Privacy Policy


Privacy Policy

We inform you below about the legal requirements of data protection law (in particular the German Federal Data Protection Act (BDSG n.F.) and the European General Data Protection Regulation ‘GDPR’) regarding the type, scope, and purpose of the processing of personal data by our company. This privacy policy also applies to our websites and social media profiles. With regard to the definition of terms such as “personal data” or “processing”, we refer to Art. 4 GDPR.

Name and Contact Details of the Controller

Our controller (hereinafter “Controller”) within the meaning of Art. 4 No. 7 GDPR is:

Manuel Gruber Am Anger 9a 84140 Gangkofen website2026a@manuelgruber.com

Types of Data, Purposes of Processing and Categories of Data Subjects

Below we inform you about the type, scope, and purpose of the collection, processing, and use of personal data.

1. Types of data we process

  • Usage data (access times, visited websites, etc.)
  • Inventory data (name, address, etc.)
  • Contact data (phone number, email, fax, etc.)
  • Content data (text inputs, videos, photos, etc.)
  • Communication data (IP address, etc.)

2. Purposes of processing pursuant to Art. 13 para. 1 c) GDPR

  • Technically and economically optimize the website
  • Enable easy access to the website
  • Enable contact in the event of legal complaints by third parties
  • Support the commercial use of the website
  • Improve user experience
  • Design the website to be user-friendly
  • Economic operation of advertising and website
  • Marketing / sales / advertising
  • Creation of statistics
  • Prevention of SPAM and misuse
  • Customer service and customer care

3. Categories of data subjects pursuant to Art. 13 para. 1 e) GDPR

  • Visitors/users of the website

The data subjects are collectively referred to as “users”.

Below we inform you about the legal bases for the processing of personal data:

  1. If we have obtained your consent to process personal data, Art. 6 para. 1 sentence 1 lit. a) GDPR is the legal basis.
  2. If the processing is necessary for the performance of a contract or for the implementation of pre-contractual measures taken at your request, Art. 6 para. 1 sentence 1 lit. b) GDPR is the legal basis.
  3. If the processing is necessary for compliance with a legal obligation to which we are subject (e.g. statutory retention obligations), Art. 6 para. 1 sentence 1 lit. c) GDPR is the legal basis.
  4. If the processing is necessary to protect the vital interests of the data subject or another natural person, Art. 6 para. 1 sentence 1 lit. d) GDPR is the legal basis.
  5. If the processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, and your interests or fundamental rights and freedoms do not override these, Art. 6 para. 1 sentence 1 lit. f) GDPR is the legal basis.

Disclosure of Personal Data to Third Parties and Processors

In principle, we do not pass on data to third parties without your consent. If this is nevertheless the case, the transfer is made on the basis of the aforementioned legal bases, e.g. when transferring data to online payment providers for contract performance, or on the basis of a court order, or due to a legal obligation to disclose data for the purpose of criminal prosecution, danger prevention, or the enforcement of intellectual property rights. We also use processors (external service providers, e.g. for web hosting of our websites and databases) to process your data. When data is transferred to processors within the framework of a data processing agreement, this always takes place in accordance with Art. 28 GDPR. We carefully select our processors, monitor them regularly, and have obtained the right to issue instructions regarding the data. In addition, the processors must have taken appropriate technical and organisational measures and must comply with the data protection regulations pursuant to BDSG n.F. and GDPR.

Data Transfer to Third Countries

The adoption of the European General Data Protection Regulation (GDPR) has created a uniform basis for data protection in Europe. Your data is therefore primarily processed by companies for which the GDPR applies. If processing by third-party services outside the European Union or the European Economic Area does take place, these must meet the special requirements of Art. 44 et seq. GDPR. This means that processing takes place on the basis of special guarantees, such as the officially recognised determination by the EU Commission of a level of data protection equivalent to that of the EU, or compliance with officially recognised special contractual obligations, the so-called “standard contractual clauses”. Insofar as we collect your explicit consent to the transfer of data to the USA pursuant to Art. 49 para. 1 sentence 1 lit. a) GDPR due to the invalidity of the so-called “Privacy Shield”, we draw your attention to the risk of secret access by US authorities and the use of data for surveillance purposes, possibly without any legal remedy for EU citizens.

Deletion of Data and Retention Period

Unless expressly stated in this privacy policy, your personal data will be deleted or blocked as soon as the consent given for the processing is revoked by you, or the purpose for storage ceases to apply or the data is no longer required for the purpose, unless their further retention is required for evidentiary purposes or is subject to statutory retention obligations. These include commercial retention obligations for business letters pursuant to § 257 para. 1 HGB (6 years) and tax retention obligations for receipts pursuant to § 147 para. 1 AO (10 years). When the prescribed retention period expires, your data will be blocked or deleted unless the storage is still necessary for the conclusion or performance of a contract.

Existence of Automated Decision-Making

We do not use automatic decision-making or profiling.

Provision of Our Website and Creation of Log Files

  1. If you use our website purely for informational purposes (i.e. no registration and no other transmission of information), we only collect the personal data that your browser transmits to our server. When you wish to view our website, we collect the following data:
    • IP address;
    • Internet service provider of the user;
    • Date and time of access;
    • Browser type;
    • Language and browser version;
    • Content of the request;
    • Time zone;
    • Access status/HTTP status code;
    • Amount of data;
    • Websites from which the request originates;
    • Operating system. This data is not stored together with other personal data of yours.
  2. This data serves the purpose of delivering our website to you in a user-friendly, functional, and secure manner with its features and content, and for its optimisation and statistical evaluation.
  3. The legal basis for this is our legitimate interest in data processing, which also lies in the above purposes, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
  4. For security reasons, we store this data in server log files for a storage period of 30 days. After this period, they are automatically deleted, unless we need to retain them for evidentiary purposes in the event of attacks on the server infrastructure or other legal violations.

Cookies

  1. We use so-called cookies when you visit our website. Cookies are small text files that your internet browser places and stores on your computer. When you visit our website again, these cookies provide information to automatically recognise you. Cookies also include so-called “user IDs”, where user information is stored using pseudonymised profiles. We inform you when you visit our website, by means of a notice referring to this privacy policy, about the use of cookies for the aforementioned purposes, and how you can object to this or prevent their storage (“opt-out”).

The following types of cookies are distinguished:

• Necessary, essential cookies: Essential cookies are cookies that are absolutely necessary for the operation of the website in order to store certain functions of the website such as logins, shopping carts, or user inputs, e.g. regarding the language of the website.

• Session cookies: Session cookies are needed to recognise repeated use of an offering by the same user (e.g. if you have logged in to determine your login status). When you visit our website again, these cookies provide information to automatically recognise you. The information thus obtained serves to optimise our offerings and to provide you with easier access to our website. The session cookies are deleted when you close your browser or log out.

• Persistent cookies: These cookies remain stored even after you close your browser. They are used to store your login, for reach measurement, and for marketing purposes. These are automatically deleted after a predetermined period, which may vary depending on the cookie. You can delete the cookies at any time in your browser’s security settings.

• Third-party cookies (especially from advertisers): According to your preferences, you can configure your browser settings and, for example, refuse to accept third-party cookies or all cookies. We point out here, however, that you may then not be able to use all functions of this website. Read more about these cookies in the respective privacy policies of the third-party providers.

  1. Data categories: User data, cookie, user ID (including pages visited, device information, access times, and IP addresses).

  2. Purposes of processing: The information thus obtained serves the purpose of technically and economically optimising our web offerings and providing you with easier and more secure access to our website.

  3. Legal bases: If we process your personal data using cookies based on your consent (“opt-in”), then Art. 6 para. 1 sentence 1 lit. a) GDPR is the legal basis. Otherwise, we have a legitimate interest in the effective functionality, improvement, and economic operation of the website, so that in such a case Art. 6 para. 1 sentence 1 lit. f) GDPR is the legal basis. Art. 6 para. 1 sentence 1 lit. b) GDPR is also the legal basis when cookies are set for the initiation of a contract, e.g. for orders.

  4. Storage period / deletion: The data is deleted as soon as it is no longer required for the purpose for which it was collected. In the case of collecting data for the provision of the website, this is the case when the respective session has ended. Cookies are otherwise stored on your computer and transmitted from it to our website. Therefore, you as a user also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, it may no longer be possible to use all functions of the website to their full extent.

Here you can find information on deleting cookies by browser:

  • Chrome: https://support.google.com/chrome/answer/95647
  • Safari: https://support.apple.com/de-at/guide/safari/sfri11471/mac
  • Firefox: https://support.mozilla.org/de/kb/cookies-und-website-daten-in-firefox-loschen
  • Internet Explorer: https://support.microsoft.com/de-at/help/17442/windows-internet-explorer-delete-manage-cookies
  • Microsoft Edge: https://support.microsoft.com/de-at/help/4027947/windows-delete-cookies
  1. Objection and “opt-out”: You can generally prevent cookies from being stored on your hard drive, regardless of consent or legal permission, by selecting “do not accept cookies” in your browser settings. However, this may result in a limitation of our offerings. You can object to the use of cookies from third-party providers for advertising purposes via a so-called “opt-out” via this American website (https://optout.aboutads.info) or this European website (http://www.youronlinechoices.com/de/praferenzmanagement/).

Contact via Contact Form / Email / Fax / Post

  1. When you contact us via the contact form, fax, post, or email, your information is processed for the purpose of handling the contact request.

  2. The legal basis for processing data is, if your consent is given, Art. 6 para. 1 sentence 1 lit. a) GDPR. The legal basis for processing data transmitted in the course of a contact request or email, letter, or fax is Art. 6 para. 1 sentence 1 lit. f) GDPR. The controller has a legitimate interest in processing and storing the data in order to be able to respond to user requests, for evidence preservation for liability reasons, and in order to comply with any statutory retention obligations for business letters. If the contact aims at the conclusion of a contract, the additional legal basis for processing is Art. 6 para. 1 sentence 1 lit. b) GDPR.

  3. We may store your information and contact request in our Customer Relationship Management System (“CRM System”) or a comparable system.

  4. The data is deleted as soon as it is no longer required for the purpose for which it was collected. For the personal data from the input mask of the contact form and those transmitted by email, this is the case when the respective conversation with you has ended. The conversation has ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved. We store requests from users who have an account or contract with us for up to two years after the end of the contract. In the case of statutory archiving obligations, deletion takes place after their expiry: end of commercial (6 years) and tax (10 years) retention obligations.

  5. You have the option at any time to revoke your consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR to the processing of personal data. If you contact us by email, you can object to the storage of personal data at any time.

Contact via Telephone

  1. When you contact us by telephone, your telephone number is processed to handle the contact request and its completion, and is temporarily stored or displayed in the RAM / cache of the telephone device / display. The storage takes place for liability and security reasons, to be able to prove the call, as well as for economic reasons, to enable a callback. In the case of unauthorised advertising calls, we block the numbers.

  2. The legal basis for the processing of the telephone number is Art. 6 para. 1 sentence 1 lit. f) GDPR. If the contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b) GDPR.

  3. The device cache stores calls for 30 days and successively overwrites or deletes old data; when the device is disposed of, all data is deleted and the storage medium is possibly destroyed. Blocked telephone numbers are reviewed annually for the necessity of the block.

  4. You can prevent the display of your telephone number by calling with a withheld number.

Google Adsense

  1. We have integrated advertisements from Google’s “Adsense” service (service provider: Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) on our website. The advertisements are marked with the (i) notice “Google Ads” in each advertisement.

  2. Data categories and description of data processing: Usage data / communication data; Google receives the information that you have accessed our website when you visit it. To do this, Google places a web beacon or cookie on your computer. The data is also transmitted to the USA and analysed there. If you are logged in with a Google account, Adsense can assign the data to your account. If you do not want this, you must log out before visiting our website. However, other information can also be used by Google for this purpose:
    • The type of websites you visit and the mobile apps installed on your device;
    • Cookies in your browser and settings in your Google account;
    • Websites and apps you have visited;
    • Your activity on other devices;
    • Previous interactions with Google’s ads or advertising services;
    • Your Google account activity and information.

    When you click on an Adsense advertisement, your IP is processed by Google (usage data), whereby the processing is pseudonymised (so-called “advertising ID”) by shortening the IP by the last two digits. When displaying personalised advertising, Google does not link identifiers from cookies or similar technologies with special categories of personal data pursuant to Art. 9 GDPR, such as ethnic origin, religion, sexual orientation, or health.

  3. Purpose of processing: We have activated the personalised ads in order to show you more interesting advertising that supports the commercial use of our website, increases its value for us, and improves the user experience for you. With personalised advertising, we can reach users through Adsense based on their interests and demographic characteristics (e.g. “sports enthusiasts”). The processing also serves tracking, remarketing, and conversion measurement, as well as financing our web offering.

  4. Legal bases: If you have given your consent to the processing of your personal data via “Google Adsense with personalised ads” (“opt-in”), then Art. 6 para. 1 sentence 1 lit. a) GDPR is the legal basis. Otherwise, the legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. f) GDPR based on our legitimate interests in the analysis, optimisation, and efficient economic operation of our advertising and website.

  5. Data transfer / recipient category: Google Ireland, USA; This website also has third-party Google AdSense ads enabled. The aforementioned data may also be transmitted to these third-party providers “Certified External Vendors” listed at https://support.google.com/dfp_sb/answer/94149.

  6. Storage period: The data is stored for up to 24 months after the last visit.

  7. Objection and opt-out options: You can object to or prevent the installation of cookies by Google Adsense in various ways:
    • You can prevent cookies in your browser by using the setting “do not accept cookies”, which also includes third-party cookies;
    • You can disable personalised ads at Google directly via the link https://adssettings.google.com/, whereby this setting only remains in effect until you delete your cookies. To disable personalised advertising on mobile devices you can find instructions here: https://support.google.com/adsense/troubleshooter/1631343;
    • You can disable personalised third-party ads that participate in the advertising self-regulation initiative “About Ads” via the link https://optout.aboutads.info/ for US sites or for EU sites at http://www.youronlinechoices.com/de/praferenzmanagement/, whereby this setting only remains in effect until you delete all your cookies;
    • You can permanently disable cookies via a browser plug-in for Chrome, Firefox, or Internet Explorer at the link https://support.google.com/ads/answer/7395996. This deactivation may result in your no longer being able to use all functions of our website to their full extent.

    In Google’s privacy policy for advertising at https://policies.google.com/technologies/ads you will find more information about the use of Google cookies in ads and their advertising technologies, storage period, anonymisation, location data, functionality, and your rights.

Google AdWords with Conversion Tracking

  1. We use the service “Google Ads with Conversion Tracking” (service provider: Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) to draw attention to our website on third-party websites via advertisements.

  2. Data categories and description of data processing: Usage data / communication data. When you click on one of our Google ads, a cookie is stored in your browser, which is valid for approximately 30 days. If you then visit our website, we and Google can use the cookie to evaluate whether you have visited our website and which page you visited. Google creates a statistic based on this. The data is also transmitted to the USA and analysed there. If you are logged in with a Google account, AdWords can assign the data to your account. If you do not want this, you must log out before visiting our website.

  3. Purpose of data processing: This conversion tracking serves the purpose of analysis/performance measurement, optimisation, and the economic operation of our advertising and website.

  4. Legal bases: If you have given your consent to the processing of your personal data via “Google Ads with Conversion Tracking” (“opt-in”), then Art. 6 para. 1 sentence 1 lit. a) GDPR is the legal basis. Otherwise, the legal basis for processing your data is our legitimate interest in the analysis, optimisation, and efficient economic operation of our advertising and website pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.

  5. Data transfer / recipient category: Google Ireland.

  6. Storage period: Up to 540 days.

  7. Objection and opt-out options: You can object to or prevent the installation of cookies by Google in various ways:

    • You can prevent cookies in your browser by using the setting “do not accept cookies”, which also includes third-party cookies;
    • You can disable conversion tracking at Google directly via the link https://adssettings.google.com, whereby this setting only remains in effect until you delete your cookies;
    • You can disable personalised third-party ads that participate in the advertising self-regulation initiative “About Ads” via the link https://optout.aboutads.info for US sites or for EU sites at http://www.youronlinechoices.com/de/praferenzmanagement/, whereby this setting only remains in effect until you delete all your cookies;
    • You can permanently disable cookies via a browser plug-in for Chrome, Firefox, or Internet Explorer at the link https://support.google.com/ads/answer/7395996. This deactivation may result in your no longer being able to use all functions of our website to their full extent.

For more information, see Google’s privacy policy at https://policies.google.com/privacy?hl=de&gl=de and https://services.google.com/sitestats/de.html.

Google AdWords Remarketing / “Similar Audiences”

  1. We use the application Google Analytics Remarketing / “Similar Audiences” (service provider: Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) to draw attention to our website on third-party websites and other internet offerings via advertisements.

  2. Data categories and description of data processing: Usage data / communication data. With the remarketing or “Similar Audiences” feature (https://support.google.com/adwords/answer/1752338?hl=de) in Ads, we can reach you if you have already visited our website and address you with an appropriate message via an ad. With remarketing, we can bring back our previous visitors to our website with a click. If you then visit other websites or internet offerings, we and Google can use the cookie to evaluate whether you have already visited our website and display our advertising to you there as well. Google creates a statistic based on this. The full extent of data processing is not known to us. The data is also transmitted to the USA and analysed there. According to Google, the data collected through remarketing is not merged with your personal data possibly stored at Google, but is processed under a pseudonym.

  3. Purpose of processing: This remarketing serves the purpose of analysing, optimising, and the economic operation of our advertising and website.

  4. Legal bases: If you have given your consent to the processing of your personal data via “Google Ads Remarketing / ‘Similar Audiences’” (“opt-in”), then Art. 6 para. 1 sentence 1 lit. a) GDPR is the legal basis. Otherwise, the legal basis for processing your data is our legitimate interest in the analysis, optimisation, and efficient economic operation of our advertising and website pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.

  5. Data transfer / recipient category: Google Ireland.

  6. Storage period: When you visit certain pages of ours, a cookie is stored in your browser which is valid for 30 days.

  7. Objection and opt-out options: You can object to or prevent the installation of cookies by Google in various ways:

    • You can prevent cookies in your browser by using the setting “do not accept cookies”, which also includes third-party cookies;
    • You can disable personalised ads at Google directly via the link https://adssettings.google.com, whereby this setting only remains in effect until you delete your cookies;
    • You can disable personalised third-party ads that participate in the advertising self-regulation initiative “About Ads” via the link https://optout.aboutads.info for US sites or for EU sites at http://www.youronlinechoices.com/de/praferenzmanagement/, whereby this setting only remains in effect until you delete all your cookies;
    • You can permanently disable cookies via a browser plug-in for Chrome, Firefox, or Internet Explorer at the link https://support.google.com/ads/answer/7395996. This deactivation may result in your no longer being able to use all functions of our website to their full extent.

For more information, see Google’s privacy policy at https://policies.google.com/privacy?hl=de&gl=de.

Google Analytics

  1. We have integrated the website analysis tool “Google Analytics” (service provider: Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) on our website.

  2. Data categories and description of data processing: User ID, IP address (anonymised). When you visit our website, Google places a cookie on your computer to analyse your use of our website. We have activated the IP anonymisation “anonymizeIP”, whereby the IP addresses are only processed in a shortened form. On this website, your IP address is therefore truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide further services relating to website use and internet use for the controller. We have also activated cross-device analysis of website visitors, which is carried out via a so-called user ID. The IP address transmitted by your browser within the framework of Google Analytics is not merged with other Google data. For more information on data use by Google Analytics, see here: https://www.google.com/analytics/terms/de.html (Analytics Terms of Use), https://support.google.com/analytics/answer/6004245?hl=de (Notes on data protection in Analytics), and Google’s privacy policy https://policies.google.com/privacy.

  3. Purpose of processing: The use of Google Analytics serves the purpose of analysing, optimising, and improving our website.

  4. Legal bases: If you have given your consent to the processing of your personal data via “Google Analytics” from the third-party provider (“opt-in”), then Art. 6 para. 1 sentence 1 lit. a) GDPR is the legal basis. The legal basis is also our legitimate interest (the analysis, optimisation, and improvement of our website) in data processing pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. For services rendered in connection with a contract, tracking and analysis of user behaviour takes place pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR in order to use the information gained to offer optimised services for the fulfilment of the contractual purpose.

  5. Storage period: Data sent by us and linked to cookies, user identifiers (e.g. user ID), or advertising IDs is automatically deleted after 14 months. The deletion of data whose retention period has been reached takes place automatically once a month.

  6. Data transfer / recipient category: Google, Ireland and USA. We have also concluded a data processing agreement with Google pursuant to Art. 28 GDPR.

  7. Objection and opt-out options:

    • You can generally prevent cookies from being stored on your hard drive by selecting “do not accept cookies” in your browser settings. However, this may result in a limitation of our offerings. In addition, you can prevent the collection of the data generated by the cookie and related to your use of the website to Google, and the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de
    • As an alternative to the above browser plug-in, you can prevent collection by Google Analytics by clicking [here]. By clicking, an “opt-out” cookie will be set that will prevent the collection of your data when you visit this website in the future. This cookie only applies to our website and your current browser, and only lasts until you delete your cookies. In that case, you would have to set the cookie again.
    • You can disable cross-device user analysis in your Google Account under “My data > personal data”.

Google ReCAPTCHA

  1. We have integrated the anti-spam function “reCAPTCHA” from “Google” (provider: Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) on our website.

  2. Data category and description of data processing: Usage data (e.g. website accessed, IP). By using “reCAPTCHA” in our forms, we can determine whether the input was made by a machine (robot) or a human. When using the service, your IP address and possibly other data required for this purpose may be transmitted to Google servers in the USA.

  3. Purpose of processing: Prevention of spam and misuse, as well as our economic interest in optimising our website.

  4. Legal bases: If you have given your consent to the processing of your personal data via “reCaptcha” from the third-party provider (“opt-in”), then Art. 6 para. 1 sentence 1 lit. a) GDPR is the legal basis. The legal basis is also our legitimate interest in data processing pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, which also lies in the above purposes.

  5. Data transfer / recipient category: Third-party providers in the USA.

  6. Storage period: Until you delete the cookies.

  7. For more information about Google reCAPTCHA, see https://www.google.com/recaptcha/ and Google’s privacy policy at: https://policies.google.com/privacy.

Google Maps

  1. We have integrated maps from “Google Maps” (provider: Google Ireland Limited, registration no.: 368047, Gordon House, Barrow Street, Dublin 4, Ireland) on our website.

  2. Data category and description of data processing: Usage data (e.g. IP, location, page accessed). With Google Maps, we can display the location of addresses and directions directly on our website in interactive maps and enable you to use this tool. When our website, where Google Maps is integrated, is accessed, a connection to Google’s servers in the USA is established. Your IP address and location may be transmitted to Google. In addition, Google receives the information that you have accessed the relevant page. This also takes place without a Google user account. If you are logged in to your Google account, Google can assign the above data to your account. If you do not want this, you must log out of your Google account. Google creates user profiles from such data and uses this data for the purpose of advertising, market research, or optimisation of its websites.

  3. Purpose of processing: Provision of a user-friendly, economical, and optimised website.

  4. Legal bases: If you have given your consent to the processing of your personal data via “Google Maps” from the third-party provider (“opt-in”), then Art. 6 para. 1 sentence 1 lit. a) GDPR is the legal basis. The legal basis is also our legitimate interest in data processing pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, which also lies in the above purposes.

  5. Data transfer / recipient category: Third-party providers in the USA.

  6. Storage period: Cookies up to 6 months or until deletion by you. Otherwise as soon as they are no longer required for the processing purposes.

  7. Objection and opt-out options: You have a right to object against Google regarding the creation of user profiles. Please address this directly to Google via the privacy policy mentioned below. You can submit an opt-out objection regarding advertising cookies here in your Google Account: https://adssettings.google.com/authenticated

For more information, see Google Maps’ Terms of Use at https://www.google.com/intl/de_de/help/terms_maps.html and Google’s advertising privacy policy at https://policies.google.com/technologies/ads. Google’s general privacy policy: https://policies.google.com/privacy.

Social Media Presence

  1. We maintain profiles or fan pages in social media. When you use and access our profile in the respective network, the respective data protection notices and terms of use of the respective network apply.

  2. Data categories and description of data processing: Usage data, contact data, content data, inventory data. Furthermore, the data of users within social networks is generally processed for market research and advertising purposes. For example, user profiles can be created based on user behaviour and the resulting interests of users. The user profiles can in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to the interests of the users. For these purposes, cookies are generally stored on the computers of users in which the user behaviour and interests of the users are stored. Furthermore, data may also be stored in the user profiles independently of the devices used by the users (particularly if the users are members of the respective platforms and are logged in to these). For a detailed presentation of the respective processing forms and the objection options (opt-out), we refer to the privacy policies and information of the operators of the respective networks. In the case of information requests and the assertion of data subject rights, we also point out that these can most effectively be asserted with the providers. Only the providers have access to the users’ data in each case and can take appropriate measures directly and provide information. Should you nevertheless need help, you can contact us.

  3. Purpose of processing: Communication with users connected and registered on the social networks; information and advertising for our products, offers, and services; external presentation and image cultivation; evaluation and analysis of users and content of our social media presences.

  4. Legal bases: The legal basis for the processing of personal data is our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, which lies in the above purposes. Insofar as you have given your consent to the processing of your personal data to us or to the controller of the social network, the legal basis is Art. 6 para. 1 sentence 1 lit. a) in conjunction with Art. 7 GDPR.

  5. Data transfer / recipient category: Social network.

  6. The privacy notices, information options, and objection options (opt-out) of the respective networks / service providers can be found here:

    • XING – Service provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany) – Privacy policy / opt-out: https://privacy.xing.com/de/datenschutzerklaerung.
    • LinkedIn – Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) – Privacy policy: https://www.linkedin.com/legal/privacy-policy, cookie policy and opt-out: https://www.linkedin.com/legal/cookie-policy

Social Media Plug-ins

  1. We use social media plug-ins from social networks on our website. We use the so-called “two-click solution” Shariff https://www.heise.de/ct/artikel/Shariff-Social-Media-Buttons-mit-Datenschutz-2467514.html from c’t / heise.de: Service provider: Heise Medien GmbH & Co. KG, Karl-Wiechert-Allee 10, 30625 Hannover, Germany; Privacy policy: https://www.heise.de/Datenschutzerklaerung-der-Heise-Medien-GmbH-Co-KG-4860.html.

  2. Data category and description of data processing: Usage data, content data, inventory data. When our website is accessed, “Shariff” does not transmit any personal data to the third-party providers of the social plug-ins. In addition to the logo or brand of the social network, you will find a toggle that you can use to activate the plug-in with a click. This activation constitutes your consent in the form that the respective provider of the social network receives the information that you have accessed our website and your personal data is transmitted to the plug-in provider and stored there. These are so-called third-party cookies. For some providers such as Facebook and XING, your IP is immediately anonymised after collection, according to their information. The data collected about the user is stored by the plug-in provider as user profiles. You can revoke your consent at any time by deactivating the toggle.

  3. Purpose of data processing: Improvement and optimisation of our website; increasing our awareness via social networks; possibility of interaction with you and between users via social networks; advertising, analysis, and/or demand-oriented design of the website.

  4. Legal bases: The legal basis for the processing of personal data is our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, which lies in the above purposes. Insofar as you have given your consent to the processing of your personal data to us or to the controller of the social network, the legal basis is Art. 6 para. 1 sentence 1 lit. a) in conjunction with Art. 7 GDPR. In the case of pre-contractual enquiries or the use of your personal data for contract performance, Art. 6 para. 1 sentence 1 lit. b) GDPR is the legal basis.

  5. Data transfer / recipient category: Social network.

  6. Social networks used and objection: With regard to the purpose and scope of data collection and processing, we refer to the respective privacy policies of the social networks. You will also find information there about your rights and setting options to protect your personal data. You have the right to object to the creation of these user profiles, and in order to exercise these rights you can contact the respective plug-in provider directly.

XING

  1. We have integrated plug-ins from the social network XING (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany) within the so-called “two-click solution” of Shariff on our website. You can recognise these by the share button with the white XING logo and the “X” symbol on a green background.

  2. If you intentionally activate the XING share button on our website, this causes your browser to connect to XING’s server when the respective web page is accessed. According to XING, no data about the access is stored from which XING could derive a direct personal reference. In particular, XING does not store any IP addresses and does not use any cookies. When you click the share button, you are redirected to the XING homepage, where you can then — if you are logged in — recommend our page, which serves the purpose of increasing our awareness and reach. XING’s privacy policy mentioned below applies to these activities on the XING platform.

  3. If you log out of XING before visiting our website and delete your cookies, no data about your visit to our website will be assigned to your XING profile when the plug-in is activated.

  4. The purpose and scope of data collection as well as its further processing and use by XING, as well as your relevant rights and setting options to protect your privacy, can be found in XING’s data protection notices for the share button at https://www.xing.com/app/share%3Fop%3Ddata_protection and in XING’s general privacy policy at https://privacy.xing.com/de/datenschutzerklaerung.

Data Protection in Applications and the Application Process

  1. Applications sent to the controller electronically or by post are processed electronically or manually for the purpose of handling the application process.

  2. We explicitly point out that application documents containing “special categories of personal data” pursuant to Art. 9 GDPR (e.g. a photo that allows conclusions to be drawn about your ethnic origin, religion, or marital status), with the exception of a possible severe disability which you may wish to disclose of your own free will, are unwelcome. You should submit your application without this data. This has no effect on your chances as an applicant.

  3. The legal bases for processing are Art. 6 para. 1 sentence 1 lit. b) GDPR and § 26 BDSG n.F.

  4. If an employment relationship is entered into with the applicant after the conclusion of the application process, the applicant data will be stored in compliance with relevant data protection regulations. If no position is offered to you after the conclusion of the application process, your submitted application letter and documents will be deleted 6 months after the rejection is sent, in order to comply with any claims and proof obligations under the AGG (General Equal Treatment Act).

Rights of the Data Subject

  1. Objection or revocation against the processing of your data Insofar as the processing is based on your consent pursuant to Art. 6 para. 1 sentence 1 lit. a), Art. 7 GDPR, you have the right to revoke your consent at any time. The lawfulness of the processing carried out on the basis of the consent until the revocation is not affected by this. Insofar as we base the processing of your personal data on a balancing of interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, you can object to the processing. This is the case when the processing is in particular not necessary for the performance of a contract with you, which we present in each case in the subsequent description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the case of your justified objection, we will examine the situation and will either stop or adjust the data processing, or demonstrate to you our compelling legitimate grounds on the basis of which we will continue the processing. You can object to the processing of your personal data for advertising and data analysis purposes at any time. You can exercise the right to object free of charge. You can inform us of your advertising objection at the following contact details: Manuel Gruber Am Anger 9a 84140 Gangkofen website2026a@manuelgruber.com

  2. Right of access You have the right to ask us to confirm whether personal data concerning you is being processed. If this is the case, you have a right of access to your personal data stored with us pursuant to Art. 15 GDPR. This includes in particular the disclosure of the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the origin of your data if it was not collected directly from you.

  3. Right to rectification You have a right to rectification of incorrect data or completion of correct data pursuant to Art. 16 GDPR.

  4. Right to erasure You have a right to erasure of your data stored with us pursuant to Art. 17 GDPR, unless statutory or contractual retention periods or other statutory obligations or rights to further storage prevent this.

  5. Right to restriction You have the right to request a restriction on the processing of your personal data if one of the conditions in Art. 18 para. 1 lit. a) to d) GDPR is met:
    • If you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
    • the processing is unlawful and you object to the erasure of the personal data and instead request the restriction of its use;
    • the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise, or defence of legal claims, or
    • if you have objected to the processing pursuant to Art. 21 para. 1 GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.
  6. Right to data portability You have a right to data portability pursuant to Art. 20 GDPR, which means that you can receive the personal data stored about you by us in a structured, commonly used, and machine-readable format, or request that it be transmitted to another controller.

  7. Right to lodge a complaint You have the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement.

Data Security

In order to protect all personal data transmitted to us and to ensure that the data protection regulations are complied with by us and our external service providers, we have taken appropriate technical and organisational security measures. Therefore, among other things, all data between your browser and our server is transmitted in encrypted form via a secure SSL connection.

Last updated: 2026-03-06