Privacy Policy

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following we inform you about how we handle your personal data when you use our website. Personal data is all data by which you can be personally identified.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

The controller for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Additional controller

This privacy policy also applies to Leogra Services GmbH, Tirschenreuther Strasse 10-12, 95666 Mitterteich, Germany, phone: 09638912333, email: service@leogra.de. Insofar as Leogra Services GmbH processes personal data, it is the controller for that processing within the meaning of the General Data Protection Regulation (GDPR).

2) Data collection when you visit our website

2.1 If you use our website for information purposes only, that is, if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• The page of ours you visited
• Date and time of access
• Amount of data sent, in bytes
• Source/reference from which you reached the page
• Browser used
• Operating system used
• IP address used (where applicable: in anonymised form)

Processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to review the server log files retrospectively should there be specific indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string "https://" and the padlock symbol in your browser bar.

3) Hosting & content delivery network

For the hosting of our website and the presentation of its content we use a provider that renders its services, either itself or through selected subcontractors, exclusively on servers within the European Union.

All data collected on our website is processed on those servers, unless different data recipients are named below for specific processing operations.

We have concluded a data processing agreement with the provider which ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

4) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, that is, small text files that are stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called "session cookies"), while others remain on your device for longer and allow page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage period in the overview of the cookie settings in your web browser.

Where personal data is also processed by individual cookies we use, the processing is carried out in accordance with Art. 6 (1) (b) GDPR for the performance of the contract, in accordance with Art. 6 (1) (a) GDPR where consent has been given, or in accordance with Art. 6 (1) (f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and in a customer-friendly and effective design of your visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, or so that the acceptance of cookies is excluded in certain cases or generally.

Please note that if cookies are not accepted, the functionality of our website may be limited.

5) Contacting us

5.1 HubSpot

To provide an online appointment booking function we use the services of the following provider: HubSpot Ireland Ltd., 2nd Floor 30 North Wall Quay, Dublin 1, Ireland

For the purpose of arranging appointments, first name, surname and email address (and, where applicable, the telephone number if a telephone appointment is requested) are collected in accordance with Art. 6 (1) (b) GDPR and transmitted to the provider in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in effective customer management and efficient appointment administration, where they are stored for the organisation of the appointment.

After the appointment has taken place or after the agreed appointment period has expired, your data is deleted by the provider.

We have concluded a data processing agreement with the provider which ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

5.2 Microsoft Bookings

To provide an online appointment booking function we use the services of the following provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA

For the purpose of arranging appointments, first name, surname and email address (and, where applicable, the telephone number if a telephone appointment is requested) are collected in accordance with Art. 6 (1) (b) GDPR and transmitted to the provider in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in effective customer management and efficient appointment administration, where they are stored for the organisation of the appointment.

After the appointment has taken place or after the agreed appointment period has expired, your data is deleted by the provider.

We have concluded a data processing agreement with the provider which ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

5.3 Contact form and email

5.3 Personal data is collected when you contact us (e.g. via a contact form or by email). Which data is collected when a contact form is used can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for contacting you and for the associated technical administration.

The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR. Your data will be deleted once your enquiry has been conclusively dealt with. This is the case if it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that no statutory retention obligations prevent deletion.

6) Web analytics services

6.1 etracker

This website uses the web analytics service of the following provider: etracker GmbH, Erste Brunnenstrasse 1, 20459 Hamburg, Germany

With the help of cookies and/or comparable technologies (tracking pixels, web beacons, algorithms for reading device and browser information), the service collects and stores pseudonymised visitor data, including information about the device used such as the IP address and browser information, in order to evaluate it for statistical analyses of user behaviour on our website and to create pseudonymised usage profiles. This also makes it possible to evaluate movement patterns (so-called heatmaps), which show the duration of page visits as well as interactions with page content (e.g. text entries, scrolling, clicks and mouse-overs). Pseudonymisation generally rules out any direct reference to a person. Data collected in this way is not combined with any plain data about you obtained by other means.

All of the processing operations described above, in particular the reading or storing of information on the device used, are only carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

We have concluded a data processing agreement with the provider which ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

6.2 etracker

On this website, data is collected and stored using technologies of etracker GmbH, Erste Brunnenstrasse 1, 20459 Hamburg (www.etracker.com). Pseudonymised usage profiles may be created and evaluated from this data for the same purpose.

This website uses etracker exclusively without the use of cookies, which means that etracker does not set cookies on your device at any time.

According to information from etracker, only the website data from web servers is used, together with information that the web browser transmits to the web server in order to retrieve web pages. This information is transmitted with every single page request. However, no information is read from the memory of the user's device and no information is stored on that device.

Insofar as personal data is also processed in the operations described, this is done on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation and marketing purposes in accordance with Art. 6 (1) (f) GDPR.

You can permanently object to the collection and storage of your visitor data for the future by using the opt-out function set up for this purpose on our website.

You can find further information about etracker's data protection provisions at the following internet address: https://www.etracker.com/en/data-privacy/.

6.3 Leadinfo

This website uses the web analytics service Leadinfo of the following provider: Team.Blue GmbH, Bunsenstr. 19, 40215 Duesseldorf

With the help of cookies and/or comparable technologies (tracking pixels, web beacons, algorithms for reading device and browser information), the service collects and stores pseudonymised visitor data, including information about the device used such as the IP address and browser information, in order to evaluate it for statistical analyses of user behaviour on our website and to create pseudonymised usage profiles. This also makes it possible to evaluate movement patterns (so-called heatmaps), which show the duration of page visits as well as interactions with page content (e.g. text entries, scrolling, clicks and mouse-overs). Pseudonymisation generally rules out any direct reference to a person. Data collected in this way is not combined with any plain data about you obtained by other means.

All of the processing operations described above, in particular the reading or storing of information on the device used, are only carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

We have concluded a data processing agreement with the provider which ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

6.4 Microsoft Clarity

This website uses the web analytics service of the following provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA

With the help of cookies and/or comparable technologies (tracking pixels, web beacons, algorithms for reading device and browser information), the service collects and stores pseudonymised visitor data, including information about the device used such as the IP address and browser information, in order to evaluate it for statistical analyses of user behaviour on our website and to create pseudonymised usage profiles. This also makes it possible to evaluate movement patterns (so-called heatmaps), which show the duration of page visits as well as interactions with page content (e.g. text entries, scrolling, clicks and mouse-overs). Pseudonymisation generally rules out any direct reference to a person. Data collected in this way is not combined with any plain data about you obtained by other means.

All of the processing operations described above, in particular the reading or storing of information on the device used, are only carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

We have concluded a data processing agreement with the provider which ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

7) Retargeting/ remarketing and conversion tracking

Meta Pixel with advanced matching

Within our online offering we use the service "Meta Pixel" in advanced matching mode, provided by: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta")

If a user clicks on an advertisement placed by us on Facebook or Instagram, the URL of our linked page is extended by a parameter with the help of "Meta Pixel". After the redirect, this URL parameter is then entered into the user's browser by a cookie which our linked page sets itself. In addition, this cookie records specific customer data such as the email address that we collect on our website linked to the Facebook or Instagram advertisement during processes such as purchases, account logins or registrations (advanced matching). The cookie is then read and enables the data, including the specific customer data, to be transmitted to Meta.

We use "Meta Pixel" with advanced matching in order to make our advertisements (so-called "ads") on Facebook and/or Instagram more effective and to ensure that they correspond to the interests of users or display certain characteristics (e.g. interests in certain topics or products determined on the basis of the websites visited) which we transmit to Meta (so-called "custom audiences").

In addition, we analyse the effectiveness of our advertisements by tracking whether users were redirected to our website after clicking on an advertisement (conversion). Compared with the standard version of "Meta Pixel", the advanced matching function helps us to measure the effectiveness of our advertising campaigns more accurately by recording more attributed conversions.

All transmitted data is stored and processed by Meta so that a link to the respective user profile is possible and Meta can use the data for its own advertising purposes in accordance with Meta's data usage policy (https://www.facebook.com/about/privacy/). The data may enable Meta and its partners to display advertisements on and outside Facebook.

All of the processing operations described above, in particular the setting of cookies for reading information on the device used, are only carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

We have concluded a data processing agreement with the provider which ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

The information generated by Meta is generally transmitted to and stored on a Meta server; in this context, a transfer to servers of Meta Platforms Inc. in the USA may also take place.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

8) Website functions

8.1 Google Maps

This website uses an online map service of the following provider: Google Maps (API) by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

Google Maps is a web service for displaying interactive maps in order to present geographical information visually. Using this service shows you our location and makes it easier to plan your journey to us.

As soon as you call up the subpages into which the Google Maps map is integrated, information about your use of our website (such as your IP address) is transmitted to Google servers and stored there; in this context, a transfer to the servers of Google LLC. in the USA may also take place. This happens regardless of whether Google provides a user account through which you are logged in or whether a user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not want your data to be assigned to your Google profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and evaluates it.

The collection, storage and evaluation are carried out in accordance with Art. 6 (1) (f) GDPR on the basis of Google's legitimate interest in displaying personalised advertising, market research and/or the needs-based design of Google websites. You have a right to object to the creation of these user profiles, whereby you must contact Google in order to exercise it. If you do not agree to your data being transmitted to Google in future as part of the use of Google Maps, you also have the option of completely deactivating the Google Maps web service by switching off the JavaScript application in your browser. Google Maps and therefore the map display on this website can then no longer be used.

Insofar as legally required, we have obtained your consent in accordance with Art. 6 (1) (a) GDPR for the processing of your data as described above. You can withdraw your consent at any time with effect for the future. To exercise your withdrawal, please follow the option for objecting described above.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

Further information on data protection at Google can be found here: https://business.safety.google/privacy/

8.2 Google reCAPTCHA

On this website we use the CAPTCHA service of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC, USA.

For the visual design of the CAPTCHA window, the provider uses "Google Fonts", that is, fonts loaded from the internet by Google. No information is processed beyond that stated above, which is already transmitted to Google through the functionality of reCAPTCHA.

The service checks whether an entry is made by a natural person or improperly by machine and automated processing, and blocks spam, DDoS attacks and similar automated malicious access. In order to ensure that an action is carried out by a human and not by an automated bot, the provider collects the IP address of the device used, identification data of the browser and operating system type used as well as the date and duration of the visit, and transmits this to the provider's servers for evaluation. Cookies may be used in the process, that is, small text files that are stored in the browser of the device.

Insofar as the processing operations described above are based on cookies, these are only set if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

If the processing operations described above are carried out without the use of cookies, the legal basis is our legitimate interest in establishing individual responsibility on the internet and in preventing misuse and spam in accordance with Art. 6 (1) (f) GDPR.

We have concluded a data processing agreement with the provider which ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

8.3 Google Customer Reviews (formerly Google Certified Shops programme)

We work with Google as part of the "Google Customer Reviews" programme. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). This programme gives us the opportunity to obtain customer reviews from users of our website. After you have used our services, you will be asked on our website whether you would like to take part in an email survey by Google.

If you give your consent in accordance with Art. 6 (1) (a) GDPR, we transmit your email address to Google. You will receive an email from Google Customer Reviews asking you to rate your purchase experience on our website. The rating you submit is then combined with our other ratings and displayed in our Google Customer Reviews badge as well as in our Merchant Center dashboard. Your rating is also used for Google seller ratings. As part of the use of Google Customer Reviews, personal data may also be transmitted to the servers of Google LLC. in the USA.

You can withdraw your consent at any time by sending a message to the controller responsible for the data processing or to Google.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

Further information on Google's data protection provisions can be found here: https://business.safety.google/privacy/

8.4 Applications for job vacancies by email

In a separate section of our website we advertise current job vacancies, for which interested parties can apply by email to the contact address provided.

Applicants must provide all personal data required for a well-founded assessment, including general information such as name, address and contact details, as well as evidence relating to performance and, where applicable, health-related information. Details of the application are set out in the job advertisement.

Once the application has been received by email, the data is stored and evaluated exclusively for the purpose of processing the application. In the event of queries, we use either the applicant's email address or telephone number. The processing is carried out on the basis of Art. 6 (1) (b) GDPR (or Section 26 (1) of the German Federal Data Protection Act), under which going through the application procedure is deemed to be the initiation of an employment contract.

Insofar as special categories of personal data within the meaning of Art. 9 (1) GDPR (e.g. health data such as information about severe disability) are requested from applicants during the application procedure, the processing is carried out in accordance with Art. 9 (2) (b) GDPR so that we can exercise the rights arising from employment law and the law of social security and social protection and comply with our obligations in this respect.

Cumulatively or alternatively, the processing of the special categories of data may also be based on Art. 9 (2) (h) GDPR if it is carried out for the purposes of preventive health care or occupational medicine, for the assessment of the applicant's working capacity, for medical diagnosis, for care or treatment in the health or social sector or for the management of systems and services in the health or social sector.

If an applicant is not selected or if an applicant withdraws their application early, the data transmitted by them as well as all electronic correspondence including the application email will be deleted at the latest six months after a corresponding notification. This period is based on our legitimate interest in answering any follow-up questions about the application and, where applicable, in being able to meet our obligations to provide evidence under the provisions on equal treatment of applicants.

If an application is successful, the data provided is processed on the basis of Art. 6 (1) (b) GDPR (where processing takes place in Germany, in conjunction with Section 26 (1) of the German Federal Data Protection Act) for the purpose of carrying out the employment relationship.

9) Tools and miscellaneous

Cookie consent tool

This website uses a so-called "cookie consent tool" to obtain effective user consent for cookies and cookie-based applications that require consent. The "cookie consent tool" is displayed to users as an interactive user interface when they call up the page, on which consent for certain cookies and/or cookie-based applications can be given by ticking boxes. Through the use of the tool, all cookies/services requiring consent are only loaded if the respective user gives the corresponding consent by ticking a box. This ensures that such cookies are only set on the respective user's device if consent has been given.

The tool sets technically necessary cookies in order to save your cookie preferences. Personal user data is generally not processed in the process.

If, in individual cases, personal data (such as the IP address) is nevertheless processed for the purpose of storing, assigning or logging cookie settings, this is done in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website.

A further legal basis for the processing is Art. 6 (1) (c) GDPR. As the controller, we are subject to the legal obligation to make the use of cookies that are not technically necessary dependent on the respective user's consent.

Where necessary, we have concluded a data processing agreement with the provider which ensures the protection of our visitors' data and prohibits unauthorised disclosure to third parties.

Further information about the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

10) Rights of the data subject

10.1 Applicable data protection law grants you the following rights as a data subject (rights to information and intervention) vis-a-vis the controller with regard to the processing of your personal data, whereby reference is made to the legal basis cited for the respective conditions for exercising them:

• Right of access under Art. 15 GDPR;
• Right to rectification under Art. 16 GDPR;
• Right to erasure under Art. 17 GDPR;
• Right to restriction of processing under Art. 18 GDPR;
• Right to notification under Art. 19 GDPR;
• Right to data portability under Art. 20 GDPR;
• Right to withdraw consent given under Art. 7 (3) GDPR;
• Right to lodge a complaint under Art. 77 GDPR.

10.2 Right to object

If we process your personal data on the basis of a balancing of interests, that is, on the basis of our overriding legitimate interest, you have the right at any time to object to that processing with effect for the future on grounds relating to your particular situation.

If you exercise your right to object, we will stop processing the data concerned. However, we reserve the right to continue processing if we can demonstrate compelling legitimate grounds for the processing which override your interests, fundamental rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

If your personal data is processed by us in order to carry out direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. You can exercise your objection as described above.

If you exercise your right to object, we will stop processing the data concerned for direct marketing purposes.

11) Duration of storage of personal data

The duration of the storage of personal data is determined by the respective legal basis, by the purpose of the processing and - where applicable - additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

Where personal data is processed on the basis of express consent in accordance with Art. 6 (1) (a) GDPR, the data concerned is stored until you withdraw your consent.

Where statutory retention periods exist for data that is processed within the framework of legal or quasi-legal obligations on the basis of Art. 6 (1) (b) GDPR, this data is routinely deleted after the retention periods have expired, provided that it is no longer required for the performance or initiation of a contract and/or that we no longer have a legitimate interest in continued storage.

Where personal data is processed on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for the purpose of direct marketing on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (2) GDPR.

Unless otherwise stated in the other information in this policy about specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.