Privacy

Information on the processing of your data pursuant to Art. 13 and Art. 14 of the General Data Protection Regulation (GDPR) CONTENTS: 1. General information 2. Contact details of the controller 3. Data processing in connection with our social media presence 3.1 Facebook, Instagram and Threads 3.2 TikTok 3.3 X 3.4 YouTube 4. Data processing when visiting our website 4.1 Delivery of the website and server log files 4.2 Data processing in connection with the cookie management tool 4.3 Technically necessary cookies and local storage technologies 4.4 Use of Cloudflare 4.5 Use of Cloudflare Turnstile 4.6 Data processing in connection with the contact form 4.7 Data processing for reader accounts and personalisation 4.8 Data processing for comments, reactions, polls and quiz functions 4.9 Use of social media links and the share function 4.10 Use of Cloudflare Analytics Engine 4.11 Use of Google Analytics 4 4.12 Use of Google Ads Conversion Tracking 4.13 Use of Meta Pixel 4.14 Use of TikTok Pixel 4.15 Use of Microsoft Advertising 4.16 Use of Microsoft Clarity 4.17 Use of Google AdSense 4.18 Use of Meta Audience Network 4.19 Use of Sentry 4.20 Use of YouTube videos 4.21 Use of ipapi.co 4.22 Use of Open-Meteo 4.23 Data processing for web push notifications 5. Data processing for the newsletter and system emails 5.1 Newsletter subscription and double opt-in 5.2 Use of Brevo 5.3 Use of Cloudflare Email 6. Data processing in connection with our B2B offerings 6.1 Advertiser portal and advertising campaigns 6.2 Data licence enquiries 7. Data processing in connection with ShadowFit 7.1 Provision of the fitness game PWA 7.2 Training and body data 7.3 Leaderboards, guilds and duels 7.4 Reach measurement in ShadowFit 8. Data processing for payments via Stripe 9. Data processing by the address and postal service 10. Disclosure of data to third parties or other recipients 11. Retention period of the data 12. Data security 13. Your rights as a data subject 1. General information Below we would like to inform you how we use and store personal data. If you use certain services (e.g. our contact form), personal data may be collected. In doing so, we comply with the applicable European data protection provisions. 2. Contact details of the controller The controller for this website is Till Stephan Unternehmensberatung c/o IP-Management #11448 Ludwig-Erhard-Straße 18 20459 Hamburg Germany Telephone: +49 40 696328495 Email: info@theviralsource.news Website: https://theviralsource.news/ 3. Data processing in connection with our social media presence 3.1 Facebook, Instagram and Threads For our presence on Facebook, Instagram and Threads we use services of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, hereinafter "Meta". The provider of the platforms for persons in the European Economic Area is Meta. We use the presence to publish editorial content, to draw attention to new posts, to communicate with users and to evaluate the reach of our news and information offerings. If you visit our Meta presence or use functions such as follow, like, comment, share, rate or direct messages, Meta processes in particular profile and account data, IP address, device and browser information, cookie and advertising identifiers, usage and interaction data as well as the content you publish. This also applies if you are not logged in to Meta. We do not have full influence over the purposes and means of this platform processing as determined independently by Meta. To the extent that you contact us via Meta, comment on a post or otherwise interact with us, we process your profile name, the visible profile information, the content and time of your message or interaction as well as any further information you voluntarily provide. The processing serves communication, moderation, responding to your enquiry and, where applicable, the initiation or performance of a contract. The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest lies in appropriate communication with readers, interested parties and business partners as well as in maintaining and moderating our online presence. Additional data provided voluntarily is processed on the basis of Art. 6(1)(a) GDPR. For the evaluation of our presence, Meta provides us with aggregated statistics and so-called Insights. These may include information on views, reach, interactions, demographic characteristics and interests. For the collection of the data and their transmission to us in the form of Page Insights there is joint controllership pursuant to Art. 26 GDPR. We determine the purposes of our presence, the published content and the use of the statistics. Meta is responsible in particular for the collection of the platform data, the technical processing, the creation of the statistics and the fulfilment of data subject rights asserted against Meta. Data subject rights may be asserted against us or Meta. Meta provides the essential contents of the agreement on joint controllership. Outside this delimited area, Meta processes platform data under its own responsibility. This concerns in particular the provision and security of the platform, the management of user accounts, the personalisation of content and advertising as well as cross-platform evaluation. Meta determines the legal basis of this processing under its own responsibility. In the course of platform use, Meta may transfer data to Meta Platforms, Inc., 1 Meta Way, Menlo Park, California 94025, USA. Meta Platforms, Inc. is currently certified under the EU-US Data Privacy Framework. For this transfer there is therefore an adequacy decision of the European Commission pursuant to Art. 45 GDPR. Agreement on joint controllership: https://www.facebook.com/legal/terms/page_controller_addendum Further information on the processing of personal data by Meta: https://www.facebook.com/privacy/policy/ 3.2 TikTok For our presence on TikTok we use the platform of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London EC1A 9HP, United Kingdom, hereinafter jointly "TikTok". We publish editorial short-form content there, draw attention to content and communicate with users. If you visit our TikTok presence or use functions such as follow, like, comment, share or direct messages, TikTok processes in particular profile and account data, IP address, device and browser information, cookie and advertising identifiers, location information, usage and interaction data as well as the content you publish. TikTok independently determines the purposes and means of general platform processing. We do not have full influence over this. To the extent that you contact us via TikTok or interact with our content, we process your profile name, visible profile information, message and comment content, the time of the interaction as well as voluntary information. The processing serves communication, moderation and responding to your enquiry. The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest lies in clear communication with our users and in maintaining our presence. For the evaluation of our presence, TikTok provides us with account statistics and analytics data. We are responsible for the selection and use of our presence as well as for the evaluation of the statistics provided. TikTok collects, combines and processes the underlying platform data for the general account statistics under its own responsibility. For these general statistics there is no agreement on joint controllership between us and TikTok. The joint controllership for the TikTok Pixel described separately in the website section remains unaffected. For processing by TikTok Information Technologies UK Limited in the United Kingdom there is an adequacy decision of the European Commission pursuant to Art. 45 GDPR. TikTok states that platform data is also made accessible from the USA, Malaysia and Singapore. For these transfers TikTok uses the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR. A copy of the applicable clauses may be requested via TikTok's data protection contact point. Further information on the processing of personal data by TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/de Information from TikTok on international data transfers: TikTok information 3.3 X For our presence on X we use the platform of X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland, hereinafter "X". We publish news notices there, link to editorial content and communicate with users. If you visit our X presence or use functions such as follow, repost, like, comment or direct messages, X processes in particular profile and account data, IP address, device and browser information, cookie and advertising identifiers, usage and interaction data as well as the content you publish. X decides on the purposes and means of general platform processing under its own responsibility. We do not have full influence over this. To the extent that you contact us via X or interact with our posts, we process your profile name, visible profile information, message and post content, the time of the interaction as well as voluntary information. The processing serves communication, moderation and handling of your enquiry. The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest lies in communication with users and the editorial maintenance of our presence. For the evaluation of our presence, X provides us with aggregated statistics on reach and interactions. We use these data on the basis of Art. 6(1)(f) GDPR to evaluate the response to our content and to improve editorial communication. X collects the underlying platform data under its own responsibility. Joint controllership between us and X is not established for these general account statistics. In the course of platform use, X may transfer data to X Corp., 865 FM 1209, Building 2, Bastrop, Texas 78602, USA. X Corp. is currently certified under the EU-US Data Privacy Framework. For this transfer there is therefore an adequacy decision of the European Commission pursuant to Art. 45 GDPR. Further information on the processing of personal data by X: https://x.com/de/privacy 3.4 YouTube For our YouTube channel we use the video platform of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter "YouTube". We publish videos and editorial content there and communicate with viewers. If you visit our channel or watch, subscribe to, rate, share or comment on videos, YouTube processes in particular profile and account data, IP address, device and browser information, cookie and advertising identifiers, videos accessed, playback duration, search and interaction data as well as the content you publish. YouTube processes these data for the provision and security of the platform, recommendations, statistics and advertising under its own responsibility. We do not have full influence over this processing. To the extent that you contact us via YouTube or leave comments, we process your channel name, visible profile information, comment and message content as well as the time of the interaction. The processing serves communication, moderation and handling of your enquiry. The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest lies in communication with viewers and maintaining our channel. For the evaluation of our channel, YouTube provides us with statistics and reports on views, playback duration, reach and interactions. We use these aggregated information on the basis of Art. 6(1)(f) GDPR to evaluate the response to our content and to improve our editorial offerings. Google collects and processes the underlying platform data under its own responsibility. In the course of platform use, Google may transfer data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. Google LLC and its wholly controlled US subsidiaries are currently certified under the EU-US Data Privacy Framework. For the transfer to Google LLC there is therefore an adequacy decision of the European Commission pursuant to Art. 45 GDPR. Further information on the processing of personal data by YouTube and Google: https://policies.google.com/privacy?hl=de 4. Data processing when visiting our website 4.1 Delivery of the website and server log files When you access our website, your internet browser automatically transmits the following data to our web server for technical reasons: • IP address • Date and time of the server request • URL of the file retrieved • Amount of data transferred • Operating system • Information about the browser type and version used • Name of the internet service provider • Website from which this website was accessed • Page visited on our website The collection, processing and use of the above data takes place for the purpose of enabling the use and delivery of our website. Further purposes are the security of our IT systems and technical administration. The legal basis for the processing is Art. 6(1)(f) GDPR, whereby our legitimate interest arises from the purposes stated above. 4.2 Data processing in connection with the cookie management tool Our website uses a cookie consent management system. It serves to obtain, store and document your selection for cookies that are not technically necessary, analytics, personalisation, advertising and content from external providers. Essential functions are activated by default. Statistics, personalisation and marketing services are only enabled after your selection. In this context, in particular your consent decision, the time and version of the selection, language, a pseudonymous identifier and technical browser information are processed. A necessary consent cookie or corresponding local storage information records your decision. The legal bases are Art. 6(1)(c) GDPR for fulfilling and documenting legal obligations and Art. 6(1)(f) GDPR. Our legitimate interest lies in the legally compliant, user-friendly control of the services used on the website. Access to the end device is necessary pursuant to Section 25(2) no. 2 TDDDG (German Telecommunications-Telemedia Data Protection Act) in order to provide the expressly requested consent management. You may change your selection at any time via the settings of the cookie banner or withdraw consent already given with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected. 4.3 Technically necessary cookies and local storage technologies For the secure and functional operation of our website we use technically necessary cookies and local storage technologies. These serve in particular language and page selection, session control, login, security, storage of the consent status as well as the provision of reader accounts and expressly requested functions. In this context, session identifiers, login status, language settings, security features, local reading and game settings as well as technical status information may be stored. The legal basis for the subsequent processing of personal data is Art. 6(1)(b) GDPR to the extent that storage is necessary for an account you use or a requested function. Otherwise, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and user-friendly provision of the website. Storing and reading on the end device is necessary pursuant to Section 25(2) no. 2 TDDDG. 4.4 Use of Cloudflare For hosting, delivery, protection and processing of website functions we use services of Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA, hereinafter "Cloudflare". Cloudflare provides in particular a content delivery network, security functions and server-side functions via Cloudflare Workers. In the course of provision, Cloudflare processes in particular IP address, date and time of access, address accessed, referrer, device and browser information, security features, transmission data and error information. The processing serves the fast delivery of our content, defence against attacks, load balancing and the reliable execution of our website functions. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, high-performance and globally reachable provision of our website. To the extent that technically necessary information is stored or read on the end device for this purpose, Section 25(2) no. 2 TDDDG applies. The processing of these data by Cloudflare takes place on the basis of a data processing agreement. A transfer to Cloudflare in the USA takes place on the basis of the adequacy decision of the European Commission pursuant to Art. 45 GDPR. Cloudflare, Inc. is currently certified under the EU-US Data Privacy Framework. Further information on the processing of personal data by Cloudflare: https://www.cloudflare.com/privacypolicy/ 4.5 Use of Cloudflare Turnstile To protect our forms against automated entries, spam and abusive access we use Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA. For the security check, Turnstile evaluates technical signals of the access. In particular, IP address, TLS and device fingerprint, browser type, operating system, user agent, website key, origin address and the result of the security check are processed. According to Cloudflare, content entered in form fields is not read for the bot check. The legal basis for the processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website and forms against bots, spam, abuse and automated attacks as well as ensuring functionality and IT security. To the extent that Turnstile stores or reads information necessary for the security check on your end device, this is based on Section 25(2) no. 2 TDDDG. Processing by Cloudflare takes place on our behalf. The transfer to Cloudflare in the USA takes place on the basis of the adequacy decision pursuant to Art. 45 GDPR, as Cloudflare, Inc. is currently certified under the EU-US Data Privacy Framework. Further information on the processing of personal data by Cloudflare Turnstile: https://www.cloudflare.com/privacypolicy/ 4.6 Data processing in connection with the contact form If you use our contact form, we process your name, your email address, the selected subject or contact category, the content of your message, time and technical transmission data as well as any further voluntary information. The categories include in particular general enquiries, data protection, press, advertising and correction notices. The processing serves the allocation, handling and response to your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry is directed at the conclusion or performance of a contract. For general, editorial or organisational enquiries the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the appropriate handling of incoming messages, the correction of editorial content and the organisation of our communication. Additional data provided voluntarily is processed on the basis of Art. 6(1)(a) GDPR. For the technical protection of the form we use Cloudflare Turnstile. The information required for this can be found in the corresponding section of this privacy policy. 4.7 Data processing for reader accounts and personalisation If you register a reader account or log in, we process your email address, a display name, the encrypted stored password, registration and login times, IP address, security and session data as well as your account settings. In the event of a password reset we process your email address and a time-limited reset link. The account serves secure login, account-related use of our offerings and cross-device synchronisation of expressly selected settings. If you enable the transfer of your locally stored interest or reading history into the account, we process visited topics and articles, stored interests, interactions and recommendations derived therefrom. The legal basis is Art. 6(1)(b) GDPR. A local reading history not required for the account function as well as personalised recommendations are activated only after your consent to the personalisation category. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time via the settings of the cookie banner. You may have your account deleted. Statutory retention obligations and temporary retention for security and abuse prevention remain unaffected. 4.8 Data processing for comments, reactions, polls and quiz functions If you comment on posts, submit reactions, or participate in polls or quiz formats, we process your display name or a pseudonym, the content and time of your input, the association with the post or format, where applicable your selected answers as well as technical security and log data. For logged-in users the interaction is associated with the reader account. The processing serves the publication and display of your interaction, the evaluation of participation, the performance of the function you have chosen as well as moderation and abuse prevention. The legal basis is Art. 6(1)(b) GDPR to the extent that you request the respective participation function. In addition, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in promoting factual exchange, editorial evaluation, preventing manipulation and protecting other users. Published content is visible to other users. Please do not publish data of third parties or special categories of personal data. We may review, block or delete content if this is necessary to enforce our rules, to defend against legal infringements or to protect the platform. 4.9 Use of social media links and the share function Our website contains links to our presence on Facebook, Instagram, Threads, TikTok, X and YouTube as well as a share function for editorial articles. The icons and buttons do not initially constitute embedded social media plugins. Merely accessing our website does not establish a connection to the respective social network through these links. If you activate a link or a share button, the destination platform or the sharing function of your end device is opened. In that case, the address and title of the article to be shared as well as the usual access data such as IP address, time, browser and device information may be transmitted to the selected platform. If you are logged in there, the platform may associate the access with your account. For further processing the respective platform provider is independently responsible. The legal basis for providing the links and buttons is Art. 6(1)(f) GDPR. Our legitimate interest lies in the user-friendly distribution of our content and the accessibility of our social media presence. The data transfer to the selected platform is only triggered by your active action. 4.10 Use of Cloudflare Analytics Engine For our own reach and usage analysis, engagement measurements and A/B tests we use Cloudflare Analytics Engine. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA. Events are transmitted to Cloudflare via our own internet addresses and evaluated there on our behalf. In this context we process in particular a pseudonymous visitor or session identifier, page accessed, referrer, time, language, coarse region, device and browser characteristics, interactions, dwell time, test variant and technical event data. The IP address arises upon technical retrieval. It is not used to identify you by name. The evaluation serves the measurement of reach and usage, the improvement of our content and the testing of different presentation variants. The analytics service is only activated after you have consented to the statistics or performance category. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG to the extent that identifiers are stored or read on your end device. You may withdraw your consent at any time via the settings of the cookie banner. The analytics data are processed by Cloudflare on our behalf. Event data in Cloudflare Analytics Engine are retained for three months according to the current product specifications. The transfer to Cloudflare in the USA takes place on the basis of the adequacy decision pursuant to Art. 45 GDPR, as Cloudflare, Inc. is currently certified under the EU-US Data Privacy Framework. Further information on the processing of personal data by Cloudflare: https://www.cloudflare.com/privacypolicy/ 4.11 Use of Google Analytics 4 For the statistical analysis of the website we use Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us to evaluate views, reach, usage paths and interactions and to improve our content. In this context, in particular pseudonymous online identifiers, pages accessed, times, dwell time, origin of the access, approximate region, device and browser information, language as well as usage and event data are processed. According to Google, Google Analytics 4 does not store full IP addresses. For accesses from the European Union, IP addresses are processed via EU domains and servers before logging. The analytics service is only activated after your consent to the statistics or performance category. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time via the settings of the cookie banner. We have concluded a data processing agreement with Google. In the course of the analytics service, Google may transfer data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. Google LLC and its wholly controlled US subsidiaries are currently certified under the EU-US Data Privacy Framework. For the transfer to Google LLC there is therefore an adequacy decision of the European Commission pursuant to Art. 45 GDPR. Further information on the processing of personal data by Google: https://policies.google.com/privacy?hl=de 4.12 Use of Google Ads Conversion Tracking To measure the success of our advertisements we use Google Ads Conversion Tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service associates certain actions on our website with a previously displayed Google ad. In this context, in particular cookie and advertising identifiers, IP address, pages accessed, time, device and browser information, ad and campaign reference as well as triggered conversion events are processed. Google may also process these data for measurement, security and personalisation of its advertising services under its own responsibility. We receive aggregated campaign reports and no direct identity of individual users. Conversion tracking is only activated after your consent to the marketing category. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time via the settings of the cookie banner. In the course of the advertising service, Google may transfer data to Google LLC in the USA. Google LLC and its wholly controlled US subsidiaries are currently certified under the EU-US Data Privacy Framework. For this transfer there is therefore an adequacy decision pursuant to Art. 45 GDPR. Further information on the processing of personal data by Google: https://policies.google.com/privacy?hl=de 4.13 Use of Meta Pixel To measure and optimise our advertising we use Meta Pixel. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel enables the association of website events with ads on Facebook and Instagram, the creation of audiences and success measurement. In this context, in particular IP address, cookie and advertising identifiers, device and browser information, page accessed, time, referrer, interactions and defined conversion events are transmitted to Meta. Meta may link the data with an existing Meta account and use them for its own advertising, security and analytics purposes. We receive aggregated reports and audience functions. The pixel is only activated after your consent to the marketing category. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time via the settings of the cookie banner. For the collection of website events and their transmission to Meta there is joint controllership pursuant to Art. 26 GDPR. We are responsible in particular for the selection and integration of the pixel, the determination of the transmitted events and obtaining the required consent. Meta is responsible in particular for secure transmission, processing within its systems and handling data subject requests regarding data stored at Meta. Data subject rights may be asserted against us or Meta. After transmission, Meta processes the data for its own purposes under its own responsibility. In the course of the advertising service, Meta may transfer data to Meta Platforms, Inc., 1 Meta Way, Menlo Park, California 94025, USA. Meta Platforms, Inc. is currently certified under the EU-US Data Privacy Framework. For this transfer there is therefore an adequacy decision pursuant to Art. 45 GDPR. Agreement on joint controllership: https://www.facebook.com/legal/controller_addendum Further information on the processing of personal data by Meta: https://www.facebook.com/privacy/policy/ 4.14 Use of TikTok Pixel To measure and optimise advertising campaigns we use TikTok Pixel. The providers are TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London EC1A 9HP, United Kingdom. In this context, in particular IP address, cookie and advertising identifiers, device and browser information, page accessed, time, referrer, interactions and defined conversion events are transmitted to TikTok. TikTok may link the data with a TikTok account and process them for ad delivery, measurement, security and audience creation. We receive aggregated campaign reports and audience functions. The pixel is only activated after your consent to the marketing category. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time via the settings of the cookie banner. For the collection of website events and their transmission to TikTok there is, to the contractually defined extent, joint controllership pursuant to Art. 26 GDPR. We are responsible in particular for the selection and integration of the pixel, the determination of the events and obtaining consent. TikTok is responsible for further technical processing and data subject requests regarding data stored at TikTok. Data subject rights may be asserted against us or TikTok. After transmission, TikTok processes the data for its own purposes under its own responsibility. For transfers to the British TikTok company there is an adequacy decision pursuant to Art. 45 GDPR. For accesses from the USA, Malaysia and Singapore, TikTok uses the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR. A copy may be requested via TikTok's data protection contact point. Further information on the processing of personal data by TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/de 4.15 Use of Microsoft Advertising To measure conversions from Microsoft advertisements we use the Universal Event Tracking technology of Microsoft Advertising. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. In this context, in particular IP address, Microsoft cookie and advertising identifiers, pages accessed, time, referrer, device and browser information, ad and campaign reference as well as conversion events are processed. Microsoft may use this information for ad delivery, measurement, security and its own product improvement under its own responsibility. We receive aggregated campaign reports. The advertising service is only activated after your consent to the marketing category. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time via the settings of the cookie banner. In the course of the advertising service, Microsoft may transfer data to Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052-6399, USA. Microsoft Corporation is currently certified under the EU-US Data Privacy Framework. For this transfer there is therefore an adequacy decision pursuant to Art. 45 GDPR. Further information on the processing of personal data by Microsoft: https://privacy.microsoft.com/de-de/privacystatement 4.16 Use of Microsoft Clarity To analyse the usability of our website we use Microsoft Clarity. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Clarity creates aggregated heatmaps and session recordings in order to identify navigation problems and the use of individual page elements. In this context, in particular pseudonymous identifiers, IP address, device and browser information, pages accessed, times, scroll movements, mouse movements, clicks and display information are processed. Input fields are masked according to the technical protection specifications. We use the data to improve the structure, usability and presentation of our website. The analytics service is only activated after your consent to the statistics or performance category. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time via the settings of the cookie banner. For Clarity data, Microsoft acts as an independent controller. To the extent that data are transferred to Microsoft Corporation in the USA, Microsoft uses for Clarity the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR. A copy may be requested via Microsoft's privacy support. Further information on the processing of personal data by Microsoft Clarity: https://learn.microsoft.com/de-de/clarity/faq Microsoft privacy notices: https://privacy.microsoft.com/de-de/privacystatement 4.17 Use of Google AdSense To finance our editorial offerings we use Google AdSense. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. AdSense serves the selection, delivery and measurement of advertisements on our website. Google Funding Choices is used in addition for the transmission and observance of advertising-related consent decisions. In this context, in particular IP address, cookie and advertising identifiers, device and browser information, page accessed, time, approximate region, ad views, clicks, interactions and consent signals are processed. Google may process these data for ad provision, fraud prevention, measurement and personalisation under its own responsibility. We receive billing and performance reports. The advertising and consent services are only activated after your consent to the marketing category. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time via the settings of the cookie banner. In the course of the advertising service, Google may transfer data to Google LLC in the USA. Google LLC and its wholly controlled US subsidiaries are currently certified under the EU-US Data Privacy Framework. For this transfer there is therefore an adequacy decision pursuant to Art. 45 GDPR. Further information on the processing of personal data by Google: https://policies.google.com/privacy?hl=de 4.18 Use of Meta Audience Network To deliver and measure advertisements we use Meta Audience Network. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The service serves the selection of suitable advertising, reach measurement and the billing of ad inventory. In this context, in particular IP address, cookie and advertising identifiers, device and browser information, content accessed, time, approximate region, ad views, clicks and interactions are processed. We decide on the integration of the advertising spaces and receive performance and billing data. Meta determines the selection, delivery, security and further evaluation of the ads under its own responsibility. The advertising service is only activated after your consent to the marketing category. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time via the settings of the cookie banner. In the course of the advertising service, Meta may transfer data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is currently certified under the EU-US Data Privacy Framework. For this transfer there is therefore an adequacy decision pursuant to Art. 45 GDPR. Further information on the processing of personal data by Meta: https://www.facebook.com/privacy/policy/ 4.19 Use of Sentry To detect and remedy errors, crashes and performance problems of our website and applications we use Sentry. The provider is Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, California 94105, USA. In this context, error time, address accessed, technical process and error data, IP address, device and browser information, operating system as well as a pseudonymous user or account identifier may be processed. The configuration limits transmission to technical error data. We do not collect form content or special categories of personal data with Sentry. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the stability, security and rapid error remediation of our digital offerings. Sentry processes the transmitted error data on our behalf on the basis of a contract pursuant to Art. 28 GDPR. The transfer to Sentry in the USA takes place on the basis of the adequacy decision pursuant to Art. 45 GDPR. Functional Software, Inc. is currently certified under the EU-US Data Privacy Framework. Sentry privacy notices: https://sentry.io/privacy/ 4.20 Use of YouTube videos To present editorial content in an illustrative manner we embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The video content is initially blocked and only loaded when you consent via the cookie banner or the release area displayed directly at the content. After release, a connection to YouTube is established. In this context, in particular IP address, page accessed, time, referrer, device and browser information, cookie and advertising identifiers as well as information on playback and interaction are transmitted to Google. If you are logged in to Google or YouTube, Google may associate the use with your account. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Your release applies to the content activated in this way or according to your selection in the cookie banner. You may withdraw consent at any time via the settings of the cookie banner. In the course of video embedding, Google may transfer data to Google LLC in the USA. Google LLC and its wholly controlled US subsidiaries are currently certified under the EU-US Data Privacy Framework. For this transfer there is therefore an adequacy decision pursuant to Art. 45 GDPR. Further information on the processing of personal data by YouTube and Google: https://policies.google.com/privacy?hl=de 4.21 Use of ipapi.co For coarse geographic assignment as a technical fallback function we use the service ipapi.co. The provider is Kloudend, Inc., 1887 Whitney Mesa Drive #4080, Henderson, Nevada 89014, USA. The assignment serves in particular to determine an approximate region for statistics or personalisation functions if manual location selection is missing. In this context, the IP address is transmitted to ipapi.co. The service returns derived information such as country, region, city, time zone, approximate coordinates and network information. The results are imprecise and are not used to determine a specific address or person. The service is only activated after your consent to the respective related category statistics or personalisation. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG to the extent that information is stored or read on the end device for the assignment. You may withdraw your consent at any time via the settings of the cookie banner. Kloudend processes the data on our behalf. For the transfer to Kloudend in the USA the provider uses the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR. The clauses form part of the data processing agreement published by Kloudend. A copy may be requested from us or Kloudend. Derived geodata may, under the current contractual terms, only be stored for the immediate purpose and for a maximum of 24 hours. Further information on the processing of personal data by ipapi.co: https://ipapi.co/privacy/ 4.22 Use of Open-Meteo For the display of weather information we use the application programming interface of Open-Meteo. The provider is OpenMeteo GmbH, Hintere Schilligmatte 6, 6463 Bürglen, Switzerland. The service delivers weather and geocoding data for the location you have selected or, after your consent, coarsely determined. Upon a direct request, in particular IP address, requested location or approximate coordinates, time, application programming interface accessed as well as device and browser information may be transmitted to Open-Meteo. The processing serves the display of the desired weather chip. The legal basis is Art. 6(1)(b) GDPR if you actively select a location and request the weather display. For an automatic location-based display the legal basis is Art. 6(1)(a) GDPR. To the extent that information is stored or read on the end device for this purpose, Section 25(1) TDDDG applies. According to the provider's current information, Open-Meteo logs IP addresses and requested addresses for monitoring and providing the application programming interface. Individual log data are deleted after 90 days. For transfers to Switzerland there is an adequacy decision of the European Commission pursuant to Art. 45 GDPR. Further information on the processing of personal data by Open-Meteo: https://open-meteo.com/en/terms 4.23 Data processing for web push notifications If you enable breaking news notifications, we process a random push subscription identifier, the technical endpoint address of the push service, a public key, language, selected topics, subscription time, sending and delivery information as well as, where applicable, interactions with the notification. The notifications are delivered via a service worker even when the website is not open. Activation only occurs after your express selection and approval in the browser or operating system. The legal basis is Art. 6(1)(a) GDPR. Storage of the push identifier on your end device is based on Section 25(1) TDDDG. You may withdraw consent at any time in the notification settings of your browser or end device. After withdrawal the subscription is deleted unless proof obligations prevent this. The technical push service depends on the browser or operating system you use. For Chrome and Android, Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, may be the recipient. For Edge, Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052-6399, USA, may be the recipient. Both companies are currently certified under the EU-US Data Privacy Framework. For these transfers there is an adequacy decision pursuant to Art. 45 GDPR. For Firefox, Mozilla Corporation, 2 Harrison Street, Suite 175, San Francisco, California 94105, USA, may provide the push service. Mozilla uses for transfers from the European Economic Area the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR. A copy may be requested via dpo@mozilla.com. For Safari, Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, together with Apple Inc., One Apple Park Way, Cupertino, California 95014, USA, may provide the push service. Apple uses for the transfer to Apple Inc. the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR. A copy may be requested via Apple's data protection contact point. Google privacy notices: https://policies.google.com/privacy?hl=de Microsoft privacy notices: https://privacy.microsoft.com/de-de/privacystatement Mozilla privacy notices: https://www.mozilla.org/de/privacy/firefox/ Apple privacy notices: https://www.apple.com/de/legal/privacy/ 5. Data processing for the newsletter and system emails 5.1 Newsletter subscription and double opt-in If you subscribe to our newsletter, we process your email address, where applicable your name and your topic or language settings. For confirmation we use the double opt-in procedure. In this context we store the IP address as well as the date and time of the subscription and confirmation. Sending begins only after confirmation of the subscription link. Processing for newsletter sending is based on your consent pursuant to Art. 6(1)(a) GDPR. We process the log data on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in documenting proper consent, preventing abusive subscriptions and defending against possible claims. You may withdraw your consent at any time with effect for the future via the unsubscribe link in every newsletter or by a message to us. Your email address is then removed from the active mailing list. Proof data may be stored for three years after withdrawal in order to evidence the consent given and to defend against possible claims. 5.2 Use of Brevo For the bulk sending of our newsletter we use Brevo. The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. Brevo processes the recipient data on our behalf and provides sending, list management, unsubscription and delivery logs. In this context, in particular email address, name, language and topic selection, subscription and confirmation time, IP address, sending status, undeliverabilities and unsubscription information are processed. The processing serves exclusively the newsletter you subscribed to, its technical delivery and the management of the mailing list. The legal bases are Art. 6(1)(a) GDPR for sending and Art. 6(1)(f) GDPR for delivery security, list maintenance and proof. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Brevo. Brevo processes the recipient data according to our instructions and provides the contractually agreed technical and organisational protective measures. Further information on the processing of personal data by Brevo: https://www.brevo.com/de/legal/privacypolicy/ 5.3 Use of Cloudflare Email For the technical sending and forwarding of double opt-in messages, legal notices and transactional system emails we use Cloudflare Email. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA. In this context, in particular sender and recipient address, name, subject, message content, sending and delivery time, server and routing data, IP addresses of the mail servers involved as well as delivery and error status are processed. The legal basis is Art. 6(1)(b) GDPR for requested account, contract and system messages. For legally required notices the legal basis is Art. 6(1)(c) GDPR. For delivery security, documentation and abuse prevention the legal basis is Art. 6(1)(f) GDPR. Processing by Cloudflare takes place on our behalf. The transfer to Cloudflare in the USA takes place on the basis of the adequacy decision pursuant to Art. 45 GDPR, as Cloudflare, Inc. is currently certified under the EU-US Data Privacy Framework. Further information on the processing of personal data by Cloudflare: https://www.cloudflare.com/privacypolicy/ 6. Data processing in connection with our B2B offerings 6.1 Advertiser portal and advertising campaigns If companies plan, book or manage advertising via our advertiser portal, we process company and contact person data, business contact details, account and login data, billing address, tax and payment information, campaign content, target region, language, topic selection, runtime, budget, approvals, correspondence as well as performance data such as impressions, clicks and click-through rate. The processing serves the setup and management of the business account, the review and performance of the advertising campaign, billing, communication and success evaluation. The legal basis is Art. 6(1)(b) GDPR. To the extent that contact persons act for a company, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the efficient initiation and performance of business relationships and communication with the responsible contact persons. Recipients may in particular be payment service providers, IT and hosting service providers, tax advisors, legal advisors as well as employees and service providers who review and manage campaigns technically or editorially. Payment data are processed via Stripe. The information required for this can be found in the section on Stripe. 6.2 Data licence enquiries If companies enquire about a data licence or the use of editorial data, we process company and contact person data, business contact details, information on the desired dataset, purpose of use, scope, runtime, technical requirements, offer, contract, billing and correspondence. The processing serves the review of the enquiry, offer preparation, contract negotiation, licence management, technical provision and enforcement of agreed terms of use. The legal basis is Art. 6(1)(b) GDPR. For contact persons of a company the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper performance and documentation of our B2B business activity. We regularly receive the data directly from you or the company for which you work. To the extent that we obtain business contact details from publicly accessible company websites or professional directories, we process name, function and business contact details on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in contacting responsible business contact persons for a specifically relevant enquiry or existing business relationship. 7. Data processing in connection with ShadowFit 7.1 Provision of the fitness game PWA ShadowFit is a fitness game PWA provided at shadowfit.theviralsource.news. When using it we process account and profile data, display name, game progress, tasks, progress, points, awards, settings, language, device and browser information, IP address, security and log data as well as interactions within the game. For local use, game progress, settings and technical states are stored in IndexedDB or comparable local storage. A service worker and Workbox functions enable installation, caching and use as a PWA. If you enable cloud save, the game progress is associated with your account and stored on our systems. The legal basis is Art. 6(1)(b) GDPR. Storing and reading technically necessary PWA data on your end device is based on Section 25(2) no. 2 TDDDG. Locally stored data remain on the end device used until you delete them via the game or browser settings. Cloud save data are stored until deletion of your account or until the account function ceases. Statutory obligations and temporary safeguarding for abuse prevention remain unaffected. 7.2 Training and body data If you enter training and body data in ShadowFit, we process in particular training type, repetitions, duration, performance values, goals, height, weight and further voluntary information on physical condition. Depending on content and combination, this information may constitute health data and thus special categories of personal data within the meaning of Art. 9(1) GDPR. The processing serves the display of your progress, the adaptation of tasks and the provision of the game functions you desire. The legal bases are your consent pursuant to Art. 6(1)(a) GDPR and, for health data, your explicit consent pursuant to Art. 9(2)(a) GDPR. To the extent that individual information is necessary for the performance of the account function you have requested, Art. 6(1)(b) GDPR applies in addition. Entry is voluntary. You may withdraw your consent at any time with effect for the future and delete stored information. Without the data concerned, individual personalised training and progress functions are not available or only available to a limited extent. Health data are not used for advertising or marketing pixels. 7.3 Leaderboards, guilds and duels If you use leaderboards, guilds or duel functions including reality-related duels, we process your display name, avatar, game progress, points, rank, guild membership, invitations, opponent and result data, times as well as the interactions you trigger. The information visible to other players in each case is indicated before activation of the function. The processing serves the performance of the chosen multiplayer and competition functions, the display of results, communication within guilds and the prevention of manipulation. The legal basis is Art. 6(1)(b) GDPR. For moderation, fraud prevention and enforcement of the game rules the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in fair, safe and functional game operation. Please use a display name that does not allow unnecessary conclusions about your person. Training and body data are not published in leaderboards or to other players unless you yourself trigger a specifically designated publication. 7.4 Reach measurement in ShadowFit For our own reach measurement in ShadowFit we use a first-party event endpoint reachable under our domain at /api/events. The events are processed with Cloudflare Analytics Engine. Marketing pixels from Google, Meta, TikTok or Microsoft are not used on the game domain. In this context, in particular a pseudonymous session identifier, game view accessed, time, device and browser characteristics, language, coarse region and interaction events are processed. Training and body data are not included in the reach measurement. The measurement is only activated after your consent to the statistics or performance category. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. The event data are processed by Cloudflare on our behalf. The data are retained in Cloudflare Analytics Engine for three months. The transfer to Cloudflare in the USA takes place on the basis of the adequacy decision pursuant to Art. 45 GDPR, as Cloudflare, Inc. is currently certified under the EU-US Data Privacy Framework. 8. Data processing for payments via Stripe For payments by advertising customers and for in-app purchases in ShadowFit we use Stripe. The provider for users in the European Economic Area is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, hereinafter "Stripe". Stripe processes payments, confirms transactions and supports fraud prevention. In this context, in particular name, email address, billing address, payment method, payment data, amount, currency, product or booking reference, transaction identifier, IP address, device and browser information as well as security and verification features are processed. Full card or account data are collected directly by Stripe. We regularly receive only the payment status, a transaction identifier and the information required for accounting and performance of the service. The legal basis is Art. 6(1)(b) GDPR for payment and contract processing. For tax and commercial law retention obligations the legal basis is Art. 6(1)(c) GDPR. For fraud prevention, security and receivables management the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in secure and efficient payment processing and defence against abusive transactions. Stripe processes certain data as an independent controller, in particular for payment processing, fraud prevention and fulfilment of its own legal obligations. In the course of payment processing, Stripe may transfer data to Stripe, LLC, 354 Oyster Point Boulevard, South San Francisco, California 94080, USA. Stripe, LLC is currently certified under the EU-US Data Privacy Framework. For this transfer there is therefore an adequacy decision of the European Commission pursuant to Art. 45 GDPR. Further information on the processing of personal data by Stripe: https://stripe.com/de/privacy 9. Data processing by the address and postal service For the provision of the delivery address used in the imprint and the forwarding of incoming mail we use the service of IMPRESSUM-PRIVATSCHUTZ GmbH, Ludwig-Erhard-Straße 18, 20459 Hamburg. The service allocates mail directed to the identifier IP-Management #11448 to the controller and forwards it. In this context, sender name, sender address, recipient details, content and attachments of a consignment, time of receipt as well as forwarding and contact data may be processed. The processing serves reachability for legal and business mail and the protection of the private residential address of the controller. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in reliable serviceable reachability while preserving the private address. IMPRESSUM-PRIVATSCHUTZ GmbH processes the data on the basis of a contract pursuant to Art. 28 GDPR. Further information on the processing of personal data by IMPRESSUM-PRIVATSCHUTZ: https://impressum-privatschutz.de/datenschutzerklaerung 10. Disclosure of data to third parties or other recipients In certain cases we are legally obliged to transmit data to a requesting public authority, for example in the context of national legal provisions. The legal basis for the processing is Art. 6(1)(c) GDPR. To the extent necessary for the respective purposes, technical service providers, hosting and security providers, analytics and advertising service providers, communication and newsletter providers, payment service providers, tax advisors, legal advisors, banks, business partners and authorities obtain access to personal data. Processors are engaged on the basis of Art. 28 GDPR. Independent controllers receive data only if this is necessary for contract performance, you have consented, a legitimate interest exists or a legal obligation applies. The bases specifically used for transfers to third countries in connection with individual services are stated in the respective sections. For transfers to currently certified US companies the adequacy decision of the European Commission on the EU-US Data Privacy Framework pursuant to Art. 45 GDPR is used. For the transfers described for TikTok, Microsoft Clarity, ipapi.co, Mozilla and Apple the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR are used. A copy of the respectively applicable clauses may be requested from us or the data protection contact point named in the relevant sections. Information of the European Commission on Standard Contractual Clauses: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_de 11. Retention period of the data Personal data are stored by us only for the period necessary to fulfil the respective purposes. The duration of storage depends on the legal basis, the processing purpose, statutory retention obligations, contractual requirements as well as the necessity for the establishment, exercise or defence of legal claims. Data from contact forms and other direct communication are generally stored by us for up to three years after the last contact. Contract, booking, payment and billing data are regularly retained for six or ten years in accordance with statutory commercial and tax retention periods. Data from reader accounts and ShadowFit cloud saves are stored by us until deletion of the account, unless statutory obligations or legitimate safeguarding interests require longer retention. Newsletter recipient data are stored until withdrawal of consent. Proof data regarding newsletter consent may be retained for three years after withdrawal. Published comments and interactions generally remain stored until deletion by you, until the related content ceases to exist or until a required moderation decision. Moderation and security logs may be retained for up to three years to the extent necessary for abuse prevention or legal defence. Consent-dependent analytics, personalisation and marketing data are stored until withdrawal and thereafter according to the periods described for the respective service. Event data in Cloudflare Analytics Engine are retained for three months. Geodata derived from ipapi.co may be stored for a maximum of 24 hours. Open-Meteo deletes individual log data after 90 days. Data stored locally in IndexedDB, cookies or comparable storage remain until the expiry of their technical lifetime or until you delete them via the browser or application settings. After the respective storage purpose ceases and statutory retention periods expire, the personal data are deleted or anonymised. Longer retention takes place only if it is required due to statutory obligations, to secure evidence or for the establishment, exercise or defence of legal claims. 12. Data security We attach great importance to the protection of your personal data and have therefore implemented technical and organisational measures to ensure an appropriate level of protection in accordance with the statutory requirements, in particular the General Data Protection Regulation (GDPR). These measures serve to ensure the confidentiality, integrity and availability of the data we process and to protect them against unauthorised access, loss, destruction or manipulation. The technical and organisational measures are, where necessary, adapted to the state of the art in order to continue to ensure the protection of your data. 13. Your rights as a data subject You have the right at any time to obtain free of charge information about the purpose, scope, origin and recipients of the personal data stored about you (Art. 15 GDPR). In addition, you have the right to request the rectification of inaccurate or incomplete data (Art. 16 GDPR). Pursuant to the data protection provisions you further have the right to erasure of your personal data if the conditions of Art. 17 GDPR are met, as well as the right to restriction of processing of your personal data pursuant to Art. 18 GDPR. You also have the right to object at any time to the processing of your personal data (Art. 21 GDPR) if this is based on Art. 6(1)(e) or (f) GDPR. This applies in particular to the processing of your data for direct marketing purposes. Furthermore, you have the right to data portability. You may receive the personal data you have provided to us in a structured, commonly used and machine-readable format or request the transmission of these data to another controller, provided the conditions of Art. 20 GDPR are met. In addition, you have the right to withdraw your consent to the processing of your personal data at any time with effect for the future, for example by an informal notice by email or in writing to the contact details stated above (Art. 7(3) GDPR). The lawfulness of processing carried out on the basis of your consent until the time of withdrawal remains unaffected. To the extent that you have expressly consented to the processing of health data in ShadowFit, you may also withdraw this consent pursuant to Art. 9(2)(a) GDPR at any time with effect for the future. The data concerned are subsequently deleted unless a statutory retention obligation or another legally permissible ground prevents this. If you are of the opinion that the processing of your personal data violates data protection provisions or that your rights have otherwise been infringed, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR. Last updated: August 2026