necessary to update this privacy policy. You can access the current version of our privacy policy on our website at any time and print it out if needed.

‍

Privacy Policy (Valid since 30/03/2026)

These Privacy Notices are intended to provide an overview of what happens to your personal data (hereinafter also: “data”) in our company and to inform you about the data-protection claims and rights to which you are entitled within the meaning of the European General Data Protection Regulation (“GDPR”), the German Federal Data Protection Act (Bundesdatenschutzgesetz – “BDSG”), and the Telecommunications-Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutzgesetz – “TDDDG”). We therefore ask you to take note of these Privacy Notices and, if necessary, to print them out or save them.

Personal data is any information that can be used to personally identify you. We may process your personal data for various purposes. In general, the data processing activities carried out by Mobility Hub Parkservice GmbH (hereinafter also “MH Parkservice” or “we”) fall into the following categories:

• General: You can find general information on data protection, data processing operations, and your rights as a data subject, which applies to all processing activities we carry out, in Part A below.
• Our online presence: In connection with our website https://www.mh-parkservice.de/ (hereinafter: “Website”) or related external online platforms, such as our social media profiles, our service portal (https://service.mh-parkservice.de/) or our subsequent payment service (https://parken.mh-parkservice.de/), which link to these Privacy Notices (collectively referred to as “Online Presences”), we process data exchanged between your internet-enabled devices and our servers, as well as data you provide when using the website. You can find more details in Part B.
• Parking area users: For information on how we process data for users of the parking areas we manage—for example, regarding payment processes via the MHP Online Shop or our subsequent payment service, the handling of parking violations by MH Parkservice, or viewing parking violation details via our service portal—please see Part C.
• B2B: To perform or initiate contracts, we process the necessary data of our business customers and prospective clients. Data from our business partners and suppliers is used exclusively for the direct placement, processing, and/or performance of orders. More information is available in Part D.

Please refer to the individual sections if you would like to quickly find context-specific information on particular processing situations.

A. General information on data protection and data subject rights

I. Who is responsible for data processing and who can you contact with questions?

The controller responsible for data processing under the General Data Protection Regulation (GDPR), other national data protection laws of the Member States, and other data protection provisions is:

Mobility Hub Parkservice GmbH
Nördliche Münchner Straße 27a
82031 Grünwald, Germany
Tel.: +49 89 2778299 51
E-mail: info@mh-parkservice.de

‍

If you have questions about data protection, you can reach our Data Protection Officer using the following contact details:

Richard Metz
External Data Protection Officer (TÜV certified) / Attorney-at-law
LLP Data Protect GmbH
Würmtalstraße 20a (postal address)
81375 Munich, Germany
E-mail: datenschutz@mh-parkservice.de

II. What are your rights regarding your personal data?

If your personal data is processed, you are a “data subject” under the GDPR and may be entitled to the rights described below. If you wish to exercise your rights against MH Parkservice as the controller, we recommend that you contact us using the details provided above:

‍

1. Right of access
In accordance with Art. 15 GDPR, you may request confirmation from us as to whether we are processing your personal data and ask for information regarding the extent to which we process your data.

2. Right to rectification
If your personal data is inaccurate or incomplete, you have the right to have it rectified and/or completed pursuant to Art. 16 GDPR.

3. Right to erasure
If the statutory requirements of Art. 17 GDPR are met, you may request the erasure of your data if we are processing it unlawfully or if the processing disproportionately interferes with your legitimate interests. Please note that there may be reasons that prevent immediate erasure, such as statutory retention obligations. Regardless of your request for erasure, we will delete your data completely and immediately once the purpose of processing no longer applies, provided there are no contractual or statutory retention periods preventing us from doing so.

4. Right to restriction of processing
In the cases specified in Art. 18 GDPR, you may request that we restrict the processing of your data. If you have restricted the processing of your personal data, such data may—aside from being stored—only be processed with your consent, for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

5. Right to data portability
Pursuant to Art. 20 GDPR, you have the right to receive the data you provided to us—which we process based on your consent or for the performance of a contract by automated means—in a structured, commonly used, and machine-readable format, and to have it transmitted to you or a third party. If you request the direct transmission of this data to another controller, we will do so provided it is technically feasible. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

6. Right to object
If we process your data based on a legitimate interest under Art. 6(1)(f) GDPR, you may object to this processing at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions (see Art. 21 GDPR). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is for the establishment, exercise, or defense of legal claims.
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes. You may object to the processing of your data for direct marketing purposes at any time without providing a reason.

7. Right to withdraw consent under data protection law
Certain processing operations are only possible with your express consent under Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future. However, the lawfulness of any processing carried out prior to the withdrawal remains unaffected. Please note that even after you withdraw your consent, the processing of your data may still be possible in whole or in part based on other legal grounds.

8. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR in conjunction with § 19 BDSG). A list of the data protection authorities and their contact details can be found at the following link: www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.
If you believe that we are infringing German or European data protection law when processing your data, please contact us so we can clear up any questions.
You also have the right to contact the supervisory authority responsible for us at our registered office:

Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht – BayLDA), Promenade 18, 91522 Ansbach, Germany; Fax: +49 (0) 981 180093-800; E-mail: poststelle@lda.bayern.de; www.lda.bayern.de

III. What personal data is processed and where does it come from?

1. Source of the personal data

We primarily process data that we receive directly from you during the course of initiating business, throughout our business relationship, or when you use our website (see also Part B, Section VI).
Through our website and services, we process data that we receive during your visit or that you actively provide to us while using our site (e.g., when using our online shop). Other data is collected automatically by our IT systems when you visit the website or use our services. This mainly concerns technical data (e.g., internet browser, operating system, or the time of a page view). This data is collected automatically as soon as you enter our website or access one of our services. Details can be found in Part B.
In individual cases, we also process data that we have lawfully received or acquired from third parties such as credit agencies, creditor protection associations, or authorities, or that we have lawfully obtained or collected from publicly accessible sources (e.g., telephone directories, company registers, press, internet, or other media).

2. Categories of personal data

The personal data we regularly process includes master data and contact details such as: title, first name and surname, salutation, date of birth, address, e-mail address, telephone number, fax number, and job title.
In addition, depending on the order, service, or other relationship with you, we process the following personal data:

• Address data: street, house number, any address additions, postal code, city, country
• Contact data: telephone number(s), e-mail address(es)
• Vehicle data: vehicle registration number, vehicle owner
• Parking space management data: photographs, date and period of use of a parking space, parking authorizations, bank account details, payment details
• Registration data: information about the service for which you registered; dates and technical information on registration, confirmation, and deregistration; data provided by you during registration
• Quotation data
• Access data: date and time of the visit to our service; the page from which the accessing system reached our site; pages accessed during use; data for session identification (session ID); as well as the following information about the accessing computer system: internet protocol address used (IP address), browser type and version, device type, operating system, and similar technical information
• Information on the type and content of our business relationship such as contract data, order data, turnover and receipt data, customer and supplier history, and consulting documents
• Advertising and sales data
• Documentation data (e.g., consultation records, data from service calls, or support cases)
• Other data that we have received from you during our business relationship (e.g., in customer meetings)
• Documentation of declarations of consent

‍

IV. For what purposes and on what legal basis is the data processed?

We process your data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) in their current versions, in particular on the following bases:

1. Performance of (pre-)contractual obligations (Art. 6(1)(b) GDPR)

Personal data is processed on the basis of Art. 6(1)(b) GDPR for the performance of contractual obligations of MH Parkservice, in particular in connection with the sale and distribution of our goods and services (hereinafter also “parking services”) and all activities that are customary in the industry and required for the operation and/or administration of MH Parkservice (e.g., customer and user administration). The data may also be processed at the pre-contractual stage when initiating business with MH Parkservice or in the performance of other contractual relationships with MH Parkservice.

‍
Art. 6(1)(b) GDPR is the legal basis, for example, in the following cases:

‍

• Creation and management of a partner or supplier account in our CRM system
• Creation and management of customer/prospect files and/or our customer/prospect database in our CRM system
• Sending of information
• Offering and selling MH Parkservice products
• Offering and performance of our services

Details regarding the purpose of this data processing can be found in the relevant contractual documents and terms and conditions.

‍

2. Safeguarding legitimate interests (Art. 6(1)(f) GDPR)

On the basis of a balancing of interests, processing may, beyond the actual performance of a contract, take place to safeguard legitimate interests of MH Parkservice or third parties. This is permissible provided that your interests or fundamental rights and freedoms which require the protection of personal data do not prevail. Processing to safeguard legitimate interests occurs, for example, in the following cases:

• Providing our online services, including their functions and content
• Using technically necessary cookies or similar technologies as defined by § 25(2) TDDDG
• Responding to inquiries and communicating with users
• Sharing data with affiliated companies and partners
• Processing payments via external service providers
• Engaging debt collection agencies and attorneys to recover or enforce claims in court
• Asserting other legal claims and defending against legal disputes
• Advertising and marketing
• Conducting market and opinion research, and managing and developing our business services
  Maintaining customer, prospect, and service provider databases to improve our offerings
  Performing risk assessments (due diligence) for potential corporate restructuring or company acquisitions/sales
  Ensuring IT security and the operation of our company and services
  Implementing building and facility security measures

‍

3. Compliance with legal obligations (Art. 6(1)(c) GDPR)

We may need to process your data to fulfill various legal obligations and requirements, such as those under the German Commercial Code (Handelsgesetzbuch) or the Fiscal Code (Abgabenordnung).
‍

4. Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG)

If a service we use stores information on your device or accesses information already stored there, we require your consent under § 25(1) sentence 1 TDDDG. If the service does not access your device, the GDPR applies. When we request your consent under the GDPR, we do so based on Art. 6(1)(a) in conjunction with Art. 7 GDPR.
‍
If you have provided consent for specific data processing, we will process your data according to the purposes and scope agreed upon in that declaration. You can withdraw your consent at any time, for example for our newsletter, and it will take effect for the future. Please use the contact details provided in Part A, Section I or II. Note that any processing carried out before your withdrawal remains unaffected, and we may still be permitted to process your data in part based on other legal grounds.

‍

V. Who receives my data?

Within MH Parkservice, your data is only accessible to employees and departments that need it to fulfill our contractual and legal obligations or to pursue our legitimate interests.

To initiate or perform a contract (e.g., selling or providing parking services) under Art. 6(1) sentence 1(b) GDPR, and based on our legitimate interests under Art. 6(1) sentence 1(f) GDPR, we share your data with companies that assist us in providing our services or fulfilling contracts. This includes the following recipients and categories of recipients:

• IT service providers (e.g., email services, web hosting)
  
  • Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA (cloud storage)
  • Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (app function optimization)
  • Airparser, Sepapaja tn 6, Tallinn 11415, Estonia (document management software)
  • Celonis SE, Theresienstr. 6, 80333 Munich, Germany (integration platform)
  • Datadog Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (system security and monitoring)
  • Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA (AI platform and chat function provider)
  • Deutsche Post Adress GmbH & Co. KG, Am Anger 33, 33332 (address verification)
  • Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA (ticketing system)
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (email service provider)
  • HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA (CRM system)
  • LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam, Germany (proofreading services)
  • Leaping AI UG (haftungsbeschränkt), Potsdamer Straße 72, 10785 Berlin, Germany (AI-based call center software)
  • Octa Inc., 100 First Street, Floor 6, San Francisco, CA 94105, USA (Auth0 provider; system security)
  • OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (AI model provider)
  • Peter Park System GmbH, Balanstr. 71a, 81541 Munich, Germany (IT managed services and parking management systems)
  • sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany (accounting software)
  • Talkdesk Inc., 201 Spear Street, Suite 1100, San Francisco, CA 94105, USA (contact center software)
  • Trustpilot A/S, Pilestræde 58, 5th Floor, DK-1112 Copenhagen, Denmark (review management)
  • Webflow, Inc., 398 11th Street, San Francisco, CA 94103, United States (website hosting)
  • Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France (translation services)
• Sales partners
• Advertising partners
• Insurance companies
• Banks
• Communications providers (telephone and fax)
• Payment service providers
  
  • Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ Amsterdam, Netherlands
  • Stripe Deutschland GmbH, Prielmayerstr. 3, 80335 Munich, Germany
  • secuPay AG, Goethestraße 6, 01896 Pulsnitz, Germany
  • Shipping and logistics providers
  • Credit agencies
  • Auditors
  • Tax and legal advisors

When we use a service provider as a processor under Art. 28 GDPR, we remain responsible for your data. Where required by law, these processors are contractually bound by a data processing agreement to keep your data confidential and process it only as instructed. They receive your data only to the extent necessary to perform their services.

Data is only shared with government bodies or authorities if required by national law or if you have instructed us to do so.

‍

VI. How long will my data be stored?

Your personal data is used only for the purpose for which you provided it or consented to, and is stored only as long as that purpose remains valid. Once the purpose is fulfilled or you request deletion, we will only retain your data if required by statutory limitation periods or retention obligations (e.g., tax and commercial law). Once these periods expire, the data will be deleted unless you have explicitly consented to further use. You may exercise your rights, such as requesting that your data be blocked, even during retention periods; see Part A, Section II.

We will delete or block your data as soon as the storage purpose no longer applies or you request deletion.

In general, we process and store your data only until the end of our business relationship or until the expiration of applicable warranty, guarantee, or limitation periods. For example, the standard limitation period under §§ 195 et seq. of the German Civil Code (BGB) is three years, but can be up to thirty years in certain cases. We may also need to retain data until any legal disputes in which the data is required as evidence are finally resolved.

Furthermore, we are subject to statutory documentation and retention requirements (e.g., under the German Commercial Code § 257 HGB, the Money Laundering Act, or the Fiscal Code § 147 AO). These retention periods range from two to ten years. For instance, we may be required to store your data after our contract ends until the tax audit for the last calendar year you were our customer is complete.

VII. Is personal data transferred to a third country?

As part of our processing activities, personal data may sometimes be transferred to entities in so-called third countries outside the EU or EEA—such as the USA—where the European Commission has not yet confirmed an adequate level of data protection. If such a transfer is necessary in a specific case, it will only occur based on an adequacy decision by the European Commission, standard contractual clauses, appropriate safeguards to ensure data protection compliance, or your explicit consent.

‍

B. Using our online services

In general, you can visit our online services for informational purposes without providing any personal details (like registering, placing orders, or otherwise sharing personal information). In these cases, we only process your personal data if it’s necessary to provide a functional website and our content and services, or if cookies or similar technologies used on the site transmit information during your visit. You can find details about our own cookies and similar technologies in Part B, Section II. Beyond our own tools, our partners or third parties may also use cookies or similar technologies to recognize your browser on your next visit. You can find information about these third-party cookies and technologies in Part B, Section III.

We generally only process users’ personal data after receiving their consent. An exception applies when obtaining prior consent is not possible for practical reasons and the data processing is permitted by law.

I. Providing the website and creating log files

How we process your data
‍

Every time you access our website, our system automatically collects data and information from your device’s browser and sends it to us or our web host (these are called log files). These server log files include IP addresses or other data that could potentially identify a user—for example, if the link you used to reach our site or the link you click to leave it contains personal information. Our hosting provider collects and stores the following details:

• Browser type and version
• Operating system
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is stored in our web host’s log files and is not kept together with any other personal data about you.

We use Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (www.webflow.com) as our web host and software provider to build, host, and run our website, online forms, and other web elements (“Webflow”). You can find Webflow’s privacy policy here: https://webflow.com/legal/eu-privacy-policy. We have signed a data processing agreement with Webflow in accordance with Art. 28 GDPR (“Data Processing Addendum,” see https://webflow.com/legal/dpa). As part of these services, data may be transferred to the USA based on standard contractual clauses agreed upon with Webflow in their Data Processing Addendum, or through an equivalent data protection guarantee for processing on our behalf.

Legal basis and purpose of processing

The legal basis for temporarily storing this data and the log files is Art. 6(1)(f) GDPR. The information listed above is also necessary to provide our service under § 25(2) no. 2 TDDDG.
The system must temporarily store your IP address to deliver the website to your computer, which requires keeping it for the duration of your session.
We store this data in log files to ensure the website functions correctly. It also helps us optimize the site and keep our IT systems secure.

Storage duration and your right to object

We delete the data as soon as it is no longer needed for the purpose for which it was collected. For data collected to provide the website, this happens once your session ends.

‍
Data stored in log files is deleted after no more than 7 days.
Because collecting this data is essential for the website to function, you cannot opt out of this process.

‍

II. Using cookies and similar technologies

How we process your data

Our website uses cookies and similar methods (like web beacons or local storage) to collect, process, and use usage data (such as access times or pages visited) and metadata/communication data (like your IP address or device info), which may include personal data. For simplicity, we refer to all these technical methods as “cookies” below.

Cookies are text files containing a unique string of characters that are stored on your computer by your internet browser. They allow your browser to be uniquely identified when you return to our site. When you visit a website, a cookie may be saved to your operating system. These cookies help make our website more user-friendly, effective, and secure. When you visit a site that uses cookies, any data you enter is stored exclusively in the cookie on your computer. This data is only transmitted when you request a page from our servers.

Some cookies are deleted as soon as you close your browser (session cookies). These are technically necessary, for example, to keep you logged in to an application as you move between pages.

Other cookies remain on your device for a set period, allowing us to recognize your browser on your next visit (persistent or protocol cookies). These cookies help us provide a better user experience, "recognize" you, and show you more relevant content each time you return.

Cookies from partner companies or third parties may be used to collect information for advertising, personalized content, or statistics ("third-party cookies"). Unless we explicitly identify them as third-party, cookies are from our own service ("first-party cookies"). We will inform you separately in the following sections of this privacy policy about any third-party cookies or tracking technologies we use.

Flash cookies are data elements stored on your computer by websites that use Adobe Flash. These cookies do not have an expiration date.

For more information on the cookies and similar technologies we use, their purpose, and what data they store or share with third parties, please use our "CookieHub" management tool, provided by CookieHub ehf, Hafnargata 18, 230 Reykjanesbær, Iceland. When you visit our website, you can use this tool to manage your preferences and provide consent for the use of cookies and similar technologies.

Our cookie management tool uses JavaScript to collect log files and consent data. This allows us to inform you about the tags on our site and to obtain, manage, and document your consent. The tool saves your selected settings and consent preferences when you enter the site and processes the following data:

Consent data (anonymized log data: Consent ID, Processor ID, Controller ID, consent status, timestamp)
Device data (including truncated IP addresses (IPv4, IPv6), device information, timestamp)
User data (including email, ID, browser information, setting IDs, changelog)

To function, the cookie management tool stores a technically necessary cookie. You can find CookieHub’s privacy policy here: https://www.cookiehub.com/legal/privacy-policy.

You can find more details about the cookies we use, their purpose, and the data they collect or share in the detailed information provided by CookieHub, which you can access under "More options" or "Cookie declaration." CookieHub automatically scans our website to identify which cookies are in use, and the list of procedures and the cookie declaration are updated automatically.

‍

Legal basis and purpose of data processing

The legal basis for processing personal data via cookies and similar technologies is Art. 6(1)(f) GDPR, as we have a legitimate interest in ensuring our website functions securely and effectively, unless we have requested your consent under Art. 6(1)(a) GDPR.
The legal basis for storing and accessing other information is § 25(1) TDDDG for cookies requiring consent; for cookies essential to the website's functionality, § 25(2) no. 2 TDDDG applies.

We use CookieHub to manage consents, making it easier for you to choose which categories of cookies and similar technologies you allow. CookieHub blocks all non-essential cookies unless you provide consent. You will see an interface for this when you first visit our site.
By clicking "Accept all," you can allow all procedures, or you can use "More options" to toggle individual settings and click "Save settings" to confirm your choices.
Alternatively, you can reject all non-essential cookies by clicking "Essential cookies only," which will limit the site to only those cookies required for operation.

Technically necessary cookies are used to make our website easier to use and are required to provide our service under § 25(2) no. 2 TDDDG. Certain features of our website will not work without them, as they allow the browser to recognize you as you navigate between pages.

The purpose of other cookies—categorized as "Analytical," "Marketing," or "Necessary" in our cookie declaration—depends on the specific services used. These are explained in the following sections of this privacy policy and in more detail within CookieHub.

The legal basis for data processed by our cookie management tool is Art. 6(1)(c) GDPR for consent data, and Art. 6(1)(f) GDPR and/or § 25(2) no. 2 TDDDG for other processing. As the website operator, we have a legitimate interest in managing cookie consent in a user-friendly, legally compliant way.

‍

Storage period / right to object and removal

You can find details on how long our cookies are stored in the "Cookie declaration" section of CookieHub.
Cookies are stored on your device and sent to our website, meaning you have full control over their use. You can disable or restrict cookies by changing your browser settings, and you can delete existing cookies at any time, including automatically.
If you disable cookies for our website, some features may not work as intended.
Alternatively, you can use our integrated cookie consent tool to withdraw your consent or change your preferences at any time by clicking "Cookie settings" (found at the bottom left of our website).
‍

III. Statistical analysis of the website / increasing reach

1. Google Analytics

‍

Description of data processing

For our online services, we use features from the web analytics service Google Analytics. The provider for Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”), a subsidiary of Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA.
Google Analytics also uses cookies. The information generated by a Google cookie about your use of this website is generally transmitted to and stored on a Google server in the USA. Google processes this data, and we receive reports on your user behavior. These may include, among other things, the following reports:

Audience reports: Audience reports help us get to know our users better and understand more precisely who is interested in our service.
Behavior reports: Here we learn how you interact with our website. We can track the path you take on our site and which links you click.
Real-time reports: Here we see immediately what is happening on our website, for example, how many users are currently reading this text.

Google Analytics uses a tracking code to create a random, unique ID linked to your browser cookie. This allows Google Analytics to recognize you as a new user. When you visit our site again, you will be recognized as a “returning” user. All collected data is stored together with this user ID. This is the only way to evaluate pseudonymous user profiles.

Through identifiers such as cookies, your interactions on our website are measured. Interactions include all types of actions you perform on our website. If you also use other Google systems (such as a Google account), data generated via Google Analytics may be linked to third-party cookies. Google does not pass on Google Analytics data unless we, as the website operator, approve this. Exceptions may occur where legally required. The cookies used by Google Analytics can be found in the detailed information of our cookie management tool, CookieHub, which you can access there under “Cookie declarations”.

Our website uses Google Analytics exclusively with the “anonymizeIp()” extension. Your IP address is therefore not stored in full and is truncated by Google within Member States of the European Union or in other contracting states of the Agreement on the European Economic Area before transmission to the USA. Identification of the website visitor is excluded. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.
Below we provide an overview of key data collected with Google Analytics:

Heatmaps: Google creates so-called heatmaps. Heatmaps show exactly which areas you click. This gives us information about where you “navigate” on our page.
Session duration: Google defines session duration as the time you spend on our site without leaving it. If you are inactive for 20 minutes, the session ends automatically.
Bounce rate: A “bounce” occurs if you view only one page on our website and then leave.
Account creation: If you create an account on our website or place an order, Google Analytics records this data.
Location: The IP address can be used to determine the country and your approximate location (IP-based location determination).
Technical information: Technical information includes, among other things, your browser type, your internet service provider, or your screen resolution.
Source: Google Analytics (and we) are also interested in which website or which advertisement brought you to our site.

This list is not exhaustive and serves only as general guidance regarding data storage by Google Analytics. For further information about Google’s data processing, please refer to Google’s privacy policy: https://policies.google.com/privacy?hl=en.

‍

Legal basis and purpose of data processing

We use Google Analytics to analyze the use of our website and services, to compile reports on activities on our website and services, and to provide us with further services related to the use of our website and services and internet usage. We also use Google Analytics to evaluate data from AdWords and the DoubleClick cookie for statistical purposes.
As we, as the operator of the website and services, have a strong interest in this analysis of user behavior in order to optimize both our website and our offers placed there as well as our advertising, we request your consent to the use of Google Analytics and the storage of Google Analytics cookies on the basis of § 25(2) TDDDG.

The information generated by the cookie about your use of our website and/or our services is generally transmitted to a Google server in the USA and stored there. If IP anonymization is activated, your IP address is truncated by Google within Member States of the European Union or in other contracting states of the Agreement on the European Economic Area beforehand. Nevertheless, in exceptional cases, the full IP address may be transmitted to a Google server in the USA and truncated there.
By consenting to the setting of Google Analytics cookies, you also consent pursuant to Art. 49(1) sentence 1(a) GDPR to your data being processed in the USA if the transfer is not safeguarded by EU standard contractual clauses. The USA is regarded by the European Court of Justice as a country with an insufficient level of data protection under EU standards. In particular, there is a risk that your data may be processed by US authorities for control and surveillance purposes, possibly without the possibility of legal redress. If you click the “Reject all” button or choose a limited selection without Google cookies, the transfer to Google described above will not take place. You may withdraw your consent at any time with effect for the future.

Google will use this information to evaluate your use of the website and/or services, to compile reports on website activities for us, and to provide further services related to website use and internet use. Google also states that it may transfer this information to third parties under its own responsibility where required by law or insofar as third parties process this data on Google’s behalf. Google has contractually assured that it will not, under any circumstances, associate your IP address with other Google data. In order to safeguard this and the data processing carried out for us, we have concluded a data processing agreement with Google.

Storage period / possibility of objection and removal
Cookies are stored on the user’s computer and transmitted by the user to our website. Therefore, you as a user have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies already stored can be deleted at any time, including automatically. If cookies are deactivated for our website, not all functions of the website may be fully usable.

By installing the browser add-on to deactivate Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=en), you can object to the use of your data and its collection by Google Analytics. This tells Google Analytics that no information about your website visit should be transmitted to Google Analytics.

Furthermore, particularly on browsers of mobile devices, you can install an opt-out cookie on your device using the link https://developers.google.com/analytics/devguides/collection/gajs/?hl=en#disable so that data collection by Google Analytics on our online presence is prevented in the future. Please note that if you delete cookies on your device, you must also reinstall the opt-out cookie.

Alternatively, you can set your cookie preferences via the cookie consent tool CookieHub integrated by us.
‍

2. Google Tag Manager

Description of data processing

Google Tag Manager is a solution provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”) that allows marketers to manage website tags via an interface. Google Tag Manager itself (which implements the tags) is a domain without cookies and does not collect personal data. Google Tag Manager assists in integrating and triggering other tags, code snippets, tracking codes and conversion pixels on a website, which may themselves collect data. Google Tag Manager does not access this data. Google Tag Manager provides us with an easy-to-use user interface that does not require advanced programming skills or modifications to the website source code.
‍
We use Google Tag Manager solely for displaying Google Ads (formerly Google AdWords) for the purposes of our search engine marketing activities.
For further information on Google Tag Manager, see: https://www.google.com/intl/en/tagmanager/use-policy.html.

‍

3. Google Ads (formerly Google AdWords) & Google Ads Conversion Tracking

Description of data processing

We use Google Ads, a service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, offered in Europe by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, to integrate advertisements within our online offering and to draw attention to our attractive offerings by means of advertising materials on external websites.

‍
This enables us to determine how successful individual advertising measures are. These advertising materials are delivered by Google via so-called “ad servers”. Google AdWords uses cookies for this purpose (see the general information above). Setting the cookie enables an analysis of the use of our websites. Each time an individual page of the website operated by us is accessed on which a Google Ads component has been integrated, the internet browser on the information technology system of the data subject is automatically prompted by the respective Google Ads component to transmit data to Google for the purposes of online advertising and commission billing. In the course of this technical process, Google obtains knowledge of personal data such as the IP address of the data subject, which serves Google, among other things, to trace the origin of visitors and clicks and subsequently to enable commission billing.
As analysis values, the cookie generally stores the following information: unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions), opt-out information (marking that the user no longer wishes to be addressed). These cookies enable Google to recognise your web browser. If you do not agree to the storage of cookies on your computer, please follow the general instructions on this or the instructions at the end of this explanation.
In addition, Google Ads uses so-called web beacons (invisible graphics). These web beacons can be used to evaluate information such as visitor traffic on the pages of this offering.

The information generated by cookies and web beacons about the use of our online presence, including your IP address, and the delivery of advertising formats are transmitted to and stored on a Google server in the USA. This information may be passed on by Google to Google’s contractual partners (see https://support.google.com/admanager/answer/94149?visit_id=637060482444635472-69980806&rd=1). In detail, we have no influence on the data collected by Google, nor are we aware of the full scope of data collection or the storage period. To the best of our knowledge, Google will not combine your IP address with other data stored about you. However, if you are logged into a Google account, your data can be directly assigned to you. If you do not want this association with your Google profile, please log out before using our online offering.
Further information on data protection in relation to Google Ads can be found at https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/ads?hl=en.

‍

Legal basis and purpose of data processing

Google Ads cookies and web beacons are stored on the basis of Art. 6(1)(a) GDPR. In addition, we use Google Ads on the basis of our legitimate interest under Art. 6(1)(f) GDPR. As the website operator, we have a legitimate interest in analysing the reach of our offering, placing relevant and interesting ads, improving campaign performance reporting and achieving a fair calculation of advertising costs.
‍
We have also concluded a data processing agreement with Google.

‍

Right to object and removal

You can prevent the installation of cookies by Google Ads in various ways:
a) by setting your browser software accordingly; in particular, suppressing third-party cookies will mean you do not receive ads from third-party providers;
b) by deactivating interest-based ads with Google via www.google.com/ads/preferences, whereby this setting will be deleted if you delete your cookies;
c) by deactivating interest-based ads of providers that are part of the self-regulatory “About Ads” campaign via www.aboutads.info/choices, whereby this setting will be deleted if you delete your cookies;
d) by permanently deactivating in your browsers Firefox, Internet Explorer or Google Chrome under www.google.com/settings/ads/plugin.
We point out that in this case you may not be able to use all functions of our online offering to their full extent.

Alternatively, you can set your cookie preferences via the cookie management tool CookieHub integrated by us.

‍

Amplitude

Description of data processing

‍
We use Amplitude, a web analytics software provided by Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (“Amplitude”), to optimise our online shop and our Mobile Payment App. This procedure serves to evaluate and analyse user behaviour and to compile reports on activities for us. Data is collected in near real time as soon as the user performs a certain action (e.g. clicks a button, loads a page or completes a purchase). The following categories of data are affected:

- Usage data: clicks, pages visited, time spent, feature usage
- Device data: operating system, browser type, device type, screen resolution
- Identifiers: pseudonymised user IDs, Amplitude internal IDs, IP address (a shortened IP address is processed)

Cookies are also stored on your computer for this purpose. The information generated in this way is transmitted to and stored on an Amplitude server in the USA. We have concluded a data processing agreement with Amplitude (Data Processing Addendum) which contains the EU Standard Contractual Clauses as the mechanism for transferring personal data from the EU to the USA. Amplitude is certified under the EU–US Data Privacy Framework, which prescribes minimum standards for the protection of Europeans’ personal data that is stored or processed in the USA.
Further information about Amplitude’s data processing can be found in Amplitude’s privacy notices (https://amplitude.com/privacy).

‍

Legal basis and purpose of data processing

We use Amplitude to evaluate the use of our services, to compile reports about activities on the services concerned, and to better understand the use of our services. This helps us identify opportunities for improvement and optimise our page performance and features. As we, as a service provider, have a strong interest in analysing user behaviour for the purpose of product improvement, we request your consent to the use of Amplitude and the storage of cookies on the basis of § 25(2) TDDDG.

‍

Storage period / possibility of objection and removal

If you do not want cookies to be stored, you are requested to configure your internet browser so that it deletes cookies, blocks all or certain cookies, or issues a warning before cookies are stored. You can also set your cookie preferences via the cookie management tool CookieHub integrated by us.

‍

‍

IV. Further information on procedures, plugins and tools used to design the website

1. SSL/TLS encryption

‍
This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator. You can recognise an encrypted connection by the fact that the browser address line changes from “http://” to “https://” and by the lock symbol in your browser line.

‍
If SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

‍

2. make.com

Description of data processing

To integrate different databases and web tools, we use make, a service of Celonis SE, Theresienstr. 6, 80333 Munich, Germany. make is an interface on which various cloud-based software applications can be linked, as it were. Data required or processed in such linked applications is automatically transferred through these links. The aim is to allow digital processes to run independently, in particular standardised, recurring processes. This creates an automated flow of data and efficient processes.
Further information on data protection at Celonis can be found at https://www.make.com/en/privacy-notice and https://www.celonis.com/de/privacy-notice/.

Legal basis and purpose of data processing

The use of make.com is based on Art. 6(1)(f) GDPR. We have an interest in the efficient automation of processes, the combination of different services, and the associated import and export of personal and contact data.

‍

Language versions of our website (translations via Weglot)

How we process your data

We use the translation service Weglot, provided by Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France, on our website. Weglot loads when you visit the site, allowing you to switch languages using the provided icons. By integrating Weglot, your browser connects to their servers, and your IP address and device information are transmitted to them. This data is necessary for Weglot to function.
‍
Weglot processes this data as a processor under a data processing agreement in accordance with Art. 28 GDPR within the European Union.
‍
You can find more information on how Weglot handles personal data at https://www.weglot.com/privacy.

Legal basis and purpose

We process data in connection with Weglot based on our legitimate interest under Art. 6(1)(f) GDPR to provide our website in multiple languages and offer a selection option for our visitors, provided we are not requesting further consent under Art. 7 GDPR or § 25 TDDDG.

Opting out and removal

Using Weglot is essential for providing our website in different languages.
If you would like your personal data deleted, you can exercise your right to object and removal as outlined in the general information in Part A.

‍

‍

4. Embedding YouTube content

How we process your data

We occasionally use content or services from the YouTube video platform to embed videos on our site or link to our YouTube channel. YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and is provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (referred to as “Google”).
We may process data you provide on our YouTube channel (such as your username and any content you publish) when we respond to your comments or messages.
Otherwise, we only receive non-personal information from Google regarding post activity, such as click counts or how long a video was watched. This data is accessible via our YouTube account. Google processes data under its own responsibility, and we have no control over their use of analytics tools within YouTube.

If you choose to play an embedded video by clicking the play button, your IP address is sent to YouTube, as they need it to deliver the video to your browser. Your IP address is therefore required for the video to display. Additionally, the YouTube server is notified which page of our website you visited. If you are logged into your YouTube account, you allow YouTube to link your usage behavior directly to your personal profile when you play our videos. You can find more information about how Google processes data when using YouTube in their policies here: https://policies.google.com/privacy?hl=en&gl=en

Legal basis and purpose

We use YouTube based on our legitimate interests under Art. 6(1)(f) GDPR to provide video content on our website, link to it, and manage inquiries or comments.

Retention period and opting out

To prevent your activity from being linked to your user account, please log out of your YouTube profile before playing our videos. To restrict how Google processes your data, please check your Google or YouTube account settings, such as the “Privacy and security” section in your Google account. On mobile devices (smartphones, tablets), you can also restrict Google’s access to data like contacts, calendars, photos, and location through your device settings, depending on your operating system.

‍

5. Auth0

Description of data processing

For registration and login in our online shop, we use the cloud-based identity management platform Auth0 provided by Okta Inc., 10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA.
‍
When users enter data into a form provided by Auth0, this data is exchanged directly between the user’s browser and Auth0. For identity management, authentication (login/registration) and security of user accounts, the following data is processed:

- Inventory data: email address, name, and potentially profile picture (social login)
- Security data: password hashes, two-factor authentication (MFA) data, and session tokens
- Metadata: IP address of the login, timestamp, and browser/device used (for fraud detection)

Collection occurs exclusively during the login or registration process and whenever the session is renewed (session refresh).
Further information on data processing by Auth0 can be found at https://www.okta.com/legal/privacy-policy/.
We have selected Europe as the server location for data storage. In cases where data transfer to the USA may be required, we rely on the EU Standard Contractual Clauses, which we have included in our data processing agreement.

Legal basis and purpose of data processing

Auth0 is integrated based on our legitimate interest under Art. 6(1)(f) GDPR to ensure that only authorized and identified persons gain access to our services. Auth0 is also necessary to provide the service within the scope of user account access pursuant to § 25(2) no. 2 TDDDG.

Storage period / possibility of objection and removal

If you do not want cookies to be stored, you can configure your internet browser to delete cookies, block all or certain cookies, or issue a warning before cookies are stored. You can also set your cookie preferences via the CookieHub management tool we have integrated.

‍

6. Datadog

Description of data processing

We use DataDog, a service provided by DataDog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (“DataDog”), as a processor within the meaning of Art. 4 nos. 8 and 28 GDPR.

‍
We use DataDog to monitor system stability and analyze errors (such as unexpected deviations, anomalies including latency—i.e., time delays in data transmission to our servers—availability, and response times) on our online platforms and services, as well as for IT security purposes.
For this purpose, DataDog collects the following data on our behalf:

Log data: technical logs regarding server requests (contains users’ IP addresses)
Performance data: app response times, error rates, error information, and crash reports (stack traces, i.e., the sequence of applications that led to an error, and the time the error occurred)
Metadata: system configurations (e.g., browser type and version, operating system) and anonymized user IDs for tracing errors across different microservices

Using this data, errors can be detected, analyzed, and promptly resolved with the help of DataDog. The collected personal data may be transferred to DataDog in the USA and stored there. We have concluded a data processing agreement with DataDog that includes the EU Standard Contractual Clauses. DataDog is also certified under the EU–US Data Privacy Framework, which serves as a basis for data transfers to certified companies and organizations in the USA.
Further information about DataDog’s data processing can be found in their privacy policy: https://www.datadoghq.com/legal/privacy/.

Legal basis and purpose of data processing

After this period expires, only aggregated data without personal identifiers will be retained.
Processing is based on our legitimate interest under Art. 6(1)(f) GDPR in the error-free and proper operation of our online platforms and services, as well as in error detection and remediation.
DataDog is therefore necessary to provide our online platforms and services within the scope of user account access pursuant to § 25(2) no. 2 TDDDG.

Storage period / possibility of objection and removal

Data collected with DataDog is deleted or anonymized after the error analysis is complete.

‍

V. Links to websites of other providers

‍
Our online presence may contain links to other websites. We have no influence on the content and design of other providers’ offerings. These Privacy Notices therefore do not apply to external providers’ offerings or content to which we merely link.
If you are redirected to other sites via links from our pages, please inform yourself there about the respective handling of your data.

VI. Online presences on social networks and platforms

Description of data processing

We maintain additional online presences within social networks and/or industry networks (such as Facebook, Xing or LinkedIn) (hereinafter also “SN”) and platforms (e.g. YouTube) and link to them from our website. By clicking the respective buttons (recognisable by the logos of the social networks or platforms), you are taken to the respective online presence of the SN. The purpose of these online presences is to communicate with customers, prospective customers and users active there and to inform them about our services.
When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply.

Since the use of SN takes place outside our website and/or our services, we have no influence on it unless otherwise stated below. However, we point out that when using the platforms and networks mentioned above to which we link, data may also be processed in the USA by these SN companies and may also be processed by the respective operators for market research and advertising purposes, including the creation of user profiles. If you are logged into the respective networks and platforms, they may also store cookies on your device, which can track your use of our platform or services and further information about your usage behaviour.
Unless otherwise stated in these Privacy Notices, we process users’ data only if they communicate with us within the social networks and platforms, e.g. by writing comments or sending us messages.
‍
To make it easier for you to obtain information about the respective data processing and the objection options of the respective operators, we refer below to the privacy policies and information of the operators of the respective networks.
‍

Legal basis and purpose of data processing

We process your personal data only in the context of direct contact with us via the respective SN or interaction with our presence there or its content. Unless otherwise stated in these Privacy Notices, we process users’ data on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR for effective user information and communication only insofar as they communicate with us within the social networks and platforms (e.g. if users post content on our online presences or send us messages). If your contact is aimed at concluding a contract, an additional legal basis for processing is Art. 6(1) sentence 1(b) GDPR.
Insofar as, in connection with our presence on an SN, personal data is processed and the respective SN alone decides on the purposes and means of processing, the respective SN is otherwise solely responsible for the processing. Please carefully consider which personal data you disclose to us via an SN presence. If you wish to avoid SN processing personal data you transmit to us, please contact us by other means.

Storage period / possibility of objection and removal

If you are a member of an SN on which we maintain online presences and do not want the SN to collect data about you via our offering and link it to your SN data, you must log out of your SN before visiting our offering. For a detailed presentation of the respective processing, information on the duration of data storage by the respective SN and the options to object (opt-out), we refer you to the information of the providers linked below.
In the case of information requests and the assertion of user rights, we also point out that these can be asserted most effectively with the providers. Only the providers have access to users’ data and can take appropriate measures directly and provide information. If you nevertheless require help, you may contact us.

Facebook

We operate a Facebook company page (“fan page”) on the SN of Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
‍
Facebook Ireland is jointly responsible with us for the collection of data of visitors to our fan page. For this reason, we have concluded an agreement on joint processing of personal data with Facebook within the meaning of Art. 26 GDPR, as well as additional data processing terms:
‍
- “Controller Addendum”: https://www.facebook.com/legal/controller_addendum
- “Data Processing Terms”: https://www.facebook.com/legal/terms/dataprocessing/update
‍
We are responsible for providing data subjects with at least the information above and below regarding joint controllership with Facebook. The information required under Art. 13(1)(a) and (b) GDPR by Facebook can be found in Facebook Ireland’s data policy at https://www.facebook.com/about/privacy.
‍
Facebook Inc., Menlo Park, California, USA (hereinafter: “Facebook Inc.”), also collects and uses so-called Page Insights for analysis purposes. Page Insights are aggregated data by which both we and Facebook Inc. can gain insight into how users interact with our page. Page Insights may be based on personal data collected in connection with a user’s visit or interactions on our page. For this purpose, we have concluded the above Controller Addendum, which in particular regulates which security measures Facebook takes in connection with Page Insights and how Facebook responds to user enquiries. The purposes for which the collection and transmission of personal data constituting joint processing take place are set out in detail in the terms of use referenced by the Controller Addendum.
‍
The data collected in connection with visiting our fan page otherwise includes information about the types of content users view or interact with, or the actions they take (see “Things you and others do and provide” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data) as described in detail under “Device information” in the Facebook Data Policy: https://www.facebook.com/policy.
‍
By operating the Facebook company page, we share responsibility for Page Insights. We have agreed with Facebook Ireland that Facebook Ireland is responsible for fulfilling the rights of data subjects pursuant to Arts. 15–20 GDPR with regard to personal data stored by Facebook Ireland following joint processing. We therefore have an obligation to notify Facebook if we receive data protection enquiries regarding Page Insights. Please note that we forward enquiries concerning Page Insights to Facebook Ireland. Otherwise, please refer to the information on your data subject rights in Part A. Further information on how Facebook Ireland processes personal data, including the legal basis relied upon and the ways to exercise data subject rights vis-à-vis Facebook Ireland, can be found in Facebook Ireland’s Data Policy at https://www.facebook.com/about/privacy.
‍
The evaluation of data collected via Page Insights serves to improve our Online Presences and for advertising purposes. We operate our Facebook fan page for the purpose of communication and simple channeling of contact enquiries from Facebook users. The collection and further processing of this data is in our legitimate interest and in Facebook Inc.’s legitimate interest pursuant to Art. 6(1)(f) GDPR.
‍
We draw attention to the fact that we cannot enable or disable the Page Insights technology. Corresponding requests must therefore largely be forwarded to Facebook Ireland unless we have collected data ourselves. If you do not want Facebook Inc. to collect your data, please do not use our Facebook company page and/or configure your browser to prevent cookies from being set and/or log out of Facebook while using our page.

Privacy policy: https://www.facebook.com/about/privacy/, https://www.facebook.com/legal/terms/information_about_page_insights_data
Objection options: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com
‍

LinkedIn

LinkedIn is a service of LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA, operated in Europe by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is an internet-based social network that allows users to connect with existing business contacts and to establish new business contacts. Over 400 million registered persons use LinkedIn in more than 200 countries. LinkedIn is currently the largest platform for business contacts and one of the most visited websites in the world.
‍
Each time our website is accessed that is equipped with a LinkedIn component (LinkedIn plug-in), this component causes the browser used by the data subject to download a corresponding representation of the LinkedIn component. Further information on LinkedIn plug-ins can be accessed at https://developer.linkedin.com/plugins. In the course of this technical process, LinkedIn receives information about which specific subpage of our website is visited by the data subject.
‍
If the data subject is logged into LinkedIn at the same time, LinkedIn recognises with each access to our website by the data subject and for the entire duration of the respective stay on our website which specific subpage is visited. This information is collected by the LinkedIn component and assigned by LinkedIn to the data subject’s LinkedIn account. If the data subject clicks a LinkedIn button integrated into our website, LinkedIn assigns this information to the data subject’s personal LinkedIn user account and stores this personal data.
‍
LinkedIn always receives information via the LinkedIn component that the data subject has visited our website if the data subject is logged into LinkedIn at the time of access; this occurs regardless of whether the data subject clicks the LinkedIn component. If the data subject does not wish such information to be transmitted to LinkedIn, they can prevent transmission by logging out of their LinkedIn account before accessing our website.
‍
LinkedIn offers the possibility to unsubscribe from e-mail messages, SMS messages and targeted ads and to manage ad settings at https://www.linkedin.com/psettings/guest-controls. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua and Lotame, which may set cookies. Such cookies can be rejected at https://www.linkedin.com/legal/cookie-policy. The applicable LinkedIn privacy policy can be accessed at https://www.linkedin.com/legal/privacy-policy. LinkedIn’s cookie policy can be accessed at https://www.linkedin.com/legal/cookie-policy.

Privacy policy: https://www.linkedin.com/legal/privacy-policy
Objection option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
‍

XING

The operating company of Xing is XING AG, Dammtorstraße 29–32, 20354 Hamburg, Germany (“XING”).
Xing is an internet-based social network that allows users to connect with existing business contacts and to establish new business contacts. Users can create a personal profile. Companies can create company profiles or publish job offers on Xing.
‍
Each time an individual page of this website operated by the controller is accessed on which a Xing component (Xing plug-in) has been integrated, the internet browser on the information technology system of the data subject is automatically prompted by the respective Xing component to download a representation of the corresponding Xing component. Further information on Xing plug-ins can be accessed at https://dev.xing.com/plugins. In the course of this technical process, Xing receives information about which specific subpage of our website is visited.
‍
If the data subject is logged into Xing at the same time, Xing recognises with each access to our website by the data subject and for the entire duration of the respective stay which specific subpage is visited. This information is collected by the Xing component and assigned by Xing to the data subject’s Xing account. If the data subject clicks one of the Xing buttons integrated into our website, for example the “Share” button, Xing assigns this information to the personal Xing user account and stores this personal data.
‍
Xing always receives information via the Xing component that the data subject has visited our website if the data subject is logged into Xing at the time of access; this occurs regardless of whether the data subject clicks the Xing component. If the data subject does not wish such information to be transmitted to Xing, they can prevent transmission by logging out of their Xing account before accessing our website.
The data protection provisions published by Xing, available at https://www.xing.com/privacy, provide information on the collection, processing and use of personal data by Xing. Xing has also published privacy notices for the XING Share button at https://www.xing.com/app/share?op=data_protection.

Privacy policy / objection option: https://privacy.xing.com/de/datenschutzerklaerung

‍

VII. Active use of our website

1. Contact forms and e-mail contact

Description of data processing

A contact form is available on our website for you to get in touch with us electronically. If you use this option, the data you enter in the form is transmitted to us and stored.
‍
- Company/municipality (required)
- First name (required)
- Last name (required)
- E-mail (required)
- Telephone (optional)
- Message (optional)
‍
When you send your message via one of our contact forms, we also store the following data:
- The user’s IP address
- Date and time of submission
‍
If you contact us via an e-mail address we have provided, any personal data you include in your e-mail will be stored.
If you provide a mobile phone number to receive updates on the status of your payment request, we will use that number specifically for this purpose.

We use HubSpot Forms on our website—a service provided by our CRM system, HubSpot—to integrate our contact forms and process the data entered (see Part C, Section II). HubSpot Forms offers features for SEO, content creation, lead management, e-mail marketing, and analytics. Data entered into these forms is stored directly in our HubSpot customer relationship management system.

We use Google e-mail services via Google Workspace, provided by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (“Google”). In addition to our CRM software, which serves as our central system for managing and processing inquiries, e-mails are also stored on Google servers. We have selected the “Europe” region as our server location and have entered into a data processing agreement with Google. Google contractually guarantees that these e-mails will not be transferred to third countries, particularly the USA.

To help us organize and sort incoming inquiries, we use an interface that accesses AI-based services designed to understand and generate natural language, analyze information, and make predictions.
For this, we use the ChatGPT language model provided by OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We have an agreement with OpenAI ensuring that our data is not used to train their models and is not shared with them. You can view OpenAI’s privacy policy here: https://openai.com/de/policies/eu-privacy-policy. We have signed a Data Processing Addendum with OpenAI (see https://openai.com/policies/data-processing-addendum). Since data is transferred to the USA when using the OpenAI API, this addendum includes EU Standard Contractual Clauses to ensure an adequate level of data protection for transfers to third countries.
‍
We also use the AI-powered system Google Gemini, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Gemini is designed for advanced language and image processing. It uses machine learning to understand and generate natural language and analyze images, making it versatile for various tasks. We use Google Gemini to pre-sort e-mails and incoming documents. As a Google Workspace customer, we have the assurance that data processed via Google Gemini is not used by Google to train its publicly available AI models.

To check spelling and grammar in our replies, we use LanguageTool, a service provided by LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam, Germany (a subsidiary of Learno Inc.). This tool uses AI to correct grammar and refine phrasing. You can find the provider’s privacy policy here: https://languagetool.org/de/legal/privacy. LanguageTool stores checked text and identified errors on its servers for up to 15 minutes (this is not permanent storage). This process does not involve your IP address or any other information that could identify you personally. However, if your text contains personal information, it may be stored briefly. We have a data processing agreement with Learno Inc. that includes the necessary EU Standard Contractual Clauses for processing data in the USA, ensuring the provider complies with data protection regulations: https://languagetool.org/de/legal/dpa.

To read attached PDF or Word files, we use Airparser, located at Sepapaja tn 6, Tallinn 11415, Estonia. Airparser uses AI technology to identify and extract structured data. We have a data processing agreement with Airparser in accordance with Art. 28 GDPR, which contractually obligates them to comply with data protection laws (see https://airparser.com/dpa/). You can find more information on Airparser’s data protection practices here: https://airparser.com/gdpr/.
‍

Legal basis and purpose of data processing

The legal basis for processing data submitted via contact forms or e-mail is Art. 6(1)(f) GDPR. If your inquiry is aimed at entering into a contract, the legal basis is also Art. 6(1)(b) GDPR.
We process personal data from contact forms to handle your inquiries and communicate with you. When you contact us by e-mail, we also have a legitimate interest in processing that data. If you provide a mobile number for payment status updates, we will use it solely for that purpose.
Our use of AI-based services is based on our legitimate interest under Art. 6(1)(f) GDPR. Given the high volume of incoming messages, we rely on these tools to pre-sort and route inquiries to the correct departments, allowing us to respond quickly and effectively—which is in both our interest and yours.
‍
User information may also be stored in our CRM system or a similar inquiry management system based on our legitimate interests.
‍
Other personal data processed during the submission process helps us prevent misuse of our contact forms and ensures the security of our IT systems.

Storage period / possibility of objection and removal

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For data from contact forms or e-mails, this occurs once the conversation with the user has ended. A conversation is considered ended when the circumstances indicate that the matter has been fully resolved and there are no legal requirements for further storage.
You may withdraw your consent for the processing of your personal data at any time.
If you contact us by e-mail, you can object to the storage of your personal data at any time. In such cases, we will be unable to continue the conversation unless we have another legal basis for processing or an overriding interest.
All personal data stored during the contact process will be deleted in such cases, provided no statutory retention requirements apply.

2. Telephone hotline

Description of data processing

If you call us using a number published on our website, we record the incoming phone number and other technical details provided by the telephone system or your telecommunications provider (such as call start time and duration). We also document the core content of the call and any information you provide to our staff (name, issue, contact details for follow-up, etc.).
‍
To pre-qualify incoming calls, we use an AI-powered solution from Leaping AI UG (haftungsbeschränkt), Potsdamer Straße 72, 10785 Berlin, Germany. This tool asks for the information needed to classify your call, route it to the right department, or handle specific customer requests automatically (e.g., case reference, license plate number, caller name). We have a data processing agreement with Leaping AI in accordance with Art. 28 GDPR.
‍
We will ask for your consent before recording any call. If you agree, we store the full recording and automatically generate a transcript. We use these recordings and transcripts for staff training, resolving complaints, creating anonymized internal statistics (e.g., reasons for calls), and for evidentiary purposes in the event of legal claims.
‍
For this, we use the cloud contact center platform Talkdesk, provided by Talkdesk Inc., 201 Spear Street, Suite 1100, San Francisco, CA 94105, USA. We have a data processing agreement with Talkdesk that includes EU Standard Contractual Clauses for international transfers, ensuring they comply with data protection laws. We have also agreed that our Talkdesk instance is hosted in a European region, meaning our data is processed by default within the European Union.

Legal basis and purpose of data processing

When you call, we automatically collect data necessary for call handling (such as case reference, license plate, or name) to automate and improve the efficiency of our customer service, based on Art. 6(1)(f) GDPR. If the call relates to our services or an existing, terminated, or planned contract, the legal basis is also Art. 6(1)(b) GDPR.
During the call, we manually note your concerns in our system and save these notes once the call ends. No recording takes place in this instance. The legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if it relates to a contractual relationship.
‍
Call recordings and transcripts are created and processed only with your prior consent, pursuant to Art. 6(1)(a) GDPR.
User information may also be stored in our CRM system or a similar inquiry management system based on our legitimate interests.

Storage period / possibility of objection and removal

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. This is the case once the conversation has ended—meaning the matter is fully resolved and there are no legal requirements for further storage.
If there is no statutory retention period for recordings, the storage duration for call recordings and notes is based on statutory limitation periods (in Germany, the standard period is three years). Transcripts of call recordings are deleted after 6 months.
You may withdraw your consent to the processing of your personal data at any time. If you have consented to call recording, transcription, and storage, you can withdraw this consent at any time. In such cases, the recordings and transcripts will be deleted without undue delay, unless we are legally required to retain them.

3. Ticket system

Description of data processing

We use Freshdesk as a ticket system, a software solution by Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA. Freshdesk is a customer service platform that facilitates the processing of customer enquiries and requests across multiple channels. We use Freshdesk to receive and manage contact enquiries. If you submit contact enquiries via a contact form on our Online Presences or contact us by e-mail or telephone, the information provided in the course of contact and conversation content as well as data collected by us (see Sections VII.2 and VII.3 above) are stored and organised in the ticket system to enable chronological processing and to improve the service experience.
‍
The stored information is stored on Freshdesk servers. For organising and processing enquiries, personal data—depending on the extent to which it is provided, but at least name, first name and e-mail address—is collected, transmitted to Freshdesk, stored there and accessed. We have made use of the option to have the data processed on servers within the EU. This should technically ensure that the data is located within the European Union and that access by US authorities is not possible.
Further information on data protection at Freshdesk can be found at https://www.freshworks.com/privacy/.

Legal basis and purpose of data processing

We process information captured via Freshdesk on the basis of our legitimate interests in the efficient design of our customer service and the fastest possible response to your request for the purpose of supporting the care of our customers and users (Art. 6(1)(f) GDPR) in conjunction with a data processing agreement concluded with Freshdesk pursuant to Art. 28 GDPR, which ensures protection of the data and prohibits unauthorised disclosure to third parties.
‍
If, in an individual case, transfer of data to the USA should be necessary, this will be based on the EU Commission’s Standard Contractual Clauses.

Storage period / possibility of objection and removal

We store your data for the duration of the existence of a contractual relationship between us and the data subjects and/or until the respective conversation has been completed.
‍
If you wish to have your personal data deleted, you can exercise your right to object and removal as described in the general information in Part A.

4. Chat function

Description of data processing

The chat function provided by us on the website consists of an AI-supported chatbot of Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA (hereinafter: “Decagon”). Decagon operates an AI platform for automating customer service processes using so-called customer service “agents”. The chat function can be used, for example, to ask and have answered frequently asked or general questions about our parking system or certain parking areas managed by us (e.g. opening hours, tariffs), or to report problems at a parking area managed by us for forwarding to our customer support.
‍
As soon as you enter a question in the text field of the chat function (so-called prompts), Decagon analyses the question fully automatically and provides a text-based response from the agent. As a rule, we do not require any information about you as a person (e.g. names, e-mail addresses, telephone numbers, addresses, vehicle registration numbers). Please therefore refrain from entering such personal data about yourself or other persons unsolicited in the input field. We collect and store such data only if you voluntarily provide it to us.
‍
For the purpose of displaying and technically operating the chat function, the following technically required data is processed as log data when used:
- IP address
- Metadata about API requests
- Date and time of access
‍
Processing by the chat function is fully automatic and only begins when the data is sent to the chat. The agent operates independently within clearly defined limits and does not make independent decisions that affect your rights or access to our services. If a request requires human judgement or is outside the scope of the AI agent, it is forwarded via a supervised procedure to one of our human case workers and stored for further processing outside of Decagon in our CRM system or our ticket system.
Decagon has contractually assured that user data provided via the chat function will not be used to train other AI models.
Further information on data protection at Decagon can be found at https://decagon.ai/legal/privacy.

Legal basis and purpose of data processing

The purpose of processing is to support our customers and users by answering general questions or support concerns. We process information captured via Decagon on the basis of our legitimate interests in the efficient design of our customer service and the fastest possible response to your request (Art. 6(1)(f) GDPR) in conjunction with a data processing agreement concluded with Decagon pursuant to Art. 28 GDPR, which ensures protection of the data and prohibits unauthorised disclosure to third parties.
‍
We have also agreed with Decagon that data is processed exclusively in the EU as part of normal operation of the chat function (EU data residency). If, in an individual case, a transfer of data to the USA is required for technical support of the operation of the chat function and is authorised by us, such transfer will be based on the EU Commission’s Standard Contractual Clauses.

Storage period / possibility of objection and removal

Personal data that may be exchanged in the course of chats is stored for the duration of the existence of the legal relationship between us and the data subjects and/or until the respective conversation has been completed.
‍
If you wish to have your personal data deleted, you can exercise your right to object and removal as described in the general information in Part A.
‍

C. Data processing in connection with the use of MHP parking areas

1. Use of the MHP Online Shop

Description of data processing

Via our MHP Online Shop (hereinafter: “Online Shop”), you have the option to book and pay for the parking services described there for parking areas managed by us on the basis of the respectively applicable General Terms and Conditions. For example, you can pay your parking fees online.
We use cookies to make our Online Shop more user-friendly. Some elements of our website require that the accessing browser can also be identified after a page change. In the cookies, language and region of users are stored.
In addition, the cookies enable an analysis of browsing behaviour in the Online Shop. In this way, the following data may be transmitted: search terms entered, frequency of page views, use of website functions.

To book the parking services or to pay for your use of the parking area, you must enter your vehicle registration number in the input mask provided for this purpose, and, if applicable, select the desired parking area and/or enter a file number/reference. We require the registration number and other details to be able to allocate the parking fee owed to the respective parking transaction and/or parking service.

The data processed during the booking process includes registration number data, the amount payable, and other communication, contractual and payment data of our customers, prospective customers and other business partners. Processing is carried out for the purpose of performing contractual services in connection with operating our Online Shop, billing, delivery and customer service. During the booking process, we process, in particular, the information visible in the respective input forms, such as name, company, address, e-mail, telephone. Mandatory information is generally indicated by an asterisk (*) or marked as “optional” and includes the information necessary for providing and billing the ordered service as well as contact information to enable follow-up or to inform you of important order-related information (such as statutory mandatory information, appointment changes, etc.).
‍
We process and use the data collected in this way to enable you to select and book our parking services and to pay for them. In addition, we process the data to process and—if necessary—send the booking you submitted. Further details on the legal and organisational framework can be found in the respective General Terms and Conditions. Details on the payment service providers used by us can be found in Section C.2 below.

Storage period / possibility of objection and removal

The data is deleted as soon as it is no longer necessary for the purpose for which it was collected. For the personal data from the input mask of the booking process, this is the case after a contract for our parking services has been concluded at the earliest when the respective parking service has been fully performed. As a rule, however, we retain contract-related data until the expiry of statutory warranty obligations. In the event of a statutory archiving obligation, the data concerned will be deleted after the expiry of the relevant period.

2. Use of payment providers in order processing (“payment services”)

Description of data processing

If you are required to provide us with payment details (e.g., account number for direct debit) after entering into a paid contract for parking services, this data is necessary for payment processing.
‍
To ensure modern, convenient, and secure payment processing, we offer various payment options. In addition to banks and credit institutions, we use other payment service providers (collectively referred to as “payment service providers”).
‍
Payment transactions via common methods (e.g., Visa/MasterCard) are carried out exclusively via an encrypted SSL/TLS connection. You can identify an encrypted connection by the browser address bar changing from “http://” to “https://” and the lock icon in your browser.
With encrypted communication, the payment data you transmit to us cannot be read by third parties.

If you choose the services of a specific payment provider, that provider performs its services based on a contract between you and them, in accordance with their applicable terms of use. Data processing by these providers is their responsibility; we have no influence over it. Consequently, if you wish to assert data subject rights in this context, we must refer you to the respective payment service provider. The provider may ask for additional consent, for example, to perform identity or credit checks. Personal data processed by payment providers generally includes your first and last name, address, date of birth, gender, email address, IP address, telephone number, and data required for payment processing related to the order, such as item count, item number, invoice amount, tax percentage, or bank details like account or credit card numbers, passwords, TANs, checksums, and other contract, amount, or recipient-related information.
‍
The payment service provider processes this data to provide the chosen payment method, perform any necessary identity or credit checks, manage payments, and prevent fraud.

Legal basis and purpose of data processing

The transmission of your data to the payment providers we use is based on Art. 6(1)(b) GDPR (processing for contract performance) for data collected during an order, and otherwise on our legitimate interests (Art. 6(1)(f) GDPR), provided we do not request your consent under Art. 6(1)(a) GDPR.
‍
You may withdraw your consent for data processing by payment providers at any time with future effect. A withdrawal does not affect the validity of data processing that has already taken place.

Adyen

For certain payment methods, we use the payment service provider Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ Amsterdam, Netherlands (“Adyen”). If you select payment via Adyen, personal data is automatically transmitted to them. This generally includes the card type (e.g., Visa or Mastercard), cardholder name, card number, security code, and expiry date. Adyen’s role is to request transaction authorization from the respective payment system (e.g., Mastercard or Visa) and forward this to your bank for approval. If the bank approves, Adyen is notified by the payment system and accepts the payment to our bank. Adyen processes your data for payment processing as well as for identity and credit checks. In this case, Adyen acts as a controller, and we have no influence over their data processing.
Information on data protection at Adyen can be found at https://www.adyen.com/de_DE/privacy-policy, and for transaction processing at https://www.adyen.com/de_DE/privacy-policy/transaction.

Stripe

To process online payments for our services, we use Stripe, an online payment service provided by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”).
If you choose Stripe, the information provided during the order process, along with order details and—depending on the payment method—required information (name, address, email, customer number, order number, bank, account number, bank code, credit card number, expiry date, CVC, invoice amount, currency, transaction number, date/time, location, provider name), will be passed to Stripe. This data transfer is exclusively for payment processing and only to the extent necessary. Without this data, we cannot process payments via Stripe.
Stripe acts in a dual role as both controller and (sub-)processor. As a controller, Stripe uses the transmitted data based on its own terms and conditions to perform the contractual relationship regarding payment processing and to comply with regulatory obligations. We have no influence over this. Stripe’s privacy policy can be found at https://stripe.com/de/privacy.
As a processor, Stripe completes transactions within payment networks. In this capacity, Stripe acts solely on our instructions and is contractually obligated under Art. 28 GDPR to comply with data protection requirements.

secuPay

We offer cashless payment methods from secupay AG (Goethestr. 6, 01896 Pulsnitz, Germany; “secupay”) in our online shop. Secupay is a payment institution under the German Payment Services Supervision Act (ZAG), registered with the German Federal Financial Supervisory Authority (BaFin) (registration number: 126737), and enables cashless payments online. If secupay is used, the purchase price claim is assigned to them, allowing us to provide goods or services immediately. If you select “direct debit,” “purchase on account,” or “credit card” via secupay, data is automatically transmitted to them. During processing, payment instrument data is sent to secupay, which then performs a technical risk assessment. We are then automatically notified of the result. The personal data exchanged includes your first and last name, address, email, IP address, telephone number, and other data necessary for payment processing.
Secupay may transmit this data to credit agencies for identity and credit checks. They may also disclose data to affiliated companies or subcontractors if necessary to fulfill contractual obligations or if processed on their behalf. These activities are under secupay’s own responsibility, and we have no influence over them. You may withdraw any consent given to secupay regarding personal data at any time. A withdrawal does not affect data we are required to process or transmit for contractual payment processing. Secupay’s privacy policy is available at https://www.secupay.com/de/datenschutz.

‍

3. Use of reviews for the MHP Online Shop

Description of data processing

We use the review portal “Trustpilot,” operated by TrustPilot A/S, Pilestræde 58, 5th Floor, 1112 Copenhagen, Denmark, to give users the opportunity to review our products and services.
If you purchase a parking service online and receive your receipt via email, we include a Trustpilot button with a unique link. We maintain an interface (“API”) with Trustpilot to generate these invitation links. Clicking this link redirects you to the Trustpilot platform. If you click the button, the form on Trustpilot is automatically pre-filled with your data, allowing you to submit a review. The review is verified using the reference number generated by the link. Submitting a review is voluntary.
For this purpose, we transmit the following data to Trustpilot:
- Email address
- First name, last name
- Reference number
- Language and country-specific shop domain, access data (including IP address)
- Selected parking service

We use Trustpilot as a processor and have contractually obligated them, via a data processing agreement, to handle your data in accordance with data protection laws.
‍
Please note that you need a Trustpilot user account to submit a review. Once you submit your review and agree to Trustpilot’s terms of use, Trustpilot becomes the controller for the further processing and publication of your review. Details on data protection at Trustpilot can be found at https://de.corporate.trustpilot.com/legal/for-businesses/privacy-policy.

Legal basis and purpose of data processing

‍
Processing is carried out to create an invitation link and verify the authenticity of shop usage for Trustpilot to perform the review process. This, along with obtaining user feedback to improve our services, constitutes a legitimate interest under Art. 6(1)(f) GDPR.

Storage period / possibility of objection and removal
The invitation data for Trustpilot is stored for one year.
‍

4. Use of parking areas managed by MH Parkservice

Description of data processing

When you use our parking areas, the following data is collected automatically: vehicle registration number (including the front or rear of the vehicle), entry/exit time, date, location, and the amount and method of payment for the parking fee.
Before leaving the parking area, users without a permanent parking permit must enter their vehicle registration number at the payment machine. If the registration number is found in our database, the parking fee is calculated and can be paid. Details on data processing for payments made via our Online Shop can be found in Part C, Sections 1 and 2, and in the applicable terms of use.
If the General Terms of Use are breached, we will also process any personal data of the vehicle owner and driver necessary for legal action, specifically for collecting contractual penalties and/or asserting possessory and proprietary rights (“pursuit”).
If you receive a demand letter as the registered owner of a vehicle involved in a parking violation, it means we obtained your registration number from the German Federal Motor Transport Authority (Kraftfahrt-Bundesamt). If you are not the owner, we received your details from the owner or another third party (such as a rental or leasing company) who confirmed you were the driver at the time of the violation. If you no longer live at the address registered with the Kraftfahrt-Bundesamt, we obtained your information from the person currently registered at that address, a credit agency, or a debt collection company.
In the event of returned mail, we use the services of Deutsche Post Adress GmbH & Co. KG, Am Anger 33, 33332 Gütersloh, Germany. We reserve the right to request your current postal address via an interface after at least two letters have been returned. For this purpose, we transmit the information we have regarding the person and their previous address.
‍

Legal basis and purpose of data processing / data recipients

Processing this data is necessary to protect the legitimate interests of the parties involved in operating the parking area and for related administrative tasks (Art. 6(1)(f) GDPR), as well as to fulfill the services outlined in our General Terms of Use (e.g., calculating and billing parking fees, verifying parking permits, reconciling payments made via app or online portal, and checking compliance with maximum parking durations, free-parking periods, or grace periods) (Art. 6(1)(b) GDPR).
Owner-related data (specifically name and address) is requested from the Kraftfahrt-Bundesamt or foreign authorities using the vehicle registration number (“owner query”). Driver information may be requested from the vehicle owner, rental company, or leasing company and may be shared with third parties (e.g., attorneys, debt collection agencies) for the purposes mentioned above. For the technical operation of our parking systems and software, as well as for addressing breaches of our Terms of Use, data is processed by MHP GmbH and its contractors (Peter Park System GmbH for parking technology and software, and Amazon Web Services EMEA SARL for data storage). The legal basis is Art. 6(1)(b) GDPR where processing is required for contractual performance; otherwise, it is Art. 6(1)(f) GDPR, based on our legitimate interest in protecting the possessory and proprietary rights of MHP GmbH and third parties, ensuring the proper operation of parking areas, and speeding up vehicle flow.
‍

Storage period / obligation to provide data / possibility of objection and removal

The personal data we collect is deleted once all claims related to the use of the parking area have been settled and all statutory retention or limitation periods have expired. If there is no breach of the General Terms of Use and the user leaves the parking area within the applicable grace period, user data is automatically deleted 48 hours after exit, provided no statutory retention obligations apply.
Providing your data when using our parking areas is a contractual requirement under our General Terms of Use and is mandatory for entering into the contract. Without this data, we would be unable to provide our parking management services. We do not use your data for automated decision-making or profiling. Since data collection is mandatory, users do not have a right to object. Because registration numbers are captured upon entry, it is generally possible—if the layout allows—to turn around before entering to avoid data capture.
‍

5. Activation of parking authorisations

Description of data processing

For some of our parking areas, you can request parking authorisations via terminals or online booking forms (on the MHP website, or at retail stores or institutions located on-site). This applies to designated spaces for specific groups (e.g., employees, visitors, or customers) and/or free parking periods, subject to the conditions of the respective parking area.
To do this, you must enter the information requested in the input form. A vehicle registration number is always required. In some cases, additional information may be needed to verify your eligibility, such as an employee ID number. This information may be shared with our clients or their customers to verify your authorisation or matched against data they have provided.

Legal basis and purpose of data processing / data recipients

If we need to compare your data with other records to validate your authorisation, or if we process additional information provided in the form, we do so based on your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time, though this will not affect the lawfulness of processing that occurred before the withdrawal. Please note that if you withdraw consent, we may be unable to provide the booking service, and any existing booking may be canceled.
Otherwise, the legal basis for processing data collected during activation is Art. 6(1)(b) GDPR, as it is necessary for the intended contract, or Art. 6(1)(f) GDPR, to ensure the effective processing of parking authorisations and support the delivery of our parking services.

Storage period / obligation to provide data / possibility of objection and removal

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data from the input form, this occurs once the contract for our parking services has been fulfilled. Generally, we retain contract-related data until the expiry of statutory warranty periods. If there is a legal archiving obligation, the data will be deleted once that period expires.

6. Parking areas offering free parking for persons with disabilities

Description of data processing

‍
At some of our parking areas, we offer a special arrangement allowing persons with disabilities to park for free in designated spaces. To use this, eligible users must provide proof of a severely disabled parking permit with the markings H/aG/Bl (e.g., the blue EU disabled parking permit).
Depending on the conditions posted at the specific parking area, you must verify your eligibility, for example, by scanning a QR code on a sign, visiting our website, and uploading your parking permit via the provided form.

Legal basis and purpose of data processing

The legal basis for processing data collected during a booking is Art. 6(1)(b) GDPR, as it is necessary for the intended contract, or Art. 6(1)(f) GDPR, to ensure the effective processing of parking authorisations and support the delivery of our parking services. In the case of health-related data, this is in conjunction with Art. 9(2)(e) or (f) GDPR.

Retention period / obligation to provide data / right to object and erasure

Proof of a disabled parking permit is reviewed solely to verify the existence of an authorisation and is deleted immediately after the parking transaction is completed.

‍

7. Using the MH Parkservice service portal

Description of data processing

We offer users of the parking areas we manage the option to submit support requests via our service portal (https://service.mh-parkservice.de/) (such as general queries, challenging payment requests, or resolving other issues), view information on parking violations including photos and payment options, or access other customer-specific details.
The portal can be accessed via our website using a QR code provided to you (e.g., as part of a payment request). Once you have authenticated yourself, you can access the service portal. During the authentication process, the following personal data is provided by the user:
‍
- Reference number
- Vehicle registration number
‍
For technical reasons, a limited amount of data (connection data) is collected each time the portal is accessed. This data is technically necessary to establish and maintain a connection between your device and our servers. It is also required to maintain your session after login and to prevent unauthorised access. During each login and use of the customer portal, we and/or our hosting provider store the IP address, the time of the user action (timestamp), your internet service provider, web browser, operating system, version information, language settings, referrer URL, and the name of the page accessed.
‍
After logging into the service portal, a cookie is set to maintain and protect your session. You must allow this cookie in your browser to use the portal.
If resolving an issue or answering a question requires the involvement of other partners or service providers, we will share the information related to your enquiry or incident with them.

Legal basis and purpose of data processing

The legal basis for processing data in connection with the use of the service portal and any enquiries or downloads made through it is Art. 6(1)(b) GDPR, as it is necessary for the performance of the parking contract. Otherwise, Art. 6(1)(f) GDPR applies, as processing this data allows us to provide an effective way to handle support requests, manage and resolve enquiries, and ensure a secure connection between your device and our servers.

Retention period / right to object and erasure

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data entered during login, this is generally once the session has ended.
‍
All personal data stored during user contact is deleted once there is no longer a statutory requirement to retain it (e.g., statutory warranty periods for support enquiries).

‍

8. Invoicing

Description of data processing

To create, send, and document invoices for accounting purposes, we use the cloud-based accounting software sevDesk, provided by sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany. In this context, the contact details of the invoice recipient are processed in sevDesk. You can view sevDesk’s privacy policy at https://sevdesk.de/datenschutz/.

Legal basis and purpose of data processing

We use sevDesk based on Art. 6(1)(c) and Art. 6(1) sentence 1(b) and (f) GDPR to fulfil our legal obligations, manage our contracts, and pursue our legitimate interest in efficient accounting. We have signed a data processing agreement with sevDesk in accordance with Art. 28 GDPR, which requires them to comply with all applicable data protection standards.

Retention period / right to object and erasure

We store your data for the duration of our contractual relationship and until the end of the statutory tax retention periods for accounting documents.
If you would like your personal data deleted, you can exercise your right to object and erasure as described in the general information in Part A.

‍

D. Contractual relationships with business customers and partners

‍

I. Am I obliged to provide data?

If you enter into contract negotiations with us regarding our services, accept one of our offers, or otherwise have contractual arrangements with us, we process the personal data you provide in this context. The specific data processed depends largely on the relevant items or services you obtain from us or request. In this context, processing your data is generally mandatory for the preparation, conclusion, and performance of the contract. If you do not provide this data, we may have to refuse to conclude a contract or perform the order, or we may no longer be able to perform an existing contract.
Insofar as we use data to initiate or perform a contract with a business customer, business partner, or cooperation partner, our interest in handling your data lies in enabling and maintaining communication with that customer or partner, typically within the framework of a contractual or other relationship. If you act as the contact person—typically in your capacity as an employee of these companies—you generally do not have an overriding opposing interest if this interaction falls within your area of responsibility, meaning a right to object generally does not apply.
However, you are not obliged to consent to data processing for data that is not relevant to contract performance or not required by law.

II. CRM system (“HubSpot”)

Description of data processing

We use functionalities of the customer relationship management (CRM) system HubSpot. HubSpot is a software solution from HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, offered in Europe by HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. HubSpot is an integrated software solution that allows us to cover various aspects of our online marketing. This includes, among other things: e-mail marketing, social media publishing and reporting, contact management (e.g., user segmentation and CRM), landing pages, and contact forms.
‍
We use HubSpot to manage and implement inbound marketing in connection with various features of our online presence. The information is stored on HubSpot servers. We may use the processed data to gain detailed insights into how our online presence is used, to get in touch with website visitors, and to determine which of our company's services are of interest to them.
‍
HubSpot uses web beacons (invisible graphics or code) and cookies embedded in websites or e-mails and stored on users’ devices. The IP address, geographic location, browser type, duration of the visit, and pages accessed are recorded.
‍
HubSpot also records data entered by the user if the user (a) subscribes to our newsletter or fills out one of our contact forms.
Further information on data protection at HubSpot can be found at https://legal.hubspot.com/de/privacy-policy.

Legal basis and purpose of data processing

HubSpot cookies and web beacons are stored on the basis of Art. 6(1)(a) GDPR. Otherwise, we use the information captured via HubSpot based on our legitimate interests in optimizing our marketing and analyzing the use of our online presence, its continuous improvement, and user-friendly design, as well as to provide more targeted information to our users (Art. 6(1)(f) GDPR).

Possibility of objection and removal

Users can prevent the storage of cookies by disabling them in their browser settings. If users wish to have further personal data deleted, they may exercise their right to object and removal as described in the general information in Part A.
‍
Alternatively, you can set your cookie preferences via the CookieHub management tool we have integrated.

‍

III. Communication

In principle, we collect the necessary data from you directly during personal contact. However, you can also contact us by telephone, fax, post, or via the e-mail address provided (see imprint) or other e-mail addresses of our employees known to you. In the latter case, the personal data transmitted with the e-mail will be stored. Please note that communication by e-mail is unencrypted for technical reasons.
‍
Your data is used to process the conversation and for subsequent handling of the respective inquiry or meeting content. Processing of your data is based on Art. 6(1)(b) GDPR insofar as the communication is connected with the performance of a contract or is required to carry out pre-contractual measures.
In all other cases, processing is based on our legitimate interests (Art. 6(1)(f) GDPR) in efficiently handling inquiries addressed to us.
‍
In this context, no data is disclosed to third parties unless such disclosure is necessary to pursue our claims or legitimate interests (Art. 6(1)(f) GDPR) or there is a legal obligation to do so (Art. 6(1)(c) GDPR).
‍

IV. Data processing in the course of sales

Personal data is processed on the basis of Art. 6(1)(b) GDPR to provide the service you have instructed us to perform, in particular for fulfilling our contracts or pre-contractual measures, as well as all activities required for the operation and administration of MH Parkservice.
‍
The resulting purposes of data processing are primarily determined by the specific activities and individual services agreed with you and may include, among other things, consultancy activities or management of sales processes (e.g., compilation of documents, sending MH Parkservice product or event information, provision of services by MH Parkservice) or support for sales negotiations and contract conclusions.
Further details on the scope and purpose of data processing and recipients of your data can be found in the respective contractual documents and the associated terms and conditions.
‍
Insofar as necessary for our operational processes, we process your data in connection with our services beyond the performance of the contract to safeguard our legitimate interests (Art. 6(1)(f) GDPR).
‍
In connection with offering or providing our services, we may be subject to specific legal obligations, for example, requirements under tax law. The purposes of processing your data may therefore include, among other things, compliance with tax control and reporting obligations, customs or export regulations, and the assessment and management of risks. The necessary data processing is based on Art. 6(1)(c) GDPR.

V. Newsletter

Description of data processing

We would like to inform our business customers and prospective customers at regular intervals by e-mail or other electronic notifications about our services and other products, services, webinars, innovations, or news at MH Parkservice (hereinafter: “Newsletter”). For this, we require your e-mail address. Further information may be requested in the respective newsletter registration forms to provide you with personalized content tailored to your interests.
You can register for our newsletters by subscribing via the registration form or by ticking a box during a registration process (so-called opt-in). For this purpose, we provide various options on our websites or within registration/order interfaces to register for our newsletters (where applicable, topic-specific). Details of the respective newsletter content are described specifically in the registration form. This description is decisive for your consent.
After registration, you will receive an e-mail from us requesting that you confirm your newsletter subscription (so-called double opt-in procedure). This confirmation is necessary to rule out the possibility that someone else has misused your e-mail address to subscribe to our newsletter. Only when you activate the hyperlink included in the e-mail will your e-mail address be enabled for newsletter dispatch.

For the administration of registrations and sending of e-mails in connection with our newsletter, we use the MailChimp service from the US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA (“MailChimp”), which enables simple and user-friendly automation of the registration process and the required e-mail dispatch. As MailChimp’s IT system is located in the USA, the registration data from the input forms is transmitted to the USA and processed there. To ensure appropriate handling of the data transmitted by us, we have concluded a data processing agreement with MailChimp pursuant to Art. 28 GDPR, including the EU Standard Contractual Clauses for transfers to third countries. Further information on MailChimp’s handling of personal data can be found at: https://mailchimp.com/legal/privacy/.
‍
For verification, in addition to your e-mail address and name, the IP address and the registration date (“timestamp”) are stored.

Legal basis and purpose of data processing / data recipients

We send newsletters based on your consent under Art. 6(1)(a) and Art. 7 GDPR, in line with § 7(2) no. 3 of the German Act Against Unfair Competition (UWG). If you are an existing customer, we may also send them based on our legitimate interest in direct marketing under Art. 6(1)(f) GDPR and § 7(3) UWG.
We log the registration process based on our legitimate interests under Art. 6(1)(f) GDPR to ensure a secure, effective newsletter system that meets both our business needs and your expectations, while also allowing us to verify that consent was given.

Retention period / right to object and withdraw consent

You can opt out of receiving our newsletter or withdraw your consent at any time, either in full or in part. Simply click the unsubscribe link at the bottom of any newsletter, or reach out to us directly using the contact details provided above.
Unsubscribing from the newsletter won't affect your regular business communications with us. We will keep your data if it is still needed to fulfill a contract, and we reserve the right to store proof of lawful newsletter distribution until the relevant statutory limitation periods have expired.

VI. Data transfers

Depending on the services involved, your data or documents may be shared with public authorities, private service providers, or partners we work with regularly during the inquiry, quotation, or contract fulfillment stages (see Part A, Section V).
‍

E. Other

As we continue to develop our website and services, or as legal and regulatory requirements change, we may need to update this privacy policy. You can always find the latest version on our website and print it out if needed.