Privacy Policy (Valid from 03/30/2026)

This privacy policy is intended to provide an overview of what happens to your personal data (hereinafter also: “data”) within our company and to inform you about your data protection claims and rights under the European General Data Protection Regulation (“GDPR”) and its national implementations (Legislative Decree no. 196 of June 30, 2003, containing the “Personal Data Protection Code,” hereinafter also “Data Protection Code (Legislative Decree no. 196/2003)”). We therefore ask you to read this privacy policy and, if necessary, print or save it.

Personal data is any information that can be used to personally identify you. Your personal data may be processed for various purposes. In essence, the data processing operations carried out by Mobility Hub Parkservice Italia S.R.L (hereinafter also “MH Parkservice” or “we”) can be divided into the following areas of application:

• General: General information on data protection, data processing operations, and the rights of data subjects, which apply to all data processing operations we carry out, can be found in Part A below.
• Our websites: In connection with our website www.mh-parkservice.it (hereinafter: “website”) or related external online presences, such as our social media profiles, our service portal (https://it.mh-parkservice.de/kundenservice/) or our post-payment service (https://parcheggio.mh-parkservice.it/), from which we link to this privacy policy (website and external online presences hereinafter collectively also: “websites”), we process data from visitors that is exchanged between their internet-enabled devices and the server we operate, as well as data provided to us when using the website. Details on this can be found in Part B.
• Parking users: For information on the processing of data from users of parking areas managed by us, for example in the context of payment transactions via the MHP Online Shop or our post-payment service, the tracking of parking violations by MH Parkservice, or viewing details of parking violations via our service portal, please visit Part C.
• B2B: For the purpose of processing or initiating contracts, we process the necessary data of our business customers and prospective clients. Data of our business partners or supplier data is used exclusively for the direct placement, processing, or execution of orders. More information on this can be found in Part D.

Please visit the individual sections if you would like quick and context-specific information on certain processing situations.

‍

A. General information on data protection and data subject rights

I. Who is responsible for data processing and who can you contact if you have questions?

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection regulations, is:

Mobility Hub Parkservice Italia S.R.L.

BOLZANO (BZ)

PIAZZA DELLA MOSTRA 2 CAP 39100

Tel.: +3904711430502

Email: info@mh-parkservice.it

‍

For questions regarding data protection, you are welcome to contact our data protection officer at the following contact details: dataprotection@mh-parkservice.it

II. What rights do you have regarding your personal data?

If your personal data is processed, you are a “data subject” within the meaning of the GDPR, which means you may be entitled to the rights described below. If you wish to assert your rights against MH Parkservice as the controller, we recommend that you direct them to our contact details provided above:

1. Right of access

In accordance with Art. 15 GDPR, you can request confirmation from us as to whether we are processing personal data concerning you and request information about the extent to which we process your data.

2. Right to rectification

If the personal data concerning you is inaccurate or incomplete, you have the right to rectification and/or completion under Article 16 of the GDPR.

3. Right to erasure

You may request that we delete your data if the legal requirements of Article 17 of the GDPR are met, provided that we are processing it unlawfully or if the processing disproportionately interferes with your legitimate interests. Please note that there may be reasons that prevent immediate deletion, such as statutory retention obligations.

Regardless of whether you exercise your right to erasure, we will delete your data promptly and completely once the purpose of processing has been fulfilled, provided there are no legal or contractual retention periods to the contrary.

4. Right to restriction of processing

You may request that we restrict the processing of your data in the cases specified in Article 18 of the GDPR. If you have restricted the processing of your personal data, this data may—with the exception of storage—only be processed with your consent, for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

5. Right to data portability

Under Article 20 of the GDPR, you have the right to receive the data you provided, which we process automatically based on your consent or in fulfillment of a contract, in a structured, commonly used, and machine-readable format, or to have it transmitted to a third party. If you request the direct transmission of the data to another controller, this will only be done if it is technically feasible. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

6. Right to object

If we process your data based on a legitimate interest pursuant to Article 6(1)(f) of the GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions (see Article 21 of the GDPR). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes. You can object to the processing of your data for direct marketing purposes at any time without providing a reason.

7. Right to withdraw consent under data protection law

Some data processing operations are only possible with your express consent pursuant to Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect. The legality of the data processing carried out before the withdrawal remains unaffected. Please note that even after withdrawing consent, processing of the affected data may still be possible, in whole or in part, based on other legal grounds.

8. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the member state of your habitual residence, place of work, or the place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR (Article 77 of the GDPR in conjunction with Articles 141 et seq. of the Italian Data Protection Code (Legislative Decree No. 196/2003)).

If you believe that we have violated Italian or European data protection law while processing your data, please contact us so that we can clarify any questions.

You also have the right to contact the supervisory authority responsible for us at our registered office:

Garante per la Protezione dei Dati Personali, Piazza Venezia n. 11, I-00187 Rome, Tel.: +39 06 69 6771, Email: protocollo@gpdp.it

III. Welche personenbezogenen Daten werden verarbeitet und aus welchen Quellen stammen diese Daten?

1. Herkunft der personenbezogenen Daten

Wir verarbeiten überwiegend die Daten, die wir im Rahmen einer Geschäftsanbahnung bzw. im Verlauf der Geschäftsbeziehung von den Betroffenen bei Nutzung unserer Webseite direkt mitgeteilt bekommen (siehe hierzu auch unter Teil B Ziff. VI). 

Über unsere Webseite sowie unsere Dienste verarbeiten wir Daten, die wir im Rahmen Ihres Besuches erhalten oder die Sie uns im Rahmen Ihrer Nutzung aktiv mitteilen (z.B. bei Nutzung unseres Online-Shops). Andere Daten werden automatisch beim Besuch der Webseite oder Nutzung eines unserer Dienste durch unsere IT-Systeme erfasst. Das sind vor allem technische Daten (z.B. Internetbrowser, Betriebssystem oder Uhrzeit eines Seitenaufrufs). Die Erfassung dieser Daten erfolgt automatisch, sobald Sie unsere Webseite betreten oder einen unserer Dienste aufrufen. Details hierzu finden Sie unter Teil B.

Im Einzelfall verarbeiten wir auch Daten, die wir zulässigerweise von anderen Dritten wie Auskunfteien, Gläubigerschutzverbänden, oder von Behörden erhalten oder erworben haben, oder die wir aus öffentlich zugänglichen Quellen (z.B. Telefonverzeichnissen, Unternehmensregistern, Presse, Internet oder andere Medien) zulässigerweise entnommen, erhalten oder erworben haben. 

2. Kategorien personenbezogener Daten

Zu den personenbezogenen Daten, die wir regelmäßig verarbeiten zählen Personenstamm-/Kontaktdaten wie: Titel, Vor- und Zuname, Anrede, Geburtsdatum. Adresse, E-Mail-Adresse, Telefonnummer, Fax, Position im Unternehmen.

Darüber hinaus verarbeiten wir je nach Auftrag, Dienstleistung oder sonstiger Beziehung zu Ihnen folgende sonstige personenbezogene Daten:

• Adressdaten: Straße, Hausnummer, ggf. Adresszusätze, PLZ, Ort, Land
• Kontaktdaten: Telefonnummer(n), E-Mail-Adresse(n)
• Fahrzeugdaten: Kfz-Kennzeichen, Fahrzeughalter
• Parkraummanagementdaten: Lichtbilder, Datum und Zeitraum der Nutzung einer Parkfläche, Parkberechtigungen, Bankverbindung, Zahlungsdetails
• Anmeldedaten: Informationen über den Service, über den Sie sich angemeldet haben; Zeitpunkte und technische Informationen zu Anmeldung, Bestätigung und Abmeldung; bei der Anmeldung von Ihnen angegebene Daten
• Angebotsdaten
• Zugriffsdaten: Datum und Uhrzeit des Besuchs unseres Service; die Seite, von der das zugreifende System auf unsere Seite gelangt ist; bei der Nutzung aufgerufene Seiten; Daten zur Sitzungsidentifizierung (Session ID); außerdem folgende Informationen des zugreifenden Computersystems: verwendete Internet Protokoll-Adresse (IP-Adresse), Browsertyp und -version, Gerätetyp, Betriebssystem und ähnliche technische Informationen.
• Informationen über Art und Inhalt unserer Geschäftsbeziehung wie Vertragsdaten, Auftragsdaten, Umsatz- und Belegdaten, Kunden- und Lieferantenhistorie, Beratungsunterlagen
• Werbe- und Vertriebsdaten,
• Dokumentationsdaten (z.B. Beratungsprotokolle, Daten aus Servicegesprächen oder Supportfällen)
• sonstige Daten, die wir von Ihnen im Rahmen unserer Geschäftsbeziehung (z.B. in Kundengesprächen) erhalten haben,
• die Dokumentation von Zustimmungserklärungen

‍

IV. Für welche Zwecke und auf welcher Rechtsgrundlage werden die Daten verarbeitet?

Wir verarbeiten Ihre Daten im Einklang mit den Bestimmungen der DSGVO und dem Datenschutzkodex (GvD Nr 196/2003) in der jeweils geltenden Fassung, insbesondere auf den nachfolgenden Grundlagen:

1. Erfüllung von (vor-)vertraglichen Pflichten (Art 6 Abs. 1lit. b DSGVO)

Die Verarbeitung personenbezogener Daten erfolgt auf Grundlage von Art. 6 Abs. 1 lit. b DSGVO zur Erfüllung von vertraglichen Pflichten von MH Parkservice insbesondere im Zusammenhang mit dem Verkauf und Vertrieb unserer Waren und Dienstleistungen (im Weiteren auch „Parkleistungen“) sowie aller für den Betrieb bzw. die Verwaltung von MH Parkservice branchenüblich erforderlichen Tätigkeiten (z.B. Kunden- und Nutzerverwaltung). Die Daten können ferner auf vor-vertraglicher Ebene im Rahmen einer Geschäftsanbahnung mit MH Parkservice, oder bei Durchführung sonstiger vertraglicher Beziehungen mit MH Parkservice verarbeitet werden. 

So ist Art. 6 Abs. 1 lit. b DSGVO Rechtsgrundlage beispielsweise in folgenden Fällen:

• Anlage und Führen eines Partner- oder Lieferantenkontos in unserem CRM-System
• Anlage und Führen von Kunden-/Interessentenakten bzw. unserer Kunden-/Interessentendatenbank in unserem CRM-System
• Zusendung von Informationen 
• Angebot und Verkauf von MH Parkservice Produkten 
• Angebot und Durchführung unserer angebotenen Dienstleistungen

Einzelheiten zum Zweck dieser Datenverarbeitungen ergeben sich aus den jeweiligen Vertragsunterlagen und Geschäftsbedingungen.

2. Wahrung berechtigter Interessen (Art 6 Abs. 1 lit. f DSGVO)

Aufgrund einer Interessenabwägung kann eine Datenverarbeitung über die eigentliche Erfüllung eines Vertrags hinaus zur Wahrung berechtigter Interessen von MH Parkservice oder Dritten erfolgen. Dies ist zulässig, sofern nicht Ihre Interessen oder Grundrechte und Grundfreiheiten überwiegen, die den Schutz personenbezogener Daten erfordern. Eine Datenverarbeitung zur Wahrung berechtigter Interessen erfolgt beispielsweise in folgenden Fällen:

• Zurverfügungstellung des Onlineangebotes, seiner Funktionen und Inhalte 
• Verwendung technisch erforderlicher Cookies oder vergleichbaren Technologien im Sinne von Art. 122 Datenschutzkodex (GvD Nr 196/2003)
• Beantwortung von Kontaktanfragen und Kommunikation mit Nutzern 
• Übermittlung von Daten an mit uns verbundene Unternehmen und Partner
• Durchführung von Zahlungsvorgängen über externe Dienstleister 
• Einsatz Inkasso-Dienstleister und Rechtsanwälte, um Forderungen einzuziehen und/oder gerichtlich durchzusetzen
• Geltendmachung sonstiger rechtlicher Ansprüche und Verteidigung bei rechtlichen Streitigkeiten
• Werbung oder Marketing 
• Markt- und Meinungsumfragen
• Maßnahmen zur Geschäftssteuerung und Weiterentwicklung unserer Dienste
• Führen von Datenbanken über Kunden-/Interessenten bzw. Dienstleister zur Verbesserung unseres Angebots
• Durchführung einer Risikoprüfung (due-dilligence) im Rahmen etwaiger Unternehmensumstrukturierungen oder eines Unternehmenskaufs bzw. -verkaufs
• Gewährleistung der IT-Sicherheit und des IT-Betriebs unseres Unternehmens und unserer Dienste
• Maßnahmen zur Gebäude- und Anlagensicherheit

3. Compliance with legal obligations (Art. 6(1)(c) GDPR)

Processing your data may be necessary to fulfill various legal obligations and requirements to which we are subject, such as those arising from the German Commercial Code (HGB) or the Fiscal Code (AO).

4. Consent (Art. 6(1)(a) GDPR, Art. 122 of the Data Protection Code (Legislative Decree No. 196/2003))

If a service we use stores information on the user's end device or accesses such information in any way, consent is required under Art. 122 of the Data Protection Code (Legislative Decree No. 196/2003). If the service functions without any access to the end device, the GDPR applies. Where we request your consent within the scope of the GDPR, this is done on the basis of Art. 6(1)(a) in conjunction with Art. 7 GDPR.

If you have provided us with consent to process your data in a specific case, processing will be carried out in accordance with the purposes and scope defined in the declaration of consent. You may withdraw your consent at any time with future effect, for example, for receiving our newsletter. To do so, please use the contact details provided in Part A, Section I or Section II. Please note that processing carried out before the withdrawal is not affected by the withdrawal, and in some cases, data processing may continue to be possible, at least in part, on the basis of another legal ground.

‍

V. Who receives my data?

At MH Parkservice, your data is accessed by those employees or organizational units that require it to fulfill our contractual and legal obligations or to process and pursue our legitimate interests.

To initiate or execute a contractual relationship (e.g., the sale or provision of parking services) pursuant to Art. 6(1) sentence 1(b) GDPR, or—depending on the specific nature of the contract—based on our legitimate interests under Art. 6(1) sentence 1(f) GDPR, your data will be shared with companies we regularly engage in connection with providing our services or processing contracts. This concerns the following recipients or categories of recipients:

• IT service providers (e.g., email service providers, web hosting companies)
  
  • Amazon Web Services, Inc., 410 Terry Avenue North Seattle WA 98109, USA (cloud storage provider)
  • Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (app function optimization)
  • Airparser, Sepapaja tn 6, Tallinn 11415, Estonia (document management software provider)
  • Celonis SE, Theresienstr. 6 80333 Munich (integration platform provider)
  • Datadog Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (system security, monitoring)
  • Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114 USA (AI platform operator and provider of an AI chat function)
  • Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA (ticket system provider)
  • Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland
  • Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (email service provider)
  • HubSpot Inc. 25 First Street, 2nd Floor, Cambridge, MA 02141 USA (CRM system provider)
  • LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam (proofreading service provider)
  • Leaping AI UG (limited liability), Potsdamer Straße 72, 10785 Berlin (provider of AI-supported call center software)
  • Octa Inc., 100 First Street, Floor 6, San Francisco, CA 94105, USA (provider of Auth0 for system security)
  • OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (AI model provider)
  • Peter Park System GmbH, Balanstr. 71a, 81541 Munich, Germany (provision of IT systems as managed services and parking management systems)
  • sevDesk GmbH, Hauptstraße 115, 77652 Offenburg (accounting software provider)
  • Talkdesk Inc. 201 Spear Street, Suite 1100, San Francisco, CA 94105 USA (contact center software provider)
  • Trustpilot A/S, Pilestraede 58, 5th floor, DK-1112 Copenhagen, Denmark (review platform provider)
  • Webflow, Inc., 398 11th Street, San Francisco, CA 94103, United States (web hosting service provider for the website)
  • Weglot, SAS, 138, rue Pierre Joigneaux in Bois-Colombes 92270 France (translation service provider)

• Sales partners
• Advertising partners
• Insurance companies
• Banks
• Communication providers (telephone providers, fax providers)
• Payment service providers
  
  • Adyen N.V. Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands
  • Stripe Deutschland GmbH, Prielmayerstr. 3, 80335 Munich
  • secuPay AG, Goethestraße 6, 01896 Pulsnitz
• Shipping and logistics service providers
• Credit agencies
• Auditors
• Tax and legal advisors

When we engage a service provider as a data processor under Art. 28 GDPR, we remain responsible for the protection of your data. Where required by law, data processors are contractually obligated via a data processing agreement to treat your data confidentially and to process it only within the scope of providing the service. The processors we engage receive your data only if they require it to fulfill their respective services.

Your data will only be transmitted to government institutions and authorities, or collected for such purposes, if required by mandatory national legislation or if you instruct us to do so.

‍

VI. How long is my data stored?

Your personal data is used only for the purpose for which you provided it or for which you have consented to its processing, and it is stored only until that purpose has been fulfilled. Once the purpose is fully achieved, or as soon as you have requested the deletion of your data, your data will only be stored for as long as required by statutory limitation or retention periods (particularly those under tax and commercial law). After these periods expire, the data will be deleted unless you have expressly consented to further or different use. You may exercise your rights, such as the blocking of your data, even during the retention periods. Please refer to Part A, Section II.

Your data will be deleted or blocked by us as soon as the purpose for storage no longer applies or you request its deletion.

In principle, we process and store your data only until the end of the business relationship or until the expiration of applicable guarantee, warranty, or limitation periods. Furthermore, it may be necessary to retain data until the final conclusion of any legal disputes in which the data is required as evidence. We are also subject to statutory documentation and retention requirements (e.g., under commercial or tax law).

‍

VII. Is personal data transferred to a third country?

As part of our processing activities, personal data may sometimes be transferred to countries outside the EU or the EEA that have not yet been recognized by the European Commission as providing an adequate level of data protection, such as the USA. If such a transfer becomes necessary in a specific case, it will only take place based on an adequacy decision by the European Commission, standard contractual clauses, appropriate safeguards for data protection, or your explicit consent.

‍

B. Using our websites

In general, you can visit and browse our websites without having to provide any personal information (such as registering, placing orders, or otherwise submitting personal details). In this case, we only process personal data to the extent necessary to provide a functional website and our content and services, or if cookies or similar technologies used on the site transmit personal information to us when you visit. Information about our own cookies or similar technologies can be found in Part B, Section II. Other cookies or similar technologies may allow us, and potentially our partners or third parties, to recognize your browser on your next visit. Please see Part B, Section III for details on these third-party cookies or similar technologies.

We generally only process our users' personal data with their consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons and the data processing is permitted by law.

‍

I. Providing the website and creating log files

Description of data processing

Every time you visit our website, our system automatically collects data and information from your computer system, which your browser sends to us or our web host (so-called log files). These server log files contain IP addresses or other data that could identify a user. This might happen, for example, if the link to the website from which the user arrived, or the link to the website the user navigates to, contains personal data. Our hosting provider collects and stores the following information:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer and time of the server request
• IP address

This data is stored in our web host's log files. It is not stored together with other personal data of the user.

We use Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (www.webflow.com) (hereinafter: “Webflow”) as our web host and software provider for creating, hosting, and operating our website, online forms, and other web elements. You can find information about Webflow's data protection at https://webflow.com/legal/eu-privacy-policy. We have entered into a data processing agreement with Webflow in accordance with Art. 28 GDPR (“Data Processing Addendum,” see https://webflow.com/legal/dpa). As part of these services, data may be transferred to the USA based on standard contractual clauses that Webflow has agreed to in its Data Processing Addendum, or via an equivalent data protection safeguard for processing on our behalf.

Legal basis and purpose of data processing

The legal basis for the temporary storage of data and log files is Art. 6(1)(f) GDPR. This information is also necessary to provide the service in accordance with Art. 122 of the Data Protection Code (Legislative Decree No. 196/2003).

The system must temporarily store the IP address to deliver the website to the user's computer. To do this, the user's IP address must remain stored for the duration of the session.

Data is stored in log files to ensure the website's functionality. We also use this data to optimize the website and ensure the security of our IT systems.

Storage duration / Right to object and erasure

Data is deleted as soon as it is no longer required for the purpose for which it was collected. When collecting data to provide the website, this occurs once the respective session has ended.

If data is stored in log files, this occurs after no more than 7 days.

Collecting data to provide the website and storing it in log files is strictly necessary for the website to operate. Consequently, the user has no option to object.

‍

II. Use of cookies and similar technologies

Description of data processing

Our website uses cookies or similar technologies (e.g., web beacons, local storage) to collect, process, and use usage data (e.g., access times, pages visited) or meta and communication data (IP address, device information), including personal data. For the sake of simplicity, we refer to these technical methods generally as "cookies" throughout this document.

Cookies are text files containing a unique string of characters that are stored on your computer system by your internet browser. They allow your browser to be uniquely identified when you return to our site. When you visit a website, a cookie may be stored on your operating system. This cookie contains a characteristic string of characters. These cookies help make our website more user-friendly, effective, and secure. When you visit a page where a cookie is embedded, the data you enter is stored exclusively in the cookie on your computer. In this case, data is only transmitted to our servers when a page request is made.

Some cookies are deleted after your browser session ends and you close your browser (so-called session cookies). These cookies are technically necessary, for example, to allow you to log in to the application and remain logged in as you navigate between pages during your visit.

Other cookies remain on your device for a set period, allowing us to recognize your browser on your next visit (so-called persistent or log cookies). The purpose of these cookies is to provide you with optimal navigation, "recognize" you, and present you with a varied and fresh experience each time you return.

Cookies from partner companies or third parties may be used, for example, to collect information for advertising, customized content, or statistics ("third-party cookies"). Unless we identify cookies as originating from third-party providers, they are "first-party cookies" from our own site. We provide separate information about the third-party cookies or tracking technologies we use in the following sections of our privacy policy.

Flash cookies are data elements stored on your computer by websites that run on Adobe Flash. Flash cookies have no expiration date.

For more information on the cookies and similar technologies we use to design our website, their purpose, and what data is stored or transmitted to third parties, please refer to our Cookie Management Tool "CookieHub" provided by CookieHub ehf, Hafnargata 18, 230 Reykjanesbær, Iceland. You can use this tool to provide your consent for the use of cookies and similar technologies according to your preferences when you visit our website.

Our cookie management tool collects log file and consent data using JavaScript. This JavaScript allows us to inform you about specific tags on our website, and to obtain, manage, and document your consent. The cookie management tool saves the settings and consent you provided when entering the website and processes the following data:

• Consent data (anonymized log data (Consent ID, Processor ID, Controller ID), consent status, timestamp)
• Device data (including truncated IP addresses (IP v4, IP v6), device information, timestamp)
• User data (including email, ID, browser information, SettingIDs, changelog)

For this purpose, the cookie management tool stores a technically necessary cookie. You can find information about data protection at CookieHub here: https://www.cookiehub.com/legal/privacy-policy

Further information on which cookies we use to design our website, their purpose, and what data is stored in them or transmitted to third parties can be found in the detailed information provided by CookieHub, which you can access under "More options" or "Cookie declaration". CookieHub automatically analyzes which cookies are set on the site. The list of methods used and the cookie declaration are then updated automatically.

Legal basis and purpose of data processing

The legal basis for processing personal data using cookies and similar technologies is Art. 6(1)(f) GDPR, based on our legitimate interest in ensuring the best possible functionality and security of the website, as well as a customer-friendly and effective site experience, provided we are not asking for your consent under Art. 6(1)(a) GDPR.

‍

The legal basis for storing and accessing other information is consent pursuant to Art. 122 of the Data Protection Code (Legislative Decree No. 196/2003) for cookies and similar technologies that require consent; otherwise, for cookies necessary for the website's function, it is Art. 122 of the Data Protection Code (Legislative Decree No. 196/2003).

We have integrated CookieHub to obtain your consent. This makes it easier for users to provide or manage consent for the individual categories of cookies and similar technologies we use. CookieHub blocks all categories of cookies that are not essential for the proper functioning of the website unless you provide your consent for additional tools. When you visit our website, you will see an interface for this purpose:

• By clicking the "Accept all" button, you can either allow all methods or decide individually via the "More options" button (by activating the individual toggles and clicking the final "Save settings" button) which cookies and/or cookie-based applications and subsequent data processing you consent to.
• Alternatively, you can reject all non-essential cookies by clicking the "Only essential cookies" button and use the website exclusively with the cookies required for its operation.

Technically necessary cookies are used to make our website easier and more convenient for you to use, which is required to provide our services under Article 122 of the Data Protection Code (Legislative Decree No. 196/2003). Some features of our site won't work without these cookies. Specifically, they are needed to allow the browser to recognize you when you navigate between pages.

The purpose of the cookies we use in the "Analytical Cookies," "Marketing Cookies," and "Necessary Cookies" categories depends on the specific services and data processing involved. You can find more details in the following sections of this privacy policy and within CookieHub.

The legal basis for data processed via our cookie management tool is Article 6(1)(c) of the GDPR regarding user consent data, and otherwise Article 6(1)(f) of the GDPR or Article 122 of the Data Protection Code (Legislative Decree No. 196/2003). As a website operator, we have a legitimate interest in providing a legally compliant, user-specific, and user-friendly cookie consent management system and in designing our website in a legally compliant manner.

.

Storage duration / Right to object and removal

For details on how long our cookies are stored, please refer to the "Cookie Declaration" section in CookieHub.

Cookies are stored on your computer and transmitted to our site. As a user, you have full control over how cookies are used. You can disable or restrict the transmission of cookies by changing your browser settings. Cookies that have already been saved can be deleted at any time, and this can even be done automatically.

If you disable cookies for our website, you may not be able to use all of its features to their full extent.

Alternatively, you can use the features of our integrated cookie consent tool to withdraw your consent at any time or change your preferences by clicking the "Cookie Settings" button.

‍

III. Website analytics / Reach optimization

1. Google Analytics

Description of data processing

We use features of the web analytics service Google Analytics for our online services. The provider in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), a subsidiary of Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics also uses cookies. The information generated by a Google cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. Google processes this data, and we receive reports about your user behavior. These reports may include, among other things:

• Audience reports: These help us get to know our users better and understand exactly who is interested in our services.
• Behavior reports: These show us how you interact with our website. We can track the path you take on our site and which links you click.
• Real-time reports: These let us see what is happening on our website right now. For example, we can see how many users are currently reading this text.

Google Analytics uses a tracking code to create a random, unique ID linked to your browser cookie. This allows Google Analytics to recognize you as a new user. The next time you visit our site, you will be recognized as a "returning" user. All collected data is stored along with this user ID, which is what makes it possible to evaluate pseudonymous user profiles.

Identifiers like cookies are used to measure your interactions on our website. Interactions are any actions you take while on our site. If you also use other Google systems (such as a Google account), data generated via Google Analytics may be linked to third-party cookies. Google does not share Google Analytics data unless we, as the website operator, authorize it. Exceptions may occur if required by law. You can find the cookies used by Google Analytics in the detailed information within our cookie management tool, CookieHub, under "Cookie Declaration."

Our website uses Google Analytics exclusively with the "anonymizeIp()" extension. This means your IP address is not stored in full; it is truncated by Google within the member states of the European Union or other contracting states to the Agreement on the European Economic Area before being transmitted to the USA. It is impossible to identify individual website visitors. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. Below is an overview of the most important data collected via Google Analytics:

• Heatmaps: Google creates so-called heatmaps. These heatmaps show exactly which areas you click on, giving us information about where you are "moving" on our site.
• Session duration: Google defines session duration as the time you spend on our site without leaving. If you are inactive for 20 minutes, the session ends automatically.
• Bounce rate: A bounce occurs when you view only one page on our website and then leave.
• Account creation: If you create an account or place an order on our website, Google Analytics collects this data.
• Location: Your country and approximate location can be determined via your IP address. This process is also known as IP geolocation.
• Technical information: Technical information includes, among other things, your browser type, your internet service provider, or your screen resolution.
• Source of origin: Google Analytics—and we ourselves—are naturally interested in which website or advertisement led you to our site.

This list is not exhaustive and serves only as a general guide to data storage by Google Analytics. For more information about how Google processes data, please read Google's privacy policy: https://policies.google.com/privacy?hl=en

Legal basis and purpose of data processing

We use Google Analytics to evaluate the use of our website and services, to compile reports on activities on our website and services, and to provide us with other services related to the use of our website, services, and the internet. We also use Google Analytics to evaluate data from AdWords and the DoubleClick cookie for statistical purposes. Since we, as the website and service operator, have a significant interest in analyzing user behavior to optimize our website, our offerings, and our advertising, we ask for your consent to use Google Analytics and store Google Analytics cookies based on Art. 122 of the Data Protection Code (Legislative Decree No. 196/2003).

The information generated by the cookie about your use of our website or services is generally transmitted to a Google server in the USA and stored there. If IP anonymization is activated, your IP address will be truncated by Google within member states of the European Union or other contracting states to the Agreement on the European Economic Area. In exceptional cases, however, the full IP address may be transmitted to a Google server in the USA and truncated there. By consenting to the use of cookies by Google Analytics, you also agree, in accordance with Art. 49(1)(1)(a) GDPR, that your data may be processed in the USA, provided the data transfer is not secured on the basis of EU standard contractual clauses. The USA is considered by the European Court of Justice to be a country with an inadequate level of data protection according to EU standards. In particular, there is a risk that your data may be processed by US authorities for control and surveillance purposes, possibly without the possibility of legal recourse. If you click the "Reject All" button or make a limited selection without Google cookies, the described transmission to Google will not take place. You can revoke your consent at any time with effect for the future.

Google will use this information to evaluate your use of the website or services, to compile reports on website activity for us, and to provide other services related to website and internet usage. According to its own statements, Google may also transfer this information to third parties where required by law or where third parties process this data on Google's behalf. Google has contractually guaranteed that it will not associate your IP address with any other data held by Google. To secure this, as well as the data processing performed on our behalf, we have concluded a data processing agreement with Google.

Storage duration / Right to object and removal

Cookies are stored on the user's computer and transmitted to our site. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.

By installing the browser add-on to deactivate Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=en), you can object to the use and collection of your data by Google Analytics. This informs Google Analytics that no information about your website visit should be transmitted to them.

Furthermore, especially for browsers on mobile devices, you can install an opt-out cookie on your device via this link https://developers.google.com/analytics/devguides/collection/gajs/?hl=en#disable to prevent future data collection by Google Analytics on our website. Please note that if you delete the cookies on your device, you will need to reinstall the opt-out cookie.

Alternatively, you can also set your cookie preferences via the Cookie Hub tool we have integrated.

‍

2. Google Tag Manager

Description of data processing

Google Tag Manager is a solution from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), which allows marketers to manage website tags via an interface. Google Tag Manager itself (which implements the tags) is a cookie-free domain and does not collect any personal data. Google Tag Manager assists with the integration and triggering of other tags, code snippets, tracking codes, and conversion pixels on a website, which may in turn collect data. Google Tag Manager does not access this data. Google Tag Manager provides us with an easy-to-use user interface that does not require in-depth programming knowledge or modifications to the website's source code.

We use Google Tag Manager solely to display Google Ads (formerly Google AdWords) for our search engine marketing activities.

For more information on Google Tag Manager, see: https://www.google.com/intl/en/tagmanager/use-policy.html.

‍

3. Google Ads (formerly Google AdWords) & Google Ads Conversion Tracking

Description of data processing

We use Google Ads, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and in Europe by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, to display advertisements within our online services and to draw attention to our attractive offers using advertising materials on external websites.

This allows us to determine how successful individual advertising campaigns are. These advertisements are delivered by Google via so-called "AdServers." Google AdWords uses cookies for this purpose (see the general information above). The placement of these cookies enables an analysis of how our websites are used. Each time you access one of the individual pages of our website that incorporates a Google Ads component, the internet browser on your information technology system is automatically prompted by the respective Google Ads component to transmit data to Google for the purpose of online advertising and commission billing. As part of this technical process, Google receives personal data, such as your IP address, which Google uses, among other things, to track the origin of visitors and clicks and subsequently to facilitate commission billing. The cookies used typically store the following information as analysis values: unique cookie ID, number of ad impressions per placement (frequency), last impression (relevant for post-view conversions), and opt-out information (indicating that the user no longer wishes to be targeted). These cookies allow Google to recognize your web browser. If you do not agree to the storage of cookies on your computer, please follow the general instructions for this or the instructions at the end of this explanation.

In addition, Google Ads uses so-called web beacons (invisible graphics). These web beacons allow information such as visitor traffic on the pages of this service to be evaluated.

The information generated by cookies and web beacons about your use of our website, including your IP address and the delivery of ad formats, is transmitted to a Google server in the USA and stored there. This information may be shared by Google with its contractual partners (see https://support.google.com/admanager/answer/94149?visit_id=637060482444635472-69980806&rd=1). We have no influence over the data collected by Google, nor are we aware of the full extent of the data collection or the storage duration. To our knowledge, however, Google will not associate your IP address with any other data held by you. If you are logged into a Google account, however, your data may be directly associated with it. If you do not want this association with your Google profile, please log out before using our online services.

Further information on data protection at Google Ads can be found at https://policies.google.com/privacy?hl=en, as well as at https://policies.google.com/technologies/ads?hl=en

Legal basis and purpose of data processing

The storage of Google Ads cookies and web beacons is based on Art. 6 (1) (a) GDPR. Furthermore, we use Google Ads based on our legitimate interest under Art. 6 (1) (f) GDPR. As a website operator, we have a legitimate interest in analyzing the reach of our services, displaying relevant and interesting ads, improving campaign performance reports, and achieving fair calculation of advertising costs.

We have also entered into a data processing agreement with Google.

Right to object and removal

You can prevent the installation of Google Ads cookies in several ways: a) by adjusting your browser settings accordingly; in particular, blocking third-party cookies will prevent you from receiving ads from third-party providers; b) by deactivating interest-based ads on Google via the link www.google.de/ads/preferences, although this setting will be deleted if you clear your cookies; c) by deactivating interest-based ads from providers that are part of the "About Ads" self-regulatory campaign via the link www.aboutads.info/choices, although this setting will be deleted if you clear your cookies; d) by permanently deactivating them in your Firefox, Internet Explorer, or Google Chrome browser via the link www.google.com/settings/ads/plugin. Please note that in this case, you may not be able to use all the functions of our online services to their full extent.

Alternatively, you can also set your cookie preferences using the CookieHub cookie management tool we have integrated.

‍

4. Amplitude

Description of data processing

To optimize our online shop and our mobile payment app, we use the web analytics software Amplitude, a service provided by Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA ("Amplitude"). This process is used to evaluate and analyze user behavior and to compile reports on activities for us . Data is collected in near real-time as soon as the user performs a specific action (e.g., clicking a button, loading a page, or completing a purchase). The following data categories are affected:

• Usage data: clicks, pages visited, time spent, feature usage.
• Device data: operating system, browser type, device type, screen resolution.
• Identifiers: pseudonymized user IDs, Amplitude-internal IDs, IP address. A truncated IP address is processed for this purpose.

Cookies are also stored on your computer for this purpose.

The information generated in this way is transmitted to an Amplitude server in the USA and stored there. We have concluded a Data Processing Addendum with Amplitude, which includes the EU Standard Contractual Clauses as a mechanism for the transfer of personal data from the EU to the USA. Amplitude participates in the EU-US Data Privacy Framework, which mandates minimum standards for the protection of personal data of Europeans whose data is stored or processed in the USA.

Further information on data processing by Amplitude can also be found in Amplitude's privacy policy (https://amplitude.com/privacy).

Legal basis and purpose of data processing

We use Amplitude to analyze how our services are used and to generate reports on activity, which helps us better understand user behavior. This allows us to identify areas for improvement and optimize our site performance and features. As we have a legitimate interest in analyzing user behavior to improve our products, we ask for your consent to use Amplitude and store cookies in accordance with Art. 122 of the Data Protection Code (Legislative Decree No. 196/2003).

Storage duration / Right to object and removal

If you do not want cookies to be stored, you can configure your browser to delete cookies, block all or specific cookies, or provide a warning before cookies are saved. You can also manage your cookie preferences using our integrated CookieHub management tool.

‍

IV. Further information on procedures, plugins, and tools used for website design

1. SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser's address line changes from “http://” to “https://” and by the lock symbol in your browser bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

2. make.com

Description of data processing

To integrate various databases and web tools, we use make, a service provided by Celonis SE, Theresienstr. 6, 80333 Munich. make is a platform where different cloud-based software applications can be connected. Data required or processed in these linked applications is automatically transferred through these connections. The goal is to allow digital processes, especially standardized, recurring ones, to run independently. This creates an automated data flow and efficient workflows.

Further information on data protection at Celonis can be found at https://www.make.com/en/privacy-notice and https://www.celonis.com/de/privacy-notice/ 

Legal basis and purpose of data processing

The use of make.com is based on Art. 6(1)(f) GDPR. We have a legitimate interest in efficiently automating processes, consolidating various services, and the associated import and export of personal and contact data.

‍

3. Language versions of the website (translations with Weglot) 

Description of data processing

On our website, we use the translation service Weglot, provided by Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France. Weglot is loaded when you visit the website and allows you to change the site's language using the corresponding language icons. By integrating the Weglot translation service, a connection is established between your browser and Weglot's servers when you visit our site, and your IP address and device information are transmitted to Weglot. The transmitted data is necessary for Weglot to function.  

Data processed through the use of Weglot is handled by Weglot as a data processor within the European Union, based on a data processing agreement in accordance with Art. 28 GDPR. 

Information on how Weglot handles personal data can be found at https://www.weglot.com/privacy .

Legal basis and purpose of data processing

The legal basis for the data processing carried out in connection with Weglot is our legitimate interest pursuant to Art. 6(1)(f) GDPR in providing our website in multiple languages, including a corresponding selection option for website visitors, provided that we do not request any further consent pursuant to Art. 7 GDPR or Art. 122 of the Data Protection Code (Legislative Decree No. 196/2003).

Right to object and removal

The use of the Weglot service is strictly necessary to provide the website in different language versions.

If you would like your personal data to be deleted, you can exercise your right to object and removal as described in the general information in Part A.

4. Integration of YouTube content

Description of data processing

From time to time, we use content or services from the video platform YouTube to embed video content on our website via a plugin or to link to videos on our YouTube channel. YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States, and is provided in Europe by Google Ireland Limited
Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”).

We may process data you enter on our YouTube channel (in particular your username and content published under your account) if we respond to your posts or messages via our YouTube channel.

Otherwise, we only receive certain non-personal information from Google regarding post activity, such as the number of profile or media clicks and the watch time for a specific video. This data can be viewed via our YouTube account. Beyond this, data processing is carried out by Google under its own responsibility; we have no way to prevent or disable the use of analysis tools and similar features by Google within YouTube.

If you wish to play embedded videos using this plugin (by clicking the play button), your IP address will be sent to YouTube, as YouTube cannot send the video content to your browser without it. The IP address is therefore required for display purposes. Furthermore, information about which subpage of our website you visited is transmitted to the YouTube server. If you are logged into your YouTube account as a member, playing our videos allows YouTube to associate your usage behavior directly with your personal profile. Further information on data processing by Google when using YouTube can be found in the privacy policy applicable to YouTube: https://policies.google.com/privacy?hl=en&gl=en

Legal basis and purpose of data processing

The use of YouTube is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR to provide or link to video content on our website and to process inquiries or comments.

Storage duration / Right to object and removal

To prevent your activity from being associated with your user account, please log out of your YouTube profile before playing our video content. You must inform yourself via Google or your YouTube user account about ways to restrict the processing of your data by Google. For example, you can do this in the general settings of your Google account under “Privacy and Security.” Furthermore, on mobile devices (smartphones, tablets), you can restrict Google’s access to contact and calendar data, photos, location data, etc., in the device settings. However, this depends on the operating system you are using.

‍

5. Auth0

Description of data processing

For registration and login in our online shop, we use the cloud-based identity management platform Auth0, provided by Okta Inc., 10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA.

When users enter data into a form provided by Auth0, this data is exchanged directly between the user’s browser and Auth0. The following data is processed for identity management, authentication (login/registration), and user account security:

• Account data: email address, name, and profile picture (if using social login).
• Security data: password hashes, two-factor authentication (MFA) data, and session tokens.
• Metadata: login IP address, timestamps, and browser/device information (for fraud detection).

Data is collected exclusively during the login or registration process, as well as whenever a session is refreshed.

For more information on how Auth0 processes data, please visit https://www.okta.com/legal/privacy-policy/.

We have chosen Europe as the server location for data storage. If a data transfer to the USA becomes necessary in individual cases, we base this on the EU Standard Contractual Clauses, which we have concluded in conjunction with a data processing agreement.

Legal basis and purpose of data processing

We integrate Auth0 based on our legitimate interest under Art. 6(1)(f) GDPR to ensure that only authorized and identified individuals can access our services. Furthermore, Auth0 is necessary for providing the service as part of user account access in accordance with Art. 122 of the Data Protection Code (Legislative Decree No. 196/2003).

Storage duration / Right to object and removal

If you do not want cookies to be stored, please configure your internet browser to delete cookies, block all or specific cookies, or provide a warning before cookies are saved. You can also set your cookie preferences using our integrated cookie management tool, CookieHub.

‍

6. Datadog

Description of data processing

We use DataDog, a service provided by DataDog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA ("DataDog"), as a data processor within the meaning of Art. 4(8) and Art. 28 GDPR.

We use DataDog to monitor system stability and for error analysis (such as unexpected deviations, anomalies, latency—i.e., the time delay in transmitting data to our servers—availability, and response times) of our websites and services, as well as for IT security purposes.

For this purpose, DataDog collects the following data on our behalf:

• Log data: Technical logs of server requests (including user IP addresses).
• Performance data: App response times, error rates, error information, and crash reports (stack traces, i.e., the sequence of application events that led to an error, as well as the time the error occurred).
• Metadata: System configurations (e.g., browser type and version, operating system) and anonymized user IDs to track errors across various microservices.

With DataDog, this data allows us to detect, analyze, and immediately resolve errors. The collected personal data may be transferred to and stored by DataDog in the USA. We have entered into a Data Processing Agreement with DataDog that includes the EU Standard Contractual Clauses. Furthermore, DataDog is certified under the EU-U.S. Data Privacy Framework, which serves as the basis for data transfers to certified companies and organizations in the USA.

For more information on how DataDog processes data, please see DataDog Inc.'s privacy policy: https://www.datadoghq.com/legal/privacy/

Legal basis and purpose of data processing

After this period, only aggregated, non-personal data is retained.
This data is processed based on our legitimate interest under Art. 6(1)(f) GDPR in ensuring the error-free and demand-oriented operation of our websites and services, as well as for error detection and resolution.
DataDog is therefore necessary for providing our websites and services as part of user account access in accordance with Art. 122 of the Data Protection Code (Legislative Decree No. 196/2003).

Storage duration / Right to object and removal

Data collected via DataDog is deleted or anonymized after error analysis.

‍

V. Links to third-party websites

Our website may contain links to other websites. We have no control over the content or design of third-party offerings. Therefore, these privacy notices do not apply to external providers whose content or services we merely link to.

If you are redirected to other sites via links on our pages, please check their respective policies regarding how they handle your data.

‍

VI. Online presence on social networks and platforms

Description of data processing

We maintain additional online profiles on social networks and industry platforms (such as Facebook, Xing, or LinkedIn) (hereinafter referred to as “SN”) and platforms (e.g., YouTube), which we link to from our website. By clicking on the respective buttons (identifiable by the logos of the social networks or platforms), you will be taken to the corresponding online profile. The purpose of these profiles is to communicate with active customers, interested parties, and users, and to provide information about our services.

When accessing these networks and platforms, the terms and conditions and data processing policies of the respective operators apply.

Since the use of SN occurs outside of our website and services, we have no influence over it, unless otherwise stated below. However, please be aware that when using the aforementioned platforms and networks we link to, your data may be processed by these SN companies in the USA and may also be used by the respective operators for market research and advertising purposes, including the creation of user profiles. If you are logged into these networks and platforms, they may also store cookies on your device that track your use of our platform or services, as well as other information about your usage behavior.

Unless otherwise stated in our privacy policy, we only process user data when they communicate with us within these social networks and platforms, for example, by writing comments or sending us messages.

To make it easier for you to find information about data processing and opt-out options, we have provided links to the privacy policies and information of the respective network operators below.

Legal basis and purpose of data processing

We only process your personal data when you contact us directly via the respective SN or interact with our profile or its content. Unless otherwise stated in our privacy policy, we process user data based on our legitimate interests under Art. 6(1)(f) GDPR to effectively inform and communicate with users, provided they interact with us within these social networks and platforms (e.g., when users post on our profiles or send us messages). If your contact is aimed at entering into a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR.

To the extent that personal data is processed in connection with our presence on an SN and the respective SN alone determines the purposes and means of processing, that SN is the sole controller for such processing. Please carefully consider what personal data you share with us via an SN profile. If you wish to avoid having an SN process personal data you provide to us, please contact us through another method.

Retention period / Right to object and erasure

If you are a member of an SN where we maintain a profile and do not want the SN to collect data about you via our site and link it to your member data, you must log out of the SN before visiting our site. For a detailed overview of the respective processing, information on how long data is stored by each SN, and your opt-out options, please refer to the provider links provided below.

Regarding information requests and the assertion of user rights, please note that these are most effectively handled directly by the providers. Only the providers have access to user data and can take appropriate action or provide information. Should you still require assistance, you are welcome to contact us.

Facebook

We maintain a company Facebook page ("fan page") on the social network operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Facebook Ireland and we are joint controllers for the collection of data from visitors to our fan page. For this reason, we have entered into an agreement on the joint processing of personal data with Facebook in accordance with Article 26 of the GDPR, as well as additional data processing terms:

• "Controller Addendum": https://www.facebook.com/legal/controller_addendum
• "Data Processing Terms": https://www.facebook.com/legal/terms/dataprocessing/update

We are responsible for providing data subjects with at least the information above and below regarding our joint controllership with Facebook. The information required by Article 13(1)(a) and (b) of the GDPR from Facebook can be found in the Facebook Ireland Data Policy at https://www.facebook.com/about/privacy.

Facebook Inc., based in Menlo Park, California, USA (hereinafter: "Facebook Inc."), also collects and uses "Page Insights" for analytical purposes. Page Insights are summaries of data that allow both us and Facebook Inc. to gain insights into how users interact with our page. Page Insights may be based on personal data collected in connection with our users' visits or their interactions on our page. To this end, we have entered into a "Controller Addendum" with Facebook (see above), which specifically regulates the security measures Facebook takes in the context of Page Insights and how Facebook responds to user inquiries. The purposes for which the collection and transmission of personal data—which constitute joint processing—take place are set out in detail in the terms of use referenced by the aforementioned Controller Addendum.

Data collected during visits to our "fan page" also includes information about the types of content users view or interact with, or actions they take (see "Things you and others do and provide" in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices users employ (e.g., IP addresses, operating system, browser type, language settings, and cookie data, as described in detail under "Device Information" in the Facebook Data Policy: https://www.facebook.com/policy).

However, by maintaining this Facebook company page, we share responsibility for Page Insights and have agreed with Facebook Ireland that Facebook Ireland is responsible for fulfilling the rights of data subjects under Articles 15-20 of the GDPR regarding personal data stored by Facebook Ireland following joint processing. Therefore, we have a reporting obligation to Facebook if we receive data protection inquiries regarding Page Insights. Please note that we will forward inquiries regarding Page Insights to Facebook Ireland. Otherwise, please refer to the information on your rights as a data subject in Section A. For further information on how Facebook Ireland processes personal data, including the legal basis Facebook Ireland relies on and how you can exercise your rights as a data subject against Facebook Ireland, please refer to the Facebook Ireland Data Policy at https://www.facebook.com/about/privacy.

The analysis of data collected via Page Insights is used to improve our websites and for advertising purposes. We maintain our Facebook fan page for the purpose of communication and to easily channel contact requests from Facebook users. The collection and further processing of this data is in our legitimate interest and the legitimate interest of Facebook Inc. pursuant to Article 6(1)(f) of the GDPR.

Please be aware that we cannot enable or disable the Page Insights feature. We must therefore forward most such requests to Facebook Ireland, unless we have collected the data ourselves. If you do not want Facebook Inc. to collect your data, we ask that you do not use our Facebook company page and/or configure your browser to block cookies and/or log out of Facebook while using our page.

Privacy Policy:

https://www.facebook.com/about/privacy/, https://www.facebook.com/legal/terms/information_about_page_insights_data

Right to object:

https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com

LinkedIn

LinkedIn is a service provided by the LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA, operated in Europe by the LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is an internet-based social network that allows users to connect with existing business contacts and make new ones. Over 400 million registered individuals use LinkedIn in more than 200 countries. This makes LinkedIn currently the largest platform for business contacts and one of the most visited websites in the world.

Every time our website is accessed and equipped with a LinkedIn component (LinkedIn plug-in), this component prompts the browser used by the data subject to download a corresponding representation of the component from LinkedIn. Further information on LinkedIn plug-ins can be found at https://developer.linkedin.com/plugins. As part of this technical process, LinkedIn receives information about which specific subpage of our website is being visited by the data subject.

If the data subject is logged into LinkedIn at the same time, LinkedIn recognizes which specific subpage of our website the data subject is visiting each time they access our site and for the entire duration of their stay. This information is collected by the LinkedIn component and assigned by LinkedIn to the data subject's respective LinkedIn account. If the data subject clicks on a LinkedIn button integrated into our website, LinkedIn assigns this information to the data subject's personal LinkedIn user account and stores this personal data.

LinkedIn always receives information via the LinkedIn component that the data subject has visited our website if the data subject is logged into LinkedIn at the time they access our website; this occurs regardless of whether the data subject clicks on the LinkedIn component or not. If the data subject does not want this information to be transmitted to LinkedIn, they can prevent the transmission by logging out of their LinkedIn account before accessing our website.

LinkedIn offers the option to unsubscribe from email messages, SMS messages, and targeted ads, as well as to manage ad settings, at https://www.linkedin.com/psettings/guest-controls. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua, and Lotame, which may set cookies. Such cookies can be rejected at https://www.linkedin.com/legal/cookie-policy. LinkedIn's current privacy policy is available at https://www.linkedin.com/legal/privacy-policy. LinkedIn's cookie policy is available at https://www.linkedin.com/legal/cookie-policy.

Privacy Policy https://www.linkedin.com/legal/privacy-policy ,

Opt-out option:

https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out ,

XING

The operating company of XING is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany ("XING").

XING is an internet-based social network that allows users to connect with existing business contacts and build new ones. Users can create a personal profile on XING. Companies can, for example, create company profiles or post job offers on XING.

Each time you access one of the individual pages of this website operated by the controller, on which a XING component (XING plug-in) has been integrated, the internet browser on your IT system is automatically prompted by the respective XING component to download a display of the corresponding XING component from XING. Further information on XING plug-ins can be found at https://dev.xing.com/plugins. As part of this technical process, XING receives information about which specific subpage of our website you are visiting.

If you are logged into XING at the same time, XING recognizes which specific subpage of our website you are visiting each time you access our site and for the entire duration of your stay. This information is collected by the XING component and assigned by XING to your respective XING account. If you click on one of the XING buttons integrated into our website, such as the "Share" button, XING assigns this information to your personal XING user account and stores this personal data.

The XING component always informs XING that you have visited our website if you are logged into XING at the time you access our site; this happens regardless of whether you click on the XING component or not. If you do not want this information to be transmitted to XING, you can prevent the transmission by logging out of your XING account before accessing our website.

The privacy policy published by XING, which is available at https://www.xing.com/privacy, provides information about the collection, processing, and use of personal data by XING. Furthermore, XING has published privacy notices for the XING Share button at https://www.xing.com/app/share?op=data_protection .

Privacy Policy / Opt-out option:

https://privacy.xing.com/de/datenschutzerklaerung

‍

VII. Active use of our website

1. Contact forms and email contact

Description of data processing

Our website contains a contact form that can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask is transmitted to us and stored.

• Company/Municipality (required)
• First name (required)
• Last name (required)
• Email (required)
• Phone (optional)
• Message (optional)

At the time your message is sent via one of our contact forms, the following data is also stored:

• the user's IP address
• date and time of registration

If you contact us via an email address provided by us, the personal data of the user transmitted with the email will be stored.

If you provide a mobile phone number to receive updates on the status of your payment request, we will use the number you provided for this purpose.

We use HubSpot Forms on our website, a service provided by our CRM system HubSpot, to integrate contact forms and process the data entered there (see Part C, Section II). HubSpot Forms offers features for SEO, content creation, lead management, email marketing, and analytics. The data entered by users in the forms is stored in our customer relationship management system provided by HubSpot.

We use Google email services provided via Google Workspace by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (hereinafter: "Google"). In addition to our CRM software, which serves as our central system for managing and processing inquiries, emails are also stored on Google's servers. We have selected the "Europe" region as our server location and have entered into a data processing agreement with Google. There is no further transfer of these emails to third countries, particularly the USA, which Google also contractually guarantees.

To channel and sort incoming inquiries, we use an interface to access AI-based services designed to understand and generate natural language and related inputs, analyze information, and make predictions.

• For this, we use the ChatGPT language model from OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We have agreed with OpenAI that our data will not be used for training models or shared with OpenAI. You can view OpenAI's privacy policy at https://openai.com/de/policies/eu-privacy-policy. We have entered into a data processing agreement with OpenAI (see https://openai.com/policies/data-processing-addendum). Since data is transferred to the USA when using the OpenAI API, the Data Processing Addendum includes the EU Standard Contractual Clauses to ensure an adequate level of data protection even when data is transmitted to a third country.
• In addition, we use the AI-powered system Google Gemini, offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Gemini was developed to provide advanced language and image processing capabilities. It uses machine learning to understand and generate natural language and analyze images, offering versatile applications in various fields. We use the Google Gemini model to pre-select emails and incoming documents. As Google Workspace customers, Google ensures that data used with Google Gemini is not used by Google to train its generally available AI models.

For spell-checking responses to incoming emails, we use the LanguageTool application, software from LanguageTooler GmbH
, Karl-Liebknecht-Str. 37, 14482 Potsdam, a subsidiary of Learno Inc., which includes AI features for checking spelling and grammar as well as refining phrasing. You can find the provider's privacy policy for LanguageTool at: https://languagetool.org/de/legal/privacy. LanguageTool stores checked records and the errors found within them on its servers for up to 15 minutes (not on permanent storage media). This storage occurs without an IP address or other information that would allow the data records to be linked to a specific person. However, if the text contains personal information, this is also stored temporarily. We have entered into a data processing agreement with Learno Inc. that includes the EU Standard Contractual Clauses required for data processing in the USA, by which the provider contractually commits to complying with applicable data protection regulations: https://languagetool.org/de/legal/dpa

To read attached PDF or Word files, we use the software solution Airparser, Sepapaja tn 6, Tallinn 11415, Estonia. Airparser uses AI technology to recognize and extract structured data. We have entered into a data processing agreement with Airparser in accordance with Art. 28 GDPR, by which Airparser is contractually obligated to comply with applicable data protection regulations (see https://airparser.com/dpa/). You can view Airparser's privacy policy at https://airparser.com/gdpr/ .

‍

Legal basis and purpose of data processing

The legal basis for processing data transmitted in the course of sending a contact form inquiry or an email is Art. 6(1)(f) GDPR. If the contact form inquiry or email contact aims at the conclusion of a contract, an additional legal basis for the processing is Art. 6(1)(b) GDPR.

The processing of personal data from the input mask serves to help us process inquiries and establish contact. In the case of contact via email, this also constitutes the necessary legitimate interest in processing the data. If you provide a mobile phone number for updates on the status of your payment request, we will use the number you provided for this purpose.

The use of AI-based services is based on our legitimate interest under Art. 6(1)(f) GDPR. Due to the high volume of incoming messages, we rely on such pre-selection and allocation to the relevant departments within the company to ensure fast and targeted processing of these inquiries, which is in both our interest and the interest of the senders.

User information may also be stored in our customer relationship management system (CRM software) or similar inquiry management systems based on our legitimate interests.

Other personal data processed during the submission process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

Duration of storage / Right to object and erasure

Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the contact form input mask and data sent via email, this is the case when the respective conversation with the user has ended. The conversation is considered ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified and there are no legal requirements for longer storage.

Users have the option to revoke their consent to the processing of personal data at any time.

If a user contacts us via email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued unless we can base it on another legal ground for data processing or have an overriding interest in further data processing.

All personal data stored in the course of contacting us will be deleted in this case, provided that no legal requirements mandate longer storage.

‍

2. Telephone Hotline

Description of data processing

If a user chooses to contact us by phone using a number provided on our websites, we collect the caller's phone number as well as other technical information from the telephone system (start time and duration of the call), which is either generated there or provided by the telephone company. We also record the essential content of the conversation and any information provided to our staff by the person concerned (name, request, contact details for follow-up questions, etc.).

To pre-qualify incoming calls, we use an AI-supported software solution from Leaping AI UG (limited liability), Potsdamer Straße 72, 10785 Berlin. This software is used to request the data required to categorize the call, route it to the correct department, or answer user queries (in particular our reference number, license plate number, and the caller's name) and allows certain customer requests to be handled automatically. We have concluded a data processing agreement with Leaping AI in accordance with Art. 28 GDPR.

We will ask you if you consent to your call being recorded. If the caller consents to a recording of the telephone call, we save the entire content of the conversation and automatically create a transcript. We use call recordings and transcripts for training and coaching our service staff, resolving customer complaints, creating anonymized internal evaluations (classifying calls, generating statistics on reasons for calls), and for evidentiary purposes in connection with asserting our legal claims or defending against legal claims directed at us.

We use the cloud contact center platform Talkdesk from Talkdesk Inc., 201 Spear Street, Suite 1100, San Francisco, CA 94105 USA (hereinafter: "Talkdesk"). We have concluded a data processing agreement with Talkdesk in accordance with Art. 28 GDPR, along with the EU Standard Contractual Clauses for data transfers to third countries, which contractually obligates Talkdesk to comply with applicable data protection regulations. Furthermore, we have agreed with Talkdesk that our Talkdesk instance will be hosted in a region in Europe, ensuring that our data is processed by default in a regional cloud within the European Union.

Legal basis and purpose of data processing

When a call is answered, we automatically collect the data required for call processing (in particular our reference number, license plate number, and the caller's name) for the purpose of automating and more efficiently handling certain customer requests or interaction components, based on Art. 6 (1) (f) GDPR. If the call relates to our services and an existing, terminated, or planned contractual relationship with the caller, the additional legal basis for processing is Art. 6 (1) (b) GDPR.

During the call, we manually save the caller's request in our system and store this call note once the call ends. No call recording takes place in this instance. The legal basis for processing this data is Art. 6 (1) (f) GDPR. If the call relates to our services and an existing, terminated, or planned contractual relationship with the caller, the additional legal basis for processing is Art. 6 (1) (b) GDPR.

Call recordings and transcriptions are created and further processed exclusively on the basis of consent previously given by the user in accordance with Art. 6 (1) (a) GDPR.

User information may also be stored in our customer relationship management system (CRM software) or similar request management systems based on our legitimate interests.

Storage duration / Right to object and erasure

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case when the respective conversation with the user has ended. The conversation is considered ended when it is clear from the circumstances that the matter in question has been conclusively resolved and no legal requirements necessitate longer storage.

Unless a statutory retention period is specified for recordings, the duration for storing call recordings and call notes is based on the statutory limitation periods (the standard limitation period is 5 years according to Art. 2947 c.c. and 10 years according to Art. 2946 c.c.). Transcripts of call recordings are deleted after 6 months.

Users have the option to revoke their consent to the processing of personal data at any time. If a caller consents to the recording of the call and the storage of that recording and transcript, they may revoke this consent at any time. In such a case, the recordings or transcripts will be deleted immediately, provided that no legal requirements compel us to store them for a longer period.

‍

3. Ticket System

Description of data processing

We use Freshdesk as our ticket system, a software solution from Freshworks, Inc., 2950 S. Delaware Street, Suite 201 in San Mateo, CA 94403 USA. Freshdesk is a customer service platform that facilitates the handling of customer inquiries and requests across various channels. We use Freshdesk to receive and manage contact requests. If you submit contact requests via our websites using a contact form, or contact us by email or phone, the information provided during the contact process and the content of the conversation, as well as data collected by us (see sections VII. 2 and VII. 3 above), are stored and organized in the ticket system to enable chronological processing and improve the service experience.

The stored information is saved on Freshdesk's servers. For the organization and processing of requests, personal data is collected according to the scope of what you provide—at a minimum, your first name, last name, and email address—transmitted to Freshdesk, stored there, and retrieved. We have taken advantage of the option to have data processed on servers within the EU. This is intended to technically ensure that the data remains within the European Union and that access by US authorities is not possible.

For more information on data protection at Freshdesk, please visit https://www.freshworks.com/privacy/ .

Legal basis and purpose of data processing

We process the information collected via Freshdesk based on our legitimate interest in providing efficient customer service and answering your requests as quickly as possible to support our customers and users (Art. 6(1)(f) GDPR). This is in conjunction with a data processing agreement concluded with Freshdesk in accordance with Art. 28 GDPR, which ensures data protection and prohibits unauthorized disclosure to third parties.

If a data transfer to the USA is necessary in individual cases, it will be based on the EU Commission's standard contractual clauses.

Storage duration/right to object and erasure

We store your data for the duration of our contractual relationship with you or until the respective conversation has been resolved.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

‍

4. Chat function

Description of data processing

The chat function provided on our website uses an AI-powered chatbot from Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA ("Decagon"). Decagon operates an AI platform that automates customer service processes using customer service "agents." You can use the chat function to ask and receive answers to frequently asked or general questions about our parking system or specific parking areas we manage (e.g., opening hours, rates), or to report issues at a parking area we manage so they can be forwarded to our customer support team.

As soon as you enter a question into the chat text field (known as prompts), Decagon automatically analyzes the question and provides a text-based response from the agent. Generally, we do not need any personal information about you (e.g., names, email addresses, phone numbers, addresses, license plate numbers) for this. Please refrain from voluntarily entering such personal data about yourself or others into the input field. We only collect and store such data if you provide it to us voluntarily.

To display and technically operate the chat function, the following technically necessary data is processed as part of log files when you use it:

• IP address
• Metadata about API requests
• Date and time of access

Processing by the chat function is fully automated and only occurs once data is sent to the chat. The agent works independently within clearly defined boundaries and does not make independent decisions that affect your rights or access to our services. If a request requires human judgment or falls outside the AI agent's scope, it is forwarded to one of our human agents via a supervised process and stored outside of Decagon in our CRM or ticketing system for further processing.

Decagon has contractually guaranteed that user data provided via the chat function will not be used to train other AI models.

For more information on data protection at Decagon, please visit https://decagon.ai/legal/privacy.

Legal basis and purpose of data processing

The purpose of processing is to support our customers and users by answering general questions or support requests. We process the information collected via Decagon based on our legitimate interest in providing efficient customer service and answering your requests as quickly as possible (Art. 6(1)(f) GDPR). This is in conjunction with a data processing agreement concluded with Decagon in accordance with Art. 28 GDPR, which ensures data protection and prohibits unauthorized disclosure to third parties.

Furthermore, we have agreed with Decagon that data will be processed exclusively within the EU during the normal operation of the chat function (EU data residency). If a data transfer to the USA is necessary for technical support of the chat function and has been authorized by us, it will be based on the EU Commission's standard contractual clauses.

Storage duration / Right to object and erasure

We store personal data exchanged during chats for the duration of the legal relationship between us and the affected parties, or until the respective conversation has been concluded.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

‍

C. Data processing in connection with the use of MHP parking facilities

1. Using the MHP Online Shop

Description of data processing

Via our MHP online shop (hereinafter: “Online Shop”), you have the option to book and pay for the parking services described there for parking areas managed by us, based on the applicable General Terms and Conditions. For example, you can pay your parking fees online.

‍

We use cookies to make our online shop more user-friendly. Some elements of our website require the browser to be identified even after navigating to a different page. These cookies store information such as language and user region.

In addition, cookies enable an analysis of browsing behavior within the online shop. This allows the following data to be transmitted: search terms entered, frequency of page views, and use of website features.

To book parking services, you must fill out and submit the respective booking form. On the provided input screen, you must enter your vehicle license plate number, select your desired parking area if applicable, and/or provide a file number or reference. We require the license plate number and other details to assign the owed parking fee to the specific parking process or service.

Data processed during the booking process includes license plate data, the amount to be paid, and other communication, contract, and payment data of our customers, prospective customers, and other business partners. Processing is carried out for the purpose of providing contractual services as part of operating our online shop, billing, delivery, and customer service. During the booking process, we specifically process the information provided in the respective input forms, such as name, company, address, email, and telephone number. Mandatory fields are generally marked with an asterisk (*) or labeled as “optional,” and include the information necessary for providing and billing the ordered service, as well as contact information to allow for follow-up or to notify you of important order-related information (e.g., mandatory legal information, schedule changes, etc.).

We process and use the data collected here to enable you to select, book, and pay for our parking services. We also process the data to handle and, if necessary, ship the booking you have placed. Further details regarding the legal and organizational framework can be found in the underlying General Terms and Conditions. Details on the payment service providers we use can be found in Section 2 of this Part C below.

Legal basis and purpose of data processing

The legal basis for processing data collected during a booking is Art. 6(1)(b) GDPR, due to the intended conclusion of a contract. Otherwise, it is Art. 6(1)(f) GDPR, used to detect and combat harmful behavior and to uncover and prevent other negative experiences in order to maintain the integrity of the online shop and promote protection and security. Both we and other users of our services have an interest in preventing, detecting, or investigating illegal activities, fraud, or security breaches. The above information is also required for the provision of the service in accordance with Art. 122 of the Data Protection Code (Legislative Decree No. 196/2003).

We process the personal data from the input screen to handle the respective booking and to provide the corresponding parking service.

Processing of data entered in the online shop may also be based on your consent (Art. 6(1)(a) GDPR) if we have requested it. You can withdraw your consent at any time. The legality of data processing already carried out remains unaffected by the withdrawal. Please note that as a result of your withdrawal, we may not be able to provide the full booking process, and your booking may no longer be able to be carried out.

Storage duration / Right to object and erasure

Data is deleted as soon as it is no longer required for the purpose for which it was collected. For personal data from the booking input screen, this is the case once a contract for our parking services has been concluded and the respective parking service has been fully provided. As a rule, however, we retain contract-related data until the expiration of statutory warranty obligations. In the event of a statutory archiving obligation, the affected data will be deleted after the relevant period has expired.

‍

2. Using payment providers for order processing ("Payment Services")

Description of data processing

If you are required to provide us with your payment details (e.g., account number for direct debit) after entering into a contract for paid parking services, this data is necessary for processing your payment.

To ensure modern, simple, and secure payment processing, we offer our customers various payment methods, for which we use banks, credit institutions, and other payment service providers (collectively referred to as: "Payment Service Providers").

Payment transactions via common payment methods (e.g., Visa/MasterCard) are processed exclusively via an encrypted SSL or TLS connection. You can identify an encrypted connection by the browser address bar changing from "http://" to "https://" and the padlock icon in your browser bar.
With encrypted communication, your payment data transmitted to us cannot be read by third parties.

If you choose a specific Payment Service Provider as your payment option, they will provide their services based on a contract between you and that provider, in accordance with their applicable terms and conditions. The data processing carried out by these providers is their sole responsibility, and we have no influence over it. Consequently, if you wish to exercise your data subject rights in this context, you must contact the respective Payment Service Provider directly. The provider may ask for additional consent, for example, to perform identity or credit checks. Personal data processed by Payment Service Providers typically includes your first and last name, address, date of birth, gender, email address, IP address, phone number, and data necessary for processing the payment related to your order, such as the number of items, item numbers, invoice amount, tax percentages, or bank details required to complete the transaction (e.g., account or credit card numbers, passwords, TANs, and checksums), as well as contract, total, and recipient-related information.

The Payment Service Provider processes this data to offer the respective payment method and, if necessary, for identity and credit checks, payment administration, and fraud prevention.

Legal basis and purpose of data processing

Your data is transmitted to the Payment Service Providers we use based on Article 6(1)(b) GDPR (processing for the performance of a contract) for data collected during an order, as well as based on our legitimate interests (Article 6(1)(f) GDPR) where we do not otherwise request your consent under Article 6(1)(a) GDPR.

You may revoke your consent for data processing by payment providers at any time with future effect. A revocation does not affect the validity of data processing operations that have already taken place.

5.1. American Express

The provider is American Express Europe S.A., Theodor-Heuss-Allee 112, 60486 Frankfurt am Main, Germany. You can find American Express's privacy policy here: https://www.americanexpress.com/de/legal/online-datenschutzerklarung.html

5.2. Apple Pay

The provider is Apple Inc., Infinite Loop, Cupertino, CA 95014, USA. You can find Apple Pay's privacy policy here: https://www.apple.com/legal/privacy/de-ww/

5.3. Giropay

The provider is giropay GmbH, An der Welle 4, 60322 Frankfurt, Germany. You can find Giropay's privacy policy here: https://www.giropay.de/rechtliches/datenschutzerklaerung/

5.4. Google Pay

The provider of Google Pay in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, an affiliate of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. You can find their privacy policy here: https://policies.google.com/privacy

5.5. Mastercard

The provider is Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium. You can find their privacy policy here: https://www.mastercard.de/de-de/datenschutz.html.

5.6. PayPal

We offer the option to process payments via the payment service provider PayPal (PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). You can find their privacy policy here: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

5.7. Visa

The provider is Visa Europe Services Inc., London Branch, 1 Sheldon Square, London W2 6TT, UK. You can find their privacy policy here: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

‍

Adyen

For certain payment methods, we use the payment service provider Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands (hereinafter: "Adyen"). If you select a payment via Adyen, personal data is automatically transmitted to Adyen. The personal data transmitted to Adyen generally includes the card type (e.g., Visa or Mastercard), cardholder name, card number, security code, and expiration date. Adyen's role is to request authorization for the transaction from the respective payment system, such as Mastercard or Visa, and to send this authorization to the buyer's bank for approval. Once the bank approves, Adyen is notified by the payment system and processes the payment to our bank. Adyen processes your data for payment processing as well as for identity and credit checks. In this case, Adyen processes your personal data as an independent controller. We therefore have no influence over Adyen's data processing.

You can find Adyen's privacy information here: https://www.adyen.com/de_DE/privacy-policy, and information regarding transaction processing at https://www.adyen.com/de_DE/privacy-policy/transaction.

‍

Stripe

For the online processing of payments for our services, we use Stripe, an online payment service provided by the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe").

If you choose Stripe as your payment method, the information provided during the checkout process, along with details about your order and any information required by the specific payment method (name, address, email address, customer number, order number, bank, account number, sort code, credit card number, expiration date, CVC, invoice amount, currency, transaction number, date and time of the transaction, location, and provider name), will be shared with Stripe. This data is shared exclusively for the purpose of payment processing with Stripe and only to the extent necessary. We cannot process payments via Stripe without transmitting your personal data.

Stripe acts in a dual role as both a controller and a (sub-)processor for data processing activities. As a controller, Stripe uses your transmitted data in accordance with its applicable terms and conditions to fulfill the contract between you and Stripe regarding payment processing and to comply with regulatory obligations. We have no influence over this process. You can find Stripe's privacy policy with further information here: https://stripe.com/de/privacy

Stripe acts as a processor to complete transactions within the payment networks. As part of this processing relationship, Stripe acts solely on our instructions and has been contractually obligated to comply with data protection regulations in accordance with Art. 28 GDPR.

‍

secuPay

We offer cashless payment methods from secupay AG (Goethestr. 6, 01896 Pulsnitz; "secupay") in our online shop. Secupay is a payment institution as defined by the Payment Services Supervision Act (ZAG) and is registered with the Federal Financial Supervisory Authority (BaFin) (Graurheindorfer Str. 108, 53117 Bonn; registration number: 126737), enabling cashless payments for products and services online. When using secupay as a payment method, the purchase price claim is assigned to secupay. This allows online shop operators to deliver goods, services, or downloads to the customer immediately after the order. If you select "direct debit," "invoice," or "credit card" via secupay during checkout, your data is automatically transmitted to secupay. During payment processing via secupay, your payment details are transmitted to secupay. Secupay then performs a technical check of the payment default risk. The transaction result is then automatically communicated to us. The personal data exchanged with secupay includes your first name, last name, address, email address, IP address, phone number, or other data necessary for payment processing.

The personal data exchanged between secupay and us may be transmitted by secupay to credit agencies. The purpose of this transmission is to perform identity and credit checks. Secupay may share personal data with affiliated companies, service providers, or subcontractors if necessary to fulfill contractual obligations or if the data is to be processed on our behalf. This data processing is carried out under secupay's own responsibility. We have no influence over this. You have the option to revoke any consent given to secupay regarding the handling of personal data at any time. A revocation does not affect personal data that we are legally required to process, use, or transmit for contractual payment processing. The applicable privacy policy of secupay can be found at https://www.secupay.com/de/datenschutz.

‍

3. Using MHP Online Shop reviews

Description of data processing

We use the services of the review portal "Trustpilot," operated by Trustpilot A/S, Pilestraede 58, 5th Floor, 1112 Copenhagen, Denmark. Trustpilot allows users to rate our products and services.

When one of our parking services is purchased online through our shop and the receipt is subsequently sent via email, we include a Trustpilot button in that email containing a unique link generated by Trustpilot. To do this, we maintain an interface ("API") with Trustpilot to create these invitation links. Clicking this link will take you directly to the Trustpilot review platform. When you click the button with the invitation link, the form on Trustpilot is automatically populated with your data, allowing you to submit your desired review on the portal. The review is verified based on the reference number via the generated link. Submitting a review is voluntary.

For this purpose, we transmit the following data to Trustpilot:

• Email address
• First and last name
• Reference number
• Language- and country-specific domain of our shop, access data (including IP address)
• Selected parking service

We use Trustpilot as a data processor and have contractually obligated them to handle your data in compliance with data protection regulations through a data processing agreement.

Please note that you need a user account with Trustpilot to submit a review, and that after you submit your review and agree to Trustpilot's terms of use, Trustpilot becomes the controller for the further processing of your review, particularly its publication. Details on data protection at Trustpilot can be found at https://de.corporate.trustpilot.com/legal/for-businesses/privacy-policy.

Legal basis and purpose of data processing

Data is processed for the purpose of creating an invitation link and verifying the authenticity of the shop usage for Trustpilot to conduct the review process. This, along with gathering user feedback to improve our services, constitutes a legitimate interest under Art. 6 (1) (f) GDPR.

Storage duration / Right to object and erasure

Invitation data for Trustpilot is stored for a period of one year.

‍

4. Use of parking areas managed by MH Parkservice

Description of data processing

When using the parking areas, the following data is automatically recorded: vehicle license plate including the front and/or rear of the vehicle, entry/exit time, date and location stamp, and the amount and payment method of the parking fee.

Before leaving the parking area, you must enter your license plate at the pay station, unless you have a permanent parking permit. If the entered license plate is found in our database, the parking fee is calculated and paid by the user. Details on data processing for payments via our online shop can be found in Part C, Sections 1 and 2 and the applicable terms of use.

In the event of violations of the General Terms of Use, all personal data of the vehicle's registered owner and the driver relevant to the legal pursuit of the violation—specifically the collection of a forfeited contractual penalty and/or the assertion of possession and property rights ("follow-up")—will also be processed.

If you receive a demand letter as the registered owner of the vehicle involved in a parking violation, your license plate was previously transmitted by us to the Pubblico Registro Automobilistico (P.R.A.) of the Automobile Club d’Italia, Via Marsala 8, 00185 Rome (hereinafter: "Vehicle Register"). If you are not the registered owner of the vehicle, your data was provided to us by the registered owner or another third party (e.g., a vehicle rental or leasing company) who confirmed to us that you were the driver of the vehicle at the time of the parking violation. If you no longer reside at the address registered with the vehicle register, we obtained your data through the person currently registered at that address, a credit agency, or a collection agency.

Legal basis and purpose of data processing / Data recipients

Processing the collected data is necessary to protect the legitimate interests of the parties involved in operating the parking area and related standard administrative tasks (Art. 6(1)(f) GDPR), as well as for the contractual fulfillment of services according to the General Terms of Use (e.g., calculating and billing parking fees, verifying registered parking permits, reconciling payments made via app or online portal, and monitoring compliance with maximum parking durations, free parking periods, or grace periods) (Art. 6(1)(b) GDPR).

Registered keeper data (specifically name and address) is retrieved from vehicle registries or foreign information offices by forwarding the license plate number ("keeper inquiry"). Driver data may be requested via the identified vehicle owner, vehicle rental, or leasing company and shared with third parties for the aforementioned purposes (e.g., lawyers, collection agencies). For the technical operation of parking equipment and software, as well as for tracking violations of the General Terms of Use, data is processed by MHP GmbH and its contractors (Peter Park System GmbH for parking technology and software operation, and Amazon Web Services EMEA SARL for data storage). The legal basis is Art. 6(1)(b) GDPR where processing is required for contract performance, and otherwise Art. 6(1)(f) GDPR for pursuing legitimate interests in protecting the property rights of MHP GmbH and third parties, ensuring the proper operation of parking areas, and accelerating vehicle processing on-site.

Storage duration / Obligation to provide data / Right to object and erasure

The personal data we collect will be deleted once all claims arising from or in connection with the use of the parking area have been settled and all statutory retention or limitation periods have expired. If there is no violation of the General Terms of Use and the user leaves the parking area within the grace period applicable from entry, user data is automatically deleted 48 hours after exiting the parking area, provided no statutory retention obligations prevent this.

Providing your data when using the parking lots we manage is contractually required under the respective General Terms of Use or is strictly necessary for concluding the contract. Without your data, it would not be possible to fulfill the underlying legal relationship and the services provided as part of parking management. We do not use your data for automated decision-making, including profiling. Since data collection and processing are strictly necessary, users do not have the option to object. As license plate recognition occurs upon entry, it is generally possible to turn around before entering—provided the site layout allows—to avoid data collection.

‍

5. Activation of parking permits

Description of data processing

For some of the parking areas we manage, parking permits—such as those for designated groups (e.g., employees, visitors, or customers) and/or free parking periods—can be requested via terminals or online booking forms (via the MHP website, online, or at local retail stores or institutions), in accordance with the conditions applicable to the respective parking area.

To do this, you must enter the data requested in the respective input form. The license plate number is always required. Additional information may be necessary to verify membership in a specific group, such as employee ID numbers. This information may be transmitted to our clients or their customers to verify eligibility or may be cross-referenced with data provided by them.

‍

Legal basis and purpose of data processing / Data recipients

Where cross-referencing with additional data is required to validate eligibility, or where additional data provided in the form is processed, this is done based on your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time. The lawfulness of data processing already carried out remains unaffected by the withdrawal. Please note that as a result of your withdrawal, we may not be able to provide the full booking process, and any booking already made may no longer be executable.

The legal basis for processing data collected during a booking is Art. 6(1)(b) GDPR for the purpose of entering into a contract, and otherwise Art. 6(1)(f) GDPR for the purpose of effectively managing parking permits and supporting the provision of the respective parking service.

‍

Storage duration / Obligation to provide data / Right to object and erasure

Data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the input form, this is the case after a contract for our parking services has been concluded and the respective service has been fully provided. As a rule, however, we retain contract-related data until the expiry of statutory warranty periods. In the event of a statutory archiving obligation, the affected data will be deleted after the period expires.

‍

6. Parking areas with free parking options for people with disabilities

Description of data processing

For some of the parking areas we manage, we offer a special arrangement that allows people with disabilities to park for free in designated spaces during their stay. To take advantage of this, eligible users must provide us with proof of their disability parking permit (e.g., the blue EU disability parking card).

Depending on the specific terms posted at the parking facility where this free parking option is offered, you will need to verify your eligibility. You can do this by scanning the QR code on the sign, visiting our website, and uploading your parking permit through the input form provided.

‍

Legal basis and purpose of data processing

The legal basis for processing data collected during a booking is Art. 6(1)(b) GDPR, as it is necessary for the performance of a contract. Otherwise, processing is based on Art. 6(1)(f) GDPR for the purpose of effectively managing parking permits and supporting the provision of parking services. In the case of health-related data, this is in conjunction with Art. 9(2)(e) or (f) GDPR.

‍

Storage duration / Obligation to provide data / Right to object and erasure

Proof of a disability parking permit is checked solely to verify eligibility and is deleted immediately after the parking transaction has been processed.

‍

7. Using the MH Parkservice Service Portal

Description of data processing

Once registered, our portal allows customers to submit support requests, request support services, and access customer-specific information via a secure login area.

You can access the portal via our website using the QR code provided to you (e.g., on a payment notice). Once authenticated, you can access the service portal. During the authentication process, the following personal data is provided by the user:

• Reference number
• License plate

For technical reasons, a limited amount of data (connection data) is collected every time you access the portal. This data is technically necessary to establish and maintain a connection between your device and our servers. Furthermore, this data is required to maintain your session after login and to prevent unauthorized access. During each login process and while using the customer portal, we or our hosting provider store your IP address, the timestamp of the action, your internet service provider, the web browser and operating system used (including version information), language settings, the referrer URL, and the name of the page accessed.

After logging into the portal, a cookie is set to maintain and protect your session. You must allow this cookie in your web browser to use the portal.

If a solution to a problem reported via the portal or an answer to a question requires the involvement of other partners or service providers, we will share the information related to your request or incident with them.

Legal basis and purpose of data processing

The legal basis for processing data collected during registration, portal usage, requests submitted, or downloads is Art. 6(1)(b) GDPR, as it is necessary for the initiation and performance of a contract. Additionally, Art. 6(1)(f) GDPR applies, as processing personal data in connection with our portal enables effective communication with our sales and support teams, facilitates the management and resolution of inquiries, and ensures a secure connection between user devices and our servers.

Storage duration / Right to object and erasure

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data from the registration input mask, this is generally the case once the specific usage session has ended.

Any personal data stored during the contact process will be deleted once it is no longer required by law (for example, statutory warranty periods related to support requests).

‍

8. Invoicing

Description of data processing

To create, send, document, and account for invoices, we use the cloud-based accounting software sevDesk, provided by sevDesk GmbH, Hauptstraße 115, 77652 Offenburg. In this context, the invoice recipient's contact details are processed via sevDesk. You can view the sevDesk privacy policy at https://sevdesk.de/datenschutz/.

Legal basis and purpose of data processing

We use sevDesk based on Art. 6(1)(c) and Art. 6(1)(b) and (f) of the GDPR for the aforementioned purposes of fulfilling our legal obligations, for contractual purposes, and for our legitimate interest in efficient accounting. We have entered into a data processing agreement with sevDesk in accordance with Art. 28 of the GDPR, which obligates sevDesk to comply with applicable data protection requirements.

Storage duration / Right to object and erasure

We store your data for the duration of our contractual relationship and until the end of the statutory retention periods for accounting-related documents.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

‍

D. Contractual relationships with customers and business partners

I. Am I required to provide data?

When you contact us with questions about our services, enter into contract negotiations, accept one of our offers, or enter into other contractual agreements with us, we process the personal data you provide in this context. The specific data processed depends largely on the relevant items or services you are requesting or purchasing from us. In this context, processing your data is generally essential for the preparation, conclusion, and execution of the contract. If you do not provide this data, we may be unable to enter into a contract, fulfill an order, or continue to perform an existing contract.

When we use data in the context of initiating or fulfilling a contract with a business customer, business partner, or cooperation partner, our interest in handling your data lies in enabling and maintaining communication with that customer or partner, typically as part of a contractual or other relationship. If you act as a contact person—typically in your capacity as an employee of these companies—you generally do not have an overriding interest to the contrary, provided this interaction is part of your job responsibilities, which means a right to object usually does not apply.

However, you are not required to provide consent for the processing of data that is not relevant to the fulfillment of the contract or not required by law.

II. HubSpot

Description of data processing

This website uses features from the customer relationship management (CRM) system HubSpot. HubSpot is a software solution provided by HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, and offered in Europe by HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. HubSpot is an integrated software solution that we use to manage various aspects of our online marketing. This includes, among other things: email marketing, social media publishing & reporting, analytics, contact management (e.g., user segmentation & CRM), landing pages, and contact forms.

We use HubSpot to manage and implement inbound marketing across various features of our online presence. The information collected is stored on HubSpot's servers. We use this data to gain detailed insights into how our online presence is used, to connect with website visitors, and to determine which of our services might be of interest to them.

HubSpot uses "web beacons" (invisible graphics or code) and cookies embedded in websites or emails, which are stored on users' devices. This tracks your IP address, geographic location, browser type, duration of your visit, and the pages you view.

Furthermore, HubSpot collects data you provide when you (a) subscribe to our newsletter or (b) fill out one of our contact forms.

For more information on HubSpot's privacy policy, please visit https://legal.hubspot.com/de/privacy-policy.

Legal basis and purpose of data processing

HubSpot cookies and web beacons are stored based on Art. 6(1)(a) GDPR. We use the information collected via HubSpot based on our legitimate interests in optimizing our marketing, analyzing the use of our online presence, ensuring its continuous improvement and user-friendliness, and providing our users with more targeted information (Art. 6(1)(f) GDPR).

Right to object and removal

You can prevent cookies from being stored by adjusting your browser settings. If you would like your other personal data to be deleted, you can exercise your right to object and removal as described in the general information in Part A.

Alternatively, you can manage your cookie preferences using our integrated CookieHub tool.

‍

III. Communication

Generally, we collect the necessary data directly from you during personal contact. However, you are welcome to contact us by phone, fax, mail, or via the email address provided (see Legal Notice) or any other email addresses of our staff known to you. In the latter case, the personal data transmitted with the email will be stored. Please note that communication via email is unencrypted for technical reasons.

Your data is used to process the conversation and follow up on the respective inquiry or meeting content. Your data is processed based on Art. 6(1)(b) GDPR if the communication relates to the fulfillment of a contract or is necessary for pre-contractual measures.

In all other cases, processing is based on our legitimate interests (Art. 6(1)(f) GDPR) in effectively handling inquiries addressed to us.

In this context, data is not shared with third parties unless it is necessary to pursue our claims or legitimate interests (Art. 6(1)(f) GDPR) or if there is a legal obligation to do so (Art. 6(1)(c) GDPR).

‍

IV. Data processing in sales

Personal data is processed based on Art. 6(1)(b) GDPR to provide the services you have commissioned, particularly for the execution of our contracts or pre-contractual measures, as well as all activities necessary for the operation and administration of MH Parkservice .

The resulting purposes of data processing depend primarily on the specific activities and individual services agreed upon with you. These may include consulting activities, sales process management (e.g., compiling documents, sending MH Parkservice product or event information, providing services through MH Parkservice), or supporting sales negotiations and contract conclusions.

Further details regarding the scope, purpose of data processing, and recipients of your data can be found in the respective contract documents and associated terms and conditions.

Where necessary for our business operations, we process your data beyond the actual fulfillment of the contract to protect our legitimate interests (Art. 6(1)(f) GDPR).

In connection with offering or providing our services, we may be subject to specific legal obligations, such as tax law requirements. The purposes of processing your data may therefore include, among other things, compliance with tax-related control and reporting obligations, customs or export regulations, and the assessment and management of risks. The data processing required for this is based on Art. 6(1)(c) GDPR.

‍

V. Newsletter

Description of data processing

We would like to keep our customers and interested parties regularly updated with promotional messages about our services and other products, offerings, webinars, updates, or news from MH Parkservice via email or other electronic notifications (hereinafter referred to as the “Newsletter”). For this, we require your email address. In the respective newsletter registration forms, additional information may be requested to provide you with personalized content tailored to your interests.

You can sign up for our newsletters by using the corresponding function in a registration form or by checking a box (so-called opt-in) during a registration process. We provide various options on our websites or within registration and order interfaces for you to sign up for our (potentially topic-specific) newsletters. Details regarding the specific content of the newsletters are described in the respective registration form. This description is decisive for your consent.

After signing up, you will receive an email from us asking you to confirm your newsletter subscription (the so-called double opt-in procedure). This confirmation is necessary to ensure that no one else has misused your email address to sign up for our newsletter without your knowledge. Your email address will only be activated for newsletter delivery once you click the hyperlink provided in that email.

To manage registrations and send emails related to our newsletter, we use the service MailChimp, provided by the US company Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA (hereinafter “MailChimp”), which allows us to automate the registration process and the necessary email delivery in a simple and user-friendly way. Since MailChimp’s IT system is located in the USA, registration data from the input forms is transferred to and processed in the USA. To ensure appropriate handling of the data we transmit, we have concluded a data processing agreement with MailChimp in accordance with Art. 28 GDPR, including EU standard contractual clauses for data transfers to third countries. Further information on how MailChimp handles personal data can be found at: https://mailchimp.com/legal/privacy/.

For verification purposes, your IP address and the date of registration (“timestamp”) are stored alongside your email address and name when you sign up for the newsletter.

Legal basis and purpose of data processing / Data recipients

The legal basis for sending newsletters is the consent you provide as a recipient in accordance with Art. 6(1)(a) GDPR, Art. 7 GDPR in conjunction with Art. 130 of the Data Protection Code (Legislative Decree No. 196/2003), or, if consent is not required for existing customers under Art. 130 of the Data Protection Code (Legislative Decree No. 196/2003), based on our legitimate interest in direct marketing measures pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 130 of the Data Protection Code (Legislative Decree No. 196/2003).

Logging the registration process is based on our legitimate interests under Art. 6(1)(f) GDPR in maintaining a secure and targeted newsletter system that serves both our business sales interests and the expectations and needs of the recipients, as well as in being able to provide proof of the consent given.

Storage duration / Right to object and removal

You can object to receiving the newsletter at any time or revoke your consent to receive it, either in full or in part. You will find an unsubscribe link at the end of every newsletter. You can also contact us directly using the contact details provided at the beginning of this document.

Unsubscribing from the newsletter does not affect business communication. If necessary for the purpose of contract fulfillment, your data will remain stored with us. Furthermore, we reserve the right to store the necessary evidence to prove that our newsletter distribution is legally compliant until the statutory limitation periods have expired.

VI. Data transmission

During both the inquiry/quote phase and the contract execution phase, your data or documents may be shared with public authorities, private service providers, or individuals with whom we regularly collaborate, depending on the scope of the service (see Part A Section V).

‍

E. Other

Durch die Weiterentwicklung unserer Webseite, unserer Dienste oder unserer sonstigen Angebote sowie aufgrund geänderter gesetzlicher beziehungsweise behördlicher Vorgaben kann es notwendig werden, diese Datenschutzerklärung zu ändern. Die jeweils aktuelle Datenschutzerklärung kann jederzeit auf unserer Webseite von Ihnen abgerufen und bei Bedarf ausgedruckt werden.

‍

Data Protection Notice (Effective as of March 30, 2026)

These Privacy Notices are intended to provide an overview of what happens to your personal data (hereinafter also: “data”) in our company and to inform you about the data protection claims and rights to which you are entitled within the meaning of the European General Data Protection Regulation (“GDPR”) and its national implementations (Decreto legislativo 30 giugno 2003, n.196 recante il „Codice in materia di protezione dei dati personali“, hereinafter also “Data Protection Code (GvD No. 196/2003)”). We therefore ask you to take note of these Privacy Notices and, if necessary, to print them out or save them.

Personal data are all data by which you can be personally identified. The processing of your personal data may take place for various purposes. Essentially, the data processing operations by Mobility Hub Parkservice Italia S.R.L (hereinafter also “MH Parkservice” or “We”) can be divided into the following areas of application:

• General: General information on data protection, data processing operations and data subject rights, which apply to all data processing operations carried out for us, can be found in Part A below.
• Our Internet presences: In connection with our website www.mh-parkservice.it. (hereinafter: “Website”) or related external online presences, such as our social media profiles, our service portal (https://it.mh-parkservice.de/kundenservice/) or our subsequent payment service (https://parcheggio.mh-parkservice.it/), from which we refer to these Privacy Notices (website and external online presences hereinafter collectively also: “Internet presences”), we process data of visitors that are exchanged between their internet-enabled end devices and the server operated by us, as well as data communicated to us in the course of using the website. Details can be found in Part B.
• Parking space users: For information on the processing of data of users of parking areas managed by us, for example in the context of payment transactions via the MHP Online Shop or our subsequent payment service, the tracking of parking violations by MH Parkservice or insight into details of parking violations via our service portal, please visit Part C.
• B2B: For the purpose of handling or initiating contracts, we process the necessary data of our business customers and interested parties. Data of our business partners or supplier data serve exclusively the direct placing of orders, processing and performance. More information can be found in Part D.

Please visit the individual sections if you want to obtain quick and context-related information on certain processing situations.

‍

A. General information on data protection and data subject rights

I. Who is responsible for data processing and whom can you contact if you have questions?

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the Member States as well as other data protection provisions is:

Mobility Hub Parkservice Italia S.R.L.
BOLZANO (BZ)
PIAZZA DELLA MOSTRA 2 CAP 39100
Tel.: +3904711430502
E-Mail: info@mh-parkservice.it

For questions on data protection, you are welcome to contact our data protection officer at the following contact details: dataprotection@mh-parkservice.it

II. What rights do you have regarding your personal data?

If personal data relating to you are processed, you are a “data subject” within the meaning of the GDPR, which may entitle you to the rights described below. To the extent that you assert rights against MH Parkservice as the responsible entity, we recommend that you address these to our above contact details:

1. Right of access
In accordance with Art. 15 GDPR, you may request from us confirmation as to whether personal data concerning you are processed by us and request information about the extent to which we process your data.

2. Right to rectification
If personal data concerning you are inaccurate or incomplete, you have a right to rectification and/or completion in accordance with Art. 16 GDPR.

3. Right to erasure
If the legal requirements of Art. 17 GDPR are met, you may request the erasure of your data if we process it unlawfully or if the processing interferes disproportionately with your legitimate protection interests. Please note that there may be reasons that prevent immediate erasure, e.g. in the case of statutory retention obligations.
Irrespective of the exercise of your right to erasure, we will, in order to fulfil our statutory erasure obligations, delete your data immediately and completely after the processing purpose ceases to apply, unless a contractual or statutory retention period prevents this.

4. Right to restriction of processing
In the cases specified in Art. 18 GDPR, you may request from us the restriction of the processing of your data. If you have restricted the processing of your personal data, such data – apart from being stored – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

5. Right to data portability
Pursuant to Art. 20 GDPR, you have the right to receive data you have provided, which we process in an automated manner on the basis of your consent or in performance of a contract, in a commonly used, machine-readable format, or to have it transferred to a third party. If you request the direct transfer of the data to another controller, this will only take place insofar as it is technically feasible. The right to data portability does not apply to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

6. Right to object
If we process your data based on a legitimate interest as defined in Art. 6(1)(f) GDPR, you have the right to object to this processing at any time for reasons relating to your specific situation; this also applies to profiling based on these provisions (see Art. 21 GDPR). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is for the establishment, exercise, or defense of legal claims.
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes. You may object to the processing of your data for direct marketing purposes at any time without providing a reason.

7. Right to withdraw consent
Some processing operations are only possible with your express consent as defined in Art. 6(1)(a) GDPR. You may withdraw any consent you have already given at any time, effective for the future. However, the lawfulness of any processing carried out prior to the withdrawal remains unaffected. Please note that even after withdrawing consent, processing of the affected data may still be possible in whole or in part based on other legal grounds.

8. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority—particularly in the Member State of your habitual residence, place of work, or the place of the alleged infringement—if you believe that the processing of your personal data violates the GDPR (Art. 77 GDPR in conjunction with Art. 141 et seq. Data Protection Code (GvD No. 196/2003)). If you believe we are violating Italian or European data protection law when processing your data, please contact us so we can address your concerns.
You also have the right to contact the supervisory authority responsible for us based on our registered office:

Garante per la Protezione dei Dati Personali,
Piazza Venezia n. 11, I-00187 Rome,
Tel.: +39 06 69 6771,
E-Mail: protocollo@gpdp.it

III. What personal data is processed and where does it come from?

1. Origin of personal data
We primarily process data that we receive directly from you when initiating or maintaining a business relationship, or when you use our website (see also Part B, Section VI).
‍
Through our website and services, we process data received during your visit or that you actively provide (e.g., when using our online shop). Other data is collected automatically by our IT systems when you visit the website or use our services. This is mainly technical data (e.g., internet browser, operating system, or time of access). This data is collected automatically as soon as you enter our website or access our services. Details can be found in Part B.
‍
In individual cases, we also process data lawfully received or acquired from third parties such as credit agencies, creditor protection associations, or authorities, or data obtained from publicly accessible sources (e.g., telephone directories, company registers, press, internet, or other media).

2. Categories of personal data
The personal data we regularly process includes master/contact data such as: title, first and last name, salutation, date of birth, address, e-mail address, telephone number, fax, and job title.
In addition, depending on the order, service, or relationship, we process the following personal data:

• Address data: street, house number, address additions (if applicable), postal code, city, country
• Contact data: telephone number(s), e-mail address(es)
• Vehicle data: license plate number, vehicle owner
• Parking space management data: photographs, date and period of use of a parking area, parking permits, bank details, payment details
• Registration data: information about the service used for registration; times and technical information regarding registration, confirmation, and cancellation; data provided by you during registration
• Offer data
• Access data: date and time of visit; the referring page; pages accessed; session ID; additionally, information from the accessing computer system: IP address, browser type and version, device type, operating system, and similar technical information.
• Information about the nature and content of our business relationship, such as contract data, order data, turnover and receipt data, customer and supplier history, and consulting documents
• Advertising and sales data,
• Documentation data (e.g., consultation logs, service call records, or support cases)
• Other data received from you during our business relationship (e.g., in customer meetings),
• Documentation of consent declarations

IV. For what purposes and on what legal basis is the data processed?

We process your data in accordance with the GDPR and the Data Protection Code (GvD No. 196/2003) as amended, particularly on the following bases:

1. Performance of (pre-)contractual obligations (Art. 6(1)(b) GDPR)
Personal data is processed based on Art. 6(1)(b) GDPR to fulfill MH Parkservice’s contractual obligations, particularly regarding the sale and distribution of our goods and services (hereinafter “parking services”) and all activities required for the operation or administration of MH Parkservice (e.g., customer and user management). Data may also be processed at a pre-contractual stage when initiating a business relationship or carrying out other contractual relationships with MH Parkservice.
Thus, Art. 6(1)(b) GDPR is the legal basis in cases such as:

• Creating and maintaining a partner or supplier account in our CRM system
• Creating and maintaining customer/prospect files or our database in our CRM system
• Sending information
• Offering and selling MH Parkservice products
• Offering and performing our services

Details on the purpose of these processing operations can be found in the respective contract documents and terms and conditions.

2. Safeguarding legitimate interests (Art. 6(1)(f) GDPR)
Based on a balancing of interests, data processing beyond the actual performance of a contract may occur to safeguard the legitimate interests of MH Parkservice or third parties. This is permitted provided your interests or fundamental rights and freedoms do not override these interests. Data processing to safeguard legitimate interests occurs, for example, in the following cases:

• Providing our online offering, its functions, and content
• Using technically necessary cookies or comparable technologies as defined in Art. 122 of the Data Protection Code (GvD No. 196/2003)
• Responding to contact requests and communicating with users
• Transferring data to affiliated companies and partners
• Processing payments via external service providers
• Using debt collection agencies and lawyers to collect claims and/or enforce them in court
• Asserting other legal claims and defense in legal disputes
• Advertising or marketing
• Market and opinion research
• Business management and further development of our services
• Maintaining databases of customers/prospects or service providers to improve our offering
• Conducting risk assessments (due diligence) as part of potential corporate restructuring or company acquisitions/sales
• Ensuring IT security and the operation of our company and services
• Measures for building and facility security

3. Fulfillment of legal obligations (Art. 6(1)(c) GDPR)
Processing your data may be necessary to fulfill various legal obligations to which we are subject, such as those under commercial or tax law.

4. Consent (Art. 6(1)(a) GDPR, Art. 122 Data Protection Code (GvD No. 196/2003))
If a service we use stores information on your device or accesses such information, consent is required under Art. 122 of the Data Protection Code (GvD No. 196/2003). If the service functions without accessing your device, the GDPR applies. If we request your consent under the GDPR, this is done based on Art. 6(1)(a) in conjunction with Art. 7 GDPR.
If you have given us consent to process your data, processing is carried out according to the purposes defined in the consent declaration. Consent given, e.g., for a newsletter, can be withdrawn at any time with effect for the future. Please use the contact details provided in Part A, Section I or II. Note that processing carried out before the withdrawal is not affected, and that data processing may still be possible in part based on other legal grounds.

V. Who receives my data?

At MH Parkservice, your data is accessed by employees or organizational units that require it to fulfill our contractual and legal obligations or to pursue our legitimate interests.
Your data will be forwarded for the initiation or execution of a contractual relationship (e.g., sale or provision of parking services) pursuant to Art. 6(1) sentence 1 lit. b GDPR or—depending on the specific relationship—based on our legitimate interests pursuant to Art. 6(1) sentence 1 lit. f GDPR, particularly to companies we use to provide our services or process contracts. This concerns the following recipients or categories of recipients:

• IT service providers (e.g., e-mail service providers, web hosting companies)
  
  • Amazon Web Services, Inc., 410 Terry Avenue North Seattle WA 98109, USA (Cloud storage provider)
  • Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (Optimization of app functions)
  • Airparser, Sepapaja tn 6, Tallinn 11415, Estonia (Document management software provider)
  • Celonis SE, Theresienstr. 6 80333 Munich (Integration platform provider)
  • Datadog Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (System security, monitoring)
  • Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114 USA (AI platform operator and provider of an AI chat function)
  • Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA (Ticket system provider)
  • Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland
  • Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (E-mail service provider)
    
  • HubSpot Inc. 25 First Street, 2nd Floor, Cambridge, MA 02141 USA (CRM system provider)
  • LanguageTooler GmbH, Karl-Liebknecht-Str. 37, 14482 Potsdam (Proofreading service provider)
  • Leaping AI UG (haftungsbeschränkt), Potsdamer Straße 72, 10785 Berlin (Provider of AI-supported call center software)
  • Octa Inc., 100 First Street, Floor 6, San Francisco, CA 94105, USA (Provider of Auth0 for system security deletion)
  • OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (AI model provider)
  • Peter Park System GmbH, Balanstr. 71a, 81541 Munich, Germany (Provision of IT systems as managed services and parking management systems)
  • sevDesk GmbH, Hauptstraße 115, 77652 Offenburg (Accounting software provider)
  • Talkdesk Inc. 201 Spear Street, Suite 1100, San Francisco, CA 94105 USA (Contact center software provider)
  • Trustpilot A/S, Pilestraede 58, 5th floor, DK-1112 Copenhagen, Denmark (Provider of review procedures)
  • Webflow, Inc., 398 11th Street, San Francisco, CA 94103, United States (Web hosting service provider for the website)
  • Weglot, SAS, 138, rue Pierre Joigneaux in Bois-Colombes 92270 France (Translation service provider)
• Sales partners
• Advertising partners
• Insurers
• Banks
• Communications providers (telephone providers, fax providers)
• Payment service providers
  
  • Adyen N.V. Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands
  • Stripe Deutschland GmbH, Prielmayerstr. 3, 80335 Munich
  • secuPay AG, Goethestraße 6, 01896 Pulsnitz
    
• Shipping and logistics service providers
• Credit agencies
• Auditors
• Tax and legal advisors

If we use a service provider to process data on our behalf under Art. 28 GDPR, we remain responsible for protecting your information. Where required by law, these processors are contractually bound by a data processing agreement to keep your data confidential and use it only to provide the agreed services. The processors we hire only receive the data they need to perform their specific tasks.
We only share your data with government agencies or authorities if we are legally required to do so or if you have instructed us to.

VI. How long do we keep your data?

We only use your personal data for the purpose for which you provided it or consented to its use, and we only store it until that purpose is fulfilled. Once the purpose is met, or if you ask us to delete your data, we will only keep it for as long as required by law (such as tax or commercial retention periods). After these periods expire, we will delete your data unless you have explicitly agreed to further use. You can also exercise your rights, such as requesting that your data be blocked, during these retention periods. See Part A, Section II.
We will delete or block your data as soon as the reason for storing it no longer exists or you ask us to delete it.
Generally, we only process and store your data until our business relationship ends or until any applicable warranty, guarantee, or limitation periods have expired. We may also need to keep data until any legal disputes are fully resolved if the data is needed as evidence. Additionally, we are subject to statutory documentation and retention requirements, such as those under commercial or tax law.

VII. Is personal data transferred to countries outside the EU?

In some business transactions or activities, we may transfer personal data to entities in countries outside the EU or EEA that the EU Commission has not yet deemed to have an adequate level of data protection, such as the USA. If such a transfer is necessary, it will only happen based on an adequacy decision by the European Commission, standard contractual clauses, appropriate safeguards to ensure data protection compliance, or your explicit consent.

B. Using our websites

You can generally visit our websites and use them for informational purposes without providing any personal details (like registering, placing orders, or sharing other info). In these cases, we only process personal data if it’s necessary to provide a functional website and our content, or if cookies or similar technologies transmit information to us when you visit. You can find details on the cookies and technologies we use in Part B, Section II. Other cookies or technologies might allow our partners or third parties to recognize your browser on your next visit. You can find information about these third-party cookies and technologies in Part B, Section III.

We generally only process our users' personal data after they have given their consent. An exception applies when it is factually impossible to obtain prior consent and the data processing is permitted by law.

I. Website provision and log files

How we process your data

Every time you visit our website, our system automatically collects data and information from your computer, which your browser sends to us or our web host (these are called log files). These server log files include IP addresses or other data that could identify a user. This might happen, for example, if the link you used to reach our site or the link you click to leave it contains personal data. Our hosting provider collects and stores the following information:

• Browser type and version
• Operating system
• Referrer URL
• Hostname of the accessing computer and the time of the server request
• IP address

This data is stored in our web host's log files and is not kept together with any other personal data about you.

We use Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (www.webflow.com) (hereinafter: “Webflow”) as our web host and software provider to create, host, and operate our website, online forms, and other web features. You can find Webflow’s privacy policy here: https://webflow.com/legal/eu-privacy-policy. We have signed a data processing agreement with Webflow as required by Art. 28 GDPR (“Data Processing Addendum,” see https://webflow.com/legal/dpa). As part of these services, data may be transferred to the USA based on standard contractual clauses that Webflow has agreed to with us, or via an equivalent data protection guarantee.

Legal basis and purpose of processing

The legal basis for temporarily storing this data and the log files is Art. 6(1)(f) GDPR. This information is also required to provide our services under Art. 122 of the Data Protection Code (GvD No. 196/2003).
The system needs to temporarily store your IP address to deliver the website to your computer. Your IP address must remain stored for the duration of your session. We store this in log files to ensure the website works properly. Additionally, this data helps us optimize the site and keep our IT systems secure.

Storage duration and your right to object

We delete the data as soon as it is no longer needed for the purpose it was collected. For website access data, this happens when your session ends. For data stored in log files, this happens after no more than 7 days.
Collecting this data is essential for the website to function, so you cannot opt out of this.

II. Using cookies and similar technologies

How we process your data

Our website uses cookies or similar technologies (e.g., web beacons, local storage) to collect, process, and use usage data (e.g., access times, pages visited) or meta and communication data (IP address, device information), including personal data. For simplicity, we refer to these technical procedures collectively as “cookies” below.

Cookies are text files containing a unique string of characters that are stored by your internet browser on your computer system. They allow your browser to be uniquely identified when you return to our site. When you visit a website, a cookie may be stored on your operating system. This cookie contains a specific string of characters. These cookies help make our website more user-friendly, effective, and secure. If you visit a site where a cookie is integrated, the data you enter is stored exclusively in the cookie on your computer. Data is only transmitted to our servers when a page is requested.

Some cookies are deleted automatically when you close your browser (session cookies). These are technically necessary, for example, to keep you logged in as you navigate between pages on our site.
Other cookies remain on your device for a set period, allowing us to recognize your browser on your next visit (persistent or protocol cookies). These are used to provide an optimal user experience and to “recognize” you, enabling us to present you with varied and relevant content during repeat visits.
Cookies from partner companies or third parties may be used to collect information for advertising, customized content, or statistics (“third-party cookies”). If we do not label a cookie as coming from a third party, it is a “first-party cookie” from our own site. We will inform you separately about any third-party cookies or tracking technologies we use in the following sections of this privacy policy.
Flash cookies are stored as data elements on your computer if you use Adobe Flash. These cookies have no expiration date.

For more information on the cookies and similar technologies we use, their purpose, and the data they store or transmit to third parties, please check our cookie management tool, “CookieHub,” provided by CookieHub ehf, Hafnargata 18, 230 Reykjanesbær, Iceland. You can use this tool to manage your preferences and provide consent for the use of cookies and similar technologies when you access our website.

Our cookie management tool uses JavaScript to collect log file and consent data. This allows us to inform you about, obtain, manage, and document your consent for specific tags on our website. The tool stores your selected settings and the consent you provided upon entering the site, processing the following data:

• Consent data / consent information (anonymized log data (Consent ID, Processor ID, Controller ID), Consent Status, Timestamp)
• Device data / information about the devices used (including shortened IP addresses (IP v4, IP v6), device information, Timestamp)
• User data / user information (including email, ID, browser information, SettingIDs, Changelog)

To function, the cookie management tool stores a technically necessary cookie. You can find information on CookieHub’s data protection practices here: https://www.cookiehub.com/legal/privacy-policy

Further details on the cookies we use, their purpose, and the data stored or transmitted to third parties can be found in the detailed information provided by CookieHub, which you can access under “More options” or “Cookie declaration.” CookieHub automatically analyzes which cookies are set on the site, and the list of procedures and the cookie declaration are updated automatically.

Legal basis and purpose of data processing

The legal basis for processing personal data using cookies and similar technologies is Art. 6(1)(f) GDPR, as we have a legitimate interest in ensuring the website functions correctly and securely, and in providing a customer-friendly and effective site experience, provided we do not require your consent under Art. 6(1)(a) GDPR.
The legal basis for storing and reading other information is consent pursuant to Art. 122 of the Data Protection Code (GvD No. 196/2003) for cookies and technologies that require it; otherwise, for cookies necessary for the website to function, the legal basis is Art. 122 of the Data Protection Code (GvD No. 196/2003).

We use CookieHub to manage consents, making it easier for you to grant or manage permissions for the various categories of cookies and technologies we use. CookieHub blocks all non-essential cookies unless you explicitly consent to their use. When you visit our website, you will see an interface for this purpose:
By clicking “Accept all,” you can allow all procedures, or you can use the “More options” button to decide individually which cookies or cookie-based applications you consent to by toggling the sliders and clicking “Save settings.”
Alternatively, you can reject all non-essential cookies by clicking “Only essential cookies,” allowing you to use the website with only the cookies required for its operation.

Technically necessary cookies are used to simplify and improve the user experience and are required to provide our services under Art. 122 of the Data Protection Code (GvD No. 196/2003). Some website functions cannot work without these cookies, as they are needed to recognize your browser when you navigate between pages.
The purpose of other cookies in the “Analytical,” “Marketing,” and “Necessary” categories depends on the specific services used and is explained in more detail in the following sections of our privacy policy and within CookieHub.

The legal basis for data processed via our cookie management tool is Art. 6(1)(c) GDPR regarding user consent data; otherwise, it is Art. 6(1)(f) GDPR or Art. 122 of the Data Protection Code (GvD No. 196/2003). As website operators, we have a legitimate interest in managing cookie consent in a legally compliant, user-friendly, and transparent manner.

Storage period / right to object and removal

Details regarding the storage duration of our cookies can be found in the CookieHub information under “Cookie declaration.”
Cookies are stored on your computer and transmitted to our site. You have full control over their use. You can deactivate or restrict the transmission of cookies by changing your browser settings. You can also delete existing cookies at any time, or set your browser to do this automatically.
Please note that if you deactivate cookies for our website, some functions may not work as intended.

Alternatively, you can use our integrated cookie consent tool to revoke your consent at any time or change your preferences by clicking the “Cookie settings” button.

III. Statistical analysis of the website / increasing reach

1. Google Analytics

Description of data processing

We use Google Analytics for our online services. The provider in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”), a subsidiary of Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA.
Google Analytics also uses cookies. The information generated by these cookies about your use of our website is usually transmitted to a Google server in the USA and stored there. Google processes this data, and we receive reports on your user behavior. These reports may include, among other things, the following:

• Audience reports: Through audience reports, we get to know our users better and understand more precisely who is interested in our service.
• Behaviour reports: Here we learn how you interact with our website. We can track the path you take on our site and which links you click.
• Real-time reports: Here we can see immediately what is happening on our website at any given moment. For example, we can see how many users are currently reading this text.

Google Analytics uses a tracking code to create a random, unique ID associated with your browser cookie. This allows Google Analytics to recognise you as a new user. The next time you visit our site, you will be recognised as a “returning” user. All collected data is stored together with this user ID. This is what makes it possible to evaluate pseudonymous user profiles.

Your interactions on our website are measured using identifiers such as cookies. Interactions are all types of actions you perform on our website. If you also use other Google systems (such as a Google account), data generated via Google Analytics may be linked to third-party cookies. Google does not share Google Analytics data unless we, as the website operator, approve it. Exceptions may occur if required by law. The cookies used by Google Analytics can be found in the detailed information of our cookie management tool, CookieHub, which you can access there under “Cookie declarations”.

Our website uses Google Analytics exclusively with the “anonymizeIp()” extension. Your IP address is therefore not stored in full; it is shortened by Google within Member States of the European Union or in other states party to the Agreement on the European Economic Area before being transmitted to the USA. Identification of the website visitor is excluded. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. Below, we provide an overview of the most important data collected with Google Analytics:

• Heatmaps: Google creates so-called heatmaps. Heatmaps show exactly which areas you click. This gives us information about where you are “moving around” on our site.
• Session duration: Google defines session duration as the time you spend on our site without leaving. If you are inactive for 20 minutes, the session ends automatically.
• Bounce rate: A bounce occurs when you view only one page on our website and then leave.
• Account creation: If you create an account on our website or place an order, Google Analytics collects this data.
• Location: The IP address can be used to determine your country and approximate location. This process is also known as IP location determination.
• Technical information: Technical information includes, among other things, your browser type, your internet service provider, or your screen resolution.
• Source of origin: Google Analytics—and we, of course—are interested in which website or advertisement led you to our site.

This list does not claim to be exhaustive and serves only as a general guide to data storage by Google Analytics. For further information about Google’s data processing, please read Google’s privacy policy: https://policies.google.com/privacy?hl=en

Legal basis and purpose of data processing

We use Google Analytics to evaluate the use of our website and services, to compile reports on activities on our website and services, and to provide us with other services related to the use of our website, services, and internet usage. We also use Google Analytics to evaluate data from AdWords and the DoubleClick cookie for statistical purposes. Since we, as website and service operators, have a significant interest in analysing user behaviour to optimise our website, our offers, and our advertising, we ask for your consent to use Google Analytics and store Google Analytics cookies based on Art. 122 of the Data Protection Code (GvD No. 196/2003).

The information generated by the cookie about your use of our website or services is usually transmitted to a Google server in the USA and stored there. If IP anonymisation is activated, your IP address is shortened by Google beforehand within Member States of the European Union or in other states party to the Agreement on the European Economic Area. Nevertheless, in exceptional cases, the full IP address may be transmitted to a Google server in the USA and shortened there. By consenting to the use of cookies by Google Analytics, you also agree, pursuant to Art. 49(1) sentence 1 lit. a GDPR, that your data may be processed in the USA, provided the data transfer is not safeguarded by EU standard contractual clauses. The USA is regarded by the European Court of Justice as a country with an insufficient level of data protection according to EU standards. In particular, there is a risk that your data may be processed by US authorities for control and monitoring purposes, possibly without the possibility of legal remedy. If you click the “Reject all” button or make a limited selection without Google cookies, the transmission to Google described above does not take place. You can revoke your consent with effect for the future at any time.

Google will use this information to evaluate your use of the website or services, to compile reports on website activity for us, and to provide other services related to website and internet usage. Google also states that it may transfer this information to third parties under its own responsibility where required by law or where third parties process this data on behalf of Google. Google has contractually assured that it will not associate your IP address with other Google data under any circumstances. To safeguard this, as well as the data processing carried out for us, we have concluded a data processing agreement with Google.

Storage period / right to object and removal option

Cookies are stored on the user’s computer and transmitted by it to our site. Therefore, you as a user have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies already stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, not all functions of the website may be fully usable.

By installing the browser add-on to deactivate Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=en), you can object to the collection and use of your data by Google Analytics. This tells Google Analytics that no information about your website visit should be transmitted to them.

Furthermore, you can install an opt-out cookie on your device via this link https://developers.google.com/analytics/devguides/collection/gajs/?hl=en#disable, especially on mobile browsers, to prevent future data collection by Google Analytics on our website. Please note that if you delete the cookies on your device, you must reinstall the opt-out cookie.
‍

2. Google Tag Manager

Description of data processing

Google Tag Manager is a solution from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”), which allows marketers to manage website tags via an interface. Google Tag Manager itself (which implements the tags) is a cookie-less domain and does not collect any personal data. Google Tag Manager helps with the integration and ensures the triggering of other tags, code snippets, tracking code, and conversion pixels on a website, which in turn may collect data. Google Tag Manager does not access this data. Google Tag Manager provides us with a user-friendly interface that does not require in-depth programming knowledge or modifications to the website’s source code.

We use Google Tag Manager only to display Google Ads (formerly Google AdWords) for our search engine marketing activities.

For further information on Google Tag Manager, see: https://www.google.com/intl/en/tagmanager/use-policy.html.

3. Google Ads (formerly Google AdWords) & Google Ads Conversion Tracking

Description of data processing

We use Google Ads, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and in Europe by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, to integrate ads into our website and promote our offers on external sites.

This helps us see how well our ads are performing. These ads are delivered by Google using "ad servers." Google Ads uses cookies for this (see the general notes above). Setting these cookies allows us to analyze how our website is used. Whenever you visit a page on our site that includes a Google Ads component, your browser is automatically prompted by that component to send data to Google for online advertising and commission tracking. Through this process, Google receives personal data, such as your IP address, which it uses to track visitor origins and clicks for commission purposes. Typically, the following data is stored in the cookie: a unique cookie ID, the number of ad impressions (frequency), the last impression (for post-view conversions), and opt-out information (indicating you no longer want to see these ads). These cookies allow Google to recognize your browser. If you don't want cookies stored on your computer, please follow the instructions provided later in this notice.

Google Ads also uses web beacons (invisible graphics) to evaluate information like visitor traffic on our site.

The information generated by these cookies and web beacons about your use of our site, including your IP address and ad delivery data, is sent to a Google server in the USA and stored there. Google may share this information with its partners (see https://support.google.com/admanager/answer/94149?visit_id=637060482444635472-69980806&rd=1). We have no control over the data Google collects, nor do we know the full extent of their data collection or storage periods. To our knowledge, Google does not link your IP address with other data they hold about you. However, if you are logged into a Google account, your data may be linked directly to your profile. If you prefer to avoid this, please log out of your Google account before using our site.

You can find more information about Google Ads' privacy practices at https://policies.google.com/privacy?hl=en, as well as https://policies.google.com/technologies/ads?hl=en

Legal basis and purpose of data processing

Google Ads cookies and web beacons are stored based on Art. 6(1)(a) GDPR. We also use Google Ads based on our legitimate interest under Art. 6(1)(f) GDPR. As website operators, we have a legitimate interest in analyzing our reach, displaying relevant ads, improving campaign performance reports, and ensuring fair advertising cost calculations.

We have also entered into a data processing agreement with Google.

Right to object and removal options

You can prevent Google Ads cookies from being installed in several ways: a) by adjusting your browser settings (blocking third-party cookies will stop ads from third-party providers); b) by opting out of interest-based ads on Google via www.google.de/ads/preferences (note: this setting is lost if you clear your cookies); c) by opting out of interest-based ads from providers participating in the "About Ads" self-regulatory program at www.aboutads.info/choices (note: this setting is lost if you clear your cookies); d) by permanently disabling them in Firefox, Internet Explorer, or Google Chrome using the link www.google.com/settings/ads/plugin. Please note that if you do this, you may not be able to use all the features of our website.

Alternatively, you can manage your cookie preferences using our integrated CookieHub tool.

4. Amplitude

Description of data processing

We use the web analytics software Amplitude, provided by Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA, to optimize our online shop and mobile payment app. This helps us evaluate and analyze user behavior and generate activity reports. Data is collected in real time whenever a user performs an action (e.g., clicking a button, loading a page, or completing a purchase). The following data categories are involved:

• Usage data: clicks, pages visited, time spent, feature usage.
• Device data: operating system, browser type, device type, screen resolution.
• Identifiers: pseudonymized user IDs, Amplitude internal IDs, IP address. IP addresses are shortened before further processing.

Cookies are also stored on your computer for this purpose.

The information generated is sent to an Amplitude server in the USA and stored there. We have a data processing agreement with Amplitude that includes EU Standard Contractual Clauses for transferring personal data from the EU to the USA. Amplitude participates in the EU-US Data Privacy Framework, which sets minimum standards for protecting the personal data of Europeans stored or processed in the USA.

For more information on how Amplitude processes data, please see their privacy policy (https://amplitude.com/privacy).

Legal basis and purpose of data processing

We use Amplitude to evaluate how our services are used, to compile reports on service activity, and to better understand user behavior. This helps us identify areas for improvement and optimize our page performance and features. As a service provider, we have a legitimate interest in analyzing user behavior to improve our products, so we ask for your consent to use Amplitude and store cookies in accordance with Art. 122 of the Data Protection Code (GvD No. 196/2003).

Retention period / right to object and removal

If you prefer not to have cookies stored, you can configure your browser to delete cookies, block all or specific cookies, or provide a warning before a cookie is saved. You can also manage your cookie preferences using our integrated CookieHub tool.

IV. Further information on website design procedures, plugins, and tools

1. SSL or TLS encryption

Description of data processing

For security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us, this site uses SSL or TLS encryption. You can identify an encrypted connection by the browser address bar changing from “http://” to “https://” and by the lock icon in your browser.

When SSL or TLS encryption is active, the data you transmit to us cannot be read by third parties.

2. make.com

Description of data processing

To integrate various databases and web tools, we use Make, a service provided by Celonis SE, Theresienstr. 6, 80333 Munich. Make is an interface that allows various cloud-based software applications to be connected. Data required or processed in these linked applications are automatically transferred via these connections. The goal is to allow digital processes—especially standardized, recurring ones—to run independently, creating automated data flows and efficient workflows.

Further information on data protection at Celonis can be found at https://www.make.com/en/privacy-notice and https://www.celonis.com/de/privacy-notice/

Legal basis and purpose of data processing

The use of make.com is based on Art. 6(1)(f) GDPR. We have a legitimate interest in efficiently automating processes, integrating various services, and the associated import and export of personal and contact data.

3. Language versions of our website (translations via Weglot)

Description of data processing

We use the translation service Weglot, provided by Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France. Weglot loads when you access the website, allowing you to select your preferred language via the language icons. By integrating Weglot, a connection is established between your browser and Weglot’s servers when you visit our site, and your IP address and device information are transmitted to Weglot. This data is necessary for Weglot to function.

Data processed through the use of Weglot is handled by Weglot as a processor, based on a data processing agreement in accordance with Art. 28 GDPR within the European Union.

Information on how Weglot handles personal data can be found at https://www.weglot.com/privacy

Legal basis and purpose of data processing

The legal basis for processing data via Weglot is our legitimate interest under Art. 6(1)(f) GDPR to provide our website in multiple languages with a selection option for visitors, provided we are not requesting further consent under Art. 7 GDPR or Art. 122 of the Data Protection Code (GvD No. 196/2003).

Right to object and removal

Using the Weglot service is essential for us to offer the website in different language versions.

If you would like your personal data deleted, you can exercise your right to object and removal as explained in the general information in Part A.

4. Integrating YouTube content

How we process your data

We occasionally use content or services from the video platform YouTube to embed videos on our site or link to our YouTube channel. YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and is provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (referred to as “Google”).

We may process data you provide on our YouTube channel (such as your username and any content you publish) if we reply to your posts or messages.

Otherwise, we only receive non-personal information from Google regarding post activity, such as the number of clicks on profiles or media and how long a video was watched. This data is accessible via our YouTube account. Google also processes data under its own responsibility; we have no way to disable or prevent Google’s use of analysis tools within YouTube.

If you choose to play an embedded video by clicking the play button, your IP address is sent to YouTube, as they need it to deliver the video to your browser. Your IP address is therefore necessary for the video to display. Additionally, the YouTube server is notified which subpage of our site you visited. If you are logged into your YouTube account, you allow YouTube to link your viewing habits directly to your personal profile. You can find more information on how Google processes data when using YouTube in their privacy policy: https://policies.google.com/privacy?hl=en&gl=en

Legal basis and purpose of data processing

We use YouTube based on our legitimate interests under Art. 6(1)(f) GDPR to provide or link to video content and to manage inquiries or comments.

Retention period / right to object and removal

To prevent your activity from being linked to your user account, log out of YouTube before playing our videos. You should check your Google or YouTube account settings to see how you can restrict Google’s data processing. For example, you can manage this in your Google account’s “Privacy and security” settings. Depending on your device’s operating system, you can also limit Google’s access to your contacts, calendar, photos, and location data in your smartphone or tablet settings.

5. Auth0

How we process your data

We use the cloud-based identity management platform Auth0, provided by Okta Inc. (10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA), to handle registrations and logins for our online shop.

When you enter data into an Auth0 form, it is exchanged directly between your browser and Auth0. The following data is processed for identity management, authentication (login/registration), and user account security:

• Master data: email address, name, and potentially profile picture (if using social login).
• Security data: password hashes, two-factor authentication (MFA) data, and session tokens.
• Metadata: login IP address, timestamp, and browser/device information (for fraud detection).

Data is collected only during the login or registration process and whenever a session is refreshed.

You can find more information about how Auth0 processes data at https://www.okta.com/legal/privacy-policy/.

We store data on servers located in Europe. If data needs to be transferred to the USA in specific cases, we rely on EU Standard Contractual Clauses, which we have included in our data processing agreement.

Legal basis and purpose of data processing

We integrate Auth0 based on our legitimate interest under Art. 6(1)(f) GDPR to ensure that only authorized and identified individuals can access our services. Auth0 is also necessary for providing our services when users access their accounts, in accordance with Art. 122 of the Data Protection Code (GvD No. 196/2003).

Retention period / right to object and opt-out

If you prefer not to have cookies stored, you can configure your browser to delete them, block all or specific cookies, or notify you before they are saved. You can also manage your preferences using our integrated CookieHub tool.

6. Datadog

Description of data processing

We use DataDog, a service provided by DataDog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (“DataDog”), as a data processor as defined by Art. 4 No. 8 and Art. 28 of the GDPR.

We use DataDog to monitor system stability and analyze errors—such as unexpected deviations, anomalies, latency (the delay in data transmission to our servers), availability, and response times—to ensure the security and performance of our websites and services.

To do this, DataDog collects the following information on our behalf:

• Log data: technical server request logs (including user IP addresses).
• Performance data: app response times, error rates, error details, and crash reports (stack traces, which show the application path leading to an error, along with the timestamp).
• Metadata: system configurations (e.g., browser type and version, operating system) and anonymized user IDs to track errors across different microservices.

This data allows us to detect, evaluate, and fix errors immediately using DataDog. Personal data may be transferred to and stored by DataDog in the USA. We have signed a Data Processing Agreement with DataDog that includes the EU Standard Contractual Clauses. Additionally, DataDog participates in the EU-US Data Privacy Framework, which serves as a basis for transferring data to certified organizations in the USA.

For more details on how DataDog processes data, please see their privacy policy: https://www.datadoghq.com/legal/privacy/

Legal basis and purpose of data processing

Once this period expires, only aggregated data that cannot be linked to an individual is kept.

We process this data based on our legitimate interest under Art. 6(1)(f) GDPR to ensure our websites and services run smoothly, meet user needs, and allow for effective error detection and resolution. DataDog is therefore necessary for providing our services when users access their accounts, as per Art. 122 of the Data Protection Code (GvD No. 196/2003).

Retention period / right to object and opt-out

Data collected via DataDog is deleted or anonymized once the error evaluation is complete.

‍
V. Links to third-party websites

Our website may contain links to other sites. We have no control over the content or design of these third-party offerings. Consequently, these privacy notices do not apply to external providers whose content or services we simply link to.

If you are redirected to other websites via our links, please check their respective policies to see how your data is handled.

VI. Social media and platform presence

How we process your data

We maintain a presence on various social and industry networks (such as Facebook, Xing, or LinkedIn) and platforms (like YouTube), which we link to from our website. By clicking the relevant buttons—easily identified by the network or platform logos—you will be taken directly to our page on that site. We use these channels to connect with customers, interested parties, and users, and to keep you updated on our services.

When you visit these networks and platforms, the terms and conditions and data processing policies of their respective operators apply.

Since your use of these social networks happens outside our website, we generally have no control over it. Please be aware that when you use these linked platforms, your data may be processed in the USA by the network operators. They may also use this data for market research and advertising, including building user profiles. If you are logged into these networks, they may store cookies on your device to track your activity on our site and gather other information about your usage habits.

Unless otherwise stated in these privacy notices, we only process user data when you interact with us directly on these social networks, such as by posting comments or sending us messages.

To help you easily find information on how these operators process your data and how you can opt out, we have provided links to their privacy policies below.

Legal basis and purpose of data processing

We only process your personal data when you interact with us directly on these social networks or engage with our content there. Unless otherwise specified in these notices, we process user data based on our legitimate interest under Art. 6(1)(f) GDPR to effectively communicate with and inform our users. If your contact is related to a potential contract, the legal basis for processing is Art. 6(1)(b) GDPR.

If an social network processes your personal data for its own purposes and decides how that data is used, that network is the sole controller for that processing. Please be mindful of the personal information you share with us via social media. If you would prefer that these networks do not process the data you send us, please reach out to us through a different channel.

Storage duration and your right to object

If you are a member of a social network where we have a presence and you do not want them to collect data about you through our site or link it to your profile, please log out of the network before visiting our website. For detailed information on how these providers process data, how long they store it, and how you can opt out, please refer to the provider links below.

If you wish to exercise your user rights or request information, please note that it is most effective to contact the providers directly. They have exclusive access to your data and are best equipped to provide information or take necessary action. However, if you need assistance, feel free to contact us.

Facebook

We maintain a company page (“Fanpage”) on the social network operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Facebook Ireland and we are joint controllers for the collection of data from visitors to our Fanpage. We have entered into an agreement regarding this joint processing of personal data in accordance with Art. 26 GDPR, along with additional data processing terms:

“Controller Addendum”: https://www.facebook.com/legal/controller_addendum
“Data Processing Terms”: https://www.facebook.com/legal/terms/dataprocessing/update

We are responsible for providing you with this information regarding our joint controllership with Facebook. You can find the information required by Facebook under Article 13(1)(a) and (b) GDPR in the Facebook Ireland Data Policy at https://www.facebook.com/about/privacy.

Facebook Inc., Menlo Park, California, USA (hereinafter: Facebook Inc.) also collects and uses so-called Page Insights for analysis purposes. Page Insights are the aggregation of data through which both we and Facebook Inc. can obtain information about how our users interact with our page. Page Insights may be based on personal data collected in connection with visits by our users or their interactions on our page. For this purpose, we have concluded an addendum for controllers (“Controller Addendum”, see above) with Facebook, which regulates in particular what security measures Facebook takes within the scope of Page Insights and how Facebook responds to user requests. The purposes for which the collection and transmission of the personal data that constitute the joint processing take place are set out in detail in the terms of use referred to in the above Controller Addendum.

The data collected in the context of a visit to our “Fanpage” otherwise include information on the types of content that users view or interact with, or the actions they take (see “Things you and others do and provide” in Facebook’s Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data described in detail under “Device information” in Facebook’s Data Policy: https://www.facebook.com/policy)).

However, by maintaining the Facebook company page we share responsibility for the Page Insights and we have agreed with Facebook Ireland that Facebook Ireland is responsible for fulfilling the rights of data subjects pursuant to Articles 15-20 GDPR with regard to the personal data stored by Facebook Ireland following the joint processing. Therefore, we have an obligation to notify Facebook if data protection requests regarding Page Insights are received by us. Please note that we forward requests regarding Page Insights to Facebook Ireland. In addition, please note the information on the data subject rights to which you are entitled under section A. For further information on how Facebook Ireland processes personal data, including the legal basis on which Facebook Ireland relies and the options for exercising the rights of data subjects vis-à-vis Facebook Ireland, please refer to Facebook Ireland’s Data Policy at https://www.facebook.com/about/privacy

The evaluation of the data collected via Page Insights serves to improve our internet presences and for advertising purposes. We maintain our Facebook Fanpage for the purpose of communication and simple channelling of contact enquiries from Facebook users. The collection of these data and their further processing is in our legitimate interest as well as in the legitimate interest of Facebook Inc. pursuant to Art. 6(1)(f) GDPR.

We point out that we cannot switch Page Insights technology on and off. We therefore have to forward corresponding requests largely to Facebook Ireland, insofar as we have not collected data ourselves. If you do not want Facebook Inc. to collect your data, we ask you not to use our Facebook company page and/or to set your browser so that it prevents the setting of cookies and/or to log out of Facebook while using our page.

Privacy policy:
https://www.facebook.com/about/privacy/, https://www.facebook.com/legal/terms/information_about_page_insights_data
Objection option:
https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com

LinkedIn

‍LinkedIn is a service of LinkedIn Corporation, 2029 Stierlin Court Mountain View, CA 94043, USA, operated in Europe by LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland. LinkedIn is an internet-based social network that enables users to connect with existing business contacts and to establish new business contacts. Over 400 million registered people use LinkedIn in more than 200 countries. This makes LinkedIn currently the largest platform for business contacts and one of the most visited websites in the world.

Each time our website is accessed that is equipped with a LinkedIn component (LinkedIn plug-in), this component causes the browser used by the data subject to download a corresponding representation of the component of LinkedIn. Further information on the LinkedIn plug-ins can be accessed at https://developer.linkedin.com/plugins. As part of this technical process, LinkedIn gains knowledge of which specific subpage of our website is visited by the data subject.

If the data subject is logged into LinkedIn at the same time, LinkedIn recognises with each access to our website by the data subject and for the entire duration of the respective stay on our website which specific subpage of our website is visited by the data subject. This information is collected by the LinkedIn component and assigned by LinkedIn to the respective LinkedIn account of the data subject. If the data subject clicks on one of the LinkedIn buttons integrated on our website, LinkedIn assigns this information to the personal LinkedIn user account of the data subject and stores these personal data.

LinkedIn always receives information via the LinkedIn component that the data subject has visited our website if the data subject is logged into LinkedIn at the time of access to our website; this takes place regardless of whether the data subject clicks on the LinkedIn component or not. If such a transmission of this information to LinkedIn is not desired by the data subject, the data subject can prevent the transmission by logging out of their LinkedIn account before accessing our website.

LinkedIn offers the possibility to unsubscribe from e-mail messages, SMS messages and targeted ads and to manage ad settings at https://www.linkedin.com/psettings/guest-controlsdie. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua and Lotame, which may set cookies. Such cookies can be rejected at https://www.linkedin.com/legal/cookie-policy. LinkedIn’s applicable privacy policy can be accessed at https://www.linkedin.com/legal/privacy-policy. LinkedIn’s cookie policy can be accessed at https://www.linkedin.com/legal/cookie-policy.

Privacy policy https://www.linkedin.com/legal/privacy-policy,
Objection option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out,

XING

The operating company of Xing is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany (“XING”).

Xing is an internet-based social network that enables users to connect with existing business contacts and to establish new business contacts. Individual users can create a personal profile on Xing. Companies can, for example, create company profiles or publish job offers on Xing.

Each time one of the individual pages of this website operated by the controller and on which a Xing component (Xing plug-in) has been integrated is accessed, the internet browser on the information technology system of the data subject is automatically prompted by the respective Xing component to download a representation of the corresponding Xing component of Xing. Further information on the Xing plug-ins can be accessed at https://dev.xing.com/plugins. As part of this technical process, Xing gains knowledge of which specific subpage of our website is visited by the data subject.

If the data subject is logged into Xing at the same time, Xing recognises with each access to our website by the data subject and for the entire duration of the respective stay on our website which specific subpage of our website is visited by the data subject. This information is collected by the Xing component and assigned by Xing to the respective Xing account of the data subject. If the data subject clicks on one of the Xing buttons integrated on our website, for example the “Share” button, Xing assigns this information to the personal Xing user account of the data subject and stores these personal data.

Xing always receives information via the Xing component that the data subject has visited our website if the data subject is logged into Xing at the time of access to our website; this takes place regardless of whether the data subject clicks on the Xing component or not. If such a transmission of this information to Xing is not desired by the data subject, the data subject can prevent the transmission by logging out of their Xing account before accessing our website.

The privacy policy published by Xing, which can be accessed at https://www.xing.com/privacy, provides information about the collection, processing and use of personal data by Xing. Xing has also published privacy information for the XING Share button at https://www.xing.com/app/share?op=data_protection.

Privacy policy / opt-out: https://privacy.xing.com/de/datenschutzerklaerung

‍
VII. Using our website

1. Contact forms and email

How we process your data

You can get in touch with us electronically using the contact form on our website. When you use this form, the information you enter is sent to us and stored.

Company/municipality (required)
First name (required)
Last name (required)
Email (required)
Phone (optional)
Message (optional)

When you send a message via one of our contact forms, we also store the following data:

Your IP address
Date and time of submission

If you contact us via email, we store the personal data you include in your message.

If you provide a mobile number to receive payment status updates, we will use that number for this purpose.

We use HubSpot Forms, part of our HubSpot CRM system, to manage our contact forms and process the data you provide (see Part C, Section II). HubSpot Forms helps us with SEO, content creation, lead management, email marketing, and analytics. Any data you enter into these forms is stored in our HubSpot CRM.

We use Google Workspace email services provided by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland (“Google”). In addition to our CRM software, which is our primary tool for managing requests, emails are also stored on Google servers. We have selected the “Europe” region for server hosting and have signed a data processing agreement with Google. Google contractually guarantees that these emails are not transferred to third countries, specifically the USA.

To help us organize and route incoming inquiries, we use AI-based services via an interface. These tools are designed to understand and generate natural language, analyze information, and make predictions.

For this, we use the ChatGPT language model from OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We have an agreement with OpenAI ensuring that our data is not used to train their models or shared with them. You can view OpenAI’s privacy policy here: https://openai.com/de/policies/eu-privacy-policy. We have also signed a Data Processing Addendum with OpenAI (see https://openai.com/policies/data-processing-addendum). Since using the OpenAI API involves transferring data to the USA, this addendum includes EU Standard Contractual Clauses to ensure an adequate level of data protection for any data transferred to a third country.

We also use the AI-powered system Google Gemini, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Gemini is designed for advanced language and image processing. It uses machine learning to understand and generate natural language and analyze images, making it useful for a variety of tasks. We use the Gemini model to pre-sort incoming emails and letters. As Google Workspace customers, we have the assurance that Google does not use our data to train its publicly available AI models.

To check spelling when replying to emails, we use LanguageTool, a software from LanguageTooler GmbH

located at Karl-Liebknecht-Str. 37, 14482 Potsdam, a subsidiary of Learno Inc. This tool uses AI to check spelling and grammar and suggest wording improvements. You can find the provider’s privacy policy here: https://languagetool.org/de/legal/privacy. LanguageTool stores checked text and identified errors on its servers for up to 15 minutes (not on permanent storage). This storage does not include your IP address or any other information that could identify you. However, if your text contains personal information, that is also stored for this short period. We have a data processing agreement with Learno Inc. that includes the EU Standard Contractual Clauses required for data processing in the USA, ensuring the provider complies with applicable data protection laws: https://languagetool.org/de/legal/dpa

To read attached PDF or Word files, we use the software Airparser, located at Sepapaja tn 6, Tallinn 11415, Estonia. Airparser uses AI to identify and extract structured data. We have a data processing agreement with Airparser in accordance with Art. 28 GDPR, which contractually obligates them to comply with data protection regulations (see https://airparser.com/dpa/). You can view Airparser’s privacy policy at https://airparser.com/gdpr/.

Legal basis and purpose of processing

The legal basis for processing data sent via contact forms or email is Art. 6(1)(f) GDPR. If your inquiry is related to entering into a contract, the additional legal basis is Art. 6(1)(b) GDPR.

The processing of the personal data from the input mask serves us to process enquiries and to contact you. In the case of contact by e-mail, this also constitutes the required legitimate interest in processing the data. If you leave a mobile phone number for updates on the status of your payment request, we use the number you provided for this purpose.

The use of AI-based services takes place on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR. Due to the high number of incoming messages, for a fast and targeted processing of these enquiries, which is both in our interest and in the interest of the enquiring parties or senders of messages addressed to us, we rely on such a pre-selection and allocation to the respective responsible units within the company.

User details may also be stored on the basis of our legitimate interests in our Customer Relationship Management system (CRM software) or comparable enquiry organisation.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

Storage period / right to object and removal option

The data are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified and no legal requirements require longer storage.

The user has the possibility at any time to withdraw consent given by them for the processing of personal data.

If the user contacts us by e-mail, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued insofar as we cannot base it on another data protection legal basis or have an overriding interest in further processing of the data.

All personal data stored in the course of contact will be deleted in this case, unless legal requirements require longer storage.

2. Telephone hotline

Description of data processing

If a user makes use of the possibility to contact us by telephone using a telephone number stated on our internet presences, we record the incoming telephone number of the caller as well as further technical information from the telephone system (start of the call and call duration), which was either generated there or provided by transmission from the telephone company, and record the essential content of the call as well as information provided to our employees by the data subjects (name, concern, contact possibilities for enquiries, etc.).

For a pre-qualification of incoming calls, we use an AI-supported software solution of the provider Leaping AI UG (haftungsbeschränkt), Potsdamer Straße 72, 10785 Berlin, with which the data required for categorising the call and forwarding it to the correct specialist unit or answering the user concerns (in particular our reference number, licence plate, name of the caller) are requested and certain customer concerns can be processed automatically. For this purpose, we have concluded an agreement with Leaping AI for processing data on our behalf pursuant to Art. 28 GDPR.

We will ask you whether you consent to a recording of your call. If the caller consents to a recording of the call, we store the complete content of the call and automatically create a transcript of the call. We use call recordings and transcripts for training purposes for our service staff, clarification of customer complaints, as well as for the creation of anonymised internal evaluations (classification of calls, creation of statistics on reasons for calls) as well as for evidentiary purposes in connection with the assertion of legal claims to which we are entitled or the defence against legal claims asserted against us.

We use the cloud contact centre platform Talkdesk of the provider Talkdesk Inc. 201 Spear Street, Suite 1100, San Francisco, CA 94105 USA (hereinafter: “Talkdesk”) concluded. We have concluded an agreement with Talkdesk for commissioned processing pursuant to Art. 28 GDPR including the EU Standard Contractual Clauses for data transfers to third countries, under which Talkdesk is contractually obliged to comply with the applicable data protection provisions. We have also agreed with Talkdesk that our Talkdesk instance will be provided in a region in Europe and thus our data are processed by default in a regional cloud within the European Union.

Legal basis and purpose of data processing

When accepting the call, we automatically collect the data required for call processing (in particular our reference number, licence plate, name of the caller) on the basis of Art. 6(1)(f) GDPR for the purpose of automating and handling certain customer concerns or interaction components more efficiently. If the call relates to our services and an existing, terminated or planned contractual relationship with the caller, the additional legal basis for processing is Art. 6(1)(b) GDPR.

During the call, we manually store the caller’s concern in our system and save this call note at the end of the call. No call recording takes place. The legal basis for processing these data is Art. 6(1)(f) GDPR. If the call relates to our services and an existing, terminated or planned contractual relationship with the caller, the additional legal basis for processing is Art. 6(1)(b) GDPR.

Call recordings and transcriptions are created and further processed exclusively on the basis of the user’s prior consent pursuant to Art. 6(1)(a) GDPR.

User details may also be stored on the basis of our legitimate interests in our Customer Relationship Management system (CRM software) or comparable enquiry organisation.

Retention period / right to object and deletion

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. This happens once the conversation with the user has ended. A conversation is considered ended when it is clear from the circumstances that the matter has been fully resolved and there are no legal requirements for further retention.

If no specific statutory retention period applies to recordings, the storage duration for call recordings and notes is based on the statutory limitation periods (the standard limitation period is 5 years under Art. 2947 c.c., and 10 years under Art. 2946 c.c.). Transcripts of call recordings are deleted after 6 months.

You have the right to withdraw your consent to the processing of your personal data at any time. If a caller consents to having their call recorded and the recording and transcript stored, they can revoke this consent whenever they like. In such cases, the recordings or transcripts will be deleted immediately, unless we are legally required to keep them longer.

3. Ticket system

Description of data processing

We use Freshdesk as our ticket system, a software solution provided by Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA. Freshdesk is a customer service platform that helps us manage customer inquiries and requests across various channels. We use it to receive and manage contact requests. If you reach out via our website’s contact form, email, or phone, the details you provide, the content of our conversation, and any other data we collect (see sections VII. 2 and VII. 3 above) are stored and organized in the ticket system to ensure we can handle your request chronologically and improve our service.

The information is stored on Freshdesk servers. To organize and process your requests, we collect personal data as provided by you—at a minimum your first name, last name, and email address—which is then transmitted to and stored by Freshdesk. We have configured the system to process data on servers within the EU. This is intended to ensure that data remains within the European Union and is not accessible to US authorities.

For more information on data protection at Freshdesk, please visit https://www.freshworks.com/privacy/.

Legal basis and purpose of data processing

We process information collected via Freshdesk based on our legitimate interest in providing efficient customer service and responding to your requests as quickly as possible (Art. 6(1)(f) GDPR). This is supported by a data processing agreement with Freshdesk in accordance with Art. 28 GDPR, which ensures data protection and prohibits unauthorized disclosure to third parties.

If, in specific cases, a data transfer to the USA becomes necessary, it will be based on the EU Commission’s Standard Contractual Clauses.

Retention period / right to object and deletion

We store your data for as long as a contractual relationship exists between us and the data subjects, or until the specific conversation has been fully processed.

If you would like your personal data to be deleted, you can exercise your right to object and request deletion as described in the general information in Part A.

4. Chat function

Description of data processing

The chat function on our website uses an AI-powered chatbot from Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA (“Decagon”). Decagon operates an AI platform that automates customer service using “agents.” You can use the chat to ask general questions about our parking system or specific parking areas (e.g., opening hours, rates), or to report issues at our parking facilities so they can be forwarded to our customer support team.

As soon as you enter a question into the chat (a “prompt”), Decagon automatically analyzes it and provides a text-based response from the agent. Generally, we do not need any personal information from you (such as names, email addresses, phone numbers, addresses, or license plate numbers). Please avoid entering such personal data about yourself or others into the chat unless necessary. We only collect and store such data if you provide it to us voluntarily.

To display and technically operate the chat function, the following technical log data is processed when you use the chat:

• IP address
• Metadata about API requests
• Date and time of access

The chat function processes data fully automatically, and only when you send it within the chat. The agent operates independently within strictly defined limits and does not make autonomous decisions that affect your rights or your access to our services. If a request requires human judgment or falls outside the AI agent’s scope, it is forwarded to one of our human case handlers via a supervised process and stored for further handling outside of Decagon in our CRM or ticket system.

Decagon has contractually guaranteed that any user data provided via the chat function will not be used to train other AI models.

You can find more information about data protection at Decagon at https://decagon.ai/legal/privacy.

Legal basis and purpose of data processing

We process this data to help our customers and users with general questions or support requests. We process information collected via Decagon based on our legitimate interest in providing efficient customer service and responding to your concerns as quickly as possible (Art. 6(1)(f) GDPR). This is done in conjunction with a data processing agreement concluded with Decagon under Art. 28 GDPR, which ensures data protection and prohibits unauthorized disclosure to third parties.

We have also agreed with Decagon that data will be processed exclusively within the EU during the normal operation of the chat function (EU data residency). If, in specific cases, a data transfer to the USA is necessary and authorized by us for technical support, it will be based on the EU Commission’s Standard Contractual Clauses.

Storage period / right to object and deletion

Personal data exchanged during chats is stored by us for the duration of our legal relationship with you or until the specific conversation has been fully processed.

If you would like your personal data to be deleted, you can exercise your right to object and request removal as described in the general information in Part A.

‍
C. Data processing in connection with the use of MHP parking spaces

1. Using the MHP Online Shop

Description of data processing

Through our MHP online shop (hereinafter: “Online Shop”), you can book and pay for parking services at our managed parking areas, subject to our current General Terms and Conditions. For example, you can pay your parking fees online.

We use cookies to make our online shop more user-friendly. Some parts of our website require the browser to be identified even after you navigate to a new page. These cookies store your language and region settings.

Additionally, cookies allow us to analyze browsing behavior in the online shop. This may include transmitting data such as search terms entered, frequency of page views, and use of website features.

To book parking services, you must complete and submit the booking form. You will need to enter your vehicle’s registration number in the provided field and, if applicable, select your desired parking area or provide a reference number. We require your registration number and other details to correctly assign the parking fee to your specific parking session or service.

Data processed during the booking process includes registration numbers, payment amounts, and other communication, contract, and payment details from our customers, interested parties, and business partners. This processing is necessary to provide contractual services, handle billing, manage delivery, and support our customers. During booking, we process the information provided in the input forms, such as your name, company, address, email, and telephone number. Mandatory fields are usually marked with an * or labeled “optional,” and include the information required to provide and bill for the service, as well as contact details so we can reach you regarding important order information (such as legally required notices, rescheduling, etc.).

We process and use this collected data to allow you to select, book, and pay for our parking services. We also process the data to manage and, if necessary, send your booking confirmation. Further details on the legal and organizational framework can be found in our applicable General Terms and Conditions. Information regarding the payment service providers we use can be found in Section 2 of this Part C below.

Legal basis and purpose of data processing

The legal basis for processing data collected during a booking is Art. 6(1)(b) GDPR, as it is necessary for the performance of a contract. Otherwise, we rely on Art. 6(1)(f) GDPR to detect and combat harmful behavior, uncover and prevent negative experiences, maintain the integrity of our online shop, and ensure safety and security. Both we and other users of our services have a legitimate interest in preventing, detecting, or investigating illegal activities, fraud, or security breaches. The information above is also required to provide the service under Art. 122 of the Data Protection Code (GvD No. 196/2003).

We process the personal data from the input form to manage your booking and provide the requested parking service.

Data entered in our online shop may also be processed based on your consent (Art. 6(1)(a) GDPR) if we have requested it. You can withdraw your consent at any time. This does not affect the lawfulness of any data processing that took place before your withdrawal. Please note that if you withdraw your consent, we may be unable to complete the booking process, and any existing booking may have to be cancelled.

Storage period / right to object and deletion

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data from the booking form, this occurs once the contract for our parking services has been fulfilled and the service has been fully provided. Generally, we retain contract-related data until the statutory warranty period expires. If there is a legal obligation to archive the data, it will be deleted once that period ends.

2. Use of payment providers for order processing (“payment services”)

Description of data processing

If you are required to provide payment details (such as an account number for direct debit) after entering into a paid contract for parking services, this information is necessary for processing your payment.

To ensure modern, simple, and secure payment processing, we offer various payment options. In addition to banks and credit institutions, we work with other payment service providers (collectively referred to as “payment service providers”).

Transactions using standard payment methods (e.g., Visa/MasterCard) are processed exclusively via an encrypted SSL or TLS connection. You can identify an encrypted connection by the “https://” prefix in your browser’s address bar and the lock icon displayed there.

Encrypted communication ensures that your payment details cannot be read by third parties while being transmitted to us.

If you choose a specific payment service provider, that provider delivers its services based on a contract between you and them, governed by their own terms and conditions. Data processing by these providers is their responsibility, and we have no influence over it. Consequently, if you wish to exercise your data subject rights, you must contact the payment service provider directly. They may ask for additional consent, for example, to perform identity or credit checks. Personal data processed by these providers typically includes your first and last name, address, date of birth, gender, email address, IP address, phone number, and transaction-specific data such as item numbers, invoice amounts, tax percentages, bank details (account or credit card numbers), passwords, TANs, checksums, and other contract or recipient-related information.

The payment service provider processes this data to offer the selected payment method, perform any necessary identity or credit checks, manage payments, and prevent fraud.

Legal basis and purpose of data processing

We transfer your data to our payment service providers based on Art. 6(1)(b) GDPR (performance of a contract) for order processing, or based on our legitimate interests (Art. 6(1)(f) GDPR) where we have not requested your consent under Art. 6(1)(a) GDPR.

You may withdraw your consent for data processing by payment providers at any time, effective for the future. This withdrawal does not affect the validity of any data processing that occurred in the past.

Adyen

For certain payment methods, we use Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands (“Adyen”). If you select Adyen, your personal data is automatically transferred to them. This generally includes the card type (e.g., Visa or Mastercard), cardholder name, card number, security code, and expiration date. Adyen’s role is to request authorization from the payment system (e.g., Mastercard or Visa) and forward the approval from your bank to us. Once the bank approves, Adyen notifies us and processes the payment to our bank. Adyen processes your data for payment handling as well as for identity and credit checks. In this capacity, Adyen acts as a data controller, and we have no further influence over their data processing.
Information on Adyen’s data protection practices can be found at: https://www.adyen.com/privacy-policy, and regarding transaction processing at https://www.adyen.com/privacy-policy/transaction.

Stripe

For online payment processing of our services, we use Stripe, a service provided by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”).
If you choose Stripe, we share the information provided during checkout—along with your order details and other necessary data (name, address, email, customer number, order number, bank details, credit card information, invoice amount, currency, transaction ID, date/time, and provider name)—with Stripe. This data is shared solely for payment processing purposes and only to the extent necessary. We cannot process payments via Stripe without transmitting this data.
‍
Stripe acts in a dual role as both a controller and a processor. As a controller, Stripe uses your data according to their own terms and conditions to perform the contract between you and them and to meet regulatory requirements. We have no influence over this. You can find Stripe’s privacy policy here: https://stripe.com/privacy
Stripe also acts as a processor to complete transactions within payment networks. In this capacity, Stripe acts strictly according to our instructions and is contractually obligated under Art. 28 GDPR to comply with data protection regulations.

secuPay

We offer cashless payment methods from secupay AG (Goethestr. 6, 01896 Pulsnitz; “secupay”) in our online shop. Secupay is a payment institution as defined by the Payment Services Supervision Act (ZAG), is registered with the Federal Financial Supervisory Authority (Graurheindorfer Str. 108, 53117 Bonn; “BaFin”) (registration number: 126737), and enables cashless payments for products and services online.
‍
When you use secupay as a payment method, your purchase price claim is assigned to secupay. This allows online shop operators to deliver goods, services, or downloads to the customer immediately after the order is placed. If you select “direct debit,” “purchase on account,” or “credit card” as a payment option via secupay during checkout, your data is automatically transferred to secupay. When processing payments via secupay, your payment instrument details are transmitted to them. Secupay then performs a technical risk assessment regarding payment default. The transaction result is then automatically communicated to us. The personal data exchanged with secupay includes your first name, last name, address, e-mail address, IP address, telephone number, and any other data required for payment processing.
The personal data exchanged between secupay and us may be transmitted by secupay to credit agencies in certain circumstances. This is done for identity and credit verification purposes. Secupay may share personal data with affiliated companies, service providers, or subcontractors if necessary to fulfill contractual obligations or if the data is being processed on their behalf. These data processing operations are carried out under secupay’s own responsibility, and we have no influence over them. You have the right to withdraw your consent for secupay to handle your personal data at any time. A withdrawal does not affect personal data that must be processed, used, or transmitted by us as a mandatory requirement for (contractual) payment processing. You can access secupay’s current data protection policy at https://www.secupay.com/de/datenschutz.

‍
3. Using MHP Online Shop reviews

Description of data processing

We use the review portal “Trustpilot,” operated by TrustPilot A/S, Pilestraede 58, 5th Floor, 1112 Copenhagen, Denmark. Trustpilot allows users to review our products and services.

If you purchase one of our parking services online via our shop and receive your receipt by e-mail, we include a Trustpilot button in that e-mail containing a unique link generated by Trustpilot. We maintain an interface (“API”) with Trustpilot to create these invitation links. Clicking this link will take you directly to the Trustpilot review platform. If you click the button with the invitation link, the form on Trustpilot will be automatically pre-filled with your data, allowing you to submit your review on their portal. The review is verified using the reference number linked to your purchase. Submitting a review is entirely voluntary.

For this purpose, we transmit the following data to Trustpilot:

E-mail address
First and last name
Reference number
Language- and country-specific shop domain, access data (including IP address)
Selected parking service

We use Trustpilot as a data processor and have contractually obligated them, through a data processing agreement, to handle your data in compliance with data protection laws.

Please note that you need a Trustpilot user account to submit a review. Once you submit your review and agree to Trustpilot’s terms of use, Trustpilot becomes the controller for the further processing of your review, particularly its publication. You can find details on Trustpilot’s data protection practices at https://de.corporate.trustpilot.com/legal/for-businesses/privacy-policy.

Legal basis and purpose of data processing

Data is processed to create an invitation link and to verify that the shop was used, allowing Trustpilot to carry out the review process. This, along with collecting user feedback to improve our services, constitutes a legitimate interest under Art. 6(1)(f) GDPR.

Storage period / right to object and removal

Invitation data for Trustpilot is stored for one year.

4. Using parking areas managed by MH Parkservice

Description of data processing

When you use our parking areas, the following data is recorded automatically: vehicle registration number (including front and rear images), entry/exit time, date and location stamp, and the amount and method of payment for the parking fee.

Before leaving the parking area, users must enter their vehicle registration number at the pay machine, unless they have a permanent parking permit. If the entered registration number is found in our database, the parking fee is calculated and paid by the user. Details on data processing for payments via our online shop can be found in Part C, Sections 1 and 2, and the applicable terms of use.

In the event of a violation of our General Terms of Use, we will process all personal data of the registered vehicle owner and the driver relevant to legal prosecution. This includes, in particular, the collection of a forfeited contractual penalty and/or the assertion of possessory and ownership rights (“follow-up”).

If you receive a demand letter as the registered owner of a vehicle involved in a parking violation, your registration number was previously obtained by us from the Pubblico Registro Automobilistico (P.R.A.) of the Automobile Club d’Italia, Via Marsala 8, 00185 Rome (the “Vehicle Register”). If you are not the registered owner, your data was provided to us by the registered owner or another third party (e.g., a vehicle rental or leasing company) who confirmed that you were the driver at the time of the violation. If you no longer reside at the address recorded in the vehicle register, we may have obtained your data from the person currently registered at that address, a credit agency, or a debt collection company.

Legal basis and purpose of data processing / data recipients

Processing the collected data is necessary to protect the legitimate interests of the parties involved in operating the parking area and for standard industry administrative tasks (Art. 6(1)(f) GDPR), as well as for fulfilling the services outlined in our General Terms of Use (e.g., calculating and billing parking fees, verifying stored parking permits, processing app or online portal payments, and monitoring compliance with maximum parking times, free parking periods, or grace periods) (Art. 6(1)(b) GDPR).

Vehicle owner information (specifically name and address) is requested from vehicle registration authorities or international information centers via a "keeper request." Driver details may be requested from the registered owner, rental agency, or leasing company and shared with third parties as needed (e.g., legal counsel or collection agencies). For the technical operation of our parking management systems and software, as well as for addressing violations of our General Terms of Use, data is processed by MHP GmbH and its service providers, Peter Park System GmbH (parking technology and software) and Amazon Web Services EMEA SARL (data storage). The legal basis is Art. 6(1)(b) GDPR when processing is required for contract performance, or Art. 6(1)(f) GDPR when pursuing the legitimate interests of MHP GmbH and third parties in protecting property rights, ensuring the proper operation of parking facilities, and streamlining vehicle traffic.

Storage period / obligation to provide / right to object and removal option

Personal data we collect is deleted once all claims related to the use of the parking area have been settled and all statutory retention and limitation periods have expired. If no violation of the General Terms of Use occurs and the user leaves the parking area within the designated grace period, user data is automatically deleted 48 hours after departure, provided no statutory retention requirements apply.

Providing your data when using our parking areas is contractually required under our General Terms of Use or is mandatory for the contract to be concluded. Without your data, we cannot fulfill our obligations or provide parking management services. We do not use your data for automated decision-making or profiling. Because data collection and processing are mandatory, users do not have the right to object. Since license plates are recorded upon entry, it is generally possible—provided the site layout allows—to turn around before entering to avoid data collection.

5. Activation of parking permits

Description of data processing

For some of our parking areas, you can apply for parking permits via terminals or online booking forms (on the MHP website, online, or at local retail shops or institutions). These permits may be for designated spaces for specific groups (e.g., employees, visitors, or customers) or for free parking periods, depending on the conditions applicable to that specific location.

To do this, you must provide the information requested in the input form. A vehicle license plate number is always required. Depending on the situation, additional information may be needed to verify your eligibility, such as an employee ID number. This information may be shared with our clients or their customers to confirm your authorization or compared against data they have provided.

Legal basis and purpose of data processing / data recipients

If we need to compare data to validate your authorization, or if the processing of additional information is based on your consent, we do so under Art. 6(1)(a) GDPR. You may withdraw your consent at any time, though this will not affect the legality of any processing that occurred before your withdrawal. Please note that if you withdraw your consent, we may be unable to complete the booking process or honor an existing booking.

The legal basis for processing data collected during a booking is Art. 6(1)(b) GDPR (intended contract conclusion) or Art. 6(1)(f) GDPR (the legitimate interest in efficiently managing parking permits and supporting the provision of parking services).

Storage period / obligation to provide / right to object and removal option

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data entered in forms, this occurs once the contract for our parking services has been fulfilled. Generally, we retain contract-related data until the statutory warranty period expires. If a statutory archiving obligation exists, data will be deleted once that period has passed.

6. Parking areas with the option of free parking for people with disabilities

Description of data processing

At some of our parking areas, we offer free parking for people with disabilities in designated spaces. To use this service, eligible users must provide proof of a valid disability parking permit (e.g., the blue EU parking card).

In accordance with the conditions posted at the specific parking area, you must verify your eligibility. This can typically be done by scanning a QR code on the relevant sign, which will direct you to our website where you can submit your parking permit via the provided input form.

Legal basis and purpose of data processing

The legal basis for processing data collected during a booking is Art. 6(1)(b) GDPR, as it is necessary for the performance of a contract. Otherwise, Art. 6(1)(f) GDPR applies for the purpose of effectively processing parking permits and supporting the provision of parking services. Health data is processed in conjunction with Art. 9(2)(e) or (f) GDPR.

Storage period / obligation to provide / right to object and removal

Proof of a disabled parking permit is checked solely to verify its validity and is deleted immediately after the parking session ends.

7. Using the MH Parkservice Service Portal

How we process your data

Once registered, you can use our portal to submit support requests, request services, or access your specific customer information via a secure login area.

You can access the portal via our website using a QR code provided to you (e.g., on a payment request). After logging in, you can access the service portal. During the authentication process, the following personal data is provided by the user:

• Reference number
• License plate number

For technical reasons, certain connection data is collected every time you access the portal. This data is necessary to establish and maintain a connection between your device and our servers. It is also required to keep your session active after login and to prevent unauthorized access. During each login and use of the customer portal, we or our hosting provider store your IP address, the time of your action (timestamp), your internet service provider, web browser, operating system (including version), language settings, referrer URL, and the name of the page accessed.

After logging into the portal, a cookie is set to maintain and protect your session. You must allow this cookie in your browser to use the portal.

If resolving a problem or answering a question submitted via the portal requires the involvement of other partners or service providers, we will share the information related to your inquiry with them.

Legal basis and purpose of data processing

The legal basis for processing data during registration, portal use, inquiries, or downloads is Art. 6(1)(b) GDPR, as it is necessary for the performance of a contract. Otherwise, Art. 6(1)(f) GDPR applies, as processing this data allows us to provide effective communication with our sales and support teams, manage and resolve inquiries, and ensure a secure connection between your device and our servers.

Storage period / right to object and removal

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data entered during login, this is generally once the usage session has ended.

All personal data stored during contact will be deleted once no further legal requirements mandate longer storage (such as statutory warranty periods for support inquiries).

8. Invoicing

How we process your data

To create, send, and document invoices for accounting purposes, we use the cloud-based accounting software sevDesk, provided by sevDesk GmbH, Hauptstraße 115, 77652 Offenburg. In this process, the invoice recipient's contact details are processed by sevDesk. You can view the sevDesk privacy policy at https://sevdesk.de/datenschutz/.

Legal basis and purpose of data processing

We use sevDesk based on Art. 6(1)(c) and Art. 6(1) sentence 1 lit. b and lit. f GDPR for the aforementioned purposes to fulfill our legal obligations, for contractual purposes, and for our legitimate interest in efficient accounting. We have entered into a data processing agreement with sevDesk in accordance with Art. 28 GDPR, which requires them to comply with all applicable data protection regulations.

Retention period / right to object and erasure

We store your data for as long as our contractual relationship exists and until the end of the statutory tax retention periods for accounting documents.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

D. Contractual relationships with customers and business partners

I. Am I required to provide data?

If you contact us with questions about our services, enter into contract negotiations, accept an offer, or otherwise have a contractual agreement with us, we will process the personal data you provide. The specific data processed depends largely on the items or services you are inquiring about or purchasing. Generally, processing this data is mandatory for the preparation, conclusion, and performance of the contract. If you do not provide this information, we may be unable to enter into a contract, execute an order, or continue to perform an existing agreement.

When we use data for contract initiation or performance with a business customer or partner, our interest lies in enabling and maintaining our professional relationship. If you are acting as a contact person—typically as an employee of these companies—you generally do not have an overriding interest that would prevent this, as the interaction falls within your professional responsibilities, meaning a right to object is typically excluded.

However, you are not required to consent to data processing for purposes that are not relevant to the performance of the contract or legally required.

II. HubSpot

Description of data processing

This website uses features from the Customer Relationship Management (CRM) system HubSpot. HubSpot is a software solution provided by HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, and offered in Europe by HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland. HubSpot is an integrated platform we use for various aspects of our online marketing, including email marketing, social media publishing and reporting, contact management (e.g., user segmentation and CRM), landing pages, and contact forms.

We use HubSpot to manage and implement inbound marketing across our online presence. Information is stored on HubSpot servers. We use this data to gain detailed insights into how our website is used, to connect with visitors, and to determine which of our services are of interest to them.

HubSpot uses "web beacons" (invisible graphics or code) and cookies that are embedded in websites or emails and stored on your device. This records your IP address, geographic location, browser type, visit duration, and the pages you access.

Furthermore, HubSpot records data entered by the user if they (a) subscribe to our newsletter or (b) fill out one of our contact forms.

Further information on data protection at HubSpot can be found at https://legal.hubspot.com/de/privacy-policy.

Legal basis and purpose of data processing

HubSpot cookies and web beacons are stored based on Art. 6(1)(a) GDPR. Otherwise, we use information collected via HubSpot based on our legitimate interests in optimizing our marketing, analyzing the use of our online presence, improving user-friendliness, and providing our users with more targeted information (Art. 6(1)(f) GDPR).

Right to object and erasure

You can prevent cookies from being stored by adjusting your browser settings. If you would like other personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

Alternatively, you can also set your cookie preferences using our integrated CookieHub management tool.

III. Communication

Generally, we collect the necessary data directly from you through personal contact. However, you are welcome to reach out to us by phone, fax, mail, or via the email address provided in our legal notice, or through the email addresses of our employees you may already have. If you contact us via email, we will store the personal data you provide. Please keep in mind that email communication is not encrypted for technical reasons.

We use your data to process your inquiry and follow up on any topics discussed. This processing is based on Art. 6(1)(b) GDPR, provided the communication relates to the performance of a contract or is necessary for pre-contractual measures.

In all other cases, processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in handling your inquiries effectively.

We do not share your data with third parties unless it is necessary to pursue our legal claims or legitimate interests (Art. 6(1)(f) GDPR), or if we are legally required to do so (Art. 6(1)(c) GDPR).

IV. Data processing for sales

Personal data is processed under Art. 6(1)(b) GDPR to provide the services you have commissioned, specifically for fulfilling contracts or pre-contractual measures, as well as for all activities related to the operation and administration of MH Parkservice.

The purposes of this data processing depend on the specific activities and services agreed upon with you. This may include consulting, managing sales processes (e.g., preparing documents, sending information about MH Parkservice products or events, providing services), or supporting sales negotiations and contract finalization.

You can find further details regarding the scope, purpose, and recipients of your data in your specific contract documents and the associated terms and conditions.

Where necessary for our operational processes, we may process your data in connection with our services beyond the actual contract performance to protect our legitimate interests (Art. 6(1)(f) GDPR).

When offering or providing our services, we may be subject to specific legal obligations, such as tax regulations. Consequently, we may process your data to fulfill tax-related control and reporting requirements, customs or export regulations, and for risk assessment and management. This processing is based on Art. 6(1)(c) GDPR.

V. Newsletter

Description of data processing

We would like to keep our customers and interested parties updated with regular promotional messages about our services, products, webinars, innovations, or news from MH Parkservice via email or other electronic notifications (the "newsletter"). To do this, we need your email address. We may ask for additional details in our registration forms to provide you with content tailored to your interests.

You can subscribe to our newsletters by using the registration form or by checking a box during a sign-up process (opt-in). We offer various ways on our websites or within registration and order interfaces to sign up for our (sometimes topic-specific) newsletters. Details about the content of each newsletter are provided in the respective registration form, which serves as the basis for your consent.

After registering, you will receive an email asking you to confirm your subscription (the "double opt-in" procedure). This confirmation ensures that no one else has misused your email address to sign up without your knowledge. Your email address will only be activated for our newsletter once you click the link in that confirmation email.

To manage registrations and send our newsletters, we use MailChimp, a service provided by the US company Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. This allows us to automate the registration and email delivery process in a simple, user-friendly way. Since MailChimp’s IT systems are located in the USA, your registration data is transferred to and processed in the USA. To ensure your data is handled securely, we have entered into a data processing agreement with MailChimp pursuant to Art. 28 GDPR, which includes the EU Standard Contractual Clauses for data transfers to third countries. You can find more information on how MailChimp handles personal data here: https://mailchimp.com/legal/privacy/.

For verification purposes, we store your email address, name, IP address, and the date of registration ("timestamp") when you sign up for our newsletter.

Legal basis, purpose of data processing, and data recipients

The legal basis for sending newsletters is the consent you have provided as a recipient (Art. 6(1)(a) GDPR, Art. 7 GDPR in conjunction with Art. 130 of the Data Protection Code (Legislative Decree No. 196/2003)), or, where consent is not required for existing customers under Art. 130 of the Data Protection Code (Legislative Decree No. 196/2003), our legitimate interest in direct marketing pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 130 of the Data Protection Code (Legislative Decree No. 196/2003).

Logging the registration process is based on our legitimate interests under Art. 6(1)(f) GDPR in maintaining a secure and effective newsletter system that meets both our business sales interests and the preferences and needs of our recipients, as well as ensuring the verifiability of the consent provided.

Storage period / right to object and removal

You can object to receiving our newsletter at any time or withdraw your consent in whole or in part. You will find an unsubscribe link at the bottom of every newsletter. Alternatively, you can contact us directly using the contact details provided at the beginning of this notice.

Unsubscribing from the newsletter does not affect business-related communications. If such communication is necessary for contract fulfillment, your data will remain stored with us. We also reserve the right to retain necessary evidence of lawful newsletter distribution until the relevant statutory limitation periods have expired.

VI. Data transfer

Depending on the scope of the service, your data or documents may be shared with public authorities, private service providers, or other parties with whom we regularly collaborate during the inquiry, offer, or contract performance phases (see Part A, Section V).

E. Other

The ongoing development of our website, services, and other offerings, as well as changes in legal or regulatory requirements, may necessitate updates to this Privacy Policy. The current version of our Privacy Policy is always available on our website and can be printed for your records if needed.

‍

Privacy Policy (valid from 03/30/2026)

This privacy policy provides an overview of how your personal data (hereinafter referred to as "data") is handled by our company and informs you about your data protection rights under the European General Data Protection Regulation ("GDPR"), the Federal Data Protection Act ("BDSG"), and the Telecommunications Digital Services Data Protection Act ("TDDDG"). Please read this information carefully and feel free to save or print it for your records.

Personal data includes any information that can be used to identify you personally. Your personal data may be processed for various purposes. In general, data processing operations by Mobility Hub Parkservice Italia S.R.L (hereinafter "MH Parkservice" or "we") fall into the following categories:

• General information: General information regarding data protection, processing procedures, and the rights of data subjects, which applies to all processing activities we perform, can be found in Part A below.
• Our websites: In connection with our website https://www.mh-parkservice.it/ (hereinafter: "Website") or related external online presences, such as our social media profiles, our service portal (https://service.mh-parkservice.it/) or our post-payment service (https://parcheggio.mh-parkservice.it/), which link to this privacy policy (the website and external online presences are collectively referred to as "Internet Presences"), we process visitor data exchanged between your internet-enabled devices and our servers, as well as data provided to us while using the site. Further details are available in Part B.
• Parking users: For information on how we process data for users of the parking facilities we manage—for example, regarding payment procedures via the MHP online shop or our post-payment service, the tracking of parking violations by MH Parking Service, or viewing violation details via our Service Portal—please refer to Part C.
• B2B: We process the necessary data of our business clients and interested parties to initiate or fulfill contracts. Data from our business partners and suppliers is used exclusively for the direct placement, processing, and execution of orders. Further information on this can be found in Part D.

Please refer to the individual sections if you would like quick, context-specific information regarding particular processing situations.

A. General information on data protection and the rights of data subjects

I. Who is responsible for data processing, and who can you contact with questions?

The data controller responsible under the General Data Protection Regulation, other national data protection laws of the member states, and other data protection regulations is:

Mobility Hub Parkservice Italia S.R.L
BOLZANO (BZ)
PIAZZA DELLA MOSTRA 2, 39100
Tel.: +3904711430502
E-mail: info@mh-parkservice.it

‍
If you have any questions regarding data protection, you can contact our Data Protection Officer at the following address: dataprotection@mh-parkservice.it

II. Quali sono i suoi diritti in merito ai suoi dati personali?

Se i suoi dati personali vengono trattati, viene considerata una “persona interessata” ai sensi del RGPD, che le conferisce i diritti descritti di seguito. Se rivendica dei diritti nei confronti di MH Parkservice in qualità di titolare del trattamento, le consigliamo di rivolgersi ai nostri recapiti sopra indicati:

1. Diritto di accesso alle informazioni
Ai sensi dell’art. 15 RGPD, Lei ha il diritto di ottenere da noi la conferma che sia o meno in corso un trattamento di dati personali che la riguardano, e di sapere l’entità del trattamento.

2. Diritto di rettifica
Se i dati personali che la riguardano sono errati o incompleti, ha il diritto di rettificarli e/o di integrarli ai sensi dell’art. 16 RGPD.

3. Diritto alla cancellazione
Se i requisiti legali dell’art. 17 RGPD sono soddisfatti, può richiederci la cancellazione dei suoi dati se li trattiamo illecitamente o se il trattamento interferisce in modo sproporzionato con i suoi legittimi interessi di protezione. La preghiamo di tenere presente che ci possono essere ragioni che impediscono la cancellazione immediata, ad es. nel caso di obblighi di conservazione previsti dalla legge.
Indipendentemente dall’esercizio del suo diritto alla cancellazione, una volta decaduto lo scopo del trattamento, cancelleremo i suoi dati immediatamente e completamente per adempiere ai nostri obblighi di cancellazione previsti dalla legge, a meno che non vi sia un periodo di conservazione negoziale o legale che preveda il contrario.

4. Diritto di limitazione del trattamento
Lei ha il diritto di ottenere dal titolare del trattamento la limitazione del trattamento quando ricorre una delle ipotesi citate nell’art. 18 RGPD: se ha limitato il trattamento dei suoi dati personali, questi dati – a parte la loro conservazione – potranno essere trattati solo con il suo consenso o per l'accertamento, l’esercizio o la difesa di un diritto in sede giudiziaria oppure per tutelare i diritti di un’altra persona fisica o giuridica, o per motivi di interesse pubblico rilevante dell’Unione o di uno Stato membro.

5. Diritto alla portabilità dei dati
Ai sensi dell’art. 20 RGPD Lei ha il diritto di ricevere i dati da Lei forniti, che trattiamo in modo automatizzato sulla base del suo consenso o per l’esecuzione di un contratto, in un formato di uso comune e leggibile da dispositivo automatico, oppure di trasmetterli a una terza parte. Lei ha il diritto di ottenere la trasmissione diretta dei dati personali da un titolare del trattamento all’altro, se tecnicamente fattibile. Il diritto alla portabilità dei dati non si applica al trattamento necessario per l’esecuzione di un compito di interesse pubblico o connesso all’esercizio di pubblici poteri di cui è investito il titolare del trattamento.

6. Dritto di opposizione
Se trattiamo i suoi dati sulla base di un legittimo interesse ai sensi dell’art. 6 par. 1 lett. f, Lei ha il diritto di opporsi in qualsiasi momento, per motivi connessi alla sua situazione particolare, al trattamento dei dati personali che la riguardano, compresa la profilazione sulla base di tali disposizioni (vedi art. 21 RGPD). Se esercita il diritto di opposizione, ci asterremo dal trattare ulteriormente i dati personali salvo che riuscissimo a dimostrare l’esistenza di motivi legittimi cogenti per procedere al trattamento che prevalgono sugli interessi, sui diritti e sulle libertà dell’interessato oppure per l’accertamento, l’esercizio o la difesa di un diritto in sede giudiziaria.
Qualora i suoi dati personali vengano trattati per finalità di marketing diretto, Lei ha il diritto di opporsi in qualsiasi momento al trattamento dei dati personali che la riguardano effettuato per tali finalità, compresa la profilazione, nella misura in cui sia connessa a tale marketing diretto. Qualora Lei si opponga al trattamento per finalità di marketing diretto, i dati personali non saranno più oggetto di trattamento per tali finalità. Può opporsi al trattamento dei suoi dati ai fini di marketing diretto in qualsiasi momento e senza fornire motivazioni.

7. Diritto di revoca della dichiarazione di consenso in merito alla protezione dei dati
Alcune procedure per il trattamento dei dati personali sono possibili solo con il suo esplicito consenso ai sensi dell’art. 6 par. 1 lett. a del RGPD. Può revocare il suo consenso in qualsiasi momento con effetto per il futuro. La revoca del consenso non pregiudica la validità del trattamento avvenuto in precedenza. La preghiamo di tenere presente che anche dopo la revoca del consenso, il trattamento dei dati in questione può essere possibile, in tutto o in parte, anche sulla base di altri principi giuridici.

8. Diritto di proporre reclamo all’autorità di controllo
Fatto salvo ogni altro ricorso amministrativo o giurisdizionale, se Lei ritiene che il trattamento che la riguarda violi l’RGPD (art. 77 RGPD unitamente all’art. 141 e segg. del Codice in materia di protezione dei dati personali (D.Lgs. n. 196/2003)), ha il diritto di proporre reclamo a un’autorità di controllo, nello Stato membro in cui risiede abitualmente, lavora oppure del luogo ove si è verificata la presunta violazione.
Se ritiene che nel trattare i suoi dati stiamo violando la legge italiana o europea sulla protezione dei dati, la preghiamo di contattarci in modo da poter chiarire qualsiasi quesito.

‍
Naturalmente, ha anche il diritto di contattare l’autorità di controllo responsabile in base alla nostra sede aziendale:
Garante per la Protezione dei Dati Personali, Piazza Venezia n. 11, I-00187 Roma, Tel.: +39 06 69 6771, E-mail: protocollo@gpdp.it

III. Quali dati personali vengono trattati e da quali fonti provengono?

1. Provenienza dei dati personali‍

Trattiamo principalmente i dati che riceviamo direttamente dagli interessati quando utilizzano il nostro sito web nel corso dell’avvio di una relazione commerciale o nel corso di una relazione commerciale (vedi a riguardo anche la parte B punto VI).

Attraverso il nostro sito web e i nostri servizi, trattiamo i dati che riceviamo durante la sua visita o che Lei ci comunica attivamente durante il suo utilizzo (ad es. quando usa il nostro online-shop). Altri dati vengono raccolti automaticamente dai nostri sistemi informatici quando visita il sito web o utilizza uno dei nostri servizi. Si tratta soprattutto di dati tecnici (ad es. il browser internet, il sistema operativo o l’ora di visualizzazione di una pagina). La raccolta di questi dati avviene in modo automatico, non appena entra nel nostro sito web o accede a uno dei nostri servizi. Dettagli a riguardo sono disponibili nella parte B.

In singoli casi, trattiamo anche i dati che abbiamo ricevuto o acquisito legittimamente da altre terze parti, come agenzie di credito, associazioni di tutela dei creditori o autorità, o che abbiamo evinto, ricevuto o acquisito legittimamente da fonti pubblicamente accessibili (ad es. elenchi telefonici, registri aziendali, stampa, internet o altri media).

2. Categorie di dati personali

I dati personali che trattiamo regolarmente comprendono dati personali anagrafici/di contatto come: titolo, nome e cognome, appellativo, data di nascita. Indirizzo, indirizzo mail, numero di telefono, fax, posizione nell’azienda.

Inoltre, a seconda dell’ordine, del servizio o di altri rapporti con Lei, trattiamo anche i seguenti dati personali:

• Indirizzo: via, numero civico, eventualmente altri dati sull’indirizzo, CAP, località, paese
• Dati di contatto: numero(i) di telefono, indirizzo(i) e-mail
• Dati del veicolo: targa del veicolo, proprietario del veicolo
• Dati riservati alla gestione del parcheggio: fotografie, data e periodo di utilizzo di un parcheggio, autorizzazioni di parcheggio, coordinate bancarie, dettagli di pagamento
• Dati di registrazione: informazioni sul servizio con il quale ha effettuato la registrazione; orario e informazioni tecniche sulla registrazione, conferma e uscita; dati forniti da Lei durante la registrazione
• Dati dell’offerta
• Dati d’accesso: data e ora della visita al nostro servizio; la pagina da cui il sistema di accesso ha raggiunto il nostro sito; le pagine visitate durante l’utilizzo; i dati di identificazione della sessione (ID sessione); anche le seguenti informazioni del sistema informatico di accesso: indirizzo di protocollo internet (indirizzo IP) utilizzato, tipo e versione del browser, tipo di dispositivo, sistema operativo e informazioni tecniche simili
• Informazioni sulla natura e sul contenuto della nostra relazione commerciale, come i dati del contratto, i dati dell’ordine, i dati di vendita e le distinte, archivio storico dei clienti e dei fornitori, i documenti di consulenza.
• Dati di marketing e di vendita
• Dati di documentazione (ad es. protocolli di consulenza, dati di chiamate di servizio o casi di assistenza)
• Altri dati che abbiamo ricevuto da Lei nell’ambito della nostra relazione commerciale (ad es. durante i colloqui con i clienti)
• La documentazione della dichiarazione di consenso

IV. Per quali finalità e su quale base giuridica vengono trattati i dati?

Trattiamo i suoi dati in conformità alle disposizioni del RGPD e del Codice in materia di protezione dei dati personali (D.Lgs. n. 196/2003), nella versione rispettivamente vigente; in particolare sulle seguenti basi:

1. Adempimento di obblighi (pre)contrattuali (art. 6 par. 1 lett. b RGPD)
Il trattamento dei dati personali avviene sulla base dell’art. 6 par. 1 lett. b RGPD per l’adempimento degli obblighi contrattuali di MH Parkservice, in particolare in relazione alla vendita e alla distribuzione dei nostri beni e servizi (di seguito denominati anche “servizi di parcheggio”), nonché di tutte le attività necessarie per il funzionamento o l’amministrazione di MH Parkservice, secondo gli usi del settore (ad es. l’amministrazione dei clienti e degli utenti). I dati possono anche essere trattati a livello precontrattuale nell’ambito dell’avvio di una relazione commerciale con MH Parkservice o nel corso di altre relazioni contrattuali con MH Parkservice.
Ad esempio, l’art. 6 par 1 lett. b RGPD è la base giuridica nei seguenti casi:

• Creazione e gestione di un account partner o fornitore nel nostro sistema CRM
• Creazione e gestione di file di clienti/interessati o del nostro database di clienti/interessati nel nostro sistema CRM
• Invio di informazioni
• Offerta e vendita dei prodotti di MH Parkservice
• Offerta ed esecuzione dei servizi da noi offerti
  I dettagli sulle finalità di questo trattamento dei dati sono riportati nei rispettivi documenti contrattuali e nelle Condizioni di Contratto.

2. Perseguimento del legittimo interesse (art. 6 par. 1 lett. f RGPD)
Ai fini di ottenere un equilibrio tra gli interessi, i dati possono essere trattati al di là dell’effettiva esecuzione di un contratto, per proteggere gli interessi legittimi di MH Parkservice o di terzi. Questo è legittimo a condizione che non prevalgano gli interessi o i diritti e le libertà fondamentali dell’interessato che richiedono la protezione dei dati personali. Il trattamento dei dati per il perseguimento del legittimo interesse ha luogo, ad esempio, nei seguenti casi:

• Fornitura dell’offerta online, delle sue funzioni e dei suoi contenuti
• Utilizzo di cookie necessari per finalità tecniche o di tecnologie comparabili ai sensi dell’art. 122 del Codice in materia di protezione dei dati personali (D.Lgs. n. 196/2003).
• Risposta alle richieste di contatto e comunicazione con gli utenti
• Trasmissione di dati ad aziende e partner collegati a noi
• Esecuzione di transazioni di pagamento tramite fornitori di servizi esterni
• Utilizzo di società di recupero crediti e avvocati per recuperare crediti e/o farli valere in tribunale
• Esercizio di altri diritti in sede giudiziaria e difesa in controversie legali
• Pubblicità o marketing
• Sondaggi di mercato e opinione
• Misure per il controllo aziendale e l’ulteriore sviluppo dei nostri servizi
• Gestione di banche dati di clienti/interessati o fornitori di servizi per migliorare la nostra offerta
• Esecuzione di una valutazione del rischio (due diligence) nell’ambito di una riorganizzazione aziendale o di un’acquisizione o vendita di un’azienda
• Garanzia di sicurezza informatica e del funzionamento informatico della nostra azienda e dei nostri servizi
• Misure per la sicurezza degli edifici e degli impianti

3. Adempimento degli obblighi di legge (art. 6 par. 1 lett. c RGPD)
Il trattamento dei suoi dati può essere necessario in parte per l'adempimento degli obblighi e delle disposizioni a cui siamo soggetti, ad es. dal Codice commerciale o dal Testo unico delle leggi tributarie.

4. Consenso (art. 6 par. 1 lett. a RGPD, art. 122 Codice in materia di protezione dei dati personali (D.Lgs. n. 196/2003)
Se un servizio da noi utilizzato memorizza in qualsivoglia forma le informazioni nell’apparecchio terminale dell’utente o accede a tali informazioni, è necessario il consenso ai sensi dell’art. 122 del Codice in materia di protezione dei dati personali (D.Lgs. n. 196/2003). Se il servizio funziona senza alcun accesso all’apparecchio terminale, l’RGPD è pertinente. Qualora il trattamento sia basato sul RGPD, ciò avviene sulla base dell’art. 6 par. 1 lett. a unitamente all’art. 7 RGPD.
Se ha espresso il suo consenso al trattamento dei suoi dati in singoli casi, questi saranno trattati in conformità alle finalità specificate nella dichiarazione di consenso e nella misura concordata in essa. Il consenso espresso, ad es. per l’invio di una newsletter, può essere revocato in qualsiasi momento con effetto per il futuro. A questo scopo, la preghiamo di utilizzare i dettagli di contatto forniti nella parte A punto I o II. La preghiamo di tenere presente che il trattamento che ha avuto luogo prima della revoca non è interessato dalla revoca e che il trattamento dei dati può ancora essere possibile, almeno in parte, sulla base di un’altra base giuridica.

V. Chi riceve i miei dati?

Ricevono i suoi dati quei collaboratori o quelle unità organizzative in MH Parkservice che ne necessitano per l'adempimento dei nostri obblighi contrattuali e legali o per elaborare o perseguire i nostri legittimi interessi.

I suoi dati saranno trasmessi per avviare o eseguire un rapporto contrattuale (ad es. vendita o fornitura di servizi di parcheggio) ai sensi dell’art. 6 par. 1 cpv. 1 lett. b RGPD o – a seconda del tipo di rapporto contrattuale concreto – anche sulla base dei nostri interessi legittimi ai sensi dell’art. 6 par. 1 cpv.1 lett. f RGPD, in particolare ad aziende di cui usufruiamo regolarmente in relazione alla fornitura dei nostri servizi o per l’esecuzione del contratto. Il punto di cui sopra riguarda i seguenti destinatari o categorie di destinatari:

• Fornitori di servizi informatici (ad es. fornitori di servizi e-mail, aziende di web hosting)
  
  • Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA (Cloud-Storage-Provider)
  • Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (Ottimizzazione delle funzionalità dell'app)
  • Airparser, Sepapaja tn 6, Tallinn 11415, Estonia (fornitore di software per la gestione dei documenti)
  • UAB Baltsoft, Kosciuskos 26-17, Vilnius, LT-01100, Lituania (fornitore di soluzioni software di conversione)
  • Celonis SE, Theresienstr. 6 80333 Monaco (fornitore di piattaforme di integrazione)
  • Datadog Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (Gestore di piattaforma IA e fornitore di una funzione di chat IA)
  • Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114 USA (operatore di piattaforma AI e fornitore di una funzione di chat AI)
  • Freshworks, Inc., 2950 S.Delaware Street, Suite 201 a San Mateo, CA 94403 USA (fornitore di sistemi di biglietteria)
  • Google Ireland Limited, Gordon House, Barrow Street, Dublino 4, Irlanda
  • Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublino 2, Irlanda (E-Mail-Service-Provider)
  • HubSpot Inc. 25 First Street, 2nd Floor, Cambridge, MA 02141 USA (fornitore di sistemi CRM)
  • Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA (Ticket-System-Provider)
  • Octa Inc., 100 First Street, Floor 6, San Francisco, CA 94105, USA (Fornitore di AutenticazioneZero per una cancellazione ai fini della sicurezza dei sistemi)
  • Leaping AI UG (haftungsbeschränkt), Potsdamer Straße 72, 10785 Berlino (fornitore di software per call center supportato dall'intelligenza artificiale)
  • Peter Park System GmbH, Balanstr. 71a, 81541 Monaco di Baviera, Germania (fornitura di sistemi IT come servizi gestiti e sistemi di gestione dei parcheggi)
  • Planet Payment Group Holdings Limited, IDA Business Park, Dangan, Galway H91A06C, Irlanda (gateway del sistema di pagamento del fornitore)
  • sevDesk GmbH, Hauptstraße 115, 77652 Offenburg (fornitore di software di contabilità)
  • Talkdesk Inc. 201 Spear Street, Suite 1100, San Francisco, CA 94105 USA (fornitore di software per contact center)
  • Trustpilot A/S, Pilestraede 58, 5° Piano, DK-1112 Copenaghen, Danimarca (Fornitore di procedure di valutazione)
  • Webflow, Inc, 398 11th Street, San Francisco, CA 94103, Stati Uniti (fornitore di servizi di web hosting per il sito web)
  • Weglot, SAS, 138, rue Pierre Joigneaux a Bois-Colombes 92270 Francia (fornitore di servizi di traduzione)
• Partner commerciali
• Partner pubblicitari
• Assicurazioni
• Banche
• Fornitori di servizi di comunicazione (fornitori di servizi telefonici, fornitori di servizi fax)
• Fornitori di servizi di pagamento
  
  • Stripe Deutschland S.R.L, Prielmayerstr. 3, 80335 Monaco di Baviera
  • Adyen N.V. Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Paesi Bassi
  • secuPay AG, Goethestraße 6, 01896 Pulsnitz
• Fornitori di servizi di spedizioni e logistica
• Agenzie di credito
• Revisori contabili
• Consulenti fiscali e legali

Se ci avvaliamo di un fornitore di servizi quale responsabile del trattamento ai sensi dell’art. 28 RGPD, rimaniamo comunque responsabili della protezione dei suoi dati. Quando è previsto dalla legge, i responsabili del trattamento sono contrattualmente obbligati, tramite un accordo di elaborazione degli ordini, a trattare i suoi dati in modo confidenziale e a trattarli solo nell’ambito della fornitura di servizi. I responsabili del trattamento da noi incaricati riceveranno i suoi dati se ne hanno necessità per adempiere al loro rispettivo servizio.

I suoi dati saranno trasmessi a istituzioni e autorità statali o raccolti per tali finalità solo nell’ambito delle disposizioni nazionali obbligatorie o se Lei ce ne dà mandato con la presente.

VI. Per quanto tempo vengono conservati i miei dati?

I suoi dati personali saranno utilizzati solo per la finalità per la quale ce li ha forniti o per la quale ha espresso il consenso al trattamento e saranno conservati solo fino al conseguimento di tale finalità. Dopo il completo conseguimento della finalità o non appena ce ne avrà richiesto la cancellazione, i suoi dati saranno conservati solo per il tempo necessario per i termini di prescrizione o periodi di conservazione previsti dalla legge (in particolare dal diritto fiscale e commerciale). Tuttavia, i dati saranno cancellati al più tardi dopo la scadenza di tali periodi, a meno che Lei non abbia espressamente acconsentito ad un uso ulteriore o diverso. Anche durante i periodi di conservazione può far valere i suoi diritti, ad es. bloccando i suoi dati. Vedere a riguardo la parte A punto II.

I suoi dati saranno cancellati o bloccati da noi non appena la finalità della conservazione decade o Lei ci chiederà di cancellarli.

Trattiamo, e in particolare conserviamo, i suoi dati solo fino alla fine del rapporto commerciale o fino alla scadenza dei periodi di garanzia e di obbligo di garanzia, e del periodo di prescrizione in vigore. Inoltre, potrebbe essere necessario conservare i dati fino alla conclusione passata in giudicato di eventuali controversie legali in cui i dati sono richiesti come prova. Inoltre, siamo soggetti a periodi di documentazione e conservazione previsti dalla legge (ad esempio, in base al diritto commerciale o fiscale).

VII. I dati vengono trasferiti a un paese terzo?

Nell’ambito dei nostri processi di trattamento, per determinate transazioni commerciali o aree di attività, i dati personali possono anche essere trasferiti a organismi nei cosiddetti paesi terzi al di fuori dell’UE o del SEE che non sono stati ancora certificati dalla Commissione UE come aventi un livello adeguato di protezione dei dati, ad esempio negli Stati Uniti. Se in singoli casi dovesse rendersi necessario un tale trasferimento di dati, questo avverrà solo sulla base di una decisione di adeguatezza della Commissione Europea, di clausole contrattuali standard, di garanzie adeguate per il rispetto della protezione dei dati o del suo esplicito consenso.

B. Using our websites

In principle, you can visit and use our websites for informational purposes without having to provide any personal data (such as registering, placing orders, or otherwise sharing personal information). In such cases, we only process your personal data to the extent necessary to provide a functional website and our content and services, or if cookies or similar technologies used on the site transmit personal information to us when you visit. Information about the cookies or similar technologies we use can be found in Part B, Section II. In addition to us, other cookies or similar technologies may allow our partner companies or third parties to recognize your browser during your next visit. For information on these third-party cookies or similar technologies, please refer to Part B, Section III.

Generally, we only process our users' personal data with their prior consent. An exception applies in cases where obtaining prior consent is not possible for legitimate reasons and the data processing is permitted by law.

I. Website provision and log file creation

Description of data processing

Every time you visit our website, our system automatically collects data and information from the computer system you are using, which your internet browser transmits to us or our web host (so-called log files). These server log files contain IP addresses or other data that could identify a user. This might happen, for example, if the link to the website you used to reach our site or the link to the website you navigate to next contains personal data. The following information is collected and stored by our hosting provider:

• Information about the browser type and version used
• Operating system used
• Referrer URL
• Hostname of the accessing computer and time of access
• IP address

The data is stored in our system's log files. This data is never stored together with other personal data of the user.

We use Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA (www.webflow.com) (hereinafter: “Webflow”) as our web host and software provider for creating, hosting, and operating our website, online forms, and other web elements. You can find Webflow's privacy policy at https://webflow.com/legal/eu-privacy-policy. We have entered into a data processing agreement with Webflow on our behalf in accordance with Art. 28 of the GDPR (“Data Processing Addendum,” see https://webflow.com/legal/dpa). As part of the services provided by Webflow, data may be transferred to the United States based on standard contractual clauses that Webflow has agreed to with us in its Data Processing Addendum, or via an equivalent data protection guarantee as part of the commissioned processing.

Legal basis and purpose of data processing

The legal basis for the temporary storage of data and log files is Art. 6(1)(f) of the GDPR. The information mentioned above is also necessary for providing the service in accordance with Art. 122 of the Italian Data Protection Code (Legislative Decree no. 196/2003).

Temporary storage of the IP address by the system is necessary to enable the website to be displayed on your computer. To do this, your IP address must remain stored for the duration of the session.

Data is stored in log files to ensure the website's functionality. Additionally, we use this data to optimize the website and ensure the security of our IT systems.

Retention period / Right to object and erasure

Data is deleted as soon as it is no longer required for the purpose for which it was collected. When the purpose of data collection is to provide the website, this occurs as soon as the session ends.

In the case of data stored in log files, this occurs after 7 days at the latest.

Collecting data to provide the website and storing it in log files is strictly necessary for the website to function. Therefore, users do not have the option to object to this.

II. Use of cookies and similar technologies

Description of data processing

Our website uses cookies or similar processes (e.g., web beacons, local storage) and collects, processes, and uses usage data (e.g., access times, pages visited) or meta and communication data (IP address, device information), including personal data. For simplicity, we refer to these technical processes generally as "cookies."

Cookies are text files containing a string of unique characters that are stored on or by your internet browser on your computer system, allowing your browser to be uniquely identified when you visit the website. When you access a website, a cookie may be stored on your operating system. A cookie contains a characteristic string of characters. These cookies are used to make a website more user-friendly, effective, and secure. When you visit a website where a cookie is embedded, the data entered is stored exclusively in the cookie on your computer. In this case, data is only transmitted to our website's servers when a page is requested.

Some cookies are deleted at the end of your browser session when you close it (so-called session cookies). These cookies are technically necessary, for example, to allow you to log in to the application and stay logged in across different pages while visiting our website.

Other cookies remain on your device for a set period, allowing us to recognize your browser on your next visit (so-called persistent or protocol cookies). The purpose of using these cookies is to provide you with optimal user guidance, to "recognize" you, and to present you with a website that is as varied as possible, along with new content during repeat visits.

Cookies from partner companies or third parties may be used, for example, to collect information for advertising purposes, personalized content, or statistics ("third-party cookies"). If we do not identify cookies as coming from third-party providers, they are from our own website ("first-party cookies"). We will inform you separately about any third-party cookies or tracking technologies we use in the following sections of our privacy policy.

Flash cookies are stored as website data elements on your computer if you use Adobe Flash. Flash cookies have no time limit.

For more information on which cookies and similar technologies we use to design our website, their purposes, and what data is stored or transmitted to third parties, please refer to our cookie management tool "CookieHub" from the provider CookieHub ehf, Hafnargata 18, 230 Reykjanesbær, Iceland. Through this tool, you can provide your consent for the use of cookies and similar technologies based on your selected preferences when visiting our website.

Our cookie management tool collects log file and consent data using JavaScript. This JavaScript allows us to inform users about their consent to specific tags on our website and to obtain, manage, and document that consent. The cookie management tool saves your selected settings and the consent given at the time of accessing the website and processes the following data:

• Consent data (anonymized log data (consent ID, processor ID, controller ID), consent status, date and time).
• Device data or data from the devices used (including truncated IP addresses (IP v4, IP v6), device information, timestamps)
• User data (including email, IDs, browser information, SettingIDs, changelog)

To this end, the cookie management tool stores a technically necessary cookie. CookieHub's data protection information is available at: https://www.cookiehub.com/legal/privacy-policy.

For more information on which cookies we use to build our website, their purpose, and what data is stored or transmitted to third parties, please refer to the detailed information from CookieHub, accessible under "Other options" or "Cookie Declaration." CookieHub automatically analyzes which cookies are set on the site. The list of processes used and the cookie declaration are then updated automatically.

Legal basis and purpose of data processing

The legal basis for processing personal data via cookies and similar technologies is Art. 6(1)(f) GDPR, to safeguard our legitimate interests in the optimal functionality and security of the website, as well as an effective and user-friendly design, unless user consent is required under Art. 6(1)(a) GDPR.

The legal basis for storing and reading other information is consent pursuant to Art. 122 of the Data Protection Code (GDPR No. 196/2003) for cookies and similar technologies that require consent; otherwise, for cookies necessary for the website's operation, it is Art. 122 of the Data Protection Code (GDPR No. 196/2003).

We have integrated CookieHub to obtain consent. This makes it easier for users to give or manage consent for the individual categories of cookies and similar technologies we use. CookieHub blocks all categories of cookies that are not essential for the proper functioning of the website unless the user consents to the use of additional tools. When accessing our website, users are shown an interface for this purpose:

By clicking the "Accept all" button, you can allow all processes, or use the "Other options" button to decide individually (by activating the individual selection sliders and clicking the final "Save settings" button) which cookies and/or cookie-based applications and the resulting data processing you provide your consent for.

Alternatively, you can reject all non-essential cookies by clicking the "Only essential cookies" button and use the website only with the cookies necessary for its operation.

The use of technically necessary cookies is intended to simplify the use of websites for users or to make them more convenient, and is therefore necessary for the provision of the service pursuant to Art. 122 of the Privacy Code (Legislative Decree 196/2003). Certain functions of our website cannot be offered without the use of such cookies. In particular, these functions require the browser to recognize users even after changing pages.

Otherwise, the purpose of the cookies we use in the "Analytical cookies," "Marketing cookies," and "Necessary cookies" categories of the cookie policy depends on the services used and the subsequent data processing, and is explained in more detail in the following sections of the data protection policy and in CookieHub.

The legal basis for data processed with our cookie management tool is Art. 6(1)(c) GDPR regarding user consent data; otherwise, it is Art. 6(1)(f) GDPR or Art. 122 of the Privacy Code (GDPR No. 196/2003). As website operators, we have a legitimate interest in legally compliant, user-specific, and user-friendly cookie consent management, as well as a legally compliant website design.

Storage duration / Right to object and restriction

For details on the storage duration of our cookies, please refer to the CookieHub information under the "Cookie Declaration" section.

Cookies are stored on your computer and transmitted from there to our website. This means you have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing your internet browser settings. Cookies that have already been saved can be deleted at any time. This process can also be automated.

If cookies are disabled for our website, you may no longer be able to use all of the website's features to their full extent.

Alternatively, you can use the features of our integrated cookie consent tool to withdraw your consent at any time or change your preferences by clicking the "Cookie Settings" button to access and adjust your settings.

III. Statistical website analysis / Reach measurement

1. Google Analytics

Description of data processing

We use the web analysis service Google Analytics for our online service. The provider in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), an affiliate of Google LLC, Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics also uses cookies. The information generated by the cookie about your use of this website is generally transmitted to a Google server in the USA and stored there. Google processes the data, and we receive reports on user behavior. These reports may include, among other things, the following:

• Target group reports: Target group reports allow us to get to know our users better and know more precisely who is interested in our service.
• Behavior reports: Here we find out how you interact with our website. We can track the path you take on our site and the links you click.
• Real-time reports: Here we find out immediately what is happening on our page at any given moment. For example, we can see how many users are currently reading this text.

Using a tracking code, Google Analytics creates a random, unique ID that is associated with your browser's cookie. This allows Google Analytics to recognize you as a new user. The next time you visit our site, you will be recognized as a "returning" user. All collected data is stored along with this user ID. This makes it possible to analyze pseudonymous user profiles.

Your interactions on our website are measured using identifiers such as cookies. Interactions are any type of action you take on our website. If you also use other Google systems (such as a Google account), the data generated via Google Analytics may be associated with third-party cookies. Google does not share Google Analytics data unless we, as the website operator, authorize it. Exceptions may be made if required by law. The cookies used by Google Analytics are listed in the detailed information of our cookie management tool, CookieHub, which you can access under "Cookie Declaration".

Our website uses Google Analytics exclusively with the "anonymiseIp()" extension. This means your IP address is not stored in full; it is truncated by Google within the member states of the European Union or other contracting states to the Agreement on the European Economic Area before being transmitted to the USA. Website visitors are not identified. Only in exceptional cases will the full IP address be sent to a Google server in the USA and truncated there. Below is an overview of the most important data collected by Google Analytics:

• Heatmaps: Google creates so-called heatmaps, which allow us to see exactly where you click. This gives us information about where you are on our site.
• Session duration: Google defines session duration as the time you spend on our site without leaving. If a user is inactive for 20 minutes, the session ends automatically.
• Bounce rate: A bounce occurs when a user leaves the site after viewing only one page.
• Account creation: When a user creates an account on our website or places an order, Google Analytics collects this data.
• Location: The country and location can be determined via the IP address. This process is also known as IP geolocation.
• Technical information: Technical information includes the browser type, internet provider, or screen resolution.
• Referral source: Google Analytics and we are naturally interested in knowing which website or advertisement led you to our site.

This list is not exhaustive and serves only as a general guide to data storage by Google Analytics. For more information on how Google processes data, please read Google's privacy policy: https://policies.google.com/privacy?hl=en

Legal basis and purpose of data processing

We use Google Analytics to analyze the use of our website and services, to compile reports on website and service activity, and to provide us with other services related to the use of our website, services, and the internet. We also use Google Analytics to analyze AdWords and double-click cookie data for statistical purposes. Since we, as the operator of the website and services, have a significant interest in this analysis of user behavior in order to optimize both our website and our offerings and advertising on the site, we ask for your consent to the use of Google Analytics and the storage of Google Analytics cookies in accordance with Art. 122 of the Italian Data Protection Code (Legislative Decree no. 196/2003).

The information generated by the cookie about your use of this website and our services is generally transmitted to a Google server in the USA and stored there. However, if IP anonymization is activated, your IP address will first be truncated by Google within the member states of the European Union or other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and truncated there. By consenting to the activation of cookies used by Google Analytics, you also consent to the processing of your data in the USA pursuant to Art. 49 para. 1 sentence 1 lit. a GDPR, provided that data transfer is not guaranteed based on EU standard contractual clauses. The USA is considered by the European Court of Justice to be a country with an inadequate level of data protection according to EU standards. In particular, there is a risk that your data may be processed by US authorities for control and monitoring purposes, possibly without the possibility of legal recourse. If you click the "Reject all" button or decide to manage your preferences without Google cookies, the described transmission to Google will not take place. You can withdraw your consent at any time with effect for the future.

Google will use this information to analyze your use of the website or services, to produce reports on website activity for us, and to provide other services related to website activity and internet usage. Google may transmit the data it collects based on this information to third parties under its own responsibility, provided this is permitted by law or if third parties process this data on Google's behalf. Google has contractually guaranteed that it will never associate your IP address with other Google data. To safeguard this and the data processing performed for us, we have entered into a data processing agreement with Google.

Storage duration / Right to object and restrict processing

Cookies are stored on your computer and transmitted from there to our website. As a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time, including automatically. If you disable cookies for our website, you may not be able to fully use all of the website's features.

By installing the browser add-on to deactivate Google Analytics (http://tools.google.com/dlpage/gaoptout?hl=en), you can opt out of having your data used and collected by Google Analytics. This tells Google Analytics that no information about your website visit should be transmitted.

In addition, you can install an opt-out cookie on your device via this link https://developers.google.com/analytics/devguides/collection/gajs/?hl=en#disable, which is particularly useful for mobile browsers, to prevent future data collection by Google Analytics on our website. Please note that if you delete the cookies on your device, you will need to reinstall the opt-out cookie.

Alternatively, you can also set your cookie preferences using the Cookie Consent Tool Cookie Hub that we have integrated.

2. Google Tag Manager

Description of data processing

Google Tag Manager is a solution from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”), which allows marketers to manage website tags through an interface. Google Tag Manager itself (which implements the tags) is a cookie-free domain and does not record personal data. Google Tag Manager facilitates the integration and ensures the activation of other tags, code snippets, tracking codes, and conversion pixels on a website, which in turn may collect data that Google Tag Manager does not access. Google Tag Manager provides us with a user-friendly interface that does not require extensive programming knowledge or changes to the website's source code.

We use Google Tag Manager only to display Google Ads (formerly Google AdWords) for our search engine marketing activities.

Further information on Google Tag Manager can be found at https://www.google.com/intl/en/tagmanager/use-policy.html.

3. Google Ads (formerly Google AdWords) and Google Ads Conversion Tracking

Description of data processing

We use Google Ads, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and offered in Europe by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, to display advertisements within our online offerings and to draw attention to our attractive offers using advertising material on external websites.

This allows us to evaluate the success of individual advertising measures. These advertisements are provided by Google via so-called “AdServers.” For this purpose, Google AdWords uses cookies (see the explanations above). By installing the cookie, the use of our websites can be analyzed. Each time you access one of the individual pages of our website where a Google Ads component has been integrated, the internet browser on your computer system is automatically prompted by the respective Google Ads component to transmit data to Google for the purposes of online advertising and commission billing. During this technical process, Google gains knowledge of personal information such as your IP address, which allows them to determine the origin of visitors and clicks, and subsequently calculate commissions. These cookies typically store the following information as analysis values: unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions), and opt-out information (a note that the user no longer wishes to be contacted). These cookies allow Google to recognize your web browser. If you do not agree to the installation of cookies on your computer, please follow the general instructions provided above or at the end of this explanation.

Google Ads also uses so-called web beacons (invisible graphics). These web beacons can be used to evaluate information such as visitor traffic on the pages of this offer.

The information generated by cookies and web beacons about your use of our website, including your IP address, and the delivery of advertising formats, is transmitted to a Google server in the USA and stored there. This information may be passed on by Google to Google's contractual partners (see https://support.google.com/admanager/answer/94149?visit_id=637060482444635472-69980806&rd=1). In detail, we have no influence over the data collected by Google, nor are we aware of the full extent of the data collection or the storage period. However, to our knowledge, Google will not merge your IP address with other data stored by you. If you are logged into a Google account, however, your data may be associated directly. If you do not want this association with your Google profile, please log out before using our website.

Further information on Google Ads data protection can be found at https://policies.google.com/privacy?hl=en, and at https://policies.google.com/technologies/ads?hl=en

Legal basis and purpose of data processing

The storage of Google Ads cookies and web beacons is based on Art. 6(1)(a) GDPR. We also use Google Ads based on our legitimate interest under Art. 6(1)(f) GDPR. As a website operator, we have a legitimate interest in analyzing the reach of our offerings, as well as displaying relevant and interesting advertisements, improving campaign performance reports, and obtaining a fair calculation of advertising costs.

We have also entered into a data processing agreement with Google for order processing.

Right to object and restriction

You can prevent Google Ads from installing cookies in several ways: a) by adjusting your browser software settings—specifically by blocking third-party cookies, you will not receive ads from third-party providers; b) by disabling interest-based ads on Google via the link www.google.it/ads/preferences, noting that this setting will be deleted if you clear your cookies; c) by disabling interest-based ads from providers participating in the “About Ads” self-regulatory campaign via the link www.aboutads.info/choices, noting that this setting will be deleted if you clear your cookies; d) by permanently disabling them in your Firefox, Internet Explorer, or Google Chrome browser via the link www.google.com/settings/ads/plugin. Please be aware that if you do this, you may not be able to fully use all the features of our online services.

Alternatively, you can also set your cookie preferences using the CookieHub cookie management tool we have integrated.

4. Amplitude

Description of data processing

To optimize our online store and mobile payment app, we use the web analytics software Amplitude, a service provided by Amplitude Inc., 201 Third Street, Suite 200, San Francisco, CA 94103, USA (“Amplitude”). This process allows us to evaluate and analyze user behavior and compile activity reports for us. Data is collected in real-time as soon as you perform a specific action (e.g., clicking a button, loading a page, or completing a purchase). The categories of data involved are as follows:

• Usage data: clicks, pages visited, time spent, feature usage.
• Device data: operating system, browser type, device type, screen resolution.
• Identifiers: pseudonymized user IDs, internal Amplitude IDs, IP address (a shortened IP address is processed).

To this end, cookies are also stored on your computer.

The information generated in this way is transmitted to an Amplitude server in the USA and stored there. We have entered into a Data Processing Addendum with Amplitude, which includes standard contractual clauses as a mechanism for transferring personal data from Switzerland to the USA. Amplitude participates in the Swiss/EU-US Data Privacy Framework, which establishes minimum standards for the protection of personal data of Swiss citizens whose data is stored or processed in the USA.

Further information on how Amplitude processes data can be found in Amplitude’s privacy policy (https://amplitude.com/privacy).

Purpose of data processing

We use Amplitude to evaluate the use of our services, compile activity reports, and better understand how our services are used. This helps us identify potential improvements and optimize the performance and functionality of our site. As service providers, we have a legitimate interest in analyzing user behavior to improve our products, so we ask for your consent to use Amplitude and store cookies.

Retention period / Right to object and deletion

If you do not want cookies to be saved, please configure your internet browser to delete cookies, block them entirely or partially, or notify you before they are stored. You can also manage your cookie preferences using the cookie management tool we use, CookieHub.

IV. Further information on procedures, plugins, and tools used for the website

1. SSL or TLS encryption

‍
This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us as the site operator. You can recognize an encrypted connection by the fact that the browser address bar changes from “http://” to “https://” and by the padlock icon in your browser bar.
‍
If SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

2. make.com

Description of data processing

We use make, a service provided by Celonis SE, Theresienstr. 6, 80333 Munich, Germany, to integrate various databases and web tools. make is an interface that can be used to virtually connect various cloud-based software applications. Data requested or processed in the connected applications is automatically transferred via these links. The goal is to enable the independent execution of digital processes, particularly those that are standardized and recurring. This creates an automated data flow and efficient processes.

Further information on data protection at Celonis can be found at https://www.make.com/en/privacy-notice and https://www.celonis.com/de/privacy-notice/.

Legal basis and purpose of data processing

The use of make.com is based on Art. 6(1)(f) GDPR. We have a legitimate interest in efficiently automating our processes, integrating various services, and importing and exporting personal and contact data accordingly.

3. Website language versions (translations via Weglot)

Description of data processing

We use the Weglot translation service provided by Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France, on our website. Weglot loads when you access the site, allowing you to set the website language using the language icons. By integrating the Weglot translation service, a connection is established between your browser and Weglot's servers when you visit our site, and your IP address and device information are transmitted to Weglot. This data is necessary for Weglot to function.

Data processed through the use of Weglot is handled by Weglot as a data processor based on a data processing agreement in accordance with Art. 28 GDPR within the European Union.

Information on how Weglot processes personal data can be found at https://www.weglot.com/privacy.

Legal basis and purpose of data processing

The legal basis for data processing in connection with Weglot is our legitimate interest under Art. 6(1)(f) GDPR in making our website available in multiple languages, including a selection option for visitors, unless we require additional consent under Art. 7 GDPR or Art. 122 of the Privacy Code (Legislative Decree No. 196/2003).

Right to object and erasure

Using the Weglot service is strictly necessary to provide the website in different language versions.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general privacy policy in Part A.

4. Integration of YouTube content

Description of data processing

From time to time, we use content and services from the YouTube video platform to embed videos on our website via a plugin or to link to videos from our YouTube channel. YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and is provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”).

We may process data you enter on our YouTube channel (specifically your username and any content you publish via your account) if we respond to your posts or messages on our channel.

Otherwise, we only receive non-personalized information from Google regarding post activity, such as the number of profile or media clicks and the watch time for a specific video. This data can be viewed via our YouTube account. Furthermore, Google is responsible for data processing; we have no way to prevent or disable Google's use of analysis tools and similar features within YouTube.

If you wish to play embedded videos using this plugin (by clicking the play button), your IP address will be sent to YouTube, as YouTube cannot send the video content to your browser without it. The IP address is therefore required for playback. The YouTube server is also informed which subpage of our website you visited. If you are logged into your YouTube account, you also allow YouTube to associate your usage behavior directly with your personal profile when you play our videos. Further information on how Google processes data when using YouTube can be found in the applicable YouTube privacy policy: https://policies.google.com/privacy?hl=de&gl=it

Legal basis and purpose of data processing

YouTube is used based on our overriding interests in making our website available or linking to it, and in handling inquiries or comments.

Retention period / Right to object and restrict processing

To prevent your activity from being linked to your user account, please log out of your YouTube profile before playing our video content. You can find out how to limit Google's data processing through your Google or YouTube account settings. For example, you can go to your Google account's general settings and check the “Privacy and security” section. You can also restrict Google’s access to your contacts, calendar, photos, location data, and more via your mobile device settings (smartphone, tablet), though this depends on your operating system.

5. Auth0

Description of data processing

We use the Auth0 identity management cloud platform from Okta Inc., 10800 NE 8th Street, Suite 700, Bellevue, WA 98004, USA, for registration and login on our online store.

When users enter information into an Auth0-provided form, that data is exchanged directly between the user's browser and Auth0. The following data is processed for identity management, authentication (login/registration), and user account security:

• Account details: email address, name, and profile picture (if using Social Login).
• Security data: password hashes, multi-factor authentication (MFA) data, and session tokens.
• Metadata: login IP address, timestamp, and browser/device information (for fraud detection).

Data is collected exclusively during the login or registration process and whenever a session is refreshed.

For more information on how Auth0 processes data, please visit https://www.okta.com/legal/privacy-policy/.

We have selected servers located in Europe for data storage. If an occasional transfer to the USA is necessary, it is carried out based on standard contractual clauses included in a Data Processing Agreement.

Purpose of data processing

Integrating Auth0 ensures that only authorized and identified individuals can access our services. Auth0 is also essential for providing our user account login service.

Retention period / Right to object and delete

If you do not want cookies to be stored, you can configure your browser to delete cookies, block them entirely or partially, or notify you before they are saved. You can also manage your cookie preferences using the CookieHub management tool.

6. DataDog

Description of data processing

We use DataDog, a service provided by DataDog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (“DataDog”), as a data processor in accordance with Art. 4 no. 8 and Art. 28 of the GDPR.

We use DataDog to monitor system stability and analyze errors (such as unexpected deviations, anomalies, latency, availability, and response times) on our websites and services, as well as for IT security purposes.

To this end, DataDog collects the following data on our behalf:

• System logs: technical records of server requests (including user IP addresses).
• Performance data: app response times, error rates, error details, and crash reports (stack traces and timestamps).
• Metadata: system configurations (browser type and version, operating system) and anonymized user IDs to track errors across different microservices.

This data allows DataDog to detect, analyze, and fix errors in a timely manner. The personal data collected may be transferred to and stored in the USA. We have entered into a Data Processing Agreement with DataDog that includes standard contractual clauses. DataDog also participates in the Swiss/EU-US Data Privacy Framework, which provides a legal basis for transferring data to certified companies and organizations in the USA.

Further information on how DataDog processes data can be found in DataDog Inc.'s privacy policy: https://www.datadoghq.com/legal/privacy/

Purpose of data processing

Data processing is used to ensure the proper and reliable operation of our websites and services, as well as to detect and fix any errors. DataDog is therefore essential for providing our services and accessing user accounts.

Retention period / Right to object and erasure

Data collected by DataDog is deleted or anonymized after the error analysis is complete.

V. Links to third-party websites

Our website may contain links to other sites. We have no control over the content or structure of these third-party offerings. Therefore, the statements in this Privacy Policy do not apply to external providers whose content or services we simply link to.

If you are redirected to other sites via links on our pages, please check their respective data processing policies.

VI. Online presence on social networks and platforms

Description of data processing

We maintain an online presence on social networks or professional networks (such as Facebook, Xing, or LinkedIn) (hereinafter referred to as "SN") and platforms (e.g., YouTube), which we link to from our website. Clicking on the respective buttons (identifiable by the social network or platform logos) will take you to our presence on that network. The purpose of these online profiles is to communicate with customers, interested parties, and active users, and to keep them informed about our services.

When you access these social networks and platforms, the terms and conditions and data processing guidelines of the respective operators apply.

Since the use of these SNs takes place outside of our website or services, we have no influence over it, unless otherwise stated below. However, please be aware that when you use the aforementioned platforms and social networks we link to, your data may also be processed in the United States by these companies. They may use this data for market research and advertising purposes, including the creation of user profiles. When you log in to these social networks and platforms, they may also store cookies on your device that track your use of our platform or services, as well as other information about your user behavior.

Unless otherwise stated in this Privacy Policy, we only process user data if they interact with us within these social networks and platforms, for example, by posting comments or sending us messages.

To make it easier for you to find information on how these operators process data and how you can object to it, we have provided links to the privacy policies and information of the respective network operators below.

Legal basis and purpose of data processing

We only process your personal data when you contact us directly via the respective SN or interact with our profile or its content. Unless otherwise stated in our Privacy Policy, we process user data based on our legitimate interests under Art. 6(1)(f) GDPR to effectively inform and communicate with users who interact with us on social networks and platforms (e.g., when users post on our pages or send us messages). If your contact is aimed at entering into a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR.

Regarding our presence on an SN, the respective SN is solely responsible for any further processing of personal data where they independently determine the purposes and means of that processing. Please carefully consider what personal data you share with us via a social network. If you wish to prevent an SN from processing the personal data you have sent us, please contact us through other means.

Retention period / Right to object and restriction

Se è membro di uno dei SN su cui gestiamo una presenza online e non desidera che il SN raccolga dati su di Lei tramite la nostra offerta e li colleghi a quelli già a disposizione del SN, deve disconnettersi dal suo SN prima di visitare la nostra offerta. Per una descrizione dettagliata dei rispettivi trattamenti, per informazioni sulla durata della conservazione dei dati da parte del rispettivo SN e per le possibilità di opposizione (opt-out), rimandiamo ai link con le informazioni dei fornitori qui di seguito.

Per quanto riguarda le richieste di informazioni e per far valere i diritti dell’utente, facciamo presente che questi possono essere fatti valere in modo più efficace presso i fornitori. Solo i fornitori hanno accesso ai dati degli utenti e possono adottare misure adeguate e fornire informazioni direttamente. Se dovesse avere comunque bisogno di aiuto, si può rivolgere a noi.

Facebook

Gestiamo una pagina business di Facebook (“Fanpage”) sul SN di Facebook Ireland Ltd., 4 Grand CanalSquare, Grand Canal Harbour, Dublino 2, Irlanda.
Facebook Irland è contitolare con noi della raccolta dei dati dei visitatori della nostra Fanpage, per questo motivo abbiamo stipulato un accordo sul trattamento congiunto dei dati personali con Facebook ai sensi dell’art. 26 RGPD, nonché ulteriori condizioni per il trattamento dei dati:
‍
- “Controller Addendum”: https://www.facebook.com/legal/controller_addendum
- “Condizioni per il trattamento dei dati”: https://www.facebook.com/legal/terms/dataprocessing/update

‍We are responsible for providing you with at least the information above, as well as the following details regarding our joint responsibility with Facebook. The information required by Facebook under Article 13(1)(a) and (b) of the GDPR can be found in the Facebook Ireland Privacy Policy at https://www.facebook.com/about/privacy.
‍
Facebook Inc., Menlo Park, California, USA (hereinafter: “Facebook Inc.”) also collects and uses so-called Page Insights for analysis purposes. Page Insights are summaries of data that allow both us and Facebook Inc. to gain insights into how users interact with our page. Page Insights may be based on personal data collected in connection with visits to or interactions with our page. To this end, we have entered into a Controller Addendum with Facebook (see above), which specifically governs the security measures Facebook takes regarding Page Insights and how Facebook responds to user requests. The purposes for which personal data is collected and transmitted as part of this joint processing are detailed in the aforementioned Controller Addendum, which refers to the Data Processing Terms.
Data collected during your visit to our “Fanpage” includes information about the types of content users view or interact with, or the actions they take (see the section “What kinds of information do we collect?” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices users employ (e.g., IP addresses, operating system, browser type, language settings, and cookie data as described in detail in the “Device Information” section of the Facebook Privacy Policy: https://www.facebook.com/policy).
‍
However, by operating the Facebook business page, we share joint responsibility for Page Insights and have agreed with Facebook Ireland that they are responsible for fulfilling the rights of data subjects under Articles 15-20 of the GDPR regarding personal data stored by Facebook Ireland following joint processing. Therefore, we are obligated to notify Facebook if we receive data protection requests concerning Page Insights. Please note that we forward requests regarding Page Insights to Facebook Ireland. Please also refer to the information on your rights as a data subject in Section A. For more information on how Facebook Ireland processes personal data, including the legal basis Facebook Ireland relies on and how you can exercise your rights against Facebook Ireland, please consult the Facebook Ireland Privacy Policy at https://www.facebook.com/about/privacy.
‍
Data collected via Page Insights is analyzed to improve our website and for advertising purposes. We operate our Facebook Fanpage for communication purposes and to provide a simple channel for contact requests from Facebook users. The collection and further processing of this data is in our legitimate interest and the legitimate interest of Facebook Inc. pursuant to Art. 6(1)(f) GDPR.
‍
Please note that we cannot enable or disable the Page Insights technology. Therefore, we must forward most related requests to Facebook Ireland, unless we have collected the data ourselves. If you do not want Facebook Inc. to collect your data, please do not use our Facebook business page and/or configure your browser to block cookies and/or log out of Facebook while using our site.
Privacy Policy:
‍
https://www.facebook.com/about/privacy/, https://www.facebook.com/legal/terms/information_about_page_insights_data
Opt-out options:
https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com

LinkedIn

LinkedIn is a service provided by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA, operated in Europe by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn is an internet-based social network that allows users to connect with existing business contacts and forge new business opportunities. With over 400 million registered users in more than 200 countries, it is currently the largest platform for professional networking and one of the most visited websites in the world.
‍
Each time you visit our website equipped with a LinkedIn component (LinkedIn plug-in), this component causes your browser to download a corresponding representation of the LinkedIn component. Further information on LinkedIn plug-ins can be found at https://developer.linkedin.com/plugins. As part of this technical process, LinkedIn receives information about which specific subpage of our website is visited by the data subject.
‍
If the data subject is logged into LinkedIn at the same time, LinkedIn recognizes which specific subpage of our website is being visited each time the data subject visits our site and for the entire duration of their stay. This information is collected by the LinkedIn component and associated by LinkedIn with the data subject's respective LinkedIn account. If the data subject clicks on one of the LinkedIn buttons integrated into our website, LinkedIn assigns this information to the data subject's personal LinkedIn user account and stores this personal data.
Through the component, LinkedIn always receives information that the data subject has visited our website if the data subject is logged into LinkedIn at the same time; this occurs regardless of whether the data subject clicks on the LinkedIn component or not. If the data subject does not want this information to be transmitted, they can prevent the transmission by logging out of their LinkedIn account before visiting our website.
‍
LinkedIn offers the option to unsubscribe from email messages, SMS messages, and targeted ads, as well as to manage ad settings at https://www.linkedin.com/psettings/guest-controls. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua, and Lotame, which may set cookies. These cookies can be rejected at https://www.linkedin.com/legal/cookie-policy. You can view LinkedIn's current Privacy Policy at https://www.linkedin.com/legal/privacy-policy. You can view LinkedIn's Cookie Policy at https://www.linkedin.com/legal/cookie-policy.
Privacy Policy https://www.linkedin.com/legal/privacy-policy
Opt-out options:
https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

XING

The operating company for Xing is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany (“XING”).
Xing is an internet-based social network that allows users to connect with existing business contacts and forge new business opportunities. On Xing, individual users can create a personal profile, while companies can, for example, create business profiles or post job offers.
When you visit a page on this website operated by us that has a Xing component (Xing plug-in) integrated, your browser will automatically download a display of the corresponding Xing component from Xing. Further information on Xing plug-ins can be found at https://dev.xing.com/plugins. As part of this technical process, Xing receives information about which specific subpage of our website is visited by the data subject.
‍
If the data subject is logged into Xing at the same time, Xing recognizes which specific subpage of our website is being visited each time the data subject visits our site and for the entire duration of their stay. This information is collected by the Xing component and associated by Xing with the data subject's respective Xing account. If the data subject clicks on one of the Xing buttons integrated into our website, Xing assigns this information to the data subject's personal Xing user account and stores this personal data.
‍
Through the component, Xing always receives information that the data subject has visited our website if the data subject is logged into Xing at the same time; this occurs regardless of whether the data subject clicks on the Xing component or not. If the data subject does not want this information to be transmitted, they can prevent the transmission by logging out of their Xing account before visiting our website.
‍
The Privacy Policy published by Xing, available at https://www.xing.com/privacy, provides information on the collection, processing, and use of personal data by Xing. Additionally, Xing has published the data protection policy for the Xing share button at https://www.xing.com/app/share?op=data_protection.
Privacy Policy / Opt-out options:
https://privacy.xing.com/de/datenschutzerklaerung

VII. Utilizzo attivo del nostro sito web

1. Moduli di contatto e contatto e-mail

Descrizione del trattamento dei dati

Sul nostro sito web è disponibile un modulo di contatto che può essere utilizzato per il contatto elettronico. Se l’utente si avvale di questa possibilità, i dati inseriti nella maschera di input saranno trasmessi a noi e conservati.

• Company / Municipality (required field)
• First name (required field)
• Last name (required field)
• Email (required field)
• Phone (optional)
• Message (optional)

Al momento dell’invio del suo messaggio attraverso il nostro modulo di contatto vengono memorizzati i seguenti dati:

• User's IP address
• Date and time of submission

Se il contatto avviene tramite un indirizzo e-mail da noi fornito, i dati personali dell'utente trasmessi con l'e-mail saranno memorizzati.

Se l'utente fornisce un numero di cellulare per ricevere aggiornamenti sullo stato della sua richiesta di pagamento, utilizzeremo il numero fornito a tale scopo.

Sul nostro sito web utilizziamo HubSpot Forms, un servizio del nostro sistema CRM HubSpot, per integrare i moduli di contatto ed elaborare i dati inseriti. (cfr. Parte C, Sezione II). HubSpot Forms offre funzionalità per il SEO, la creazione di contenuti, la gestione dei contatti, l'email marketing e le analisi. I dati degli utenti inseriti nei moduli vengono memorizzati nel nostro sistema di gestione delle relazioni con i clienti fornito da HubSpot.

Utilizziamo i servizi di posta elettronica di Google, offerti tramite Google Workspace da Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublino 2, Irlanda (di seguito: “Google”). Oltre al nostro software CRM, che è il nostro software centrale per la gestione e l'elaborazione delle richieste, anche le e-mail vengono memorizzate sui server di Google. Abbiamo scelto l'area “Europa” come sede del server e abbiamo stipulato con Google un accordo per l'elaborazione degli ordini. Il trasferimento di queste e-mail verso paesi terzi, in particolare verso gli Stati Uniti, non ha luogo, come garantito contrattualmente anche da Google.

To channel and sort incoming requests, we use an interface for AI-based services designed to understand and generate natural language and associated inputs, analyze information, and make predictions.

We use the ChatGPT language model from OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We have agreed with OpenAI that our data will not be used for model training or shared with OpenAI. You can view OpenAI's privacy policy at https://openai.com/de/policies/eu-privacy-policy. We have entered into a data processing agreement with OpenAI (see https://openai.com/policies/data-processing-addendum). Since data is transferred to the USA when using the OpenAI API, the data processing agreement stipulates that EU standard contractual clauses apply to ensure an adequate level of data protection even when transferring to a third country.

We also use the Google Gemini AI system, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Gemini is designed to provide advanced language and image processing capabilities. It uses machine learning to understand and generate natural language and analyze images, offering versatile applications across various sectors. We use the Google Gemini model to pre-screen incoming emails and documents. As a Google Workspace customer, Google guarantees that our use of Google Gemini will not be used by Google to train its generally available AI models.

We use the LanguageTool application, software from LanguageTooler GmbH, a subsidiary of Learno Inc.

Karl-Liebknecht-Str. 37, 14482 Potsdam, a subsidiary of Learno Inc. with AI functions for spell checking, grammar, and phrasing adjustments to proofread incoming email responses. The LanguageTool provider's privacy policy is available at: https://languagetool.org/de/legal/privacy. LanguageTool stores checked records and any errors found in them on their servers for a maximum of 15 minutes (not on permanent storage media). Data is stored without an IP address or other information that would allow the data records to be attributed to a specific person. However, if the text contains personal information, this is also stored for a short time. We have entered into a data processing agreement with Learno Inc. that also includes the EU standard contractual clauses required for data processing in the USA, under which the provider is contractually obligated to comply with applicable data protection regulations: https://languagetool.org/de/legal/dpa

We use the Airparser software solution, Sepapaja tn 6, Tallinn 11415, Estonia, to read PDF or Word file attachments. Airparser uses AI technology to recognize and extract structured data. We have entered into a data processing agreement with Airparser pursuant to Art. 28 GDPR, under which Airparser is contractually obligated to comply with applicable data protection regulations (see https://airparser.com/dpa/). You can view Airparser's data protection information at https://airparser.com/gdpr/.

Legal basis and purpose of data processing

The legal basis for processing data transmitted when sending a request via a contact form or email is Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR.

Processing personal data from the input mask allows us to handle your requests and contact you. If you contact us via email, this also constitutes a legitimate interest necessary for data processing. If you provide us with a mobile number to receive updates on the status of your payment request, we will use the number you provided for that purpose.

The use of AI-based services is based on our legitimate interest under Art. 6(1)(f) GDPR. Due to the high volume of incoming messages, we rely on this pre-selection and assignment to the appropriate departments within the company in order to process these requests quickly and effectively, in our interest and in the interest of the requesters or senders of messages addressed to us.

User data may also be stored in our customer relationship management system (CRM software) or a similar organization for inquiries based on our legitimate interests.

Other personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our IT systems.

Retention period / Right to object and restrict

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data from the contact form input screen and data sent via email, this occurs when the conversation with the user has ended. The conversation ends when it can be inferred from the circumstances that the matter has been definitively clarified and no legal requirements mandate longer retention.

You have the right to withdraw your consent to the processing of your personal data at any time.

If you contact us via email, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued, unless we can rely on another legal basis for data protection or have a compelling interest in further processing the data.

All personal data stored during our contact will be deleted, unless legal provisions require longer retention.

1. Telephone hotline

Description of data processing

If you have the option to contact us by phone using a number provided on our website, we record the caller's incoming phone number and other technical information about the telephone device (start and duration of the call), generated locally or provided by the telephone company, and we record the main content of the call as well as information provided to our staff by the person concerned (name, request, contact options for inquiries, etc.).

To pre-qualify incoming calls, we use an AI-powered software solution from Leaping AI UG (haftungsbeschränkt), Potsdamer Straße 72, 10785 Berlin. This system queries the data necessary to classify the call, route it to the correct department, or answer user inquiries (specifically our process code, ID, and the caller's name), and it can automatically process certain customer concerns. We have entered into a data processing agreement with Leaping AI in accordance with Art. 28 GDPR.

We will ask if you consent to your call being recorded. If you agree, we save the entire content of the call and automatically generate a transcript. We use these recordings and transcripts to train our support staff, resolve customer complaints, create anonymous internal reports (call classification and statistics on call reasons), and for verification purposes in connection with asserting or defending against legal claims.

We use the Talkdesk cloud contact center platform provided by Talkdesk Inc., 201 Spear Street, Suite 1100, San Francisco, CA 94105, USA (“Talkdesk”). We have entered into a data processing agreement with Talkdesk pursuant to Art. 28 GDPR, as well as EU Standard Contractual Clauses for data transfers to third countries, ensuring Talkdesk is contractually obligated to comply with applicable data protection regulations. We have also agreed with Talkdesk that our instance will be hosted in a European region, meaning our data is processed by default in a regional cloud within the European Union.

Legal basis and purpose of data processing

When a call is accepted, we automatically record the data necessary for processing (specifically our process code, license plate number, and the caller's name) based on Art. 6(1)(f) GDPR for the purpose of automating and efficiently handling specific customer issues or interaction components. If the call relates to our services and an existing, concluded, or planned contractual relationship with the caller, the additional legal basis for processing is Art. 6(1)(b) GDPR.

We manually save the caller's request in our system during the call and store this call note once the call ends. The call itself is not recorded. The legal basis for processing this data is Art. 6(1)(f) GDPR. If the call relates to our services and an existing, terminated, or planned contractual relationship with the caller, the additional legal basis for processing is Art. 6(1)(b) GDPR.

Call recordings and transcripts are created and processed exclusively based on your prior consent pursuant to Art. 6(1)(a) GDPR.

Your data may also be stored in our Customer Relationship Management (CRM) system or a similar organization for inquiries based on our legitimate interests.

Retention period / Right to object and restrict processing

Data is deleted as soon as it is no longer needed to fulfill the purpose for which it was collected. This occurs once the conversation with the user has ended. A conversation is considered concluded when the circumstances indicate that the matter has been definitively resolved and no legal requirements necessitate further retention.

If no specific legal retention period applies to the recordings, the retention period for recordings and call notes is based on statutory limitation periods (the standard limitation period is 5 years under Art. 2947 of the Italian Civil Code and 10 years under Art. 2946 of the Italian Civil Code). Transcripts of call recordings are deleted after 6 months.

You have the right to withdraw your consent to the processing of personal data at any time. If you consent to the recording of a call and the storage of that recording and its transcript, you may revoke this consent at any time. In such cases, the recordings or transcripts will be deleted immediately, unless we are legally required to retain them for longer.

3. Ticket system

Description of data processing

We use Freshdesk as our ticket system, a software solution from Freshworks, Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA. Freshdesk is a customer support platform that facilitates the handling of customer requests and inquiries across various channels. We use Freshdesk to accept and manage contact requests. If you submit a request via our website using a contact form, or contact us via email or phone, the information and content provided during the interaction, along with the data we collect (see sections VII. 2 and VII. 3 above), will be stored and organized in the ticket system to enable chronological processing and improve our service experience.

The stored information is saved on Freshdesk's servers. To organize and process inquiries, personal data—including at minimum your surname, first name, and email address—is collected, transmitted to Freshdesk, stored, and retrieved according to the scope of service. We have opted to have the data processed on servers within the EU. This is intended to technically ensure that the data remains within the European Union and that access by US authorities is not possible.

Further information on data protection at Freshdesk is available at https://www.freshworks.com/privacy/.

Legal basis and purpose of data processing

We process information collected via Freshdesk based on our legitimate interests in designing an efficient customer service process and responding to your requests as quickly as possible to support our customers and users (Art. 6(1)(f) GDPR). This is in connection with a data processing agreement concluded with Freshdesk pursuant to Art. 28 GDPR, which ensures data protection and prohibits unauthorized disclosure to third parties.

If, in individual cases, a transfer of data to the USA is required, this is based on the EU Commission's Standard Contractual Clauses.

Retention period / Right to object and erasure

We store your data for the duration of the contractual relationship between us and the data subject or until the relevant conversation has been processed.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

4. Chat function

Description of data processing

The chat function on our website is an AI-based chatbot provided by Decagon AI, Inc., 2261 Market Street, STE 5378, San Francisco, CA 94114, USA (hereinafter: “Decagon”). Decagon operates an AI platform for automating customer support processes using so-called customer service “agents”.

Through the chat function, you can ask frequently asked or general questions about our parking system or specific areas we manage (e.g., opening hours, rates), or report issues regarding a parking area we manage so they can be forwarded to our Customer Support team.

As soon as you enter a question into the chat text field (so-called prompts), Decagon automatically analyzes the request and provides a text response generated by the agent. Generally, you do not need to provide personal information (e.g., name, email, phone number, address, vehicle license plate). We therefore ask that you do not enter any personal data of your own or of third parties unless requested. Personal data is only collected and stored if you provide it voluntarily.

For the purpose of displaying and technically operating the chat, the following technically necessary data is processed as log data:

• IP address
• API request metadata
• Date and time of access

Processing takes place automatically on the chat side and only at the moment the data is sent. The agent operates independently within defined limits and does not make independent decisions that could affect your rights or access to our services. If a request requires human judgment or falls outside the AI agent's scope of competence, it is handled via a supervised process and stored for further processing outside of Decagon in our CRM or ticketing system.

Decagon has contractually guaranteed that user data provided via the chat will not be used to train other AI models. We have entered into a data processing agreement with Decagon, which ensures data protection and prohibits unauthorized disclosure to third parties.

Further information on Decagon's privacy policy is available at https://decagon.ai/legal/privacy.

Purpose of data processing

The purpose of the processing is to support the management of our customers and users in answering general questions or support requests. Data collected via Decagon is processed based on our legitimate interest in ensuring efficient customer service and rapid response to inquiries.

We have also agreed with Decagon that data is processed exclusively within the EU during normal chat operations (EU data residency). Should a transfer to the USA be necessary in exceptional cases to technically support the chat, this will take place in accordance with standard contractual clauses.

Retention period / Right to object and erasure

Personal data exchanged during chats is stored for the duration of the contractual relationship with the data subjects or until the conversation has been concluded.

If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

C. Data processing in connection with the use of MHP parking facilities

1. Using the MHP Online Shop

Description of data processing

Our MHP online shop (hereinafter referred to as the “online shop”) allows you to book and pay for parking services at the facilities we manage, as described in more detail and subject to our applicable general terms and conditions. For example, you can pay for parking fees online.

We use cookies to make our online shop more user-friendly. Some elements of our website require the browser to be identified even after navigating to a different page. Your language and region settings are stored in cookies.

Cookies also allow us to analyze browsing behavior within the online shop. This may involve transmitting data such as search terms entered, page view frequency, and the use of website features.

To book parking services, you must complete and submit the booking form. You will need to enter your vehicle license plate number in the designated field and, if applicable, select your desired parking space and/or a reference number. We use your license plate number and other details to assign the parking fee to the specific parking session or service.

Data processed during the booking process includes license plate information, the amount to be paid, and other communication, contractual, and payment details from our customers, interested parties, and other business partners. This processing is carried out to provide contractual services, including operating our online shop, billing, delivery, and customer service. During the booking process, we process individual data provided in the respective input forms, such as name, company, address, email, and phone number. Mandatory fields are generally marked with an asterisk (*) or labeled as “optional,” and they include the information necessary for providing and billing the ordered service, as well as contact details so we can reach you or provide important order-related information (e.g., mandatory legal notices, updates, etc.).

The collected data is processed and used to enable you to select, book, and pay for our parking services. We also process this data to fulfill and, if necessary, ship your booking. For further details on the legal and organizational terms, please refer to our respective General Terms and Conditions. Details regarding the payment service providers we use can be found in point 2 of this Part C below.

Legal basis and purpose of data processing

The legal basis for processing data collected during a booking is Article 6(1)(b) of the GDPR, as it is necessary for the performance of a contract. Otherwise, it is based on Article 6(1)(f) of the GDPR to detect and combat harmful behavior, prevent other negative experiences, maintain the integrity of the online shop, and promote protection and security. Both we and other users of our services have a legitimate interest in preventing, detecting, or investigating illegal activities, fraud, or security breaches. The information mentioned above is also necessary for the provision of the service in accordance with Article 122 of the Privacy Code (Legislative Decree 196/2003).

Processing the personal data from the input screen is necessary to handle your booking and provide the respective parking service.

Data entered in the online shop may also be processed based on your consent (Article 6(1)(a) of the GDPR) if requested. You can withdraw your consent at any time. The legality of any data processing that has already taken place remains unaffected by the withdrawal. Please note that if you withdraw your consent, we may be unable to complete the booking process, and any existing booking may no longer be fulfillable.

Retention period / Right to object and restrict processing

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data from the booking process input screen, this occurs once the contract for our parking services has been concluded and the service has been fully provided. Generally, however, we retain contract-related data until the statutory warranty obligations have expired. If there is a legal obligation to archive the data, it will be deleted after the retention period expires.

2. Use of payment service providers in the ordering process (“payment services”)

Description of data processing

If you are required to provide payment details (e.g., account number for direct debit authorization) after concluding a paid contract for parking services, this data will be necessary for the payment process.

To ensure modern, simple, and secure payment processing, we offer our customers various payment options for which we work with banks, credit institutions, and other payment service providers (hereinafter collectively referred to as: “payment service provider”).

Payment transactions using standard payment methods (e.g., Visa/MasterCard) are carried out exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the browser address bar changing from “http://” to “https://” and by the padlock icon in the browser bar.

Thanks to this encrypted communication, the payment data you transmit to us cannot be read by third parties.

If you choose to pay using a specific provider's services, that provider will deliver their services based on a contract between you and them, in accordance with their current terms and conditions. These providers are responsible for their own data processing, and we have no influence over it. Consequently, you must contact the respective payment provider directly to exercise any related data subject rights. The payment provider may ask for additional consent, for example, to perform identity or credit checks. Personal data processed by the payment provider generally includes your first and last name, address, date of birth, gender, email address, IP address, phone number, and details required to process your order, such as item quantities, order numbers, invoice amounts, tax rates, or banking details like account or credit card numbers, passwords, TANs, and checksums, as well as contract, total, and recipient information.

The payment provider processes this data to offer the selected payment method, perform necessary identity and/or credit checks, manage payments, and prevent fraud.

Legal basis and purpose of data processing

Your data is transmitted to our payment providers based on Art. 6(1)(b) GDPR (processing for contract performance) for data collected during an order, and based on our legitimate interests (Art. 6(1)(f) GDPR), unless we request your consent under Art. 6(1)(a) GDPR.

You may withdraw your consent for data processing by payment providers at any time, effective for the future. A withdrawal does not affect the validity of data processing procedures that have already taken place.

Adyen
For certain payment methods, we use the payment service provider Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands (hereinafter: "Adyen"). If you select payment via Adyen, your personal data is automatically transmitted to them. The data typically includes the card type (e.g., Visa or Mastercard), cardholder name, card number, security code, and expiration date. Adyen's role is to request authorization for the transaction from the relevant payment system, such as Mastercard or Visa, and to forward this authorization to the buyer's bank for approval.
If the bank authorizes it, Adyen receives a notification from the payment system and processes the payment to our bank. Adyen processes your data to handle the payment and perform identity and credit checks. In this case, Adyen acts as a data controller. We therefore have no influence over Adyen's data processing.
For information on Adyen's data protection, please visit: https://www.adyen.com/de_DE/privacy-policy, and for transaction processing, see https://www.adyen.com/de_DE/privacy-policy/transaction.

secuPay
In our online shop, we offer cashless payment methods from secupay AG (Goethestr. 6, 01896 Pulsnitz; "secupay"). Secupay is a payment institution under the Payment Services Supervision Act (ZAG), registered with the Federal Financial Supervisory Authority (BaFin) (registration number: 126737), and enables cashless payments for products and services online. If you use secupay as a payment method, the claim to the purchase price is assigned to secupay. This allows online shop operators to deliver goods, services, or downloads to the customer immediately after the order is placed. If you select "direct debit," "invoice," or "credit card" as a payment option via secupay during checkout, your data is automatically transmitted to secupay to process the payment. Secupay then performs a technical check for payment default risk. The result of the transaction is then automatically communicated to us. The personal data exchanged with secupay includes your first and last name, address, email address, IP address, phone number, or other data required for payment processing.
Personal data exchanged between us and secupay may be transmitted by secupay to credit agencies. The purpose of this transmission is to verify your identity and creditworthiness. Secupay may transmit personal data to affiliated companies and service providers or subcontractors to the extent necessary to fulfill contractual obligations or if data must be processed on behalf of the customer. This data processing is carried out under the responsibility of secupay. We have no influence over this. You have the option to withdraw your consent for the processing of personal data provided to secupay at any time. A withdrawal does not affect personal data that must be processed, used, or transmitted by us for (contractual) payment processing. Secupay's applicable data protection regulations can be found at https://www.secupay.com/de/datenschutz.

3. Use of MHP Online Shop reviews

Description of data processing

We use the review portal "Trustpilot" from TrustPilot A/S, Pilestraede 58, 5th Floor, 1112 Copenhagen, Denmark. Trustpilot allows users to rate our products and services.

When a parking service is purchased online through our shop and the receipt is sent via email, we include a Trustpilot button in that email with a unique link generated by Trustpilot. To do this, we maintain an interface ("API") with Trustpilot to create these invitation links. By clicking the link, you will be redirected directly to the Trustpilot review platform. Additionally, the Trustpilot form is automatically populated with your data, allowing you to submit your review. The review is verified using the reference number associated with the link. Participation in the review process is voluntary.

The data transmitted to Trustpilot includes:

• Email address
• First and last name
• Reference number
• Language- and country-specific shop domain, access data (including IP address)
• Selected parking service

For this reason, we use Trustpilot as a data processor and have entered into a data processing agreement that ensures privacy compliance.

Please note that a Trustpilot account is required to leave a review and that, after submitting your review and accepting Trustpilot's terms of use, Trustpilot becomes the data controller for the management and publication of the review. Further details on Trustpilot's privacy policy can be found at https://de.corporate.trustpilot.com/legal/for-businesses/privacy-policy.

Purpose of data processing

Data processing is used to create the invitation link and to verify the authenticity of your use of our shop for Trustpilot, in order to conduct the review process. Furthermore, collecting user feedback to improve our services constitutes a legitimate interest.

Retention period / Right to object and erasure

Data related to the Trustpilot invitation is stored for one year.

4. Use of parking areas managed by MH Parkservice

Descrizione del trattamento dei dati

Nell'ambito dell'utilizzo delle aree di parcheggio vengono raccolti automaticamente i seguenti dati: numero di targa comprensiva della parte anteriore e posteriore del veicolo, orario di ingresso/uscita, data e timbro del luogo, importo e modalità di pagamento del parcheggio.

Prima che gli utenti del parcheggio escano dal parcheggio, a meno che non siano muniti di contrassegno di parcheggio permanente, dovranno inserire alla cassa automatica la targa del proprio veicolo. Se il numero di targa inserito viene ritrovato nel nostro database, la tariffa del parcheggio verrà calcolata e pagata dall'utente del parcheggio. I dettagli sul trattamento dei dati per i pagamenti tramite il nostro negozio online si trovano nella parte C, sezione. 1 e 2 e le condizioni d'uso applicabili.

In caso di violazione delle Condizioni Generali d'Uso, tutti i dati personali dell'intestatario del veicolo e del conducente del veicolo rilevanti per il perseguimento legale della violazione, in particolare la riscossione di una penale contrattuale incamerata e/o l'affermazione di verranno trattati anche i diritti di proprietà e di proprietà ("tracciabilità").

Se ricevi una lettera di reclamo in qualità di intestatario del veicolo che ha violato il parcheggio, la tua targa è stata da noi precedentemente trasmessa al Pubblico Registro Automobilistico (P.R.A.) dell'Automobile Club d'Italia, Via Marsala 8, 00185 Roma (di seguito: “Registro del Veicolo”). Se non sei il titolare dell'immatricolazione del veicolo, i tuoi dati ci sono stati forniti dal titolare dell'immatricolazione o da un altro terzo (ad esempio società di noleggio veicoli o società di leasing) che ci ha confermato che eri il conducente del veicolo al momento della registrazione. momento della violazione del parcheggio. Se non abiti più all'indirizzo registrato nel registro dei veicoli, abbiamo ricevuto i tuoi dati dalla persona attualmente registrata a questo indirizzo, da un'agenzia di credito o da un'agenzia di recupero crediti.

Base giuridica e finalità del trattamento dei dati/destinatario dei dati

Il trattamento dei dati raccolti è necessario per tutelare i legittimi interessi delle parti nella gestione dell'area di parcheggio e delle relative attività amministrative consuete nel settore (art. 6 (1) (f) GDPR) nonché per l'elaborazione contrattuale dei servizi da fornire in conformità con i Termini e le Condizioni Generali d'Uso (ad es. determinazione e fatturazione della tariffa di parcheggio, confronto con i permessi di parcheggio memorizzati, confronto con i pagamenti tramite app, confronto con i pagamenti tramite il portale dei servizi, determinazione del rispetto del tempo massimo di parcheggio consentito o del tempo di parcheggio gratuito o del periodo di grazia) (art. 6 (1) (b) GDPR).

I dati relativi al proprietario (in particolare nome e indirizzo) vengono richiesti al registro di circolazione o ai centri di informazione esteri mediante l'invio della targa (“richiesta del proprietario”). I dati del conducente possono essere richiesti al proprietario del veicolo identificato, alla società di noleggio o leasing del veicolo e trasmessi anche a terzi per gli scopi sopra indicati (ad esempio avvocati, società di recupero crediti). Per il funzionamento tecnico della tecnologia e del software di parcheggio nonché per il monitoraggio delle violazioni delle Condizioni generali di utilizzo, i dati vengono elaborati da MHP S.R.L e dai suoi appaltatori (Peter Park System S.R.L (gestione della tecnologia e del software di parcheggio) e Amazon Webservices EMEA SARL (archiviazione dati)) . La base giuridica è l'articolo 6 paragrafo 1 lettera b GDPR, nella misura in cui il trattamento viene effettuato per l'esecuzione del contratto, e l'articolo 6 paragrafo 1 lettera f GDPR per il perseguimento di interessi legittimi alla tutela della proprietà e dei diritti di proprietà di MHP S.R.L e di terzi soggetti e il loro legittimo interesse a garantire il corretto funzionamento delle aree di parcheggio e ad accelerare la movimentazione dei veicoli nell'area di parcheggio.

I dati personali da noi raccolti verranno cancellati una volta risolti tutti i reclami esistenti derivanti da e in relazione all'utilizzo del parcheggio e dopo la scadenza di tutti i termini di conservazione o prescrizione previsti dalla legge. Se non vi è alcuna violazione delle condizioni generali di utilizzo del parcheggio e l'utente lascia il parcheggio entro il periodo di attesa che decorre dal momento dell'ingresso, i dati dell'utente verranno automaticamente cancellati 48 ore dopo aver lasciato il parcheggio, a condizione che non sussistano obblighi legali di conservazione contrari.

Il conferimento dei vostri dati durante l'utilizzo dei parcheggi da noi gestiti è previsto contrattualmente in conformità alle rispettive condizioni generali di utilizzo oppure è assolutamente necessario per la conclusione del contratto. Senza il conferimento dei vostri dati non sarebbe possibile l'adempimento degli obblighi sottostanti e dei servizi nell'ambito della gestione dei parcheggi. Tuttavia, non utilizziamo i tuoi dati nell’ambito del processo decisionale automatizzato, inclusa la profilazione. Poiché la raccolta dei dati e il loro ulteriore trattamento sono assolutamente necessari, gli utenti non hanno alcuna possibilità di opporsi. Poiché la targa viene catturata quando si entra nel parcheggio, in genere è possibile fare retromarcia anticipatamente per evitare la cattura dei dati, purché le condizioni strutturali lo consentano.

5. Attivazione dei permessi di sosta

Descrizione del trattamento dei dati

Per alcune delle aree di parcheggio da noi gestite, le autorizzazioni di parcheggio possono essere richieste tramite terminali o maschere di prenotazione online (tramite il sito web di MHP, online o, ad esempio, presso i negozi al dettaglio o le istituzioni locali), ad esempio per i posti auto designati per determinati gruppi autorizzati (ad esempio, dipendenti, visitatori o clienti) e/o per gli orari di parcheggio gratuiti, in conformità con le condizioni applicabili in loco per la rispettiva area di parcheggio.

A tale scopo è necessario inserire i dati forniti nella rispettiva maschera di input. E' sempre necessario inserire il numero di targa del veicolo. Se necessario, potrebbero essere necessarie ulteriori informazioni per determinare l'appartenenza a un gruppo autorizzato, come i numeri di identificazione dei dipendenti. Queste informazioni possono essere trasmesse ai nostri clienti o ai loro clienti per chiarire l'autorizzazione o confrontate con i dati da loro forniti.

Base giuridica e finalità del trattamento dei dati/destinatario dei dati

Qualora il confronto con altri dati sia necessario per validare l'autorizzazione oppure il trattamento degli ulteriori dati forniti nel modulo sia basato sul tuo consenso (art. 6 par. 1 lett. a GDPR). Puoi revocare il tuo consenso in qualsiasi momento. La liceità del trattamento dei dati già avvenuto non viene pregiudicata dalla revoca. Tieni presente che a seguito della tua cancellazione potremmo non essere in grado di fornire l'intero processo di prenotazione e la prenotazione effettuata potrebbe non essere più effettuata.

La base giuridica per il trattamento dei dati raccolti nel corso di una prenotazione è l'articolo 6, paragrafo 1, lettera b) GDPR in vista della conclusione prevista di un contratto e l'articolo 6, paragrafo 1, lettera f) GDPR ai fini di un'efficace conclusione del contratto. elaborazione dei permessi di parcheggio e per supportare la fornitura del rispettivo servizio di parcheggio.

I dati verranno cancellati non appena non saranno più necessari per il raggiungimento dello scopo per il quale sono stati raccolti. Per i dati personali riportati nella maschera di immissione ciò avviene dopo la conclusione del contratto per i nostri servizi di parcheggio e non prima della completa fornitura del rispettivo servizio di parcheggio. Di norma conserviamo tuttavia i dati contrattuali fino alla scadenza degli obblighi di garanzia previsti dalla legge. In caso di obbligo legale di archiviazione, i dati interessati verranno cancellati allo scadere del termine.

6. Aree di parcheggio con possibilità di parcheggio gratuito per persone con disabilità

Descrizione del trattamento dei dati

For some of the parking areas we manage, people with disabilities are offered the option to park for free during their stay in specially marked spaces. To take advantage of this, users must provide us with proof of their disability parking authorization (such as a blue disabled parking permit).
Specifically, depending on the conditions posted at the parking area offering this option, eligibility for free parking must be verified. This can be done, for example, by scanning a QR code on the corresponding sign, visiting our website, and registering the parking authorization via the provided form.

Purpose of data processing

Data collected during the booking process is processed for the purpose of concluding a contract and, in general, to effectively manage parking authorizations and support the provision of parking services. If health-related data is processed as particularly sensitive personal information, your explicit consent will be requested.

Retention period / Obligation to provide / Right to object and erasure

Proof of disability parking authorization is verified solely for the purpose of granting free parking and is deleted immediately after the parking session is completed.

7. Using the MH Parkservice portal

Description of data processing

We offer users of the parking facilities we manage the option to submit support requests via our service portal (https://service.mh-parkservice.ch/) — for example, to ask questions, dispute payment requests, clarify other issues, view information regarding parking violations including receipt images and payment methods, or access other personalized information.

The portal is accessible via a QR code provided to users (e.g., on a payment request). After authentication, you can access the PCN portal. During authentication, the user provides the following personal data:

• Case number
• Vehicle license plate

Technically, limited connection data is collected each time the portal is accessed. This is necessary to establish and maintain the connection between the user's device and our servers, keep the session active, and prevent unauthorized access. During each login process and use of the portal, we or our hosting provider record:

• IP address and timestamp of user actions
• Internet service provider
• Browser and operating system (including version details)
• Language settings, referrer URL, and the name of the webpage visited

After logging in, a cookie is set to maintain and secure the session. To use the portal, you must allow this cookie in your browser.

If resolving an issue reported via the PCN portal or answering a question requires the involvement of other partners or providers, information regarding the request or incident will be shared with those parties.

Purpose of data processing

Data processed via the PCN portal and submitted requests is used to fulfill the contract between the user and us for parking usage, to enable effective communication with support teams, to manage, process, and resolve received requests, and to ensure a secure connection between user devices and our servers.

Retention period / Right to object and erasure

Data is deleted as soon as it is no longer needed for the purpose for which it was collected. Personal data provided during authentication is generally deleted once the usage process is complete. All personal data stored during contact with support is deleted no later than when there are no longer any legal retention obligations (e.g., statutory warranty periods for support requests).

8. Billing

Description of data processing

We use the cloud accounting software sevDesk, provided by sevDesk GmbH, Hauptstrasse 115, 77652 Offenburg, to create, send, document, and record our invoices. In this context, the invoice recipient's contact details are processed by sevDesk. You can find sevDesk's privacy policy at https://sevdesk.de/datenschutz/.

Purpose of data processing

We use sevDesk to fulfill our legal obligations, for contractual purposes, and to pursue our legitimate interest in managing our accounting efficiently. We have entered into a data processing agreement with sevDesk, which requires them to comply with all applicable data protection regulations.

Retention period / Right to object and erasure

We store your data for the duration of our contractual relationship and until the statutory retention periods for relevant accounting documents have expired.
If you would like your personal data to be deleted, you can exercise your right to object and erasure as described in the general information in Part A.

D. Contractual relationships with customers and business partners

I. Am I required to provide my data?

If you contact us with questions about our services, enter into contract negotiations with us, accept one of our offers, or sign other agreements with us, we will process the personal data you provide. The specific data we process depends largely on the goods or services you are purchasing or requesting. In this context, processing your data is generally strictly necessary for the preparation, conclusion, and execution of the contract. If you do not provide this data, we may be forced to decline the contract or order, or we may no longer be able to fulfill an existing contract.

When we use data as part of initiating or executing a contract with a business customer, partner, or collaborator, our interest in processing your data lies in our ability to maintain communication with that customer or partner, typically within the scope of a contractual or other business relationship. If you are acting as a point of contact—typically in your capacity as an employee of these companies—you generally do not have an overriding interest to the contrary, provided this interaction falls within your professional scope of duties, meaning the right to object usually does not apply.

However, you are not required to consent to the processing of data that is not relevant to the performance of the contract or legally required.

II. HubSpot

Description of data processing

In principle, necessary data is collected directly from you through personal contact. However, you are of course free to contact us by phone, fax, mail, or via the email address provided (see our legal notice) or the email addresses of our employees shared with you. In the latter case, the personal data transmitted in your email will be stored. Please note that, for technical reasons, email communication is not encrypted.

We use HubSpot to manage and implement inbound marketing across various features of our online presence. The information is stored on HubSpot's servers. We may use the processed data to gain detailed insights into how our online presence is used, to connect with our website visitors, and to determine which of our company's services are of interest to them.

In all other cases, processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in efficiently handling the inquiries we receive.

Additionally, HubSpot collects data you enter when you (a) subscribe to our newsletter or (b) fill out one of our contact forms.

Further information on data protection at HubSpot can be found at https://legal.hubspot.com/de/privacy-policy.

Legal basis and purpose of data processing

HubSpot cookies and web beacons are stored based on Art. 6(1)(a) GDPR. We also use the information collected via HubSpot based on our legitimate interests in optimizing our marketing, analyzing the use of our online presence, ensuring its continuous improvement and user-friendly design, and providing our users with more targeted information (Art. 6(1)(f) GDPR).

You can prevent cookies from being stored by adjusting your browser settings. If you would like other personal data to be deleted, you can exercise your right to object and erasure as outlined in the general information in Part A.

Alternatively, you can also set your cookie preferences using the CookieHub cookie management tool we have integrated.

III. Communication

Generally, we collect the necessary data directly from you through personal contact. You can, of course, also contact us by phone, fax, mail, or alternatively, via the email address we provide (see Legal Notice) or the email addresses of our staff that have been provided to you. In the latter case, the personal data you transmit via email will be stored. Please note that, for technical reasons, communication via email is not encrypted.

Your data will be used to process the conversation and follow up on your request or the content of the conversation. The processing of your personal data is based on Art. 6(1)(b) GDPR, insofar as the communication is related to the performance of a contract or is necessary for pre-contractual measures.

In all other cases, processing is based on our legitimate interests (Art. 6(1)(f) GDPR) in effectively handling the requests addressed to us.

In this context, data will not be passed on to third parties unless it is necessary to pursue our claims or legitimate interests (Art. 6(1)(f) GDPR) or there is a legal obligation to do so (Art. 6(1)(c) GDPR).

IV. Data processing in the context of sales

Personal data is processed on the basis of Art. 6(1)(b) GDPR for the provision of the service you have requested, in particular for the execution of our contracts or pre-contractual measures, as well as for all activities necessary for the management and administration of MH Parkservice.

The resulting purposes of data processing depend primarily on the specific activities and individual services agreed upon with you and may include, among other things, consulting activities or activities related to the management of sales processes (e.g., collecting documents, sending information about MH Parkservice products or events, provision of services by MH Parkservice) or assistance in sales negotiations and contract conclusion.

Further details on the scope, purpose of data processing, and the recipients of your data can be found in the respective contractual documents and the related general terms and conditions.

To the extent necessary for our business processes, we process your data in connection with our services beyond the actual fulfillment of the contract to protect our legitimate interests (Art. 6(1)(f) GDPR).

In connection with the offer or provision of our services, we may be subject to specific legal obligations, such as tax law requirements. The purposes of processing your data may therefore include, among other things, the fulfillment of monitoring and reporting obligations under tax law, customs or export regulations, as well as risk assessment and management. Data processing necessary for these purposes is based on Art. 6(1)(c) GDPR.

V. Newsletter

Description of data processing

‍We would like to periodically inform our customers and interested parties with promotional communications via email or other electronic notifications regarding our services and other products, webinars, innovations, or news from MH Parkservice (hereinafter referred to as "newsletter"). For this purpose, we require your email address. Additional information may be requested in the respective newsletter subscription forms so that we can send you content tailored to your interests.

You can subscribe to our newsletters using the appropriate function in a subscription form or by selecting a checkbox (so-called opt-in) during a registration process. To this end, we provide various options on our websites or within registration or order interfaces to subscribe to our newsletters (possibly topic-specific). Details regarding the content of the newsletters are described specifically in the respective subscription form. This description is decisive for your consent.

Following your subscription, you will receive an email from us asking you to confirm your newsletter order again (the so-called Double-Opt-In procedure). This confirmation is necessary to ensure that third parties have not misused your email address to subscribe to our newsletter with someone else's address. Your email address will only be enabled for newsletter delivery after you activate the hyperlink contained in the email.

Per la gestione delle registrazioni e l'invio delle e-mail relative alla nostra newsletter, utilizziamo il servizio MailChimp del fornitore statunitense Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA (di seguito "MailChimp"), che ci consente un'automazione semplice e intuitiva del processo di registrazione e del necessario invio di e-mail. Poiché il sistema IT di MailChimp si trova negli Stati Uniti, i dati di registrazione inseriti nei moduli vengono trasferiti negli Stati Uniti e lì elaborati. Per garantire un trattamento adeguato dei dati da noi trasmessi, abbiamo stipulato con MailChimp un accordo sul trattamento dei dati ai sensi dell'Art. 28 del GDPR, incluse le clausole contrattuali standard dell'UE per il trasferimento dei dati verso paesi terzi. Ulteriori informazioni sul trattamento dei dati personali da parte di MailChimp sono disponibili all'indirizzo: https://mailchimp.com/legal/privacy/.

For verification purposes, in addition to your email address and name, your IP address and the date of registration ("timestamp") are stored for the delivery of the newsletter.

Legal basis and purpose of data processing / Data recipients

‍The legal basis for sending newsletters is your consent as the recipient in accordance with Art. 6(1)(a) GDPR and Art. 7 GDPR in conjunction with Art. 130 of the Italian Data Protection Code (Legislative Decree 196/2003) or, where consent is not required under Art. 130 of the Privacy Code for existing customers (soft spam), based on our legitimate interest in direct marketing activities pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 130 of the Privacy Code (Legislative Decree 196/2003).

The registration of the subscription process is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR in maintaining a secure and effective newsletter system that serves both our commercial sales interests and the expectations and needs of our recipients, as well as providing proof of consent.

Retention period / Right to object and unsubscribe

‍You can object to receiving our newsletter at any time or withdraw your consent in whole or in part. You will find an unsubscribe link at the bottom of every newsletter. You can also contact us directly using the details provided at the beginning of this document.

Unsubscribing from the newsletter does not affect other commercial communications. If necessary for the performance of a contract, your data will remain stored with us. We also reserve the right to retain the evidence required to demonstrate that our newsletter distribution complies with the law until the relevant statutory limitation periods have expired.

VI. Data disclosure

During the inquiry or quote phase, as well as during contract execution, your data or documents may be transmitted to public authorities or to private service providers and partners with whom we regularly collaborate, depending on the scope of the services (see Part A, Section V).

E. Other

As we continue to develop our website and services, or due to changes in legal or regulatory requirements, it may become necessary to update this privacy policy. The current version of our privacy policy can be viewed and, if necessary, printed from our website at any time.