Privacy Policy

StartHub Hessen is implemented by Hessen Trade & Invest GmbH (HTAI) on behalf of the Hessian Ministry of Economics.
The data controller within the meaning of the EU General Data Protection Regulation (GDPR), the Hessian Data Protection and Freedom of Information Act (HDSIG), and other national data protection laws of the member states, as well as other data protection regulations, is:

Hessen Trade & Invest GmbH
Mainzer Straße 118
65189 Wiesbaden
Phone: +49 611 95017 80
Email: info@htai.de
Website: www.htai.de

Represented by the Managing Director:
Dr. Rainer Waldschmidt

You can contact the data protection officer of the controller as follows:

SCHIEDERMAIR Beratungsgesellschaft für Datenschutz mbH
Eschersheimer Landstraße 60
60322 Frankfurt am Main
Email: datenschutzbeauftragter@hessen-agentur.de or info@schiedermair-datenschutz.com
Phone: +49 69 95508-400
Fax: +49 69 95508-401

Personal Data

Personal data refers to any information relating to an identified or identifiable natural person; a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Below, we describe how we process your personal data.

Storage of Personal Data in Our Customer Relationship Management System

Description and Scope of Data Processing: When you contact us for business purposes, we may store your personal data in our Customer Relationship Management system and, from time to time, inform you about current topics in our field of activity and events (not a newsletter).

The provision of personal data by you is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obligated to provide us with personal data.

Legal basis for data processing: The legal basis for data processing is the public mandate entrusted to us for economic development in the State of Hesse (Art. 6(1)(e) of the GDPR).

Purpose of data processing: The processing of personal data serves to organize our business contacts and to send information in connection with the fulfillment of the public mandate for economic development in Hesse entrusted to us.

Retention Period: The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. We regularly review, at least every three years, whether further retention of the data is necessary. This does not apply if legal or contractual obligations, in particular retention periods, preclude deletion.

Website Provision and Creation of Log Files

You can visit our website at any time without having to register or provide any personal information. However, every time you access our website, our system automatically collects data and information from the computer system of the device used to access the site.

Description and Scope of Data Processing: The following data is automatically collected when you visit a page:

browser type and version,
operating system used,
the website from which you are visiting us (referrer URL),
the webpage you are visiting,
the date and time of your visit,
your Internet Protocol (IP) address.

The collection and storage of system information in log files is absolutely necessary for the operation of the website.

Legal basis for data processing: The legal basis for the temporary storage of information and log files is Article 6(1)(f) of the GDPR.

Purpose of data processing: The temporary storage of the IP address you use is necessary to enable the website to be delivered to your computer. The purpose of storing data in log files is to ensure the functionality and stability of the website and our IT system. The data is not analyzed for marketing purposes in this context. The purposes described above also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR.

Retention period: The data is deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collected to provide the website, this occurs when the respective session ends. The data stored in log files is deleted no later than seven days after collection.

Contacting Us via Email

Description and Scope of Data Processing: When you contact us using the email address provided, the personal data transmitted with the email will be stored.

Legal basis for data processing: The legal basis for processing the data transmitted when you send an email is Article 6(1)(f) of the GDPR. Our legitimate interest lies in responding to your email inquiry. If the email contact is intended to conclude a contract or takes place during an ongoing contractual relationship, the additional legal basis for processing is Article 6(1)(b) of the GDPR.

Purpose of data processing: We process the personal data contained in an email solely for the purpose of handling the email inquiry.

Retention period: The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For personal data sent via email, this is the case once the respective conversation with you has ended. The conversation is considered ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved. This does not apply if deletion is precluded by legal or contractual obligations, in particular retention periods.

Contact Form

Description and Scope of Data Processing: When you submit a contact request via our contact form, the data entered in the form is transmitted to us and stored. At the time the message is sent, the IP address you used, as well as the date and time of the contact request, are also stored.

The provision of personal data by you is voluntary. Failure to provide personal data—insofar as such data is required—means that it will not be possible to contact us via the contact form, as we cannot process your request without this data.

Legal basis for data processing: The legal basis for processing the data transmitted via the contact form is our legitimate interest (Art. 6(1)(f) of the GDPR). Our legitimate interest lies in processing your contact request. In certain cases, we will obtain your consent to the processing of your data before you submit a contact request; in these cases, the legal basis is Article 6(1)(a) of the GDPR. If the contact request is intended to conclude a contract or is made in connection with an existing contractual relationship, the additional legal basis for processing is the implementation of (pre-)contractual measures (Art. 6(1)(b) of the GDPR).

Purpose of Data Processing: We process the personal data entered in the contact form solely for the purpose of handling your contact request.

Retention Period: The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. For personal data entered in the contact form, this occurs once the relevant conversation with you has ended. The conversation is considered concluded when the circumstances indicate that the matter in question has been definitively resolved. This does not apply if the deletion conflicts with legal or contractual obligations, in particular retention periods. The personal data collected additionally during the submission process will be deleted no later than seven days after submission.

Provision of information, communications regarding economic development (newsletters, mailings, informational mail)

Description and scope of data processing: As the economic development agency for the State of Hesse, one of our most important tasks is to provide information on state-specific and current topics and developments and to promote the State of Hesse. To this end, we communicate via mail and/or email and, depending on the communication channel, process names, mailing addresses, and email addresses.

If we offer the option to subscribe to one of our free newsletters on our website and you register, the data entered in the form is transmitted to us and processed for the purpose of sending you the requested newsletter. At the time you submit your newsletter subscription, the IP address you used, as well as the date and time of your registration, are also stored.

If you subscribe to the newsletter via our website, we verify your email address using a “double opt-in” procedure, in which you receive an email after signing up asking you to confirm your information and your consent to receive the newsletter within a certain period of time.

When you open one of our newsletters and click on a link or certain buttons within it, this action may be logged (date, time, email address). We process these open and click rates for statistical purposes so that we know our newsletters are being delivered and opened, and so that we can use the actions taken after opening a newsletter to tailor our content even better to the interests of our newsletter subscribers. This also constitutes our legitimate interest in data processing. This data is not analyzed for personal usage analysis or combined with other data to create user profiles.

The provision of personal data by you is voluntary. However, if you do not provide personal data—insofar as this data is required for subscribing to a newsletter—we will be unable to send you the newsletter.

Legal basis for data processing: The legal basis for processing data for the purpose of sending our newsletter is the consent you have provided (Art. 6(1)(a) of the GDPR). The legal basis for any statistical analyses conducted in connection with the distribution of the newsletter is Article 6(1)(f) of the GDPR. By sending the email as part of the double opt-in process, we fulfill our legal obligation to verify your email address, in accordance with Article 6(1)(c) of the GDPR.

As an economic development agency commissioned by the State of Hesse, we also perform tasks in the public interest or in the exercise of official authority by sending out information, in accordance with Article 6(1)(e) of the GDPR.

Purpose of data processing: The data is used exclusively for sending information. If other personal data is collected during the registration process for a newsletter, this is done to personalize the newsletter and to prevent misuse of the services or the email address provided.

Retention Period: You may object to receiving information at any time. You may revoke your consent to receive a newsletter at any time without providing a reason. In the event of an objection or revocation, your email or mailing address will be marked as “blocked” for the purpose of sending information or newsletters, to document that you no longer wish to be contacted by us in the future. Data that is no longer required will be deleted immediately. The flag and your email address will be deleted three years after the end of the calendar year in which the flag was set. If you do not confirm your subscription to the newsletter as part of the double opt-in process, we will block your data and delete it after one month.

Registration Forms for Topic-Specific Databases

Description and Scope of Data Processing: On our website, you have the option to register for topic-specific databases, such as the StartHub Community. When you submit the registration form, the data entered in the form is transmitted to us and stored. At the time the form is submitted, your IP address, as well as the date and time of submission, are also stored.

The provision of personal data by you is voluntary. Failure to provide personal data—insofar as such data is required—will result in the inability to register for the respective database.

Legal basis for data processing: By providing the databases, we fulfill our public-interest tasks of economic development and public relations. The legal basis for data processing in this context is Article 6(1)(e) of the GDPR. Depending on the structure of the registration process and the database, we will obtain your consent to data processing, in accordance with Article 6(1)(a) of the GDPR. If registration for a database takes place within the framework of an existing contractual relationship or for the purpose of establishing such a relationship, the additional legal basis is Article 6(1)(b) of the GDPR.

Purpose of Data Processing: The processing of personal data is intended solely to add you or the organization you represent to the respective database, to edit entries, and, if necessary, to be able to contact you for this purpose.

Retention Period: The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. If we reject your registration, we will delete the data no later than one month after the rejection. In the event of a successful registration, we will store the provided data for the duration of your inclusion in the respective database. You may delete your registration and be removed from the respective database at any time. To do so, please contact datenschutzbeauftragter@hessen-agentur.de.

Any additional personal data collected during the submission process will be deleted no later than seven days after collection.

For the provision and processing of this service, we use the services of Lime Technologies Germany GmbH (Probsteigasse 44-46, 50670 Cologne, hereinafter “Lime”) under a data processing agreement.

We have carefully selected Lime as a specialized service provider and regularly review its operations to ensure that your privacy is protected. Lime processes your personal data only on our behalf and in accordance with our instructions, and may use your personal data exclusively for the purposes specified by us. Compliance with these data protection provisions and the necessary security measures is guaranteed at all times.

Sending Newsletters via Lime

When processing email information and sending our newsletter to registered subscribers, we use the services of Lime Technologies Germany GmbH (Probsteigasse 44-46, 50670 Cologne, hereinafter “Lime”) under a data processing agreement.

With the help of Lime, we also analyze the success and responses to our newsletters for statistical purposes. In doing so, we evaluate whether and when a newsletter is opened, whether and which links are clicked, and how the newsletter is otherwise interacted with. For this purpose, the date and time, browser referrer, user agent, and data regarding user interactions are processed. For this purpose, the newsletters contain so-called “web beacons”—that is, pixel-sized files that are retrieved from the Lime server when a newsletter is opened and collect the information mentioned above.

If you do not wish to be tracked, you have the option to opt out. If you opt out, the date, time, and status (opt-out) will be stored.

Your consent to the processing of this data is obtained at the conclusion of the subscription process, and reference is made to this Privacy Policy.

We have carefully selected Lime as a specialized service provider and regularly review its practices to ensure that your privacy is protected. Lime processes your personal data only on our behalf and in accordance with our instructions, and may use your personal data exclusively for the purposes specified by us. Compliance with this privacy policy and the required security measures is guaranteed at all times.

Recording and Streaming of Online Events

Description and Scope of Data Processing: We record some events and offer them for (live) streaming on our websites and/or social media channels to enable real-time participation from outside the event venue and later access to recordings of an event. When recording online and hybrid events, any chat messages are stored separately; these are not published. In the case of online participation in events, connection data (device information and IP address) of the participants is also stored. This is technically necessary for online participation in an event.

The recordings may be published on our websites and/or social media pages. In doing so, we fulfill our mission to present and document our activities and to inform the public. For publication on social media channels, as well as for recordings containing portraits or close-ups of you, your consent will be obtained separately, and reference will be made to this Privacy Policy.

For the live streaming of events, we regularly collaborate with external service providers who act on our behalf in accordance with our instructions and based on a data processing agreement.

Legal basis for data processing: The legal basis for processing the data is your consent when we take portrait or close-up photos as part of our recordings and publish them on social media pages (Art. 6(1)(a) of the GDPR). The creation and publication of recordings featuring overview shots, group shots, and shots of speakers on websites is based on our public mandate for economic development and public relations (Art. 6(1)(e) of the GDPR). The legal basis for storing connection data in the case of online participation in an event is Article 6(1)(f) of the GDPR; our legitimate interest lies in ensuring the functionality of the systems required to conduct the event.

Purpose of data processing: The processing of personal data serves the purposes specified in the section “Description and Scope of Data Processing.”

Retention period: The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. Published recordings of events will remain stored as long as the respective publications are accessible or available. Connection data will be deleted no later than seven days after collection.

Recipients and Data Transfer to Third Countries: If, as part of your registration, you have consented to the publication on social media of photos and videos depicting you or a recording of the online event, the data will be transferred to the operators of these social networks. As part of your consent, you are informed that some social media operators are based outside the EU and the European Economic Area (EEA)—particularly in the United States—and that these countries do not have an adequate level of data protection. We cannot rule out the possibility that, even if social media operators are based in the EU, personal data may still be transferred to group companies in the United States or another country outside the EU or the EEA and/or stored on servers in the United States or another country outside the EU or the EEA. In particular, data may be transferred to the following social media operators:

Facebook
The service provider is Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland). The corporate headquarters, Meta Platforms, Inc., Menlo Park, California, USA, is certified to participate in the EU-U.S. Data Privacy Framework. For more information on data protection, please visit https://www.facebook.com/policy.php.

Instagram
The service provider is Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland). The parent company, Meta Platforms, Inc., based in Menlo Park, California, USA, is certified to participate in the EU-U.S. Data Privacy Framework. For more information on data protection, please see the Instagram Privacy Policy at https://privacycenter.instagram.com/policy.

LinkedIn
The service provider is LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland). For more information on data protection, please see LinkedIn’s Privacy Policy at https://www.linkedin.com/legal/privacy-policy and its Cookie Policy at https://www.linkedin.com/legal/cookie-policy.

X
The service provider is X Internet Unlimited Company (One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland). For more information on data protection, please see X’s Privacy Policy at https://x.com/de/privacy#x-privacy-9.1.

YouTube
The service provider is YouTube LLC (901 Cherry Avenue, San Bruno, CA 94066, USA), a subsidiary of Google LLC, USA. For more information on data protection, please see Google’s Privacy Policy at https://policies.google.com/privacy?hl=de.

Vimeo
The service provider is Vimeo, Inc. (555 West 18th Street, New York, New York 10011, USA). For more information on data protection, please see Vimeo’s Privacy Policy at https://vimeo.com/privacy. Vimeo processes personal data in the United States.

We cannot rule out the possibility that, even if social media operators are based in the EU, personal data may still be transferred to affiliated companies in the United States or another country outside the EU or the EEA and/or stored on servers in the United States or another country outside the EU or the EEA.

Registration for Events

For the live streaming of events, we regularly collaborate with external service providers who act on our behalf in accordance with our instructions and based on a data processing agreement.

Purpose of data processing: The processing of personal data serves the purposes specified in the section “Description and Scope of Data Processing.”

Registration for Networking Activities at Events

Description and Scope of Data Processing: Prior to certain events, visitors have the opportunity to register to participate in networking activities (known as “partnering” or “matchmaking”) and to submit profiles. When you submit your registration for partnering/matchmaking and your profile, the data entered in the forms is transmitted to us and stored. At the time the registration is submitted, the IP address you used, as well as the date and time of registration, are also stored. Your consent to the processing of this data is obtained as part of the submission process, and reference is made to this privacy policy. For recurring events, you may have the option to save your profile permanently for future events as well. We will indicate this separately in the consent form, if applicable.

Providing personal data is voluntary. However, participation in the partnering/matchmaking program is not possible if you do not provide us with the data marked as required fields.

Participants who have registered for the partnering/matchmaking program generally receive access to the profiles of other participants prior to the event and can contact them.

Legal basis for data processing: The legal basis for processing the data is your consent (Art. 6(1)(a) of the GDPR).

Purpose of data processing: The processing of personal data is intended solely for registration for and the implementation of measures to facilitate networking at events.

Retention period: The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. The personal data collected in your profile as part of the registration for partnering/matchmaking will be deleted no later than six months after the end of the event, unless you have consented to the longer retention of your profile.

The additional personal data collected during the submission process will be deleted no later than seven days after submission.

Taking and Publishing Photos

Taking and Publishing Photos and Videos

Description and Scope of Data Processing: As part of our special public mandate to promote and (further) develop economic development in the State of Hesse, it is our responsibility to inform the public about events through text and images in appropriate publications. To this end, photographs, audio recordings, and video recordings are made at events and published in print media, our own publications, on our websites, and/or on our social media platforms. We will obtain your consent for the taking of portrait and close-up photographs of you, as well as for publication on social media platforms, and will refer you to this Privacy Policy.

Legal basis for data processing: The legal basis for processing the photographs and video recordings is the public mandate entrusted to us by the Economic Development Agency of Hesse (Art. 6(1)(e) of the GDPR). If you have given your consent to the creation and/or publication of photographs, audio recordings, and video recordings, this constitutes the legal basis for data processing (Art. 6(1)(a) of the GDPR).

Purpose of data processing: The purpose of publishing photos and videos is to fulfill our specific public mandate to promote and (further) develop economic development in the State of Hesse and, accordingly, to inform the interested public about events.

Retention period: The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. If photos, audio recordings, and videos are not published, they will be deleted no later than one month after the event ends. Published photos, audio recordings, and videos will remain stored for as long as the respective publications are accessible or available.

Recipients and Data Transfer to Third Countries: For publication in print media, the photos taken are transmitted primarily to daily newspapers and publishing houses. If, as part of the registration process, you have consented to the publication of photos and videos depicting you on social media, the data will be transferred to the operators of these social networks. As part of the consent process, you are informed that some social media operators are based outside the territory of the EU and the European Economic Area (EEA)—particularly in the U.S.—and that some of these countries may not have an adequate level of data protection, or that confirmation of the adequacy of the data protection level is subject to additional conditions (e.g., certification of participation in the EU-U.S. Data Privacy Framework). We cannot rule out the possibility that, even if social media operators are based in the EU, personal data may still be transferred to affiliated companies in the United States or another country outside the EU or the EEA and/or stored on servers in the United States or another country outside the EU or the EEA. In particular, transfers may occur to the following social media operators:

We cannot rule out the possibility that, even if social media operators are based in the EU, personal data may still be transferred to group companies in the U.S. or another country outside the EU or the EEA and/or stored on servers in the U.S. or another country outside the EU or the EEA.

Registration Forms for Topic-Specific Databases

Description and Scope of Data Processing: On our website, you have the option to register for topic-specific databases. When you submit the registration form, the data entered in the form is transmitted to us and stored. At the time the form is submitted, the IP address you used, as well as the date and time of submission, are also stored.

The provision of personal data by you is voluntary. Failure to provide personal data—insofar as such data is required—will result in the inability to register for the respective database.

Legal basis for data processing: By providing the databases, we fulfill our tasks of economic development and public relations, which are in the public interest. The legal basis for data processing in this context is Article 6(1)(e) of the GDPR. Depending on the nature of the registration and the database, we will obtain your consent to the data processing, in accordance with Article 6(1)(a) of the GDPR. If registration for a database takes place within the framework of an existing contractual relationship or for the purpose of establishing such a relationship, the additional legal basis is Article 6(1)(b) of the GDPR.

Any additional personal data collected during the submission process will be deleted no later than seven days after submission.

Provision of (Interactive) Questionnaires

Description and Scope of Data Processing: We incorporate questionnaires into our services that allow you to assess your own skills, specific situations, and development potential, and/or to share your views and evaluations. As a general rule, the questionnaires can be completed without providing personal data and are evaluated by us anonymously. In some cases, certain information—such as your role or position—is collected that could be used to identify you, but we do not use this information for that purpose. Information from the questionnaires is generally stored separately from other data and information we collect.

If we offer to send you an evaluation and/or additional documents, you will typically have the option to provide your email address for this purpose.

In some cases, it is possible to save a questionnaire temporarily for later completion and retrieve it at a later time. This can be done via a link that is automatically generated and that you can send to your own email address. Alternatively, you can register by providing personal data and a password.

When you submit the questionnaire and/or register, the IP address you are using, as well as the date and time of submission, may be transmitted to us and stored by us.

The information provided in questionnaires may be anonymized for further evaluations, statistical surveys, and analyses.

Any provision of personal data by you is voluntary. Depending on the specific design, submitting a questionnaire may require registration, in which case the data marked as required fields must be provided.

Legal basis for data processing: The legal basis for the processing of personal data is Article 6(1)(a) of the GDPR, provided that we have obtained your consent. Otherwise, the legal basis is the pursuit of our legitimate interests pursuant to Article 6(1)(f) of the GDPR, whereby our legitimate interest lies in being able to provide you with the requested offers and features related to a questionnaire.

Purpose of data processing: The processing of personal data serves to send you the evaluation results and, if applicable, additional documents as requested upon provision of your email address, and to give you the option, in the event of registration, to save a questionnaire temporarily and complete it later.

Retention period: The data will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected. If you have provided us with your email address for the purpose of receiving the evaluation results and, if applicable, additional documents, your data will be deleted after the information has been sent. Any data used for temporarily saving a questionnaire will be deleted no later than seven days after you have completed the questionnaire. If you do not wish to complete the questionnaire, you may have it and your other stored data deleted at any time. To do so, please contact datenschutzbeauftragter@hessen-agentur.de.

Any additional data collected during the sending process will be deleted no later than seven days after the transaction.

Disclosure of Personal Data

We will not disclose your data to third parties unless you have given your express prior consent to such disclosure or the transfer is required or permitted by law. Excluded from this are our service partners who are necessary for the fulfillment of the contractual relationship and who have been commissioned by us under a data processing agreement to process personal data in accordance with our instructions.

If we have been commissioned by the State of Hesse (e.g., a ministry) as a data processor or project manager to oversee a project or campaign, the data collected in connection with the respective project or campaign may also be made available to the respective client. To the extent that no data processing under a data processing agreement is involved, the legal basis for this is Article 6(1)(e) of the GDPR in conjunction with Section 3(1) of the HDSIG, as we perform tasks in the public interest and a data transfer is necessary in this context. In individual cases, a data transfer may also be justified under Sections 21 and 22 of the HDSIG.

Use of Technically Necessary Cookies

Description and Scope of Data Processing: To make your visit to our website more engaging and to enable the use of certain features, we use technically necessary cookies on various web pages. These are small text files that are stored on your device.

Technically necessary cookies may also be used to enable the use of additional third-party tools—for example, for usage analysis or for evaluating and displaying marketing measures—and to manage your consent or refusal regarding these tools.

You can configure your browser to notify you when cookies are set and decide on a case-by-case basis whether to accept them, or to block cookies in specific cases or generally. If you do not accept cookies, the functionality of our website will be limited. The following links show you how to adjust the settings in the following common browsers:

Chrome: https://support.google.com/chrome/answer/95647?hl=de
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac

If you use different devices to visit our website (e.g., your computer, smartphone, tablet, etc.), you should ensure that your desired cookie settings are configured in each browser and on each device.

Legal basis for data processing: If personal data is processed using technically necessary cookies, the legal basis is Article 6(1)(f) of the GDPR and Section 25(2) of the TDDDG.

Purpose of Data Processing: The purpose of using technically necessary cookies is to make your visit to our website more appealing and to enable the use of certain features, such as language selection or browser recognition after registering in a website’s members-only area. Without the use of technically necessary cookies, certain features of our website cannot be provided. This also constitutes our legitimate interest within the meaning of Article 6(1)(f) of the GDPR.

The user data collected through cookies is not used to create user profiles.

Storage period: We use “session cookies.” A session cookie is a cookie that is automatically deleted after the user closes the browser.

Usage Analysis via Matomo

Description and Scope of Data Processing: This website uses the open-source web analytics service Matomo. Matomo uses cookies that enable us to analyze website usage. To this end, the information generated by cookies regarding the use of this website is stored on our server for the purpose of usage analysis. The IP address is anonymized before storage.

When individual pages of our website are accessed, the following data is stored:

Two bytes of the IP address of the user’s accessing system
Web pages accessed
The website from which the user reached the accessed web page
The subpages accessed from the accessed web page
The duration of the visit to the website
The frequency of visits to the website.

Legal basis for data processing: The legal basis for data processing is your consent pursuant to Art. 6(1)(a) of the GDPR and § 25(1) of the TDDDG.

Purpose of data processing: The purpose of the usage analysis is to optimize the website and enhance the appeal of our website.

Retention period: The data is deleted as soon as it is no longer needed for our record-keeping purposes. In our case, this occurs after seven days.

Error and Performance Monitoring via Sentry

Description and Scope of Data Processing: We use Sentry to analyze the stability and performance of the website. This service is an open-source platform provided by Functional Software, Inc., San Francisco, USA.

Sentry uses cookies to collect the following information from your device:

IP address of the user’s accessing system
Date and time of access
Browser type and version
Operating system used
Web pages accessed
Referrer URL (previously visited page)
Amount of data transferred
HTTP status code
Device type and model
Screen resolution
Plug-ins used (e.g., Flash, Java)
Browser language

Neither we nor Sentry perform usage analysis by recognizing individual users, nor is this technically possible.

Functional Software Inc. is certified under the EU-U.S. Data Privacy Framework.

Legal basis for data processing: The legal basis for data processing is your consent pursuant to Art. 6(1)(a) of the GDPR and § 25(1) of the TDDDG.

Purpose of data processing: We use Sentry to analyze the website’s susceptibility to errors and system stability. We conduct this analysis for the purpose of optimizing and maintaining the functionality of our website and services.

Retention period: No personal data is stored in connection with the error analysis.

Use of Adobe Fonts

To display visually appealing fonts, we use the external service Adobe Fonts provided by Adobe Systems Software Ireland Limited (4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland). In this process, several font files are loaded from the Adobe server into your browser and used for the content on the website. Adobe does not set any cookies to provide the fonts. However, information is collected about the website on which Adobe Fonts is used, such as the fonts provided, the ID, type, and version of the web project, the embedding type, the account ID used to identify the website operator, the service and server providing the fonts, and the hostname of the page where the fonts are loaded. This information is used for billing purposes related to Adobe Fonts and to ensure compliance with regulations. Adobe neither views nor stores your access data.

Further information about how Adobe handles your usage data is available in the Adobe Fonts Privacy Policy at https://www.adobe.com/de/privacy/policies/adobe-fonts.html. We cannot rule out the possibility that data may also be transferred to Adobe Inc., which is headquartered in the United States. Adobe Inc. is certified to participate in the EU-U.S. Data Privacy Framework.

If you do not wish for Adobe Fonts to collect your data, we recommend using a free browser extension such as uBlock Origin, which can be configured to block external font providers.

Embedded Videos

Embedding via YouTube

On our websites, you can watch videos that are embedded using a “plug-in” from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; a subsidiary of Google LLC). When you visit a webpage with an embedded video, YouTube processes system data about the device and browser you are using (IP address, browser type, device information, operating system).

YouTube uses cookies to collect data and analyze statistics, to prevent fraud, and to improve the user experience. Through the cookies set by YouTube, we receive statistical data regarding the views of individual videos embedded on the website, without any link to the specific user. If you watch a video embedded in this way, YouTube may also store and further process this data. If, in this case, you are logged into your YouTube account at the same time, YouTube may associate your browsing behavior with your YouTube user profile. You can prevent this data processing by logging out of your YouTube account before visiting our websites.

“Enhanced privacy mode” is enabled for YouTube videos on our website. This means that YouTube does not store cookies for users who view a website with an embedded YouTube video player but do not click on the video to start playback. Before you play a video, you will be informed that by clicking on a video link, you will leave the website of the data controller and be redirected to the YouTube video portal, where the webpage you are currently viewing will be transmitted. If you accept this, YouTube may, under certain circumstances, store the cookies mentioned above on your device; however, no personally identifiable cookie information is stored for views of embedded videos.

Since this is a third-party service, we have no control over YouTube’s processing of such data. For information on the purpose and scope of data collection, as well as the further processing and use of the data by YouTube or Google, and your related rights and privacy settings, please refer to the relevant privacy policy at https://policies.google.com/privacy?hl=de. Google also processes your personal data in the United States. Google LLC, headquartered in Mountain View, California, USA, is certified to participate in the EU-U.S. Data Privacy Framework.

Vimeo Videos and Related Data Collection and Use
You can access our video content on Vimeo (a service provided by Vimeo, Inc., 555 West 18th Street, New York, New York 10011, USA) through our video library or directly at https://vimeo.com/htai/videos. Since this is a third-party service, we have no influence over Vimeo’s processing of the relevant data. Vimeo states in its privacy policy that user information (including personal data) may be transferred to, stored, and processed in the United States, where Vimeo’s servers are located and its central database is operated. For more information on the purpose and scope of data collection, as well as the further processing and use of the data by Vimeo, and your rights and privacy settings in this regard, please refer to Vimeo’s privacy policy at https://vimeo.com/privacy.
We use a so-called “Content Delivery Network” (CDN) provided by Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, United States. CloudFront is certified under the Privacy Shield Framework and thereby guarantees compliance with European data protection law (https://aws.amazon.com/de/compliance/eu-data-protection/).
A CDN is a service that enables the content of our online offering—particularly large media files such as graphics or scripts—to be delivered more quickly via servers that are geographically distributed and connected via the Internet. User data is processed solely for the aforementioned purposes and to maintain the security and functionality of the CDN.
This use is based on our legitimate interests, i.e., our interest in the secure and efficient provision, analysis, and optimization of our online services in accordance with Article 6(1)(f) of the GDPR.
For more information, please refer to CloudFront’s Privacy Policy: https://aws.amazon.com/de/compliance/eu-data-protection/.

Embedded Maps

Use of Google Maps
Our websites use Google Maps, a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043. This allows us to display interactive maps directly on the website and enables you to conveniently use the map feature.
If you have consented to the transfer of data to Google by clicking the corresponding button, Google receives the information that you have accessed the relevant page of our website. In addition, the data listed under “Website Provision and Creation of Log Files” is transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish for your data to be associated with your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for advertising, market research, and/or to tailor its website to your needs. Such analysis is carried out in particular (even for users who are not logged in) to deliver targeted advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact Google.
For more information on the purpose and scope of data collection and its processing by Google, please refer to the information provided by Google at https://policies.google.com/privacy/update?hl=de&gl=de. There you will also find further information about your rights in this regard and settings options for protecting your privacy. Google also processes your personal data in the United States.
Use of OpenStreetMap
Our websites use map sections based on the OpenStreetMap (OSM) open data project.
If you have consented to the transfer of data, information about your use of the website (e.g., your IP address) will be transmitted to retrieve so-called tiles (map sections). Depending on which tiles are retrieved, data may also be transferred to countries outside Germany and the European Union or the European Economic Area, including the United States. The main server and infrastructure are currently operated in London, UK.
This service is an open-source offering over which we have no control regarding data collection and processing. In this context, the information collected may be transferred to third parties, processed on behalf of third parties, and, where applicable, combined with other data stored about the user; however, we have no information regarding this.
You can opt out of data collection by OpenStreetMap by not using the map view.
For more information on OpenStreetMap's use of personal data, please visit http://wiki.osmfoundation.org/wiki/Privacy_Policy.

Our Social Media Presence

You can find us on various social media channels. When you visit one of our social media pages, the respective social media provider processes your data to generate statistical analyses and to operate and improve its own services and offerings. Some of this data processing takes place regardless of whether you are registered with and logged into the social media platform you are visiting.

Some service providers provide us with analytics regarding the use of our social media accounts, which we use to analyze our offerings and the needs of our users. To this end, we evaluate the reach of our posts, the number of views our videos receive, and trends in our subscriber counts. We receive these analyses entirely in an anonymized form. The anonymized data, aggregated by groups or categories, includes: age, gender, users’ location (country and region/city), time and location of use, total number of users of individual features/sections, interactions (e.g., comments, click-through rate, views, shares), video watch time, devices used, operating systems, software, usage history (referring websites), language, and interests/topics viewed.

Anonymized analytics are updated daily and made available for an analysis period that includes the previous day.

We have no control over whether or to what extent service providers collect personal data. Nor are we aware of the scope, purpose, or retention period of such data collection. It must be assumed that at least the IP address and device-related information are collected and used. It is also possible that the operators use cookies and similar technologies to track and analyze user behavior on the provider’s platforms and other services.

Please note that some social media providers are based outside the EU and the European Economic Area (EEA)—particularly in the United States—and that some of these countries may not have an adequate level of data protection, or that confirmation of the adequacy of their data protection level may be subject to additional conditions (e.g., certification of participation in the EU-U. S. Data Privacy Framework). We cannot rule out the possibility that, even if social media providers are based in the EU, personal data may still be transferred to affiliated companies in the United States or another country outside the EU or the EEA and/or stored on servers in the United States or another country outside the EU or the EEA. In some third countries, such as the U.S., government agencies have extensive rights of access to data held by companies based in those third countries.

To the extent that we receive statistical analyses from the individual social media platform providers regarding the use of our profiles, we and the respective social media platform provider share responsibility for the related data processing activities.

Further information about the social media platform providers on which we maintain a profile:

Facebook
The service provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For more information on Facebook’s collection and use of personal data, please visit https://www.facebook.com/policy.php. When you use the Facebook page, Facebook stores cookies on your computer or smartphone. You can find information about this at https://www.facebook.com/policies/cookies. We have entered into a supplementary agreement with Facebook regarding joint responsibility, which specifies which data processing operations we and Facebook are responsible for when you visit our Facebook page; you can view this agreement at the following link: https://www.facebook.com/legal/controller_addendum. The corporate headquarters, Meta Platforms, Inc., Menlo Park, California, USA, is certified to participate in the EU-U.S. Data Privacy Framework.

Twitter / X
The service provider is Twitter International Unlimited Company (One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland). For more information on data protection, please see Twitter / X’s Privacy Policy at https://twitter.com/de/privacy#x-privacy-9.1.

Use of Adobe Fonts

To display visually appealing fonts, we use the external service Adobe Fonts provided by Adobe Systems Software Ireland Limited (4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland, “Adobe”). In this process, several font files are loaded from the Adobe server into your browser and used for the content on the website. Adobe does not set any cookies to provide the fonts. However, information is collected about the website on which Adobe Fonts is used, such as the fonts provided, the ID, type, and version of the web project, the embedding type, the account ID used to identify the website operator, the service and server providing the fonts, and the hostname of the page where the fonts are loaded. This information is used for Adobe Fonts billing and to comply with regulations. Adobe neither views nor stores your access data. To learn more about how Adobe handles your usage data, you can read the Adobe Fonts Privacy Policy at https://www.adobe.com/de/privacy/policies/adobe-fonts.html.

If you do not wish for Adobe Fonts to collect your data, we recommend using a free browser extension such as uBlock Origin, which can be configured to block external font providers.

Automated Decision-Making, Including Profiling

No automated decision-making, including profiling, takes place.

Rights of the Data Subject

If your personal data is being processed, you are a data subject within the meaning of the GDPR, and you have the following rights vis-à-vis the controller:

Right of Access: Pursuant to Article 15 of the GDPR, you have the right to request information about your personal data processed by us; in particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing, or objection; the existence of a right to lodge a complaint; the origin of your data, if it was not collected by us; and the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.

Right to Rectification: Pursuant to Article 16 of the GDPR, you have the right to request, without undue delay, the rectification of inaccurate personal data or the completion of incomplete personal data that we have stored about you.

Right to Erasure: Pursuant to Article 17 of the GDPR, you have the right to request the erasure of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or to establish, exercise, or defend legal claims.

Right to Restriction of Processing: Pursuant to Article 18 of the GDPR, you have the right to request the restriction of the processing of your personal data if you contest the accuracy of the data, if the processing is unlawful but you oppose its erasure, and we no longer need the data but you require it to assert, exercise, or defend legal claims, or you have objected to the processing pursuant to Article 21 of the GDPR.

Right to Data Portability: Pursuant to Article 20 of the GDPR, you have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller.

Right to File a Complaint: Pursuant to Article 77 of the GDPR, you have the right to file a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority in your usual place of residence, your place of work, or where our company is headquartered. In this case, the competent supervisory authority is: The Hessian Data Protection Commissioner, Visiting address: Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Mailing address: P.O. Box 3163, 65021 Wiesbaden, Email: Poststelle@datenschutz.hessen.de, Phone: +49 611 1408 - 0, Fax: +49 611 1408 – 900.

Right to Object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data that is carried out pursuant to Article 6(1)(f) of the GDPR.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes.

Right to Withdraw Consent: You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. You may send your withdrawal to the email address provided during registration or when placing an order, or in any case to datenschutzbeauftragter@hessen-agentur.de, or by mail using the address provided above.

Data Transmission Security

When communicating data over open networks, such as the Internet, the protection of transmitted data cannot be fully guaranteed with current technology, nor can it be completely safeguarded against access by third parties. Therefore, please do not send us any confidential data via the Internet (e.g., via the contact form or email) without adequate protection. However, all forms on this website that collect personal data are encrypted using the TLS 1.2 protocol. Furthermore, we employ appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

Changes to Our Privacy Policy

We reserve the right to update this Privacy Policy from time to time to ensure that it always complies with current legal requirements or to reflect changes to our services and website content in the Privacy Policy, such as when introducing new services. The most recent version of the Privacy Policy will apply each time you visit our website.

Effective: October 2025