Data Privacy Policy

Section 1: Information on the processing of personal data

1. (Welcome to our website! We regard data protection not only as a legal requirement but also as our moral duty. With the following information, we wish to inform you in line with statutory regulations about what happens to your personal data when you visit our website. Personal data is any information relating to you as an identified or identifiable person. This Privacy Policy is valid for the websites and services via which it is made available. Other privacy policies may apply to our other websites and services.
2. The controller as per Art. 4(7) of the EU General Data Protection Regulation (GDPR) is

Neumann & Müller GmbH & Co.KG
Strohgäustrasse 3
73765 Neuhausen auf den Fildern
Germany
Tel.: +49 711 305 29 100

Mail

Website

You can contact our company data protection officer at the address below with a letter addressed to “The Data Protection Officer”:

Thomas Brehm
c/o BBS Bier Brehm Spahn Partnerschaft Rechtsanwälte
Brandstwiete 46
20457 Hamburg
Germany

Alternatively, you can send an e-mail to datenschutz@neumannmueller.com

You can find other contact options in our Imprint on this website.

Section 2: Your rights

1. Within the scope of the law and in line with the legal prerequisites, you may exercise the following rights vis-à-vis us regarding your personal data:
   – Right of access to information
   – Right to rectification or erasure
   – Right to restriction of processing
   – Right to data portability
2. You also have the right to lodge a complaint with a data protection supervisory authority concerning infringements of data protection regulations.
3. If you have given consent to process your data, you can withdraw such consent at any time. Once you have withdrawn your consent, this will affect the reliability of the processing of your personal data.
   If processing of your personal data is based on the balancing of interests, you can lodge an objection against processing. This is especially the case if processing is not necessary to fulfil a contract with you, as described in the function description below. When exercising such an objection, please set out the reasons why we should not process your personal data in our customary way. In the event of a reasoned objection, we will examine the facts and either stop or amend processing or present you with compelling, legitimate grounds for continuing with the processing. You may of course object to the processing of your personal data for advertising and data analytics purposes at any time. If you wish to inform us of your objection to your personal data being used for advertising purposes, please use the above contact details.

Section 3: Collecting personal data upon visiting our website

General

1. If you use our website for information purposes only, that is to say if you do not log in or transmit information in any other way, we only collect the personal data your browser transmits to our server. If you would like to view our website, we collect the data listed below. This is technically necessary to show you our website and ensure stability and security (the legal basis for this is provided by Art. 6(1)(f) GDPR):
   – IP address
   – Date and time of your request
   – Time zone difference to Greenwich Mean Time (GMT)
   – Content of your request (specific page)
   – Access status/HTTP status code
   – Volume of transferred data
   – Website from which the request originates
   – Browser
   – Operating system and its user interface
   – Language and version of the browser software

Cookies

Our websites use cookies and similar technologies. Cookies are small text files stored on the user’s device by the Internet browser. A cookie usually contains a characteristic sequence of characters that enables unique identification of the browser when the website is accessed again.
Cookies are used to make the website more user-friendly, to optimise functions and services and to provide you with customised content.
Technical cookies are used to enable and facilitate use of the website and the functions provided. Some functions of this website cannot be provided without the use of cookies.
The user data collected by means of technically necessary cookies is not used to generate user profiles.
Furthermore, with your separate consent, cookies can be used to provide external media such as films and maps as well as for analysis of use of the website and for other functions.
You can deactivate or restrict the use of cookies by changing the settings in your Internet browser. Cookies that have already been set can be deleted at any time. This can also be done automatically. If cookies are deactivated for the website, it may no longer be possible to use all the functions on the website to their full extent.
The legal basis for processing personal data using technically necessary cookies is Art. 6(1)(f) GDPR, whereby the legitimate interest of the controller is the secure, stable, efficient provision of the website’s functions and of the information accessed through such functions. If the purpose of the function in question is to fulfil a contractual obligation we have with you, the legal basis is provided by Art. 6(1)(b) GDPR
If the user has given corresponding consent, Art. 6(1)(a) GDPR in combination with Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) provides the legal basis for processing personal data using cookies for analytics purposes and for other not technically necessary processing purposes.

We provided data privacy information on cookie-based services in this Privacy Policy or directly in the cookie settings of this website.

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Ltd. Google Analytics uses “cookies”, text files that are stored on your computer and enable analysis of your use of the website. The information generated by the cookie about your use of the website will normally be transmitted to and stored by Google on servers in the United States. If IP anonymisation is activated on this website, however, your IP address will first be truncated by Google within Member States of the European Union or in any other country which is party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of the website for the purposes of evaluating your use of the website, compiling reports on website activity and providing the website operator with other services relating to use of the website and of the Internet.

The IP address transferred by your browser as part of Google Analytics will not be combined with any other data held by Google.

You can prevent the installation of cookies by selecting an appropriate setting in your browser software. However, please note that if you do so, you may not be able to use all functions of this website to their full extent. Furthermore, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) for Google and the processing of this data by Google by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dhttps://tools.google.com/dlpage/gaoptout?hl=en-GBlpage/gaoptout?hl=de.

This website uses Google Analytics with the extension “_anonymizeIp()”. IP addresses are processed in a truncated form and cannot be linked to a specific person. If the data collected about you can be linked to you, this possibility will be eliminated without undue delay and the personal data erased without undue delay.

We use Google Analytics to analyse and regularly improve use of our website. The statistics we obtain help us to improve our offering and make it more interesting for you as a user.

Your data will be distributed across various physical data carriers. This has the advantage that data is available more quickly and better protected against tampering. Every Google computer centre has an appropriate emergency programme for your data. For example, if hardware fails at Google, or if the servers crash due to a natural disaster, the risk of an interruption to services at Google remains slight.

The data retention period depends on the properties used. The retention period is always determined separately for each individual property. Google Analytics provides us with four options for setting the retention period.

• 2 months: This is the shortest retention period.
• 14 months: The default data retention period in GA4 is 14 months.
• 26 months: Data can also be retained for 26 months.

Data is also deleted if we delete it manually. You also have the option of having your data deleted if you do not visit our website within the period you have selected. In this case, the retention period is reset each time you return to our website within the set period.

When this period expires, the data is deleted once a month. This retention period applies to your data linked to cookies, user IDs and ad IDs (e.g. cookies from the DoubleClick domain).

Vendor information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001.

Terms of service: http://www.google.com/analytics/thttps://marketingplatform.google.com/about/analytics/terms/us/rms/de.html.

Overview of data protection: http://www.google.com/intl/de/analytics/learn/privacy.html.

Privacy policy: http://www.google.de/intl/de/https://policies.google.com/privacy?hl=en-GB&gl=depolicies/privacy

When using Google Analytics, personal data may be transferred to the United States. So-called EU standard contractual clauses have been drawn up to cover this situation. These can be viewed here: https://policies.google.com/privacy?hl=en-GB&gl=de

Section 4: Processing of personal data in connection with making contact and order processing

In addition to simply using our offerings for information purposes, you – as a client, potential client or contact person – can send enquiries regarding our products and services in the fields of events and event technology or can place a specific order. This normally requires that you provide us with further personal data – in particular details we need to contact people in your company. We process this data so we can work on your request, answer your enquiries, enter into contracts with you and render the corresponding performance. It also allows us to process resulting tasks such as handling complaints, asserting and realising claims or responding to your feedback.

We also process personal data if this is necessary to meet legal obligations: for example in order to comply with documentation or retention obligations under tax law or commercial law.

Forwarding data to third parties

Personal data will only be forwarded to third parties if and to the extent that this is necessary for contract performance. This is especially the case if we collaborate with external service providers, business partners or logistics companies to realise an event and provide such companies with the information they require to provide their service (e.g. contacts, delivery addresses or technical requirements). Payment data may also be forwarded to payment service providers for the purpose of processing payments.

In any other cases, your data will only be forwarded to third parties if we are legally obliged to do so, if you have given your express consent or if any other facts apply that legally grant permission.

Legal bases for data processing

The following legal bases apply to the processing of your personal data:

• Consent (Art. 6(1)(a) GDPR): If you have given us your express consent to process certain data for specified purposes, this shall form the basis for processing. Once granted, such consent can be withdrawn at any time with future effect.
• Contract performance or taking steps prior to entering into a contract (Art. 6(1)(b) GDPR): Processing is necessary for performance of a contract with you or, upon request from you, to take steps prior to entering into a contract.
• Compliance with legal obligations (Art. 6(1)(c) GDPR): We process data if this is necessary to comply with legal obligations, in particular regarding tax law or commercial law.
• Legitimate interests (Art. 6(1)(f) GDPR): In certain cases, we process personal data to pursue our legitimate interests or the legitimate interests of third parties. This includes, in particular, efficient communication with you, processing matters not covered by a contract, analysing and commenting on feedback, improving our customer service, optimising our services and aligning them to actual needs, maintaining business relations and clarifying and resolving technical or organisational problems. Processing may also be necessary to track and prevent misuse or fraud or to resolve functional or security problems.

We always take great care to check whether our legitimate interests are overridden by yours and ensure that data processing complies with what is permissible by law.

Section 6: Data protection in connection with job applications and the application procedure

We process personal data from applicants for the purpose of handling the application procedure.

If we enter into an employment contract with an applicant, the data transferred is stored in compliance with statutory regulations for the purpose of managing the employment relationship. If we do not enter into a contract of employment with the applicant, the application documentation will be automatically deleted four months after the applicant is informed of the rejection. This is subject to the condition there are no other legitimate interests of the controller responsible for processing that preclude such deletion. An example of other legitimate interests in this context would be a duty to provide evidence in legal proceedings under the German General Act on Equal Treatment (AGG). The legal basis for processing the applicant’s personal data is provided by Art. 6(1)(b) 88 GDPR in combination with Section 26 of the German Data Protection Act (BDSG); if processing is for the purpose of meeting legal obligations, the basis is provided by Art. 6(1)(c) GDPR; if processing is based on the consent of the data subject, the basis is provided by Art. 6(1)(a) GDPR in combination with Section 26 BDSG.

Section 7: E-mail notifications and newsletter

1. Our website gives you the opportunity of signing up for our newsletter using a registration form. We need your e-mail address so we can send you our newsletter. The data you provide for this purpose will only be used to send you our newsletter.
   We use the double opt-in process for registration for our newsletter. That means you have to give your express consent once again to allow us to send you the newsletter after using the registration form. After registering, you will receive an e-mail with a separate activation link. This confirmation is necessary to prevent misuse. If the activation link is not confirmed within 30 days, all data and information previously collected in connection with the newsletter will be deleted.
   The newsletter will be sent and your data processed on the basis of your voluntarily granted consent. The legal basis is Art. 6(1)(a) GDPR. We will retain the data collected in connection with the newsletter for as long as you are registered.
   You can unsubscribe from the newsletter at any time with future effect free of charge and withdraw your consent. Withdrawing your consent will result in the data collected in connection with sending the newsletter being deleted unless it is needed for other purposes.
2. If you give us your e-mail address in connection with the purchase of a product or service, we may use it for the electronic transmission of advertising for our own products similar to those you have already acquired from us. We will not do so if you have objected to such use.
   The legal basis for using your e-mail address for advertising similar products is provided by Section 7(3) of the German Act against Unfair Competition (UWG) in combination with Art. 6(1)(f) GDPR, the legitimate interest being direct marketing. You can object to the use of your e-mail address at any time by sending a notification using the above contact data or by using the unsubscribe function we provide in every marketing e-mail. This does not involve any cost other than transmission costs based on the basic charges for the communication channel you use.

Section 8: Recipients

Your data will only be forwarded to third parties if and to the extent that this is necessary to enable us to comply with our contractual duties to you (Art. 6(1)(b) GDPR, for example forwarding your address as the delivery address to a logistics partner or to a courier for the purpose of delivering post or parcels.

We sometimes use external service providers to process your data (processors). These have been carefully selected and commissioned by us. They are obliged to follow our instructions and are subjected to regular reviews. Our processors may only use personal data for the purposes specified by us. They are contractually obliged to comply with data privacy requirements.

Beyond the above, we only forward your personal data if the law obliges us to do so (Art. 6(1)(c) GDPR), if you have given your express consent (Art. 6(1)(a) GDPR) or if any other facts apply that legally grant permission. Your personal data will not be forwarded for any purposes other than those stated here.

In certain cases, your data may be forwarded on the basis of our legitimate interests or the legitimate interests of third parties. Our legitimate interests include, in particular:

• Efficient and safe handling of our business processes
• Protection and assertion of our contractual claims and rights
• Prevention of misuse and fraud
• Ensuring IT security and operation of our systems
• Optimising our services and aligning them to actual needs
• Maintaining and developing business relations with our clients and partners

In so doing, we always take great care to check whether our legitimate interests are overridden by yours and ensure that data processing complies with what is permissible by law.

If our service providers or partners are located in a state outside of the European Economic Area (EEA), we will advise you of the associated consequences in the description in this Privacy Policy. In such cases, we will ensure that an appropriate level of data protection is in place in the recipient’s organisation, for example by means of EU standard contractual clauses or a European Commission adequacy decision.

Section: 9 Erasure

Unless otherwise stated in the respective specific notifications, the data controller will process personal data in line with the statutory regulations for the purposes outlined here and only for as long as personal identification of the data subject is necessary for the purpose concerned. The personal data will then be erased or neutralised/anonymised in line with the provisions of the data protection laws.

If we store data to comply with legal obligations, particularly obligations relating to tax law, the retention period can be up to 10 years.

If we store data to comply with contractual obligations and, where appropriate, to provide evidence to a court or public authority, such data will normally be erased upon expiry of the statutory limitation period. This is 3 years beginning with 31st December of the year in which the claim arose.

Data from a user account that we do not need for the purpose of contract performance or providing evidence is only retained for the duration of the business relationship with the user. Such data will be erased immediately upon termination of the contract.

Section 10: Social networks

Facebook

This section applies to the processing of personal data in connection with our Facebook presence.

Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”) is responsible for collecting and processing personal user data on Facebook websites. Please note that Facebook also collects and processes certain information regarding your visit to our Facebook page even if you do not have a Facebook user account or are not logged in to Facebook. You can find further information in data processing by Facebook in their Privacy Policy: https://www.facebook.com/about/privacy/.

As operator of the Facebook page, we can only view your public Facebook profile. The information that can be viewed here depends on the settings in your profile. We also process personal data (such as your name, content of your messages, enquiries or other posts to us) if you contact us via our Facebook page or publish contents via our presence, for example in the form or comments or posts. We only process this data for the purpose of managing and possibly replying to your enquiries or posts. These purposes also constitute our legitimate interests within the meaning of Art. 6(1)(f) GDPR.

Joint controllership in accordance with Art. 26 GDPR

As operators of a Facebook page, we are joint controllers together with Meta Platforms Ireland Limited regarding the processing of “Insights” data” in accordance with Art. 26 GDPR. Facebook provides us with anonymised statistical analyses of the use of our Facebook page (“Facebook Insights”). These statistics are compiled on the basis of personal data collected by Facebook when you visit our Facebook page. We have no influence on the compilation or processing of this Insight data. We merely receive aggregated, indirect personal analyses.

The agreement on joint controllership with Facebook can be found at: https://www.facebook.com/legal/terms/page_controller_addendum

Facebook bears primary responsibility for processing Insights data and complying with obligations under data protection law regarding such data. You can contact us and Facebook regarding your concerns relating to data protection law.

Storage outside Facebook

When we receive personal data through communication via our Facebook page, we store it – if necessary – on our own systems, i.e. outside Facebook, and only for as long as we need it for the purpose in question or for as long as we are required to do so to comply with statutory retention requirements.

Instagram

This Privacy Policy applies to our Instagram presence: Instagram is part of the Facebook group of companies and shares infrastructure, systems and technologies with Facebook itself and other Facebook companies. You will find further information at: https://www.facebook.com/help/111814505650678?ref=dp

Please note that Facebook/Instagram collects and stores the data of those using its services (e.g. personal information, IP address, etc.) any may use such data for business purposes. You will find more detailed information on data processing by Facebook at Instagram in the Instagram Privacy Policy: https://help.instagram.com/519522125107875?helpref=page_content

We have no influence on data collection and processing by Facebook/Instagram. We are unable to determine how much, where and for how long data is stored, whether Facebook/Instagram complies with erasure obligations, how data is analysed and linked, and to whom data is forwarded. If personal data is processed in connection with our Instagram page and Facebook/Instagram alone decides on the purposes and means of processing, Meta Platforms Ireland Limited (Facebook Ireland Limited), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland is solely responsible for data processing.

You can contact Instagram’s company data protection officer via the contact form provided by the company: https://www.facebook.com/help/contact/540977946302970

The Instagram Privacy Policy describes the categories of personal data processed when using Facebook products, the general purposes and categories of recipients. You will find the Privacy Policy at: http://instagram.com/legal/privacy/

You will find more information on the data processed when using Facebook products at: https://www.facebook.com/help/1561485474074139?ref=dp

You will also find information on the legal bases for processing in the Privacy Policy: https://www.facebook.com/about/privacy/legal_bases

The Privacy Policy also contains information on how to withdraw consent relating to the processing of personal data.

You will find more detailed information on how to object to processing at: https://www.facebook.com/help/2069235856423257

The Privacy Policy also contains information on how long personal data is retained, the criteria for determining this period as well as information on blocking and deleting Instagram accounts. The Privacy Policy also makes reference to the intention of Facebook/Instagram regarding the possible transfer of data to third countries. Please note that when personal data is processed in the United States of America, the level of protection for your data may be lower than that for processing within the EU.

If you visit our Instagram page, and your browser allows the storage of cookies, Facebook/Instagram will store information in the form of cookies in your browser’s memory and can access such information when you visit Instagram or other websites where Instagram technology is incorporated.

You will find further information on the purposes of cookies, on the incorporation of such cookies by other websites and how you can control your information at: https://help.instagram.com/1896641480634370?ref=ig

Cookies enable Facebook/Instagram to track your user behaviour (when signed in this is also possible across various devices) and to draw up profiles of your behaviour. This concerns both registered and unregistered persons. If you wish to avoid such transparency, we recommend that you log out from Facebook and Instagram; deactivate the “Keep me logged in” feature, delete any cookies, close your browser and open it again.

Depending on your privacy settings, certain information on your profile, your “Likes” and your posts is visible to us as operators of the page. You will find information on changing your privacy settings at: https://www.facebook.com/help/instagram/116024195217477?cms_id=116024195217477

Processing by us

If you wish to contact us about our Instagram presence or interact with our content (e.g. by means of comments or direct messages), we will process your personal data on the basis of Art. 6(1)(f) GDPR. In such cases our legitimate interest is to address the point you raised and communicate with you in an appropriate manner. If you contact us with regard to entering into a contract, Article 6(1)(b) GDPR provides an additional legal basis for processing.

LinkedIn

We maintain an online presence on LinkedIn so that we can present our company and our services, and communicate with business partners and potential clients. LinkedIn is a service provided by the LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, a subsidiary of the LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

If you visit or follow our LinkedIn company profile, LinkedIn will process your personal data. Based on such data, LinkedIn will provide us with anonymous statistics on the use of our company page and any interactions (“Page Insights”). These statistics enable us to analyse user behaviour in an aggregated form, for example the number of clicks, reaches, interactions and demographic analyses such as job function, country, industry, seniority, company size and employment status. We only receive this data in an anonymised form so that we are not able to identify individual persons.

Please note that LinkedIn is an autonomous provider that processes personal data under its own responsibility. You will find information on how LinkedIn processes your personal data in the LinkedIn Privacy Policy at: https://www.linkedin.com/legal/privacy-policy

Joint controllership in accordance with Art. 26 GDPR

We and LinkedIn have joint controllership according to Art. 26 GDPR with regard to processing “Page Insights” data. LinkedIn undertakes to assume primary responsibility for the processing of Insights data and to comply with all obligations arising from GDPR in connection with the processing of Insights data. You will find the agreement on joint controllership at: https://legal.linkedin.com/pages-joint-controller-addendum

You can contact us and LinkedIn regarding your concerns relating to data protection law.

Transferring data to third countries

LinkedIn may possibly process user data outside the European Union, particularly in the USA. The basis for such transfers to third countries is provided by the Data Privacy Framework (DPF): https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

Legal basis for processing

The basis for processing your personal data in connection with our company page on LinkedIn is our legitimate interest according to Art. 6(1)(f) GDPR). Out legitimate interests are increasing the range of our company presence and content, establishing and maintaining our business network and addressing and recruiting qualified personnel. If you voluntarily provide certain data to LinkedIn or have given consent, your data will be processed on the basis of your consent in accordance with Art. 6 (1)(a) GDPR.

Xing

We maintain a company profile on XING, a service provided by New Work SE, Am Strandkai 1, 20457 Hamburg, Germany. You will find further information on how XING handles your personal data in XING’s Privacy Policy at: https://privacy.xing.com/en/privacy-policy?nwt_nav=footer.

When you visit our XING profile, XING collects and processes personal data under its own responsibility. We only receive data from XING that you have published in your XING profile or actively send to us when making contact. This can be, for example, your job function, contact details or the content of your message.

We process this data to communicate with you, answer enquiries, enter into or perform a contract, establish an employment relationship or send you information about our company, our services, our products or current job vacancies. This data is processed to the extent permitted and in accordance with XING’s terms and conditions of use.

Our legitimate interests within the meaning of Art. 6(1)(f) GDPR are, in particular, the external presentation of our company, communication with potential clients, existing clients and business partners, recruiting, and maintaining our business network. If we need to process your data in connection with entering into, performing or terminating a contract, this is done on the basis of Art. 6 (1)(b) GDPR. If processing is based on your consent, the legal basis is provided by Article 6(1)(a) GDPR. Once granted, you can withdraw such consent at any time with future effect.

Please note that New Work SE bears primary responsibility for data processing on the XING platform. We have no influence on the type or scope of XING’s data processing.