Privacy Policy

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data means all data that can be used to identify you personally.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Thorsten Knickenberg, Gladbacher Str. 15, 40219 Düsseldorf, Germany, Tel.: +4917664653547, email: thorsten.@confidence-projects.com. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

2) Data Collection When Visiting Our Website

2.1 When you use our website for information purposes only, that is, when you do not register or otherwise send us information, we collect only the data that your browser transmits to the page server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

The website visited
Date and time of access
Amount of data sent in bytes
Source/referrer from which you reached the page
Browser used
Operating system used
IP address used (where applicable, in anonymized form)

Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. However, we reserve the right to review the server log files retrospectively if concrete indications point to unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string "https://" and the lock symbol in your browser bar.

3) Hosting & Content Delivery Network

To host our website and display its content, we use a provider that delivers its services, itself or through selected subcontractors, exclusively on servers within the European Union.

All data collected on our website is processed on these servers.

We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

4) Cookies

To make your visit to our website attractive and to enable the use of certain functions, we use cookies, i.e., small text files stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called "session cookies"). Others remain on your device longer and allow site settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage duration in the cookie settings overview of your web browser.

Where individual cookies we use also process personal data, processing is carried out pursuant to Art. 6(1)(b) GDPR for the performance of a contract, pursuant to Art. 6(1)(a) GDPR where consent has been given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of your visit.

You can set your browser to inform you when cookies are set, to decide on their acceptance individually, or to exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be limited.

5) Contacting Us

5.1 Microsoft Bookings

To provide an online appointment booking function, we use the services of the following provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

For the purpose of scheduling appointments, first and last name and email address (and, where applicable, phone number if a telephone appointment is desired) are collected pursuant to Art. 6(1)(b) GDPR. They are transmitted to the provider and stored there for appointment organization pursuant to Art. 6(1)(f) GDPR, based on our legitimate interest in effective customer management and efficient appointment administration.

After the appointment has taken place or the agreed appointment period has expired, your data is deleted by the provider.

We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

5.2 WhatsApp Business

We offer visitors to our website the opportunity to contact us via the messaging service WhatsApp of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this purpose, we use the so-called "Business version" of WhatsApp.

If you contact us via WhatsApp in connection with a specific transaction (for example, an order placed), we store and use the mobile phone number you use on WhatsApp and, if provided, your first and last name pursuant to Art. 6(1)(b) GDPR to process and respond to your request. On the same legal basis, we may ask you via WhatsApp to provide further data (order number, customer number, address, or email address) so that we can assign your request to a specific case.

If you use our WhatsApp contact for general inquiries (e.g., about our range of services, availability, or our website), we store and use the mobile phone number you use on WhatsApp and, if provided, your first and last name pursuant to Art. 6(1)(f) GDPR, based on our legitimate interest in providing the requested information efficiently and promptly.

Your data is always used only to respond to your request via WhatsApp. It is not passed on to third parties.

Please note that WhatsApp Business gains access to the address book of the mobile device we use for this purpose and automatically transmits phone numbers stored in the address book to a server of its parent company Meta Platforms Inc. in the USA. To operate our WhatsApp Business account, we use a mobile device whose address book contains only the WhatsApp contact data of users who have also contacted us via WhatsApp.

This ensures that every person whose WhatsApp contact data is stored in our address book has already, upon first use of the app on their device, consented to the transmission of their WhatsApp phone number from the address books of their chat contacts by accepting the WhatsApp terms of use, pursuant to Art. 6(1)(a) GDPR. A transmission of data of users who do not use WhatsApp and/or have not contacted us via WhatsApp is thereby excluded.

For the purpose and scope of data collection, the further processing and use of data by WhatsApp, and your rights and privacy settings in this regard, please refer to WhatsApp's privacy notices: https://www.whatsapp.com/legal/?eea=1#privacy-policy

In the course of the above processing, data may be transferred to servers of Meta Platforms Inc. in the USA.

5.3 When you contact us (e.g., via contact form or email), personal data is collected. The data collected when using a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for contacting you and the associated technical administration.

The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Art. 6(1)(f) GDPR. If your contact aims at the conclusion of a contract, an additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted after your request has been finally processed. This is the case when the circumstances indicate that the matter concerned has been conclusively resolved and provided that no statutory retention obligations prevent deletion.

6) Comment Function

When you use the comment function on this website, in addition to your comment, details on the time the comment was created and the commenter name you chose are stored and published on this website. Your IP address is also logged and stored. The IP address is stored for security reasons and in case the person concerned infringes the rights of third parties or posts unlawful content through a comment. We need your email address to contact you if a third party objects to your published content as unlawful.

The legal bases for storing your data are Art. 6(1)(b) and (f) GDPR. We reserve the right to delete comments if third parties object to them as unlawful.

7) Use of Customer Data for Direct Marketing

Sending the email newsletter to existing customers

If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers by email for goods or services from our range that are similar to those you have already purchased. Under Section 7(3) of the German Unfair Competition Act (UWG), we do not need to obtain separate consent from you for this. Data processing is carried out solely on the basis of our legitimate interest in personalized direct marketing pursuant to Art. 6(1)(f) GDPR. If you objected to the use of your email address for this purpose when it was first collected, we will not send you emails.

You are entitled to object to the use of your email address for the aforementioned advertising purpose at any time with effect for the future by notifying the controller named at the beginning. You will incur only transmission costs at the basic rates. Upon receipt of your objection, the use of your email address for advertising purposes will cease immediately.

8) Site Functionalities

8.1 LinkedIn Plugins

Our website uses plugins of the social network of the following provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

These plugins enable direct interactions with content on the social network.

To increase the protection of your data when visiting our website, the plugins are initially integrated into the page in a deactivated state by means of a so-called "2-click" or "Shariff" solution.

This integration ensures that no connection to the provider's servers is established when a page of our website containing such plugins is accessed.

Only when you activate the plugins, and thereby give your consent to the data transmission pursuant to Art. 6(1)(a) GDPR, does your browser establish a direct connection to the provider's servers. In this process, regardless of whether you are logged into an existing user profile, certain information about your device (including your IP address), your browser, and your page history is transmitted to the provider and may be further processed there.

If you are logged into an existing user profile on the provider's social network, information about interactions carried out via the plugins is also published there and displayed to your contacts.

You can withdraw your consent at any time by deactivating the activated plugin by clicking on it again. However, the withdrawal does not affect data that has already been transmitted to the provider.

Data may also be transferred to: LinkedIn Inc., USA.

We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

For the transfer of data to the USA, the provider relies on the European Commission's standard contractual clauses, which are intended to ensure compliance with the European level of data protection.

8.2 Google Maps

This website uses an online map service of the following provider: Google Maps (API) from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

Google Maps is a web service for displaying interactive (land) maps in order to visually present geographic information. Through this service, our location is shown to you and any journey is made easier.

Already when you open the subpages in which the Google Maps map is embedded, information about your use of our website (such as your IP address) is transmitted to Google servers and stored there. This may also involve a transfer to the servers of Google LLC in the USA. This happens regardless of whether Google provides a user account through which you are logged in or whether a user account exists. If you are logged in to Google, your data is assigned directly to your account. If you do not wish this assignment to your Google profile, you must log out before activating the button. Google stores your data (even for non-logged-in users) as usage profiles and evaluates them.

The collection, storage, and evaluation are carried out pursuant to Art. 6(1)(f) GDPR on the basis of Google's legitimate interest in displaying personalized advertising, market research, and/or designing Google websites to meet demand. You have a right to object to the creation of these user profiles, and to exercise it you must contact Google. If you do not agree to the future transmission of your data to Google when using Google Maps, you also have the option of completely deactivating the Google Maps web service by turning off JavaScript in your browser. Google Maps, and thus also the map display on this website, can then no longer be used.

Where legally required, we have obtained your consent for the processing of your data described above pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. To exercise your withdrawal, please follow the objection option described above.

8.3 Google Customer Reviews (formerly Google Trusted Stores Program)

We cooperate with Google under the "Google Customer Reviews" program. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). This program allows us to collect customer reviews from users of our website. After a purchase on our website, you are asked whether you would like to take part in an email survey by Google.

If you give your consent pursuant to Art. 6(1)(a) GDPR, we transmit your email address to Google. You will receive an email from Google Customer Reviews asking you to rate your purchase experience on our website. The rating you submit is then aggregated with our other ratings and displayed in our Google Customer Reviews logo and in our Merchant Center dashboard. Your rating is also used for Google Seller Ratings. In the course of using Google Customer Reviews, personal data may also be transferred to the servers of Google LLC in the USA.

You can withdraw your consent at any time by notifying the controller responsible for data processing or by notifying Google.

8.4 Microsoft Teams

To conduct online meetings, video conferences, and/or webinars, we use this provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

The provider processes various data, and the scope of the processed data depends on what data you provide before or during participation in an online meeting, video conference, or webinar. Your data as a communication participant is processed and stored on the provider's servers. This may in particular include your login data (name, email address, phone number (optional), and password) and session data (topic, participant IP address, device information, description (optional)).

In addition, participants' video and audio contributions as well as voice inputs in chats may be processed.

Art. 6(1)(b) GDPR serves as the legal basis for processing personal data necessary for the performance of a contract with you (this also applies to processing operations necessary for carrying out pre-contractual measures). Where you have given us consent to process your data, processing is based on Art. 6(1)(a) GDPR. You can withdraw consent once given at any time with effect for the future.

Otherwise, the legal basis for data processing when conducting online meetings, video conferences, or webinars is our legitimate interest pursuant to Art. 6(1)(f) GDPR in the effective conduct of the online meeting, webinar, or video conference.

We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

8.5 Job Applications by Email

On our website, we advertise currently vacant positions in a separate section. Interested persons can apply by email to the contact address provided.

Applicants must provide all personal data necessary for a well-founded assessment, including general information such as name, address, and contact details, as well as proof of qualifications and, where applicable, health-related information. Details of the application can be found in the job advertisement.

After receipt of the application by email, the data is stored and evaluated exclusively for the purpose of processing the application. For follow-up questions, we use either the applicant's email address or phone number. Processing is carried out on the basis of Art. 6(1)(b) GDPR (or Section 26(1) of the German Federal Data Protection Act, BDSG), under which going through the application process is regarded as initiating an employment contract.

Where special categories of personal data within the meaning of Art. 9(1) GDPR (e.g., health data such as information on severe disability status) are requested from applicants during the application process, processing is carried out pursuant to Art. 9(2)(b) GDPR so that we can exercise the rights arising from labor law and social security and social protection law and comply with our obligations in this regard.

Cumulatively or alternatively, the processing of special categories of data may also be based on Art. 9(2)(h) GDPR if it is carried out for the purposes of preventive health care or occupational medicine, for assessing the applicant's working capacity, for medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.

If the applicant is not selected or withdraws the application early, the submitted data and all electronic correspondence, including the application email, will be deleted after corresponding notification, at the latest after 6 months. This period is based on our legitimate interest in answering any follow-up questions about the application and, where applicable, in being able to meet our obligations of proof under the rules on equal treatment of applicants.

In the case of a successful application, the data provided will be processed for the purpose of carrying out the employment relationship on the basis of Art. 6(1)(b) GDPR (when processed in Germany, in conjunction with Section 26(1) BDSG).

9) Rights of the Data Subject

9.1 Applicable data protection law grants you the following data subject rights (rights of access and intervention) against the controller with regard to the processing of your personal data. For the respective conditions of exercise, reference is made to the legal basis cited:

Right of access under Art. 15 GDPR;
Right to rectification under Art. 16 GDPR;
Right to erasure under Art. 17 GDPR;
Right to restriction of processing under Art. 18 GDPR;
Right to notification under Art. 19 GDPR;
Right to data portability under Art. 20 GDPR;
Right to withdraw consent given under Art. 7(3) GDPR;
Right to lodge a complaint under Art. 77 GDPR.

9.2 RIGHT TO OBJECT

IF, AS PART OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE, OR DEFEND LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

10) Duration of Storage of Personal Data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and, where relevant, additionally by the respective statutory retention period (e.g., commercial and tax retention periods).

When personal data is processed on the basis of explicit consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

Where statutory retention periods exist for data processed in connection with legal transactions or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods expire, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in continued storage.

When personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

When personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(2) GDPR.

Unless the other information in this statement on specific processing situations provides otherwise, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.