Privacy Policy

Data protection is of a particularly high priority for us. Browsing fetchdocs.io is possible without any indication of personal data. Where a data subject wants to use a service through fetchdocs, processing of personal data can become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain consent from the data subject.

The processing of personal data, such as the name, address, email address or telephone number of a data subject, shall always be in line with the General Data Protection Regulation (GDPR) and in accordance with the applicable country-specific data protection regulations. By means of this data protection declaration, we would like to inform you and the general public of the nature, scope and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed of their rights by means of this data protection declaration.

As the data controller, fino data services GmbH has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website and through fetchdocs. However, internet-based data transmissions can generally have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us via alternative means, for example by telephone.

Name and address of the controller

The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the member states of the European Union and other provisions of a data protection nature is:

fino data services GmbH
Universitätsplatz 12
34127 Kassel
Germany

Management and representation: Björn Kahle, Florian Christ
Telephone: +49 4550 996 9000
Fax: +49 4550 996 9001
Email: support@finodata.com

Contact details of the data protection officer

Any person concerned can contact our data protection officer directly at any time with any questions or suggestions regarding data protection. The data protection officer of the controller is:

BullProtect, a brand of NetBull GmbH
Patrick Vaillant
bullprotect.de

You can contact our data protection officer by post at our address given above with the addition "Data Protection Officer", or by email at privacy@finodata.com.

The fetchdocs service

fetchdocs is a business-to-business interface. Our clients are companies that integrate fetchdocs into their own application in order to import documents on behalf of their users. When an end user connects a third-party service, fetchdocs collects documents from that service and delivers them to the client application that the user connected it to.

For the documents and account data processed in this way, our client determines the purposes and means of the processing and is the controller; we act as a processor on their instructions under a data processing agreement in accordance with Art. 28 GDPR. If you are an end user and want to know why your documents are being imported, or want them erased, please contact the provider of the application in which you established the connection. We will support that provider in answering you.

Connections and access credentials

To establish a connection, the user authenticates with the third-party service directly, in most cases through that provider's own OAuth consent screen. fetchdocs receives an access token, and where the provider issues one a refresh token, but never the user's password for that provider unless the protocol used by the provider offers no alternative.

Access credentials are held in dedicated secure storage rather than in our application database. They are decrypted only for the moment a fetch is carried out, are never returned through the API or the frontend, and cannot be retrieved by our clients. Credentials are deleted when the connection is deleted. A user can withdraw access at any time, either by deleting the connection through the application they connected it in, or by revoking the authorisation in their account with the third-party provider.

Documents and metadata

From a connected service we process the documents themselves (for example invoices and receipts) and the metadata the source system exposes about them, such as file name, document type, date, amount and currency. We read only the folder the user selected for that connection.

We never delete anything in a connected account. A connection can optionally be configured to file documents away once they have been imported, so that the same document is not imported twice. Where that option is enabled we also create the target folder if it does not exist yet, and move each imported document into it. This is the only change we make in a connected account, and it requires write access to that account.

Every fetched file is scanned for malware before it is delivered. A file that is flagged is blocked rather than forwarded, and the block is reported to the client application.

Retention

Documents are stored only for as long as needed to deliver them to the client application and, where the client has agreed a retention period with us for retry and support purposes, for that period. Beyond that, documents are deleted. Records about a connection and its processing history are deleted when the connection is deleted, subject to any statutory retention obligations. Technical logs about requests are retained for a limited period for security and troubleshooting.

Service providers we use

We use the following processors to operate fetchdocs. A data processing agreement in accordance with Art. 28 GDPR is in place with each of them:

• Amazon Web Services: hosting, storage, secure credential storage and infrastructure services. Provider: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA. Our infrastructure is operated in the AWS region Frankfurt (eu-central-1). Privacy policy: aws.amazon.com/privacy.
• Cloudflare: content delivery network, web application firewall and DDoS protection. Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Privacy policy: cloudflare.com/privacypolicy.

In addition, a connection necessarily involves the third-party service the user chose to connect. That provider processes the request under its own privacy policy.

Use of Google user data

Where a user connects Google Drive, fetchdocs requests the drive and drive.metadata scopes. We use that access to list the user's folders so they can choose which one to import from, to read the documents in the folder they chose, and to deliver those documents to the application in which the user established the connection.

Write access is part of those scopes because a connection can be configured to file documents away in Drive after importing them, which means creating the target folder and moving the imported file into it. We do not use that access for anything else, and we never delete files in a user's Drive.

fetchdocs' use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the document import features the user has explicitly connected.
• We do not transfer Google user data to third parties except as needed to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users.
• We do not use Google user data for serving advertisements.
• We do not sell Google user data.
• We do not use Google user data to develop, improve or train generalised or non-personalised artificial intelligence or machine-learning models.
• We allow humans to read Google user data only where we have the user's or the connecting client's explicit consent for specific data, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised.

A user can revoke fetchdocs' access to their Google account at any time at myaccount.google.com/permissions, or by deleting the connection in the application they established it in.

Collection of general data and information

Our websites collect a series of general data and information each time the website is accessed by a data subject or an automated system. This general data and information is stored in the server's log files. For example, the following may be recorded:

• browser types and versions used,
• the operating system used by the accessing system,
• the website from which an accessing system reaches our website (so-called referrers),
• the sub-websites that are accessed via an accessing system on our website,
• the date and time of access to the website,
• an internet protocol address (IP address),
• the internet service provider of the accessing system, and
• other similar data and information that serve to avert dangers in the event of attacks on our information technology systems.

When using this general data and information, no conclusions are drawn about the person concerned. This information is rather required in order to correctly deliver and present the contents of our website, to optimize the content of our website, to ensure the long-term functionality of our information technology systems and the technology of our website, and to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyber attack.

These anonymously collected data and information are therefore evaluated by the controller both statistically and with the aim of increasing data protection and data security, in order to ultimately ensure an optimal level of protection for the personal data we process. The anonymous data of the server log files are stored separately from all personal data provided by a data subject.

Hosting and infrastructure

This website and the fetchdocs API are hosted by external service providers. Personal data collected here is stored on those providers' servers. This can primarily be IP addresses, contact requests, meta and communication data, website access and other data generated via a website.

The providers are used for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the legitimate interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR). We have concluded a data processing agreement with each provider in accordance with the requirements of Art. 28 GDPR, in which we oblige them to protect our customers' data and not to pass it on to third parties. The providers used are listed under The fetchdocs service.

The fonts used on this website are served from our own infrastructure. This website does not load fonts, scripts or other assets from third-party content delivery networks, so visiting it does not transmit your IP address to such a provider.

Legal basis for processing

Art. 6 para. 1 lit. a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary to fulfill a contract to which the data subject is a party, as is the case, for example, with processing operations necessary for the provision of a service, the processing is based on Art. 6 para. 1 lit. b) GDPR. The same applies to processing operations that are necessary to carry out pre-contractual measures, for example in cases of enquiries about our products or services. If we are subject to a legal obligation which requires the processing of personal data, such as to fulfill tax obligations, the processing is based on Art. 6 para. 1 lit. c) GDPR. In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or another natural person; in that case the processing would be based on Art. 6 para. 1 lit. d) GDPR.

Ultimately, processing operations could be based on Art. 6 para. 1 lit. f) GDPR. This legal basis is used for processing operations that are not covered by any of the aforementioned legal bases if the processing is necessary to safeguard a legitimate interest of ours or a third party, provided that the interests, fundamental rights and freedoms of the data subject do not prevail. We are permitted to carry out such processing operations in particular because they were specifically mentioned by the European legislator, which took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (Recital 47, sentence 2 GDPR). If the processing of personal data is based on Art. 6 para. 1 lit. f) GDPR, our legitimate interest is the conduct of our business activities for the benefit of the well-being of all our employees and our shareholders.

Duration for which personal data is stored

The criterion for the duration of storage of personal data is the respective statutory retention period. After the deadline has expired, the corresponding data will be routinely deleted, unless they are still required to fulfill or initiate a contract or there are other statutory or legal requirements that prevent deletion. Retention periods specific to fetchdocs are described under The fetchdocs service.

Routine deletion and blocking of personal data

The controller processes and stores personal data of the data subject only for the period necessary to achieve the purpose of storage, or if this has been provided for by the European legislator or another legislator in laws or regulations to which the controller is subject.

If the purpose of storage no longer applies, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.

Legal or contractual provisions for the provision of personal data

We would like to clarify that the provision of personal data is partly required by law (e.g. tax regulations) or may also arise from contractual or pre-contractual provisions (e.g. information on the contractual partner). Sometimes it may be necessary for a data subject to provide us with personal data in order to conclude a contract, which we must subsequently process. Failure to provide the personal data would mean that the contract with the data subject could not be concluded. Before the data subject provides personal data, the data subject may contact one of our employees, who will clarify on a case-by-case basis whether the provision of the personal data is required by law or contract, whether there is an obligation to provide it, and what the consequences of non-provision would be.

Contacting us and use of forms

When you contact us, for example by email, personal data is collected. This data is stored and used solely for the purpose of answering your request and the associated technical administration. The legal basis for processing the data is our legitimate interest in answering your request in accordance with Art. 6 para. 1 lit. f) GDPR. If the purpose of your contact is to conclude a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b) GDPR. Your data will be deleted after your request has been processed, that is, once it can be inferred that the matter in question has been conclusively clarified, provided that there are no statutory or legal retention periods that prevent deletion.

The controller provides any data subject with information on request at any time about which personal data about the data subject is stored. Furthermore, the controller corrects or deletes personal data at the request or indication of the data subject, provided that there are no statutory or legal retention periods to the contrary. All of the controller's employees are available to the data subject as contact persons in this context.

Recipients or categories of recipients

Depending on the purpose of the collection, we transmit personal data to the processors listed under The fetchdocs service, to the third-party service a user has chosen to connect, and to the client application on whose behalf documents are imported. Beyond that, personal data is only passed on where there is a statutory or legal obligation to do so.

Transfer to third countries

If we transmit personal data to service providers outside the European Economic Area (EEA), the transmission will only take place if the third country has been confirmed by the EU Commission to have an adequate level of data protection, or if other appropriate data protection guarantees, for example binding internal company data protection regulations or EU standard contractual clauses, are in place.

Existence of automated decision-making

As a responsible company, we do not use automated decision-making or profiling.

Data protection for applications and in the application process

The controller collects and processes the personal data of applicants for the purpose of processing the application process. Processing can also be carried out electronically. This is particularly the case if an applicant sends the relevant application documents to the controller electronically, for example by email. If the controller concludes an employment contract with an applicant, the transmitted data is stored for the purpose of processing the employment relationship in compliance with the statutory provisions. If the controller does not conclude an employment contract with the applicant, the application documents will be automatically deleted no later than six months after the rejection decision is announced, provided that deletion does not conflict with any other legitimate interests of the controller in accordance with Art. 6 para. 1 lit. f) GDPR. Other legitimate interests in this sense include, for example, the burden of proof in proceedings under the General Equal Treatment Act (AGG).

Definitions

This data protection declaration is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). Our data protection declaration is intended to be easy to read and understand for the public as well as for our customers and business partners. To ensure this, we would like to explain the terms used in advance.

a) Personal data

"Personal data" is all information that relates to an identified or identifiable natural person (hereinafter "data subject"). A natural person is considered identifiable if he or she can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more special characteristics that express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

b) Data subject

"Data subject" is any identified or identifiable natural person whose personal data is processed by the controller.

c) Processing

"Processing" is any operation or set of operations which is carried out with or without the aid of automated procedures in connection with personal data, such as the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or another form of provision, comparison or linking, restriction, erasure or destruction.

d) Restriction of processing

"Restriction of processing" means the marking of stored personal data with the aim of restricting its future processing.

e) Profiling

"Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Pseudonymisation

"Pseudonymisation" is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not assigned to an identified or identifiable natural person.

g) File system

"File system" is any structured set of personal data accessible according to specific criteria, whether centralised, decentralised or organised according to functional or geographical criteria.

h) Controller or person responsible for processing

"Controller" (or "person responsible for processing") means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

i) Processor

"Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

j) Recipient

"Recipient" means a natural or legal person, public authority, agency or other body to whom personal data is disclosed, whether a third party or not. However, authorities which may receive personal data in the context of a specific investigation in accordance with Union or Member State law shall not be regarded as recipients.

k) Third party

"Third party" means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons authorised to process the personal data under the direct responsibility of the controller or processor.

l) Consent

"Consent" of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes in the form of a statement or other unambiguous affirmative action by which the data subject signifies agreement to the processing of personal data concerning him or her.

m) Company

"Company" means a natural or legal person which carries out an economic activity, regardless of its legal form, including partnerships or associations which regularly carry out an economic activity.

n) Group of companies

"Group of companies" means a group consisting of a controlling company and the companies controlled by it.

Rights of the data subject

a) Right to confirmation

Every data subject has the right granted by the European legislator to obtain confirmation from the controller as to whether or not personal data concerning him or her are being processed. If a data subject wishes to exercise this right of confirmation, he or she may contact an employee of the controller at any time.

b) Right to information

Every data subject affected by the processing of personal data has the right granted by the European legislator to obtain from the controller free information about the personal data stored about him or her at any time, and a copy of this information. Furthermore, the European legislator has granted the data subject the right to information about the following:

• the purposes of the processing,
• the categories of personal data being processed,
• the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations,
• where possible, the planned period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
• the existence of a right to request from the controller rectification or erasure of personal data, or restriction of processing of the personal data concerning the data subject, or to object to such processing,
• the existence of a right to lodge a complaint with a supervisory authority,
• where the personal data are not collected from the data subject, all available information as to their origin,
• the existence of automated decision-making, including profiling, pursuant to Art. 22 para. 1 and 4 GDPR and, at least in these cases, meaningful information about the logic involved and the scope and intended effects of such processing for the data subject.

The data subject also has the right to information as to whether personal data has been transferred to a third country or to an international organisation. If this is the case, the data subject also has the right to receive information about the appropriate guarantees in connection with the transfer. If a data subject wishes to exercise this right to information, he or she can contact an employee of the controller at any time.

c) Right to rectification

Any person affected by the processing of personal data has the right granted by the European legislator to request the immediate rectification of inaccurate personal data concerning him or her. Furthermore, the data subject has the right, taking into account the purposes of the processing, to request the completion of incomplete personal data, also by means of a supplementary statement. If a data subject wishes to exercise this right to rectification, he or she may contact an employee of the controller at any time.

d) Right to erasure (right to be forgotten)

Every person affected by the processing of personal data has the right granted by the European legislator to request the controller to erase personal data concerning him or her without undue delay, provided that one of the following reasons applies and to the extent that processing is not necessary:

• The personal data were collected or otherwise processed for purposes for which they are no longer necessary.
• The data subject withdraws his or her consent on which the processing was based according to Art. 6 para. 1 lit. a) GDPR or Art. 9 para. 2 lit. a) GDPR, and there is no other legal basis for the processing.
• The data subject objects to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 para. 2 GDPR.
• The personal data were processed unlawfully.
• The erasure of the personal data is necessary to fulfill a legal obligation under Union or Member State law to which the controller is subject.
• The personal data were collected in relation to information society services offered pursuant to Art. 8 para. 1 GDPR.

If one of the above reasons applies and a data subject wishes to request the erasure of personal data stored by us, he or she can contact an employee of the controller at any time, who will ensure that the deletion request is complied with immediately.

If the personal data was made public by us and we as the controller pursuant to Art. 17 para. 1 GDPR are obliged to delete the personal data, we shall take appropriate measures, including technical ones, taking into account the available technology and the implementation costs, in order to inform other data controllers which process the published personal data that the data subject has requested the deletion of all links to these personal data, or of copies or replications of these personal data, from those other data controllers, unless processing is required.

e) Right to restriction of processing

Any person affected by the processing of personal data has the right granted by the European legislator to request the controller to restrict processing if one of the following conditions is met:

• The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful, the data subject opposes the erasure of the personal data and instead requests the restriction of the use of the personal data.
• The controller no longer needs the personal data for the purposes of the processing, but the data subject needs them to assert, exercise or defend legal claims.
• The data subject has objected to the processing in accordance with Art. 21 para. 1 GDPR and it has not yet been determined whether the legitimate reasons of the controller override those of the data subject.

If one of the above conditions is met and a data subject wishes to request the restriction of personal data stored by us, he or she may contact an employee of the controller at any time, who will arrange for the processing to be restricted.

f) Right to data portability

Every data subject shall have the right granted by the European legislator to receive the personal data concerning him or her, which was made available to a controller, in a structured, common and machine-readable format. He or she also has the right to transmit these data to another controller without hindrance from the controller to whom the personal data was made available, provided that the processing is based on consent pursuant to Art. 6 para. 1 lit. a) GDPR or Art. 9 para. 2 lit. a) GDPR, or on a contract pursuant to Art. 6 para. 1 lit. b) GDPR, and the processing is carried out using automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, in exercising his or her right to data portability pursuant to Art. 20 para. 1 GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible and where doing so does not adversely affect the rights and freedoms of others. To assert the right to data portability, the data subject may contact one of our employees at any time using the contact details provided above.

g) Right to object

Any person affected by the processing of personal data has the right granted by the European legislator to object at any time to processing of personal data concerning him or her based on Art. 6 para. 1 lit. e) or f) GDPR, for reasons related to his or her particular situation. This also applies to profiling based on these provisions.

We will no longer process the personal data in the event of an objection, unless we can demonstrate compelling legitimate grounds for the processing which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

If we process personal data in order to conduct direct advertising, the data subject has the right to object at any time to the processing of personal data for the purpose of such advertising. This also applies to profiling insofar as it is related to such direct advertising. If the data subject objects to us processing the data for direct marketing purposes, we will no longer process the personal data for these purposes.

In addition, the data subject has the right to object to the processing of personal data concerning him or her by us for scientific or historical research purposes, or for statistical purposes pursuant to Art. 89 para. 1 GDPR, for reasons related to his or her particular situation, unless such processing is necessary to perform a task carried out in the public interest.

To exercise the right to object, the data subject may contact one of our employees directly. Furthermore, in relation to the use of information society services, the data subject is free to exercise his or her right of objection by automated means using technical specifications, notwithstanding Directive 2002/58/EC.

h) Automated decisions in individual cases, including profiling

Every person affected by the processing of personal data has the right granted by the European legislator not to be subjected to a decision based exclusively on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, provided that the decision is not necessary for entering into, or the performance of, a contract between the data subject and the controller, is not permitted by Union or Member State law to which the controller is subject where that law contains appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject, and is not made with the data subject's explicit consent.

If the decision is necessary for entering into, or the performance of, a contract between the data subject and the controller, or is made with the data subject's explicit consent, we shall take appropriate measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. If the data subject wishes to exercise rights with regard to automated decisions, he or she may contact an employee of the controller at any time.

i) Right to withdraw consent under data protection law

Any person affected by the processing of personal data has the right granted by the European legislator to withdraw consent to the processing of personal data at any time. If the data subject wishes to exercise his or her right to withdraw consent, he or she may contact an employee of the controller at any time.

j) Right to lodge a complaint with the data protection supervisory authority

If you believe that the processing of your personal data violates the GDPR, you have the option of submitting a complaint to the data protection officer mentioned above, or to a data protection supervisory authority in accordance with Art. 77 GDPR.

Supervisory authority

The data protection supervisory authority responsible for us is:

The Hessian Commissioner for Data Protection and Freedom of Information
P.O. Box 3163
65021 Wiesbaden
Germany

Our data protection officer is also happy to help you using the contact details given above.

Cookies

Cookies are text files that are stored and saved via an internet browser on an information technology system, for example a computer, notebook, smartphone or tablet. Many cookies contain a so-called cookie ID, a unique identifier consisting of a character string that allows websites and servers to be assigned to the specific internet browser in which the cookie was stored.

These marketing pages do not set cookies and do not use tracking or web analytics. Cookies are used in the parts of fetchdocs that require a session, namely the connection frontend and the administration panel, where they are technically necessary to keep a signed-in user's session and to protect forms against cross-site request forgery.

The person concerned can prevent the setting of cookies at any time by means of a corresponding setting in the internet browser used, and thus permanently object to the setting of cookies. Furthermore, cookies that have already been set can be deleted at any time via an internet browser or other software programs. This is possible in all common internet browsers. If the person concerned deactivates the setting of cookies in the internet browser used, not all functions of our services may be fully usable.

Cloudflare

We have integrated the content delivery network Cloudflare. The operating company is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Cloudflare is a service that enables loading times of websites to be reduced, so that websites can be loaded quickly even during peak loads. At the same time, Cloudflare protects its users' websites with an additional firewall and DDoS protection. In order for Cloudflare to be provided, personal data can be sent from your browser to the service. This gives the provider the opportunity to collect and store user data such as your IP address, your browser version, the browser type or the date of your site visit. Cloudflare states that it processes the data in compliance with the law, including the GDPR. Third-party providers with whom Cloudflare works may only process personal data under the direction of Cloudflare and in accordance with its data protection guidelines and other confidentiality and security measures. We only process personal data for as long as it is necessary. As soon as the purpose of the data processing has been fulfilled, the data is blocked and deleted in accordance with the standards of the local deletion concept, unless legal regulations prevent deletion.

Purposes of processing

Cloudflare allows us to offer a well-functioning and reliable service. Our pages load faster with Cloudflare, and it increases our protection against threats.

Legal basis

In order to use the tool, we rely on existing or impending contractual relationships, which represent the legal basis according to Section 25 para. 1 TDDDG and Art. 6 para. 1 lit. b) GDPR (contractual or pre-contractual measures). On the other hand, we have a legitimate interest in optimizing our online service and making it more secure, which is why we rely on Art. 6 para. 1 lit. f) GDPR (legitimate interest).

You can find more information on how personal data is handled in Cloudflare's privacy policy: cloudflare.com/privacypolicy.

Opportunity to object

You always have the option of managing the setting, administration and deletion of cookies in your browser according to your wishes. If you do not want a tool to set cookies and collect information about you, you can deactivate the general setting of cookies at any time in your browser settings. In individual cases this can lead to various functionalities on the websites visited no longer working as intended.