Privacy Policy of DAYONE GmbH
Version 1.2, as of May 18, 2022

As of May 25, 2018, the provisions of the EU General Data Protection Regulation (hereinafter referred to as GDPR) apply throughout Europe. Below, we would like to inform you about the processing of personal data carried out by DAYONE GmbH in accordance with this new regulation (see Article 13 GDPR). Please read our Privacy Policy carefully. If you have any questions or comments regarding this Privacy Policy, you may contact us at any time using the email address provided in Section 3.

1. Summary

2. Overview

3. Who is responsible for data processing on this website and how can the data protection officer be contacted?

4. How, for what purpose and on what legal basis is your data processed?

4.1. How and on what legal basis do we process your data when you access our website?

4.2. How, to what extent and on what legal basis do we process your data when a contract is concluded, performed or terminated?

4.3. How, for what purpose and on what legal basis do we process your data in connection with our online presence and the optimisation of our website?

5. When do we disclose your data to recipients outside the EU?

6. What rights do you have regarding your data?

7. How long do we store your data?

1.1. Who is responsible for data processing?

DAYONE GmbH
OudenarderStr. 16
D- 13347Berlin

1.2. How can the data protection officer be contacted?

Our data protection officer, IITR Datenschutz GmbH, Dr. Sebastian Kraska, Marienplatz 2, 80331 Munich, email: email@iitr.de, phone: 089-18917360.

1.3. For what purpose is your data processed?

When you access our website, the browser used on your device automatically sends information (including your IP address) to our website's server without any action on our part, where it is temporarily stored in what is known as a log file. The legal basis for processing the IP address is Article 6(1)(f) GDPR. Our legitimate interest follows from the purpose of ensuring a smooth connection, ensuring convenient use of our website and evaluating system security and stability.

In addition, in connection with our agency services in the field of digital innovation and design, we process the data required for the conclude, execute, or terminate a contract with you. The legal basis for this is Article 6(1)(b) GDPR, i.e. you provide us with the data on the basis of the contractual relationship between you and us.

On our website we also offer you the option of signing up for our Newsletter . Your electronic contact details are processed here solely on the basis of your consent (Article 6(1)(a) GDPR).

We also process your data in connection with our online presence and the optimisation of our website.

For this we use what are known as cookies on our website. Where these cookies involve personal data, they are used on the basis of consent given in accordance with Art. 6(1)(a) GDPR and on the basis of Article 6(1)(f) GDPR. Our interest in optimising our website is to be regarded as legitimate within the meaning of the aforementioned provision.

We also use the following services:

For the purpose of designing our pages to meet users' needs and continuously optimising them, we use Google Analytics on the basis of your consent (cf. Article 6(1)(a) GDPR).

For the purpose of communicating with our users and presenting ourselves externally, we operate pages on various social networks. Our profiles are currently on Instagram, LinkedIn, Spotify, Vimeo and Medium. We also link to our presence on these services from our website.

1.4. When do we disclose your data to recipients outside the EU?

In certain cases we may disclose your data to recipients outside the EU or the European Economic Area.

1.5. What rights do you have regarding your data?

In addition to the right to withdraw the consent you have given us, you also have the following further rights where the respective statutory conditions are met.

The right to information about the personal data concerned (Art. 15 GDPR), to rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), a right to object to processing (Art. 21 GDPR) and the right to data portability (Art. 20 GDPR). If you believe that the processing of personal data concerning you infringes the GDPR, you also have the right to lodge a complaint with a supervisory authority.

1.6. How long do we store your data?

The duration for which personal data is stored is generally determined by the respective purpose and by the applicable statutory retention period (commercial and tax retention periods, for example). Once the period has expired, the corresponding data is deleted as a matter of routine.

The following privacy notice informs you about the nature and extent of the processing of what is known as personal data by DAYONE GmbH. Personal data is information that can be attributed to you directly or indirectly.

Data processing by DAYONE GmbH can be divided into essentially two categories :

In accordance with the requirements of the GDPR you have various rightsthat you can assert against us. These include the right to object to selected forms of data processing, in particular processing for advertising purposes. The option to object is highlighted typographically.

If you have any questions about our privacy notice, you are welcome to contact our company data protection officer at any time. You will find the contact details below.

This privacy information applies to data processing by DAYONE GmbH, Oudenarder Str. 16, D- 13347 Berlin ("the controller"), and to the following website:

http://www.dayone.de

The data protection officer of DAYONE GmbH, Dr. Sebastian Kraska, can be reached at the above address, for the attention of the Data Protection Department, or at datenschutz@dayone.de.

4.1. How and on what legal basis do we process your data when you access our website?

4.1.1. Accessing our website

When you access our website, the browser used on your device automatically sends information to our website's server, where it is temporarily stored in what is known as a log file. We have no influence over this. The following information is collected without any action on your part and stored until it is automatically deleted:

· the IP address of the requesting internet-enabled device,

· the date and time of access,

· the name and URL of the file retrieved,

· the website from which access was made (referrer URL),

· the browser you use and, where applicable, the operating system of your internet-enabled computer, as well as the name of your access provider.

‍
The legal basis for the processing of the IP address is Article 6(1)(f) GDPR. Our legitimate interest follows from the purposes of data collection listed below. We should also point out that the data collected does not allow us to draw any direct conclusions about your identity, nor do we do so.

The IP address of your device and the other data listed above are used by us for the following purposes :

· ensuring a smooth connection,

· ensuring convenient use of our website/application,

· evaluating system security and stability, and

· further administrative purposes.

The data is stored for a period of 30 days and then deleted automatically. We also use what are known as cookies and tracking tools on our website. Exactly which procedures these are and how your data is used for them is explained in more detail under section 4.3 below.

If, in your browser, your operating system or other settings on your device, you have consented to what is known as geolocation , we use this function to offer you individual services relating to your current location (the location of the nearest branch, for example). We process the location data obtained in this way exclusively for this function. When you stop using it, the data is deleted.

4.1.2. Use of Webflow

In connection with our hosting provider, we use the Webflow service. Webflow is provided by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter "Webflow").

We use Webflow as a tool for building websites. When you visit our website, Webflow records various log files as well as your IP address. Webflow also stores cookies and other recognition technologies that are necessary for displaying the page, providing certain website functions and ensuring security (known as necessary cookies).

The legal basis for the data processing is our legitimate interest under Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable display of our website. Where we have asked for your consent, the data processing is based on the consent given within the meaning of Art. 6(1)(a) GDPR and Section 25(1) TTDSG. Consent given in this way can be withdrawn at any time.

Connecting Webflow to our hosting provider results in a transfer of data to the USA. Webflow is, however, certified under the "EU-US Data Privacy Framework". This is an agreement between the EU and the USA intended to ensure that European data protection standards are observed when data is processed in the USA. All companies certified under the "EU-US Data Privacy Framework" undertake to observe and comply with these data protection standards.

In addition, we have concluded a data processing agreement with Webflow.

You can find further information on data protection at Webflow at: https://webflow.com/legal/eu-privacy-policy

For information on Webflow’s certification under the EU-US Data Privacy Framework, visit:

https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt0000000TT9jAAG&status=Active

4.2. How, to what extent and on what legal basis do we process your data when a contract is concluded, performed or terminated?

4.2.1. Data processing when a contract is concluded

The business purpose of DAYONE GmbH is to provide agency services in the field of digital innovation and design—particularly shaping mobile and context-driven ideas into pioneering service innovations. In this context, we process the data necessary to conclude, execute, or terminate a contract with you. These include:

· Company/organisation/institution

· First name, surname

· Billing and delivery address

· Email address

· Invoice and payment details

· Date of birth, where applicable

· Telephone number, where applicable

The legal basis for this is Article 6(1)(b) GDPR, i.e. you provide us with the data on the basis of the contractual relationship between you and us. We are also obliged to process your email address because the German Civil Code (BGB) requires us to send an electronic order confirmation (Article 6(1)(c) GDPR). Insofar as we do not use your contact details for advertising purposes, we store the data collected for performing the contract until the statutory or any contractual warranty and guarantee rights have expired. After that period, we retain the information about the contractual relationship required under commercial and tax law for the periods prescribed by law. During that period (usually ten years from conclusion of the contract), the data is processed again solely in the event of a review by the tax authorities.

4.2.2. Events

From time to time DAYONE holds events in various formats. The data collected during event registration is used to prepare and run the events. For example, the email address is used to send calendar invitations and — depending on the event format — also to validate the participant.

The legal basis is Art. 6(1)(b) GDPR.

4.2.3. Sending the newsletter

On our website we offer you the option of subscribing to our newsletter. To make sure that no errors have occurred when the email address was entered, we use what is known as the double opt-in procedure: after you have entered your email address in the sign-up field, we send you a confirmation link. Only when you click that confirmation link is your email address added to our distribution list. Your electronic contact details are processed here solely on the basis of your consent (Article 6(1)(a) GDPR). You may withdrawthe consent given in this way at any time with effect for the future. A short note by email to the address given under 3. is sufficient, or you can click the "unsubscribe" button at the end of any newsletter.

4.3. How, for what purpose and on what legal basis do we process your data in connection with our online presence and the optimisation of our website?

4.3.1. Cookies – general information

We use what are known as cookies on our website. Where these cookies involve personal data, they are used on the basis of Article 6(1)(f) GDPR. Our interest in optimising our website is to be regarded as legitimate within the meaning of the aforementioned provision. Cookies are small files that your browser creates automatically and that are stored on your device (laptop, tablet, smartphone or similar) when you visit our site. Cookies do no harm to your device and contain no viruses, trojans or other malware. The cookie stores information that arises in connection with the specific device used. This does not, however, mean that we gain direct knowledge of your identity as a result. On the one hand, cookies are used to make our offering more pleasant for you to use. For instance, we use what are known as session cookies to recognise that you have already visited individual pages of our website or that you are already logged in to your customer account. These are deleted automatically when you leave our site. In addition, also for ease of use, we use temporary cookies which are stored on your device for a specified period. If you visit our site again to use our services, it is automatically recognised that you have been with us before and which entries and settings you made, so that you do not have to enter them again.

On the other hand, we use cookies in order to record use of our website statistically and to analyse it for the purpose of optimising our offering for you, as well as to display information tailored specifically to you. These cookies allow us to recognise automatically, when you visit our site again, that you have been with us before. These cookies are automatically deleted after a defined period. Most browsers accept cookies automatically. You can, however, configure your browser so that no cookies are stored on your computer or so that a notice always appears before a new cookie is created. Disabling cookies entirely may mean that you cannot use all the functions of our website. How long cookies are stored depends on their purpose and is not the same for all of them (see below).

Where individual cookies used by us also process personal data, the processing takes place on the basis of consent given in accordance with Art. 6(1)(a) GDPR and Section 25(1) TTDSG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TTDSG. Otherwise, processing takes place in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective site visit.

4.3.2. Google Analytics

For the purpose of designing our pages to meet users' needs and continuously optimising them, we use Google Analytics on the basis of your consent (cf. Article 6(1)(a) GDPR and Section 25(1) TTDSG), a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). In addition, the use of Google Analytics for the purpose of designing our pages to meet users' needs and continuously optimising them constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.

Google Analytics uses cookies with a validity of 14 months to record your access data when you visit our website. The access data is aggregated by Google on our behalf into pseudonymous usage profiles and transferred to a Google server in the USA. Before that, your IP address is anonymised. We are therefore unable to determine which usage profiles belong to a particular user. The data recorded by Google allows us neither to identify you nor to determine how you use our website.

The information generated by the cookie about your use of this website, such as

• browser type/version,

• operating system used,

• referrer URL (the previously visited page),

• host name of the accessing computer (IP address),

• time of the server request,

is transferred to a Google server in the USA and stored there.

In the event that personal data is exceptionally transferred to the USA in this process, Google has incorporated the EU standard contractual clauses into its terms of use and thereby provides a guarantee that European data protection principles and the level of data protection applicable here are also ensured for data processing taking place in the USA.

Google will use the information obtained through the cookies on our behalf to evaluate the use of our website, to compile reports on website activity and to provide us with further services connected with website use and internet use. You can also find further information on this in the Privacy Policy of Google Analytics. Google Analytics sets the following three cookies for the stated purpose with the respective storage period: "_ga" for 2 years, "_gid" for 24 hours (both to distinguish website visitors) and "_gat" for 1 minute (to reduce requests to the Google servers).

You can object to web analysis by Google at any time. There are several ways to do so:

You can find further information about Google Analytics in the privacy notice provided by Google.

4.3.3. Paperturn

‍On our website, we use the online flipbook tool Paperturn provided by Paperturn ApS, Klokkestøbervej 16, 5230 Odense M, Denmark. Paperturn is a PDF reader that allows you to convert PDF pages into an online flipbook. When interacting with Paperturn, personal data is processed to gather information about how Paperturn is used. For this purpose, Paperturn processes the following data:

This information helps to further improve the service. Paperturn processes this personal data exclusively within the European Economic Area.

For more information on data protection at Paperturn, please see here: https://www.paperturn.com/de/rechtsportal/datenschutz-richtlinien

4.3.4. Hubspot‍

Our website contains tracking technology from HubSpot Inc., 24 First St, 2nd Floor, Cambridge/MA 02141, United States (“HubSpot”). This may include cookies. HubSpot collects and stores usage data in pseudonymous profiles to enable interest-based advertising.

You can revoke your consent to user tracking and the associated recording of your user behaviour by disabling cookies (see 4.3.1).

Please refer to the consent options and ways to change consent described above in 4.3.1. For more information on data processing by HubSpot, please visit the HubSpot website of HubSpot. 

4.3.5. Typeform

We use Typeform for conducting surveys. These services are provided by TYPEFORM SL, C/Bac de Roda, 163 (Local), 08018 Barcelona Spain (Typeform). This enables us to improve our service through surveys.

To this end, we provide the following personal data to Typeform:

[Email address], [First name], [Last name], [Phone number]. Mandatory information is marked with a *.

Additionally, Typeform collects the following personal data via cookies: information about your device (IP address, device information, operating system, browser settings). Furthermore, usage data is collected, such as the date and time when you used the contact form. Typeform needs this data to ensure the display of the form and its functionality. This is in accordance with Typeform's legitimate interest (under Art. 6 para. 1 lit. f GDPR) and serves the performance of the contract (under Art. 6 para. 1 lit. b GDPR). You can find more information at:

https://help.typeform.com/hc/en-us/articles/360029581691-What-happens-to-my-data

For more information on objection and removal options regarding Typeform, please visit:

https://admin.typeform.com/to/dwk6gt

The legal basis for these processes is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent to the processing of your personal data at any time. The withdrawal can be made through the specified contact options. Your data will be processed as long as corresponding consent is in place. The legitimacy of the previous processing is not affected by the declaration of withdrawal.

4.3.6. Social Media

On our website, there are so-called hyperlinks to our offers on various social networks. When these hyperlinks are activated, you will be redirected directly from our website to the website of the social network. You can recognise this, among other things, by the change in the URL address. We accept no responsibility or liability for the confidential handling of your (personal) data by providers of other websites, as we neither know their data protection provisions nor have any influence on compliance with them.

4.3.6.1 Instagram

We maintain one or more presences on the social network Instagram to communicate with users registered there and to inform them about our company and our services. There is a hyperlink to the social network Instagram on our website, which is provided by Facebook Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. The Instagram hyperlink is marked with an Instagram logo. An overview of the appearance of the Instagram logo can be found at the following link.

If you click on the Instagram hyperlink, you will be redirected directly to our offering on Instagram and can follow us – provided you are logged into your Instagram account – on Instagram. Instagram/Facebook then receives the information that you have visited our website with your IP address. Additionally, it becomes possible for Instagram/Facebook to associate your visit to our website – if you are logged into your Instagram account – with you and your user account. We would like to point out that we have no knowledge of the content of the transmitted (personal) data and its use by Instagram/Facebook.

We process your data that you send us through these networks to communicate with you and to respond to your messages there.
This may also involve storage and further processing by us.

If you have given consent to Instagram for the data processing described above with effect for us, the legal basis is Art. 6 para. 1 lit. a GDPR. In addition, we have a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR in communicating with users as well as in our external representation for the purpose of advertising our company.

The purpose and extent of data collection and the further processing and use of data by Facebook, as well as your related rights and settings options to protect your privacy, can be found in the data protection notices of Instagram/Facebook. If you do not wish Instagram/Facebook to directly associate the information collected about your visit to our website with your Instagram profile, you must log out of Instagram before visiting our website.

For cases where personal data is transferred to the USA, standard contractual clauses apply.

4.3.6.2 LinkedIn

Our company operates a social media channel on the LinkedIn platform. There is a hyperlink to the LinkedIn platform on our website. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. The LinkedIn hyperlink is marked with a LinkedIn logo. An overview of the appearance of LinkedIn logos can be found behind the following link.

When you click the LinkedIn hyperlink, you will be redirected directly to our offer on LinkedIn and can follow us on LinkedIn – provided you are logged into your LinkedIn account. LinkedIn receives the information that you have visited our website with your IP address. Additionally, LinkedIn can then assign your visit to our website – provided you are logged into your LinkedIn account – to you and your user account. We would like to point out that we have no knowledge of the content of the transmitted (personal) data or their use by LinkedIn.

We process your data only when you contact our HR department through the LinkedIn platform or apply for a posted position via LinkedIn for these purposes. In this case, LinkedIn collects your data and makes it available to us. If you have given consent to the provider of the social network for the aforementioned data processing with effect for us, the legal basis is Article 6(1)(a) GDPR. This may also involve storage and further processing by us. Furthermore, we have a legitimate interest under Article 6(1)(f) GDPR in communicating with users and in our external representation for the purpose of advertising our company.

The purpose and scope of data collection and the further processing and use of data by LinkedIn, as well as your related rights and options for protecting your privacy, can be found in LinkedIn's privacy notices. If you do not wish LinkedIn to directly associate the information collected about your visit to our website with your LinkedIn profile, you must log out of LinkedIn before visiting our website.

For cases where personal data is transferred to the USA, the standard contractual clauses concluded with LinkedIn apply.

4.3.6.3 Vimeo

We operate one or more corporate websites on the social media network Vimeo, which is operated by Vimeo Inc., 555 West 18th Street, 10011 New York, primarily for self-presentation but also for recruiting. On our website, you will find a hyperlink to our offering on Vimeo, which is marked by the Vimeo logo. An overview of the appearance of the Vimeo logo can be found behind the following link.

Once you click on the hyperlink from Vimeo, you will be directed to our offering on Vimeo and can follow us – provided you are logged into your user account on Vimeo. This allows Vimeo to receive information that you visited our website with your IP address. Furthermore, in this case, Vimeo can link your visit to our website – if you are logged into your user account on Vimeo – to you and your user account. We would like to point out that we have no knowledge of the content of the transmitted (personal) data or their use by Vimeo.

We only process your data if you contact us via the Vimeo platform. In this case, Vimeo collects your data and provides it to us. There may also be storage and further processing by us. If you have given consent to Vimeo regarding the aforementioned data processing with effect for us, the legal basis is Article 6(1)(a) GDPR. Additionally, we have a legitimate interest pursuant to Article 6(1)(f) GDPR in the form of communication with our users as well as in our external representation for advertising purposes for our company.

The purpose and extent of data collection and the further processing and use of data by Vimeo as well as your related rights and settings for protecting your privacy can be found in Vimeo's privacy policy. If you do not wish for Vimeo to directly associate the information collected during your visit to our website with your Vimeo user account, you must log out of Vimeo before visiting our website.

For cases where personal data is transferred to the USA, the standard contractual clauses concluded with Vimeo shall apply.

4.3.6.4 Spotify

On our pages, you will find a hyperlink to the music service Spotify. The provider is Spotify AB, Birger Jarlsgatan 61, 113 56 Stockholm, Sweden. You can recognise the hyperlink by the green Spotify logo on our website. An overview of the appearance of the Spotify logo can be found behind the following link.

As soon as you click on the Spotify hyperlink, you will be redirected directly to our offering on Spotify and can follow us there – provided you are logged into your user account on Spotify. In this case, Spotify receives the information that you have visited our website with your IP address. Furthermore, it is possible for Spotify to associate your visit to our website with you and your user account – provided you are logged into your user account on Spotify. We would like to point out that we have no knowledge of the contents of the transmitted (personal) data and their use by Spotify.

We only process your data when you contact us via the music service Spotify. In this case, Spotify collects your data and makes it available to us. This may involve storage and further processing by us. If you have given consent to Spotify for the aforementioned data processing, which is effective for us, the legal basis is Article 6(1)(a) GDPR. In addition, we have a legitimate interest as per Article 6(1)(f) GDPR in communicating with our users and in our public representation for the purpose of promoting our company.

The purpose and scope of data collection and the further processing and use of the data by Spotify, as well as your related rights and options to protect your privacy, can be found in Spotify's privacy policy. If you do not wish for Spotify to immediately associate the information collected about your visit to our website with your Spotify account, you must log out of your Spotify account before visiting our website.

4.3.6.5 Medium

We also operate a page on the "Medium" portal, where we provide articles. The operator of this portal is A Medium Corporation, c/o Legal Department, P.O. Box 602, San Francisco, CA 94104–0602. The hyperlink placed on our page to our offerings on Medium is recognisable by the Medium logo. An overview of how the Medium logo looks can be found at the following link.

As soon as you click the Medium hyperlink, you will be redirected directly to our offerings on Medium and can follow us – provided you are logged into your user account at Medium. In this way, Medium receives the information that you visited our website with your IP address. Moreover, it is possible for Medium in this case to associate your visit to our website – provided you are logged into your user account at Medium – with you and your user account. We point out that we have no knowledge of the content of the transmitted (personal) data or their use by Medium.

We only process your data when you comment on our articles, follow us, or "like" the post; on Medium, this is the applause ("claps"). All this data is also processed by Medium. There may be storage and further processing by us as well. For the comments and "claps" you make, the legal basis is your implied consent under Art. 6 para. 1 lit. a GDPR. Additionally, we have a legitimate interest under Art. 6 para. 1 lit. f GDPR in the form of communication with our users and our external representation for the purpose of advertising our company.

The purpose and scope of the data collection and the further processing and use of the data by Medium as well as your related rights and options for protecting your privacy can be found in the privacy policy of Medium. If you do not wish for Medium to directly associate the information gathered from your visit to our website with your Medium account, you must log out of your Medium account before visiting our website.

Except for the processing described in 4.3, we do not pass your data to recipients based outside the European Union or the European Economic Area. The processing referred to in 4.3 involves the transfer of data to the servers of the providers of tracking technologiescommissioned by us. These servers are located in the USA. The data transfer is based on so-called standard contractual clauses of the EU Commission.

We would like to point out that the USA is not a safe third country within the meaning of EU data protection law. US companies are required to disclose personal data to security authorities without you as the affected party being able to take legal action against it. It cannot therefore be ruled out that US authorities (e.g., intelligence services) may process, evaluate and permanently store your data located on US servers for surveillance purposes. We have no influence over these processing activities.

6.1. Overview

In addition to the right to revoke your consents granted to us, you have the following additional rights where the respective legal requirements are met:

6.2. Right to object
Under the conditions of Article 21, Paragraph 1 of the GDPR, data processing may be objected to for reasons arising from the particular situation of the data subject.

The aforementioned general right of objection applies to all processing purposes described in this data protection information that are processed on the basis of Article 6, Paragraph 1, Letter f) of the GDPR. Unlike the specific right of objection aimed at data processing for advertising purposes, we are only obliged under the GDPR to implement such a general objection if you provide us with reasons of overriding significance (e.g. a possible threat to life or health). Furthermore, there is the possibility to contact the relevant supervisory authority, the Berlin Commissioner for Data Protection and Freedom of Information, at DAYONE GmbH.

7. How long do we store your data?

The duration of storage of personal data is based on the respective legal retention periods (e.g. commercial and tax retention periods). Typically, this period is 3 years (e.g. in the case of the regular limitation period for contractual claims) or 10 years (e.g. in the case of tax retention periods). After the expiry of the period, the corresponding data will be routinely deleted, unless they are no longer necessary for the fulfilment of the contract or for initiating a contract and/or we have no legitimate interest in continuing to store them.

Current status: 1 April 2026