Data Protection Policy

Preamble

With the following data protection policy, we would like to inform you which types of your personal data (hereinafter also referred to as “data”) we process, for what purposes, and to what extent. This data protection policy applies to all processing of personal data carried out by us, both in the context of providing our services and especially on our websites, in mobile applications, as well as in online presences within external platforms such as our social media profiles (referred to collectively below as “online offer”).

The terms used are not gender-specific.

Last updated: September 9, 2025

Table of Contents

• Preamble
• Controller
• Overview of Processing Activities
• Relevant Legal Bases
• Security Measures
• Transfer of Personal Data
• General Information on Data Storage and Deletion
• Rights of Data Subjects
• Performance of Duties according to Statutes or Rules of Procedure
• Business Processes and Procedures
• Providers and Services Used in Business Activities
• Payment Procedures
• Provision of Our Online Offer and Web Hosting
• Use of Cookies
• Blogs and Publishing Media
• Contact and Inquiry Management
• Communication via Messenger
• Video Conferences, Online Meetings, Webinars and Screen Sharing
• Cloud Services
• Newsletters and Electronic Notifications
• Surveys and Questionnaires
• Web Analytics, Monitoring and Optimization
• Online Marketing
• Social Media Presences
• Plugins and Embedded Features and Content
• Management, Organization and Auxiliary Tools
• Amendments and Updates
• Definition of Terms

Prof. Dr. Annette Grüters-Kieslich
Eva Luise und Horst Köhler Foundation
for People with Rare Diseases
Simrockstr. 4
53113 Bonn

Authorized representatives:

Prof. Dr. Annette Grüters-Kieslich, Achim Schroeter

Email address: info@elhks.de

Imprint: https://elhks.de/en/imprint/

Relevant Legal Bases

Relevant legal bases under the GDPR: The following provides an overview of the legal bases of the GDPR on which we process personal data. Please note that national data protection requirements in your or our country of residence or business location may apply in addition to the provisions of the GDPR. If more specific legal bases are relevant in certain cases, we will inform you in this data protection policy.

• Consent (Art. 6 para. 1 sentence 1 lit. a) GDPR) – The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.
• Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the request of the data subject.
• Legal obligation (Art. 6 para. 1 sentence 1 lit. c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6 para. 1 sentence 1 lit. f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
• Membership contract (Articles of association) (Art. 6 para. 1 sentence 1 lit. b) GDPR).

National data protection regulations in Germany: In addition to the GDPR, national data protection regulations apply in Germany. This includes, in particular, the Federal Data Protection Act (BDSG). The BDSG contains, among other things, special provisions on the right to information, the right to erasure, the right to object, processing of special categories of personal data, processing for other purposes, transmission, and automated decision-making in individual cases including profiling. State data protection laws of the individual German states may also apply.

Notice on the application of GDPR and Swiss FADP: These data protection notices serve to provide information in accordance with both the Swiss Federal Act on Data Protection (FADP) and the GDPR. As such, please note that GDPR terminology is used due to the broader application and comprehensibility. In particular, instead of the terms used in the Swiss FADP, such as “processing” of “personal data”, “overriding interest”, and “particularly sensitive personal data”, the terms “processing” of “personal data”, “legitimate interest”, and “special categories of data” as used in the GDPR are applied. However, the legal meaning of the terms remains as determined under the Swiss FADP where applicable.

Security Measures

We take appropriate technical and organizational measures, in accordance with statutory requirements and considering the state of the art, implementation costs, nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of the risks to the rights and freedoms of natural persons, to ensure a level of security appropriate to the risk.

These measures include in particular the safeguarding of confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, input, transmission, securing availability, and separation. Furthermore, we have established procedures to ensure the exercise of data subject rights, erasure of data, and response to data threats. We also take data protection into account during the development or selection of hardware, software, and processes in accordance with the principle of data protection by design and by default.

IP address truncation: If IP addresses are processed by us or by service providers and technologies used by us and the processing of a full IP address is not required, the IP address is truncated (also referred to as “IP masking”). In this process, the last two digits or the last part of the IP address after a period is removed or replaced with placeholders. The truncation is intended to prevent or significantly hinder identification of a person based on their IP address.

Securing online connections with TLS/SSL encryption technology (HTTPS): In order to protect user data transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstone technologies for secure data transmission on the Internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thus protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by “HTTPS” in the URL. This signals to users that their data is being securely and encryptedly transmitted.

Transfer of Personal Data

In the course of our processing of personal data, it may happen that the data is transmitted to other bodies, companies, legally independent organizational units, or persons or disclosed to them. Recipients of this data may include service providers commissioned with IT tasks or providers of services and content integrated into a website. In such cases, we comply with the statutory requirements and in particular enter into corresponding contracts or agreements with the recipients of your data that serve to protect your data.

Transfer of data within the organization: We may transmit personal data to other departments or units within our organization or grant them access to it. If the transfer of data is for administrative purposes, it is based on our legitimate business and organizational interests, or it is required to fulfill our contractual obligations, or if there is consent of the affected persons or a legal permission exists.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with statutory requirements as soon as the basis for consent is withdrawn or no further legal bases for processing exist. This applies to cases where the original purpose of processing no longer applies or the data is no longer needed. Exceptions exist when statutory obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax reasons or whose storage is necessary for legal action or to protect the rights of other natural or legal persons must be archived accordingly.

Our data privacy notices contain additional information about retention and deletion of data that applies specifically to certain processing activities.

If there are several different retention periods or erasure deadlines for a given dataset, the longest period always applies. Data that are no longer needed for their original purpose but are kept due to legal requirements or other grounds are processed only for the reasons justifying their retention.

Retention and deletion of data:

The following general deadlines apply to retention and archiving according to German law:

• 10 years – Retention period for books and records, annual accounts, inventories, management reports, opening balance sheets, and the work instructions and other organizational documents necessary to understand them (§ 147 para. 1 no. 1 in conjunction with para. 3 AO, § 14b para. 1 UStG, § 257 para. 1 no. 1 in conjunction with para. 4 HGB).
• 8 years – Accounting vouchers, such as invoices and cost receipts (§ 147 para. 1 nos. 4 and 4a in conjunction with para. 3 sentence 1 AO and § 257 para. 1 no. 4 in conjunction with para. 4 HGB).
• 6 years – Other business documents: received business or commercial letters, copies of outgoing business or commercial letters, other documents relevant for taxation such as timesheets, cost calculation sheets, price labels, but also payroll records as long as they are not accounting vouchers and cash register tapes (§ 147 para. 1 nos. 2, 3, 5 in conjunction with para. 3 AO, § 257 para. 1 nos. 2, 3 in conjunction with para. 4 HGB).
• 3 years – Data needed for considering potential warranty and compensation claims or similar contractual claims and rights and for handling related inquiries, based on past business experience and standard industry practice, are stored for the duration of the statutory limitation period of three years (§§ 195, 199 BGB).

Review and compliance with deletion deadlines: Compliance with statutory and internal requirements regarding the deletion of personal data is regularly reviewed. We ensure that all personal data that is no longer required or whose retention period has expired is deleted in accordance with applicable data protection laws, or, where retention or archiving is required, processing is restricted to those purposes. These checks of deletion requirements and compliance with established erasure periods are conducted regularly, at least once a year. The results of the assessments are documented and evaluated by the person(s) responsible for deletion review. If deviations are identified, corrective measures are implemented immediately, and the effectiveness of these actions is evaluated in subsequent reviews to ensure ongoing compliance.

Performance of Duties According to Statutes or Rules of Procedure

We process the data of our members, supporters, interested parties, business partners, or other individuals (collectively, “data subjects”) whenever we are engaged with them in a membership or other business relationship, carry out our statutory tasks, or are recipients of services and benefits. Furthermore, we process the data of data subjects based on our legitimate interests, such as when fulfilling administrative tasks or conducting public relations.

The type, scope, and purpose of the processed data, as well as the necessity of their processing, are determined by the underlying membership or contractual relationship, which also defines the necessity for providing certain information (we indicate required information where needed).

We delete data that are no longer necessary for fulfilling our statutory and business purposes. This depends on the respective tasks and contractual relationships. We retain the data as long as they are relevant to business operations or with regard to potential warranty or liability obligations, based on our legitimate interest in their settlement. The necessity of retaining the data is regularly reviewed; otherwise, the statutory retention periods apply.

• Types of data processed: Inventory data (e.g., full name, residential address, contact information, customer number, etc.); Contact data (e.g., postal and email addresses or phone numbers); Contractual data (e.g., subject of contract, term, customer category); Membership data (e.g., personal data such as name, age, gender, contact details (email address, phone number), membership number, information regarding membership dues, participation in events, etc.); Payment data (e.g., banking information, invoices, payment history).
• Data subjects: Members; prospects; communication partners; donors; third parties.
• Purposes of processing: Communication; organizational and administrative processes; public relations and informational purposes; fundraising.
• Retention and deletion: Deletion in accordance with the statements made in the section “General Information on Data Storage and Deletion.”
• Legal bases: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR); Membership contract (statutes) (Art. 6 para. 1 sent. 1 lit. b) GDPR).

Further notes on processing activities, procedures, and services:

• Events and organizational operations: Planning, execution, and follow-up of events, as well as the general operation of statutory activities. Planning includes collecting and processing participant data, coordination of logistics, and setting the event agenda. Execution involves managing participant registration, updating participant information during the event, and recording attendance and participant activities. Follow-up comprises the analysis of participant data to evaluate event success, report creation, and archiving relevant information. General organizational operations cover management of member data, communication with members and prospects, and organizing internal meetings and sessions; Legal bases: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR), Membership contract (statutes) (Art. 6 para. 1 sent. 1 lit. b) GDPR).
• Public relations: Procedures include creating and distributing informational materials, maintaining contact data for press and media relations, and organizing and conducting press conferences and public events. Creating informational materials involves collecting and preparing information for press releases, newsletters, reports, and other publications. Distribution takes place via digital and traditional channels, including email lists, websites, and social media. Maintaining contact data comprises collecting and updating media contact data and other relevant stakeholder information. Organizing press conferences and events involves planning and executing these events, invitation management, and coordinating logistics. Interaction with media and stakeholders occurs through direct communication with journalists, bloggers, and other opinion leaders, responding to inquiries, and providing information; Legal bases: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR), Membership contract (statutes) (Art. 6 para. 1 sent. 1 lit. b) GDPR).
• Fundraising: Procedures include planning and conducting fundraising campaigns, managing donor data, and communicating with donors and potential sponsors. Campaign planning involves developing strategies, setting goals, and choosing channels for fundraising. Campaign execution involves initiating and implementing specific fundraising actions, collecting donations via online platforms, events, and direct contact. Managing donor data encompasses collecting, updating, and analyzing data to optimize future campaigns. Communication with donors and potential sponsors is carried out with personalized messages, thank you letters, and regular updates on project achievements and fund usage; Legal bases: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR), Membership contract (statutes) (Art. 6 para. 1 sent. 1 lit. b) GDPR).

Provision of Online Offer and Web Hosting

We process user data to provide them with our online services. For this purpose, we process the IP address of the user, which is necessary to deliver the content and functions of our online services to the user’s browser or device.

• Types of data processed: Usage data (e.g., page views, duration of visit, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features); meta-, communication-, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons); log data (e.g., log files concerning logins or data retrieval or access times); content data (e.g., textual or visual messages and posts and information related to them, such as details of authorship or time of creation).
• Affected persons: Users (e.g., website visitors, users of online services).
• Purposes of processing: Provision of our online offer and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)); security measures.
• Retention and deletion: Deletion according to the information in the section “General information on data storage and deletion.”
• Legal basis: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR).

Further information on processing operations, procedures, and services:

• Provision of online offer on rented storage space: For the provision of our online offer, we use storage space, computing power, and software that we rent or otherwise acquire from an appropriate server provider (also known as a “web host”); Legal basis: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR).
• Collection of access data and log files: Access to our online offer is logged in the form of so-called “server log files.” Server log files may include the address and name of the accessed websites and files, date and time of access, data volume transferred, message about successful retrieval, browser type and version, user’s operating system, referrer URL (the page previously visited), and as a rule, IP addresses and requesting provider. Server log files may be used for security purposes, e.g., to prevent server overload (in particular in cases of abusive attacks, known as DDoS attacks), as well as to ensure server utilization and stability; Legal basis: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR). Data deletion: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data that must be stored for evidentiary purposes are excluded from deletion until the incident is finally resolved.
• Email transmission and hosting: Our web hosting services also include the sending, receiving, and storage of emails. For these purposes, the addresses of recipients and senders, as well as additional information regarding email transmission (e.g., involved providers) and the contents of individual emails, are processed. The above data may also be processed for spam detection purposes. Please note that, in general, emails are not encrypted on the Internet. While emails are typically encrypted during transport, they are not usually end-to-end encrypted on the servers from which they are sent and received. Therefore, we cannot accept responsibility for data transmission of emails between the sender and reception on our server; Legal basis: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR).
• Hetzner: Services in the area of providing information technology infrastructure and related services (e.g., storage space and/or computing capacity); Provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR); Website: https://www.hetzner.com/; Privacy policy: https://www.hetzner.com/de/rechtliches/datenschutz/. Data Processing Agreement: https://docs.hetzner.com/de/general/general-terms-and-conditions/data-privacy-faq/.
• Ninja Firewall: Firewall and security as well as error detection features; provider. Processing in European data centers in Germany (Nuremberg and Falkenstein), France (Paris), and Luxembourg (Bissen); Provider: NinTechNet Limited, Unit 1603, 16th Floor, The L. Plaza 367 – 375 Queen’s Road Central Sheung Wan, Hong Kong, China; Legal basis: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR); Website: https://nintechnet.com/. Privacy policy: https://nintechnet.com/about/#privacy/.
• Yoast SEO: Website search engine optimization; Provider: Yoast B.V., Don Emanuelstraat 3, 6602 GX Wijchen, Netherlands; Legal basis: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR); Website: https://yoast.com/; Privacy policy: https://yoast.com/privacy-notice/. Further information: Operation within an in-house hosting environment.
• INWX: Services in the area of providing information technology infrastructure and related services (e.g., storage space and/or computing capacity); Provider: INWX GmbH, Prinzessinnenstr. 30, 10969 Berlin, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR); Website: https://www.inwx.de/de/. Privacy policy: https://www.inwx.de/de/aboutus/dataprotection/.
• dogado: Services in the area of providing information technology infrastructure and related services (e.g., storage space and/or computing capacity); Provider: dogado GmbH, Saarlandstr. 25, D-44139 Dortmund, Germany; Legal basis: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR); Website: https://www.dogado.de/; Privacy policy: https://www.dogado.de/legal/datenschutz/. Data Processing Agreement: Provided by the provider.
• Note about optional services: Certain analytics or marketing services may be used occasionally or in the future, e.g., for test or optimization purposes. These services may already be specified in our privacy policy, even if they are not currently active. Once such a service is used, processing will be conducted exclusively based on your consent in accordance with Art. 6 para. 1 lit. a GDPR via our consent management tool.

Use of Cookies

The term “cookies” refers to features that store and retrieve information on users’ devices. Cookies may be used for various purposes, including functionality, security, comfort of online services, and analyzing visitor flows. We use cookies in accordance with legal regulations. Where required, we obtain users’ consent in advance. If consent is not necessary, our legitimate interests serve as the basis. This applies when the storage and retrieval of information are essential to provide explicitly requested content and features, such as saving settings and ensuring the functionality and security of our online offer. Consent may be revoked at any time. We clearly inform users about their scope and which cookies are used.

Notes on data protection legal bases: Whether we process personal data by means of cookies depends on user consent. If consent is given, it serves as the legal basis. Without consent, our legitimate interests apply, as described in this section and in the context of relevant services and procedures.

Storage duration: The following types of cookies are distinguished in relation to storage duration:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user leaves an online offer and closes their device (e.g., browser or mobile application).
• Permanent cookies: Permanent cookies remain stored even after the device is closed. For example, login status can be saved and preferred content displayed immediately upon a user’s return to a website. User data collected via cookies may also be used for reach measurement. Unless we inform users explicitly about the type and duration of cookies (such as when obtaining consent), users should assume these are permanent and may be stored for up to two years.

General information about withdrawal and objection (opt-out): Users may revoke their consents at any time and may also object to processing as stipulated by law, including through their browser’s privacy settings.

Cookie settings/opt-out option:
Click here to edit your cookie settings.

• Types of data processed: Meta-, communication-, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
• Affected persons: Users (e.g., website visitors, users of online services).
• Legal basis: Legitimate interests (Art. 6 para. 1 sent. 1 lit. f) GDPR); consent (Art. 6 para. 1 sent. 1 lit. a) GDPR).

Further information on processing operations, procedures, and services:

• Processing of cookie data based on consent: We use a consent management solution to obtain users’ consent for the use of cookies or for procedures and providers specified in the consent management solution. This procedure serves to obtain, record, manage, and revoke consents, particularly regarding the use of cookies and comparable technologies used for storing, retrieving, and processing information on users’ devices. In this process, user consents to the use of cookies and associated data processing—including specific procedures and providers referenced in the consent management process—are obtained. Users can also manage or withdraw their consents. Consent declarations are stored to avoid repeated requests and to provide proof of consent as required by law. Storage is carried out server-side and/or in a cookie (so-called opt-in cookie) or using comparable technologies, to assign consent to a specific user or device. Unless otherwise stated regarding consent management service providers, the following general information applies: Consent is stored for up to two years. A pseudonymous user identifier is created that is stored along with the timestamp, scope of consent (e.g., categories of cookies and/or service providers), and information about the browser, system, and device used; Legal basis: Consent (Art. 6 para. 1 sent. 1 lit. a) GDPR).
• BorlabsCookie: Consent management: procedure for obtaining, recording, managing, and withdrawing consent, especially for the use of cookies and similar technologies for the storage, retrieval, and processing of information on users’ devices and related processing; Provider: Operation on servers and/or computers under our own responsibility for data protection; Website: https://de.borlabs.io/borlabs-cookie/. Further information: An individual user ID, language, types of consents given, and the time they were granted are stored server-side and in a cookie on the user’s device.

Blogs and Publishing Media

We use blogs or similar forms of online communication and publication (hereinafter “publication media”). Reader data is processed for the purpose of the publication media only as far as necessary for its presentation and communication between authors and readers or for security reasons. For further details, please refer to the information on processing visitors to our publication media as provided in these data protection notices.

• Types of data processed: Inventory data (e.g., full name, residential address, contact details, customer number, etc.); contact information (e.g., postal and email addresses or phone numbers); content data (e.g., text or image-based messages and contributions, as well as related information such as authorship details or creation time); usage data (e.g., page visits and dwell time, click paths, usage frequency and intensity, device types and operating systems used, interactions with content and functions). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
• Data subjects: Users (e.g., website visitors, online service users).
• Purpose of processing: Feedback (e.g., collecting feedback via online forms). Provision of our online offer and user-friendliness.
• Retention and deletion: Deletion in accordance with the details outlined in the “General Information on Data Storage and Deletion” section.
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Newsletter and Electronic Notifications

We send newsletters, emails, and other electronic notifications (hereafter “newsletters”) only with the recipient’s consent or based on legal authorization. If newsletter content is described during sign-up, this content is binding for user consent. Typically, providing your email address is sufficient for newsletter registration. However, to provide you with a personalized service, we may also request your name for personalized addressing in the newsletter or other information necessary for the newsletter’s purpose.

Deletion and Restriction of Processing: We may retain unsubscribed email addresses for up to three years based on our legitimate interests before deletion, in order to demonstrate prior consent if needed. The processing of this data is limited to the potential defense of claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed. If an obligation to permanently honor objections applies, we will keep the email address solely for this purpose in a suppression list (so-called “blocklist”).

The logging of the registration process is carried out on the basis of our legitimate interest in proving the proper flow of registration. If we task a service provider with delivering emails, this is also based on our legitimate interests in an efficient and secure delivery system.

Content:

Our newsletters contain information about our topics, services, and company.

• Data types processed: Inventory data (e.g., full name, residential address, contact details, customer number, etc.); Contact data (e.g., postal and email addresses or phone numbers); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons); Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features).
• Categories of affected persons: Communication partners.
• Purposes of processing: Direct marketing (e.g., by email or mail).
• Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR).
• Opt-out: You can unsubscribe from our newsletter at any time, i.e., revoke your consent or object to further receipt. A link for unsubscribing is provided at the end of every newsletter or you may use any other contact method given above, preferably via email.

Further Notes on Processing, Procedures, and Services:

• Double opt-in procedure: Signing up for our newsletter generally uses a double opt-in procedure. After signing up, you will receive an email asking you to confirm your registration. This confirmation is required so that no one can register with someone else’s email address. Newsletter registrations are logged to be able to prove the registration process meets legal requirements. This includes storing the registration and confirmation timestamps as well as the IP address. Changes to your data stored with us are also logged.
• Open and click rate tracking: Newsletters contain a so-called “web beacon”, i.e., a one-pixel image that is retrieved from our, or if a mail delivery service is employed, their server when the newsletter is opened. Technical information such as details about your browser and system, your IP address, and the time of retrieval are gathered. These details help technically improve our newsletter based on technical data or user groups and their reading habits—such as their locations (determinable via IP address) or access times. This analysis also includes whether and when newsletters were opened and which links were clicked. The information is assigned to individual newsletter recipients and stored in their profiles until deleted. The evaluations help us recognize reading habits and personalize content or send different content aligned with our users’ interests. Open and click tracking as well as storage and further processing in user profiles is performed based on user consent. It is not possible to unsubscribe from success tracking separately; if you wish to opt out, you must unsubscribe entirely from the newsletter. In this case, stored profile information will be deleted; Legal basis: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR).

Online Marketing

We process personal data for the purpose of online marketing, which in particular includes the marketing of advertising space or the display of promotional and other content (collectively referred to as “content”) based on the potential interests of users, as well as measuring their effectiveness.

For these purposes, user profiles are created and stored in a file (the so-called “cookie”) or similar procedures are used, which save user information relevant to the display of the above-mentioned content. These may include viewed content, visited websites, online networks used, as well as communication partners and technical data such as the browser used, computer system, usage times, and the features accessed. If users have agreed to the collection of their location data, these may also be processed.

IP addresses of users are also stored. However, we utilize available IP-masking techniques (i.e., pseudonymization by shortening the IP address) for user protection. As a rule, no clear user data (such as email addresses or names) is stored during online marketing activities, but only pseudonyms. This means that neither we nor the providers of the online marketing tools know the actual identity of the users, only the information stored in their respective profiles.

The profile data is typically saved in cookies or similar procedures. These cookies can generally also be read on other websites using the same online marketing system and analyzed for content display purposes, supplemented with additional data, and stored on the respective online marketing provider’s server.

Exceptionally, it is possible to assign clear data to the profiles, especially when users are, for example, members of a social network that we use for our online marketing, and the network links the profiles with the aforementioned data. Please note that users may reach separate agreements with these providers, such as consent given during registration.

Generally, we only have access to aggregated information about the success of our advertising campaigns. However, as part of so-called conversion measurements, we can determine which of our online marketing methods have led to a conversion, such as signing a contract with us. Conversion tracking is used exclusively to analyze the effectiveness of our marketing efforts.

Unless stated otherwise, please assume that cookies used are stored for a period of up to two years.

Legal Basis Information: If we request user consent for the use of third-party providers, permission constitutes the legal basis for data processing. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economical, and recipient-friendly services). In this context, we also refer you to our cookie policy in this privacy statement.

Information on Withdrawal and Objection:

We refer to the privacy policies of each provider and their offered options for objection (so-called “Opt-Out”). If no explicit opt-out option is provided, you may disable cookies in your browser settings. However, this may limit features of our online offering. We therefore also recommend the following opt-out solutions, which cover specific regions:

1. a) Europe: https://www.youronlinechoices.eu/.
2. b) Canada: https://www.youradchoices.ca/choices/.
3. c) USA: https://www.aboutads.info/choices/.
4. d) Cross-region: https://optout.aboutads.info/.

Settings/Objection Options: Certain third-party services (e.g., Google services) will only be loaded after you have given consent; without consent, no data transfer to these providers will occur.

• Types of Data Processed: Usage data (e.g., page visits, session length, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features); Meta, communication, and process data (e.g., IP addresses, timestamps, IDs, involved parties). Event Data (Facebook) (“Event Data” refers to information sent, for example, via Meta Pixel (including through apps or other channels) to the provider Meta, relating to people or their actions. This includes data such as website visits, interactions with content and features, app installations, and product purchases. Event Data is processed to build audiences for content and marketing messages (Custom Audiences). Importantly, Event Data does not include actual content such as comments, login information, or contact details (e.g., names, emails, or phone numbers). “Event Data” is deleted by Meta after a maximum of two years, and related target groups are deleted when our Meta user accounts are deleted.).
• Data Subjects: Users (e.g., website visitors, online service users).
• Purposes of Processing: Reach measurement (e.g., access statistics, recognizing returning users); tracking (e.g., interest/behavior-based profiling, use of cookies); audience building; marketing; profiles featuring user-related information (profile creation); conversion measurement (measuring marketing effectiveness); provision of our online offering and user-friendliness. Click tracking.
• Storage and Deletion: Deletion according to the section “General Information on Data Storage and Deletion.” Cookies may be stored for up to 2 years (unless otherwise specified, cookies and similar storage methods may remain on user devices for up to two years).
• Security Measures: IP masking (pseudonymization of IP address).
• Legal Bases: Consent (Art. 6(1)(1)(a) GDPR). Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further Information on Processing Activities, Procedures, and Services:

• Google Ad Manager: We use the “Google Ad Manager” service to place ads in the Google advertising network (e.g., in search results, videos, websites, etc.). Google Ad Manager ensures ads are shown in real time based on the presumed interests of users. This allows us to display ads for our online offering to users who might have a potential or previous interest, and to measure ad performance; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Legitimate interests (Art. 6(1)(1)(f) GDPR); Website: https://marketingplatform.google.com/; Privacy Policy: https://policies.google.com/privacy/; Data Transfer Basis: Data Privacy Framework (DPF); Further Information: Data processing types and categories: https://business.safety.google/adsservices/; Data Processing Terms for Google Ad Services: Controller-to-Controller Terms and Standard Contractual Clauses for data transfers: https://business.safety.google/adscontrollerterms/. If Google acts as a processor, processing terms and Standard Contractual Clauses for data transfers: https://business.safety.google/adsprocessorterms/.
• Google Ads and Conversion Measurement: Online marketing system to place content and ads in the provider’s advertising network (e.g., in search results, videos, websites) so they are displayed to users who are likely interested. We also measure ad conversions, i.e., whether users interacted and engaged with ads and offers (so-called conversions). We only receive anonymous information, not personal data about individual users; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Bases: Consent (Art. 6(1)(1)(a) GDPR), Legitimate interests (Art. 6(1)(1)(f) GDPR); Website: https://marketingplatform.google.com/; Privacy Policy: https://policies.google.com/privacy/; Data Transfer Basis: Data Privacy Framework (DPF); Further Information: Types and categories of data processing: https://business.safety.google/adsservices/. Controller-to-Controller Terms and Standard Contractual Clauses for data transfers: https://business.safety.google/adscontrollerterms/.
• Instagram Ads: Placement of advertisements on Instagram and evaluation of the results; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Basis: Consent (Art. 6(1)(1)(a) GDPR); Website: https://www.instagram.com/; Privacy Policy: https://privacycenter.instagram.com/policy/; Data Transfer Basis: Data Privacy Framework (DPF); Opt-out Option: Please refer to Instagram’s privacy and advertising settings, as well as its consent procedures and contact options for exercising rights in the privacy policy; Further Information: User Event Data, i.e., behavioral and interest information, is processed for targeted advertising and audience building under a joint controller agreement (“Controller Addendum,” https://www.facebook.com/legal/controller_addendum/). This arrangement solely covers data collection and transfer to Meta Platforms Ireland Limited, an EU-based company. Further processing, especially transfers to Meta Platforms, Inc. (USA), is the sole responsibility of Meta Platforms Ireland Limited.
• LinkedIn Insight Tag: Code that loads when a user visits our site, tracks user behavior and conversions, and saves them in a profile (possible uses include measuring campaign performance, optimizing ad delivery, building custom and lookalike audiences); Service Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal Basis: Consent (Art. 6(1)(1)(a) GDPR); Website: https://www.linkedin.com/; Privacy Policy: https://www.linkedin.com/legal/privacy-policy/, Cookie Policy: https://www.linkedin.com/legal/cookie_policy/; Data Processor Addendum: https://www.linkedin.com/legal/l/dpa/; Data Transfer Basis: Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa/). Opt-out Option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out/.
• Microsoft Advertising: Online marketing procedure to place content and ads within the provider’s advertising network (e.g., in search results, videos, websites) targeting users with assumed interest. We also measure ad conversions (engagement or utilization of promoted offers). Only anonymous information is received, not personal info on individual users; Service Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal Bases: Consent (Art. 6(1)(1)(a) GDPR), Legitimate interests (Art. 6(1)(1)(f) GDPR); Website: https://about.ads.microsoft.com/en-us/; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement/; Data Transfer Basis: Data Privacy Framework (DPF). Opt-out Option: https://account.microsoft.com/privacy/ad-settings/.
• UTM Parameters: Analysis of sources and user actions based on an extension of referring URLs by an additional parameter, the “UTM” parameter. For example, the UTM parameter “utm_source=platformX&utm_medium=video” can tell us that a person clicked the link on platform X within a video. UTM parameters provide info about the link source, medium (e.g., social media, website, newsletter), campaign type or content (e.g., post, link, image, and video). This helps us improve our web visibility or evaluate campaign effectiveness; Legal Basis: Legitimate interests (Art. 6(1)(1)(f) GDPR).
• LinkedIn Ads: Placement of ads on the LinkedIn platform and evaluation of results; Service Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal Bases: Consent (Art. 6(1)(1)(a) GDPR), Legitimate interests (Art. 6(1)(1)(f) GDPR); Website: https://business.linkedin.com/de-de/marketing-solutions/ads/; Privacy Policy: https://www.linkedin.com/legal/privacy-policy/; Data Processor Addendum: https://www.linkedin.com/legal/l/dpa/; Data Transfer Basis: Data Privacy Framework (DPF), Standard Contractual Clauses (https://de.linkedin.com/legal/l/dpa/); Opt-out Option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out/. Further Information: https://legal.linkedin.com/dpa/.

Plugins and Embedded Features and Content

We integrate functional and content elements into our online offering that are retrieved from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include graphics, videos, or city maps (collectively referred to as “content”).

Integration always requires that these third-party providers process users’ IP addresses, as they could not send content to users’ browsers without the IP address. The IP address is therefore necessary to display this content or functionality. We strive only to use content whose providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags allow information such as visitor traffic on the pages of this website to be evaluated. Pseudonymized information may also be stored in cookies on users’ devices and may include technical data (such as browser and operating system details, referring websites, visit times) as well as additional usage details relating to our online offering and may be combined with data from other sources.

Notes on Legal Bases: If we ask users for consent to use third-party providers, the legal basis for processing data is permission. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economic, and recipient-friendly services). In this context, we also refer you to the information on cookies in this Privacy Policy.

• Types of Data Processed: Usage data (e.g., page views and time spent, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and features). Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, involved persons).
• Affected Individuals: Users (e.g., website visitors, online service users).
• Purposes of Processing: Provision of our online offering and user-friendliness; reach measurement (e.g., access statistics, recognition of repeat visitors); tracking (e.g., interest/behavior-based profiling, use of cookies); audience segmentation; marketing. Profiles with user-related information (creation of user profiles).
• Retention and Deletion: Deletion according to the section “General Information on Data Storage and Deletion”. Cookies may be stored for up to 2 years (unless otherwise specified, cookies and similar storage methods may remain on users’ devices for up to two years).
• Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR). Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).

Further Notes on Processing Operations, Procedures, and Services:

• Integration of Third-Party Software, Scripts, or Frameworks (e.g., jQuery): We use software in our online offering that we retrieve from the servers of other providers (e.g., function libraries to display or improve user-friendliness of our online offering). The respective providers collect users’ IP addresses and may process this data to transmit the software to users’ browsers, and for security, evaluation, and optimization purposes. – We integrate software from the servers of other providers as described; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR).
• Instagram Plugins and Content: Instagram plugins and content – These may include images, videos, texts, and buttons that allow users to share content from this online offering on Instagram. – We jointly control, together with Meta Platforms Ireland Limited, the collection or receipt (but not further processing) of “event data” obtained by Facebook through Instagram functionalities (e.g., embedded content features) used on our online offering, or that Facebook receives for the following purposes: a) Display of content and advertising information that matches users’ presumed interests; b) Delivery of commercial and transactional messages (e.g., user communication via Facebook Messenger); c) Improvement of ad delivery and personalization of features and content (e.g., better recognition of content or ads that may match users’ interests). We have a special agreement with Facebook (“Controller Addendum”, https://www.facebook.com/legal/controller_addendum) specifying security requirements (https://www.facebook.com/legal/terms/data_security_terms), and Facebook has agreed to fulfill data subject rights (i.e., users can, for example, request information or deletion directly from Facebook). Note: Where Facebook provides us with aggregated metrics, analyses, and reports (which do not identify users and are anonymous to us), this processing does not fall under joint controllership but rather a data processing agreement (“Data Processing Terms”, https://www.facebook.com/legal/terms/dataprocessing), including “Data Security Terms” (https://www.facebook.com/legal/terms/data_security_terms) and, regarding processing in the U.S., based on Standard Contractual Clauses (“Facebook-EU Data Transfer Addendum”, https://www.facebook.com/legal/EU_data_transfer_addendum). User rights (especially access, deletion, objection, and complaints to supervisory authorities) are not restricted by the agreements with Facebook; Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.instagram.com/. Privacy Policy: https://privacycenter.instagram.com/policy/.
• LinkedIn Plugins and Content: LinkedIn plugins and content – These may include images, videos, texts, and buttons that allow users to share content from this online offering on LinkedIn; Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.linkedin.com/; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Data Processing Agreement: https://legal.linkedin.com/dpa; Third-Country Transfer Basis: Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.linkedin.com/legal/l/dpa/). Opt-Out Option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out/.
• OpenStreetMap: We integrate maps from the “OpenStreetMap” service, offered on the basis of the Open Data Commons Open Database License (ODbL) by the OpenStreetMap Foundation (OSMF). User data is used by OpenStreetMap solely to display mapping functions and to temporarily store user preferences and settings. This may include, in particular, users’ IP addresses and location data, which are not collected without their consent (usually via device or browser settings); Provider: OpenStreetMap Foundation (OSMF); Legal Bases: Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR); Website: https://www.openstreetmap.de/. Privacy Policy: https://osmfoundation.org/wiki/Privacy_Policy/.
• YouTube Videos: Video content; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Bases: Consent (Art. 6 para. 1 sentence 1 lit. a GDPR); Website: https://www.youtube.com; Privacy Policy: https://policies.google.com/privacy/; Third-Country Transfer Basis: Data Privacy Framework (DPF). Opt-Out Option: Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Ad display preferences: https://myadcenter.google.com/personalizationoff/.
• Integration of External Mapping Services (Atlas Map): We integrate interactive maps from the Atlas Map service, provided via the SE-ATLAS platform (University Hospital Frankfurt, Theodor-Stern-Kai 7, 60590 Frankfurt am Main) into our website. The maps are loaded using iFrames from https://map.ext.se-atlas.de/. When accessing a page with an embedded map, your browser establishes a direct connection with the ext.se-atlas.de servers. In the process, personal data such as your IP address and technical information (e.g., browser type, operating system, access time) are transmitted to the provider. We have no control over how this data is subsequently processed by the provider. For further details, please review the SE-ATLAS privacy policy.
  The legal basis for integration is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the user-friendly display of map content. If, in the future, the integration requires your consent, data processing will take place on the basis of Art. 6 para. 1 lit. a GDPR (consent); Provider: SE-ATLAS, University Hospital Frankfurt, Theodor-Stern-Kai 7, 60590 Frankfurt am Main; Website: https://www.se-atlas.de/. Privacy Policy: https://www.se-atlas.de/aboutus/privacy/.
• Note on Optional Services: Certain analytics or marketing services may be used occasionally or in the future for testing or optimization. These services may already be listed in our Privacy Policy, even if they are currently inactive. Whenever such a service is used, processing will take place exclusively based on your consent according to Art. 6 para. 1 lit. a GDPR, via our consent management tool.

Amendments and Updates

We kindly ask you to regularly check the content of our Privacy Policy. We update the Privacy Policy whenever changes to our data processing require it. We will inform you if such changes require cooperation or an individual notification from you (e.g., consent).

If we provide addresses and contact details of companies and organizations in this Privacy Policy, please note that these addresses may change over time, so we ask you to verify the information before contacting them.

Responsible Supervisory Authority:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Bettina Gayk
PO Box 20 04 44
40102 Düsseldorf
Kavalleriestraße 2-4
40213 Düsseldorf
Phone: 02 11/384 24-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

Definition of Terms

This section provides an overview of the terminology used in this Privacy Policy. Where terms are legally defined, their legal definitions apply. The following explanations are primarily intended to aid understanding.

• Employees: Employees are individuals in an employment relationship, whether as staff, workers, or in similar positions. An employment relationship is a legal connection between an employer and employee, typically set out in a contract or agreement. It involves the employer’s obligation to pay wages while the employee performs work. The employment relationship comprises several stages, including initiation (when the contract is signed), execution (performance of work), and termination (ending the employment whether by resignation, agreement, or otherwise). Employee data refers to all information about these individuals relevant to their employment, such as personal identification details, identification numbers, salary and bank data, work hours, vacation entitlements, health information, and performance reviews.
• Master Data: Master data includes essential information needed to identify and manage contracting parties, user accounts, profiles, and similar records. This data may include personal and demographic details, such as names, contact information (addresses, phone numbers, email addresses), date of birth, and specific identifiers (user IDs). Master data forms the foundation for any formal interaction between individuals and services, institutions, or systems, enabling unique assignment and communication.
• Content Data: Content data encompasses information generated during the creation, editing, and publication of any type of content. This category may include texts, images, videos, audio files, and other multimedia content published on various platforms and media. Content data is not limited to the actual content but also includes metadata providing information about the content itself, such as tags, descriptions, author info, and publishing dates.
• Clicktracking: Clicktracking provides an overview of users’ movements throughout an online offering. Since results are more precise when user interaction is tracked over a period of time (e.g., to find out if a user returns regularly), cookies are typically stored on users’ devices for testing purposes.
• Contact Data: Contact data is essential information that enables communication with individuals or organizations. This includes phone numbers, mailing addresses, email addresses, as well as communication channels such as social media handles and instant messaging IDs.
• Conversion Measurement: Conversion measurement (also referred to as “visit action evaluation”) is a method used to assess the effectiveness of marketing activities. Typically, a cookie is stored on users’ devices within the websites where marketing measures occur and is then retrieved on the target site. For example, this process helps us determine whether the ads we have placed on other websites were successful.
• Meta, Communication, and Procedural Data: Meta, communication, and procedural data are categories that include information about how data is processed, transmitted, and managed. Metadata—also known as data about data—provides context, origin, and structure, such as file size, creation date, author, and editing history. Communication data records the exchange of information between users across channels such as email traffic, call logs, social network messages, and chat records, including participating individuals, timestamps, and transmission paths. Procedural data describes processes within systems or organizations, including workflow documentation, records of transactions and activities, as well as audit logs used for tracking and verification purposes.
• Member Data: Member data includes information relating to individuals who are part of an organization, association, online service, or other group. This data is used to manage memberships, enable communication, and deliver services or benefits related to membership. Member data may include personal identification details, contact information, membership status and duration, payment of dues, participation in events and activities, as well as preferences and interests. It may also include data on the use of organizational offerings. The collection and processing of this data is carried out in compliance with data protection regulations and serves both administrative purposes and the promotion of member engagement and satisfaction.
• Usage Data: Usage data refers to information recording how users interact with digital products, services, or platforms. This includes a broad range of data indicating how users use applications, which features they prefer, how long they spend on certain pages, and navigation paths through an application. Usage data may also include frequency, activity timestamps, IP addresses, device information, and location data. Such data is valuable for analyzing user behavior, optimizing user experience, personalizing content, and improving products or services. Additionally, usage data plays a crucial role in identifying trends, preferences, and possible problem areas within digital offerings.
• Personal Data: “Personal data” refers to any information that relates to an identified or identifiable natural person (the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie), or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
• Profiles with User-Related Information: The processing of “profiles with user-related information”, or “profiles” for short, includes any form of automated processing of personal data that uses this data to analyze, assess, or predict personal aspects relating to a natural person (e.g., demographic information, behavior, interests, such as website interactions and content, etc.). Profiling purposes often use cookies and web beacons.
• Log Data: Log data refers to information about events or activities recorded in a system or network. These typically include details such as timestamps, IP addresses, user actions, error messages, and other information regarding usage or operation of a system. Log data is often used for system troubleshooting, security monitoring, or performance reporting.
• Reach Measurement: Reach measurement (also known as web analytics) is used to evaluate visitor flows to an online offering and may include visitor behavior or interests in certain information, such as website content. Reach analysis enables website operators to, for example, determine when users visit their sites and what content they find interesting, allowing for better tailoring of content to users’ needs. Pseudonymous cookies and web beacons are often used in reach analytics to recognize repeat visitors and enable more precise analysis of online usage.
• Location Data: Location data is generated when a mobile device (or another device with location capabilities) connects to a cellular network, a Wi-Fi network, or similar location-based services. Location data indicates the geographically determinable position of the device. Such data can be used to display maps or other location-based information.
• Tracking: “Tracking” refers to monitoring user behavior across multiple online offerings. Typically, behavioral and interest-related information is stored in cookies or on the servers of technology providers (so-called profiling). This information can subsequently be used to display ads to users that likely match their interests.
• Controller: The “controller” is the natural or legal person, authority, agency, or other body that, alone or jointly with others, determines the purposes and means of processing personal data.
• Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, including collection, analysis, storage, transmission, or deletion.
• Contract Data: Contract data refers to specific information regarding the formalization of an agreement between two or more parties. This category documents the terms under which services or products are provided, exchanged, or sold. Contract data is essential for the management and fulfillment of contractual obligations and includes identification of the parties involved, specific terms and conditions, start and end dates, type of agreed services or products, price agreements, payment terms, cancellation rights, renewal options, and special clauses or provisions. It serves as the legal foundation for the relationship between parties and is crucial for clarifying rights and obligations, enforcement of claims, and dispute resolution.
• Payment Data: Payment data includes all information required to process payment transactions between buyers and sellers. This data is vital for e-commerce, online banking, and all forms of financial transactions. It may include credit card numbers, bank account details, payment amounts, transaction data, verification numbers, and billing information. Payment data may also cover payment status, chargebacks, authorizations, and fees.
• Audience Formation: Audience formation (in English, “Custom Audiences”) refers to the process of defining audiences for advertising purposes, such as displaying ads. For example, a user’s interest in certain products or topics online may be used to infer an interest in ads for similar products or for the online shop where the products were viewed. “Lookalike Audiences” refers to cases where content deemed suitable is displayed to users whose profiles or interests are similar to those for whom the profiles were originally created. Custom Audiences and Lookalike Audiences typically rely on cookies and web beacons.