Privacy Policy GEFASOFT Automatisierung und Software GmbH
As of June 1, 2026

I General Information
In the following, we inform you about the collection of personal data when using our website, in accordance with Art. 13 GDPR. Personal data is any data that can be related to you personally, e.g., name, address, email addresses, user behavior.
The controller according to Art. 4 para. 7 of the EU General Data Protection Regulation (GDPR) is
GEFASOFT Automatisierung und Software GmbH Regensburg
(see our imprint).
The Data Protection Officer according to the EU General Data Protection Regulation (GDPR) is Projekt 29 GmbH & Co. KG; Ostengasse 14; 93047 Regensburg (Email: anfragen@projekt29.de; Tel.: +49 (0)941 – 2986930).

II Your Rights
If personal data concerning you as a user is processed, you are considered a data subject under the GDPR. Data subjects have the following rights vis-à-vis the controller:
Right of access (Art. 15 GDPR)
Right to rectification or erasure of personal data (Art. 16, 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to notification in connection with the rectification or erasure of your personal data or the restriction of processing (Art. 19 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)
Right to withdraw declarations of consent. The lawfulness of data processing carried out until the withdrawal remains unaffected due to the consent valid until then. (Art. 7 para. 3 GDPR)
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

III Hosting
The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, email dispatch, security services, and technical maintenance services that we use for the purpose of operating this online offering.
In doing so, we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties, and visitors to this online offering on the basis of our legitimate interests in an efficient and secure provision of this online offering in accordance with Art. 6 para. 1 lit. f GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement).

Our host(s) will only process your data to the extent necessary to fulfill their service obligations and will follow our instructions regarding this data.

We use the following host(s):

IN-Solution GmbH
Prüfeninger Str. 20
D – 93049 Regensburg

IV Contacting Us
a. Type and Purpose of Processing
The data you enter in the contact form will be stored for the purpose of individual communication with you. This requires providing a valid email address and your name. This serves to assign the inquiry and subsequently answer it. Providing further data is optional.
If you contact us additionally by email or phone, we will process your contact data used to respond to your request.

b. Legal Basis for Processing
The processing of your personal data is based on a legitimate interest (Art 6 para. 1 lit. f GDPR). By providing the contact form, we want to enable you to contact us easily. Your information will be stored for the purpose of processing the inquiry and for possible follow-up questions. If you contact us to request an offer, the processing of the provided data takes place for the implementation of pre-contractual measures (Art 6 para. 1 lit. b GDPR).

c. Data Categories
IP address, contact details, your message
d. Recipients
Recipients of the data are internal employees of the Marketing, Sales departments, and, if applicable, processors.

e. Storage Periods
Data will be deleted at the latest 6 months after the inquiry has been processed. If a contractual relationship arises, we are subject to statutory retention periods according to the German Commercial Code (HGB) and will delete your data after these periods have expired.

f. Legal / Contractual Requirement
The provision of your personal data is voluntary. However, we can only process your inquiry if you provide us with your name, email address, and the reason for the inquiry.

g. Third-Country Transfer
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

h. Right to Object
You have the right to object to the processing of your personal data at any time. You can notify us of your withdrawal at any time using the contact option provided at the beginning of this privacy policy.

i. Automated Decision-Making and Profiling
As a responsible company, we refrain from automated decision-making or profiling in this data processing.

V Application Process / Online Applications
a. Type and Purpose of Processing
On our website, you have the option to apply for advertised positions via an application form. We use the WordPress plugin “WP Job Openings” to provide and manage job postings and applications.
As part of the application process, we process the personal data you submit. This includes, in particular, your first and last name, contact details, application documents (e.g., cover letter, CV and certificates), information on qualifications and professional experience, as well as other information submitted voluntarily.
Personal data is processed exclusively for the purpose of carrying out the application process and deciding on the establishment of an employment relationship.
Applications are received via our website and stored within our WordPress system.

b. Legal Basis for Processing
Your personal data is processed to carry out pre-contractual measures and/or to decide on the establishment of an employment relationship in accordance with Art. 6 para. 1 lit. b GDPR in conjunction with Section 26 BDSG.

c. Data Categories
Contact data
Application documents
Qualification and professional data
Communication data
Other information submitted voluntarily

d. Recipients
Recipients of the data are internal employees of the responsible departments and, where applicable, processors.

e. Retention Periods
Your personal data will only be stored for as long as this is necessary to carry out the application process and no statutory retention obligations conflict with this.
After completion of the application process, your personal data will be deleted unless there is a legal basis for further storage or you have expressly consented to longer storage.

f. Statutory / Contractual Requirement
Providing your personal data is voluntary. However, without providing the required information and application documents, it is not possible to carry out the application process.

g. Third-Country Transfer
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

h. Right of Withdrawal
You have the right at any time to object to the processing of your personal data or to withdraw consent you have given with effect for the future. To do so, it is sufficient to notify the contact details provided at the beginning of this privacy policy.

i. Automated Decision-Making and Profiling
As a responsible company, we refrain from automated decision-making or profiling as part of the application process.

VI Processing within the Business Relationship
a. Type and Purpose of Processing
We may process the personal data of our customers, prospective customers, suppliers, vendors, and partners for communication, planning, execution of the contractual relationship, marketing, administration, and security purposes.

b. Legal Basis for Processing
The processing of the provided data is based on a legitimate interest (Art. 6 para. 1 lit. f GDPR) and the fulfillment of the contract (Art. 6 para. 1 lit. b GDPR).

c. Data Categories
Contact information (full name, job title, professional email address, professional phone number, professional address)
Billing information and payment data
Further necessary information in a project or contractual relationship or information voluntarily provided to us, such as personal data relating to orders, payments, inquiries, and projects
If applicable, further data in the course of the business relationship

d. Recipients
Recipients of the data are the internal employees of the respective departments and, if applicable, the processors of the departments.

e. Retention Periods
We delete personal data when the storage of the personal data is no longer necessary for the purposes for which it was collected or processed, or to fulfill legal obligations (e.g., HGB, AO).

f. Transfer to Third Countries
Your personal data may be transferred to third parties located outside the European Union (EU) or the European Economic Area (EEA) who provide services for us, e.g., hosting services. To ensure the level of data protection in the third country, we have concluded so-called standard data protection clauses with our respective service providers.

g. Automated Decision-Making and Profiling
As a responsible company, we refrain from automated decision-making or profiling in this data processing.

VII Logging with Microsoft Teams

a. Type and purpose of processing
We use Microsoft Teams with the transcription function to convert the spoken word into text. This serves the efficient documentation and follow-up of meetings, training sessions, and internal discussions.

b. Legal basis for processing
Processing is carried out on the basis of our legitimate interest in efficient documentation and subsequent use of meeting content in accordance with Art. 6 para. 1 lit. f GDPR. When processing special categories of personal data (e.g., health data, political opinions), consent is obtained in accordance with Art. 9 para. 2 lit. a GDPR.

c. Data categories
The following data is processed during logging:

• Audio recordings of participant voices
• Automatically generated transcripts (spoken text)
• Metadata (meeting ID, participant IDs, timestamps)

d. Recipients
Microsoft processes the audio data as a processor in accordance with Art. 28 GDPR. A data processing agreement exists with Microsoft (Microsoft Product Terms + Data Protection Addendum).

e. Protective measures

• Purpose limitation: The data is used exclusively for meeting documentation
• Erasure: Transcripts and summaries are automatically deleted after 30 days
• Access restriction: Only authorized employees have access to the documentation

f. Third-country transfer
Transcription takes place in data centers within the EU (Western Europe). However, Microsoft is also certified under the EU-US Data Privacy Framework.

g. Your rights
You have the right to access, rectification, erasure, restriction of processing, and data portability. Consent can be withdrawn at any time. Please contact our Data Protection Officer.

Further information:
Microsoft Privacy Statement: https://www.microsoft.com/privacy

VIII Accessing the website
a. Type and purpose of processing
When you access our website, i.e., if you do not register or otherwise submit information, information of a general nature is automatically collected. This information (server log files) includes, for example, the type of browser, the operating system used, the domain name of your internet service provider, your IP address, and similar. This is exclusively information that does not allow any conclusions to be drawn about your person. It is processed in particular for the following purposes:
Ensuring a smooth connection setup of the website,
Ensuring smooth use of our website,
Evaluation of system security and stability as well as
for further administrative purposes.
We do not use your data to draw conclusions about your person. Information of this kind may be statistically evaluated by us to optimize our website and the underlying technology. Under certain circumstances, we also use another service provider to be able to display the privacy policy. An embedding code is used for this, via which your IP address is transmitted to said service provider.
We process your data on the basis of our legitimate interest for a limited time in order to initiate a derivation to personal data in the event of unauthorized access or access attempts to local servers and to be able to display the privacy policy properly.

b. Legal Basis for Processing
Processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

c. Data Categories
Device, browser, operating system, location, and IP address

d. Recipients
Recipients of the data are internal employees of the Marketing and IT departments and, if applicable, processors who act as processors for the operation and maintenance of our website.

e. Storage Periods
The data will be deleted as soon as it is no longer required for the purpose of its collection. For data used to provide the website, this is generally the case when the respective session ends.

f. Legal / Contractual Requirement
The provision of the aforementioned personal data is neither legally nor contractually required. However, without the IP address, the service and functionality of our website cannot be guaranteed. In addition, individual services may not be available or may be restricted.

g. Third-Country Transfer
Processing does not take place outside the European Union (EU) or the European Economic Area (EEA).

h. Right to Object
You have the right to object to the processing of your personal data at any time. You can notify us of your withdrawal at any time using the contact option provided at the beginning of this privacy policy.

i. Automated Decision-Making and Profiling
As a responsible company, we refrain from automated decision-making or profiling in this data processing.

IX Use of cookies
a. Type and purpose of processing
Like many other websites, we also use so-called “cookies”.
Cookies are simple files that store information about our web offering and your use. These small files are optionally created automatically by your browser when you use our website and stored locally on your respective end device. This does not mean that we gain immediate knowledge of your identity as a result. The use of cookies serves to make the use of our offering more pleasant for you.

Most of the cookies we use are so-called “session cookies”. They are automatically deleted after the end of your visit. Other cookies remain stored on your device for a longer period. These cookies allow us to recognize your browser on your next visit.

We generally distinguish between technically necessary and non-necessary cookies:

Technically necessary cookies (“First Party Cookies”)
are required for the operation of a website and are essential for navigating it and using its functions.

Non-necessary cookies, on the other hand, are mostly performance cookies and marketing & third-party cookies, which make it possible, for example, to record and count the number of visitors and traffic sources, thus measuring and improving the website’s performance. They also serve to find out if there are problems or errors on certain pages, which pages are most popular, and how visitors navigate the website.

Performance cookies are used to track visits and individual activities on websites. They serve to statistically record and evaluate the use of websites.
Marketing & third-party cookies originate, among others, from external advertising companies and are used to collect information about the websites visited by the user, e.g., to create target-group-oriented advertising for the user.
You can find a list of the cookies used in our cookie banner.

b. Legal Basis for Processing
The use of technically necessary cookies (“First Party Cookies”) is possible without the consent of the website visitor and is subject to a legitimate interest in the economic operation and optimization of our website and services within the meaning of Art. 6 para. 1 sentence 1 lit. f GDPR.

The use of non-necessary cookies, such as performance cookies and marketing & third-party cookies, is subject to the consent of the website visitor in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

c. Data Categories
IP address
Browser used
Operating system and device used
Internet connection
Session ID of the cookie
Time of visit

d. Recipients
Those mentioned in the course of the privacy policy

e. Storage Periods
The user can set their web browser to generally prevent the storage of cookies on their device or to ask each time if they agree to the setting of cookies. Once set, cookies can be deleted by the user at any time. How this works is described in the help function of the respective web browser.
A general deactivation of cookies may lead to functional restrictions of this website.

f. Legal / Contractual Requirement
The provision of your personal data in cookies is voluntary for non-necessary cookies, solely based on your consent (so-called opt-in cookies). You can also prevent the use of pre-set, technically necessary cookies (so-called opt-out cookies) via your browser settings. However, without consent, the service and functionality of our website cannot be guaranteed. In addition, individual services may not be available or may be restricted.

g. Third-Country Transfer
Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). Further details can be found in the following paragraphs.

h. Withdrawal of Consent
You can withdraw your consent for all cookies at any time with effect for the future in your browser settings or change your selection in the cookie banner. To do this, you can use the “Cookie Settings” button displayed at the end of the privacy policy.

i. Automated Decision-Making and Profiling
As a responsible company, we refrain from automated decision-making or profiling when collecting cookies.

X YouTube
a. Type and purpose of processing
We embed YouTube videos on some of our web pages. The operator of the corresponding plugins is YouTube, Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland. When you visit a page with the YouTube plugin, a connection to YouTube servers is established. YouTube is informed which pages you visit. If you are logged into your YouTube account, YouTube can assign your surfing behavior to you personally. You can prevent this by logging out of your YouTube account beforehand. If a YouTube video is started, the provider uses cookies that collect information about user behavior. Further information on the purpose and scope of data collection and its processing by YouTube can be found in the provider’s privacy policy. There you will also find further information on your rights in this regard and setting options for protecting your privacy (https://policies.google.com/privacy).

b. Legal Basis for Processing
The legal basis for the integration of YouTube and the associated data transfer to Google is your consent (Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG).

c. Data Categories
Device information – IP address – Referrer URL – Viewed videos

d. Recipients
Recipients of the data are internal employees of the Marketing and IT departments and YouTube as a service provider.

e. Storage Periods
Anyone who has deactivated the storage of cookies for the Google Ad program will not have to expect such cookies when watching YouTube videos. However, YouTube also stores non-personal usage information in other cookies. If you want to prevent this, you must block the storage of cookies in your browser. Further information on data protection at “YouTube” can be found in the provider’s privacy policy at: https://www.google.de/intl/de/policies/privacy/

f. Legal / Contractual Requirement
The provision of your personal data is voluntary, solely based on your consent. If you prevent access, this may lead to functional restrictions on the website.

g. Third-Country Transfer

h. Withdrawal of Consent
You can withdraw your consent to the storage of your personal data at any time with effect for the future.

i. Automated Decision-Making and Profiling
As a responsible company, we refrain from automated decision-making or profiling in this data processing.

XI Google Maps
a. Type and purpose of processing
On this website, we use the Google Maps service. Google Maps is operated by Google Cloud EMEA ltd. This allows us to display interactive maps directly on the website and enables you to conveniently use the map function. Further information about data processing by Google can be found in Google’s privacy policy. There you can also change your personal privacy settings in the privacy center. By visiting the website, Google receives information that you have accessed the corresponding subpage of our website. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish for your profile to be associated with Google, you must log out of Google before activating the button. Google stores your data as usage profiles and uses them for purposes of advertising, market research, and/or needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles, for the exercise of which you must contact Google.

b. Legal Basis for Processing
The legal basis for the integration of Google Maps and the associated data transfer to Google is your consent (Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG).

c. Data Categories
IP address – Location information – Usage data – Date and time of visit – URLs

d. Recipients
Recipients of the data are internal employees of the Marketing and IT departments and Google as a processor.

e. Storage Periods
Data in this context will only be processed as long as the corresponding consent exists. After that, they will be deleted, unless there are legal retention obligations to the contrary. To contact us in this regard, please use the contact details provided at the beginning of this privacy policy.

f. Legal / Contractual Requirement
The provision of your personal data is voluntary, solely based on your consent. If you prevent access, this may lead to functional restrictions on the website.

g. Third-Country Transfer
Processing may also take place outside the European Union (EU) or the European Economic Area (EEA). In this respect, the recipient is also Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The transfer is carried out on the basis of the European Commission’s Adequacy Decision of 10 July 2023 (EU-US Data Privacy Framework), under which Google LLC is certified. In addition, Google has incorporated the European Commission’s Standard Data Protection Clauses into its data processing terms.

h. Withdrawal of Consent
If you do not want Google to collect, process, or use data about you via our website, you can deactivate JavaScript in your browser settings. In this case, however, you may not be able to use our website, or only to a limited extent. You can withdraw your consent to the storage of your personal data at any time with effect for the future.

i. Automated Decision-Making and Profiling
As a responsible company, we refrain from automated decision-making or profiling in this data processing.

j. Use of the Google Maps Static API
When using Google Maps, a call to the Google Maps Static API (gstatic.com) may occur.

XII Google Analytics
a. Type and purpose of processing
This website uses Google Analytics, a web analysis service of Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland. Google Analytics uses so-called “cookies”, i.e., text files that are stored on your computer and that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. Due to the activation of IP anonymization on these websites, however, your IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website use and internet use to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. The purposes of data processing lie in the evaluation of the use of the website and in the compilation of reports on activities on the website. Further related services are then to be provided on the basis of the use of the website and the internet.

b. Legal Basis for Processing
The processing of the entered data is based on the user’s consent (Art. 6 para. 1 lit. a GDPR).
c. Data Categories
IP address (truncated/anonymized)
Date and time of visit – Usage data – Click path – App updates – Browser information – Device information – JavaScript support – Visited pages – Referrer URL – Downloads – Flash version – Location information – Purchase activity – Widget interactions

d. Recipients
Employees of the company’s IT and Marketing departments
Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland

e. Storage Periods
Data in this context will only be processed as long as the corresponding consent exists. After that, they will be deleted, unless there are legal retention obligations to the contrary. To contact us in this regard, please use the contact details provided at the beginning of this privacy policy.

f. Legal / Contractual Requirement
The provision of your personal data is voluntary, solely based on your consent. If you prevent access, this may lead to functional restrictions on the website.

g. Third-Country Transfer
Processing also takes place outside the European Union (EU) or the European Economic Area (EEA). To ensure the level of data protection in this third country, we have concluded the standard data protection clauses with Google (Analytics).

h. Withdrawal of Consent
You can withdraw your consent to the storage of your personal data at any time with effect for the future.
You can prevent the storage of cookies by adjusting your browser software settings; however, we point out that in this case, you may not be able to fully use all functions of this website. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (incl. your IP address) and from processing this data by Google by downloading and installing the available browser plugin: “Browser Add-on to deactivate Google Analytics”.

i. Automated Decision-Making and Profiling
With the help of the Google Analytics tracking tool, the behavior of website visitors can be evaluated and interests analyzed. For this purpose, we create a pseudonymous user profile.

XIII Online presence in social media
We maintain online presences within social networks to inform the users active there about our services and to communicate directly via the platforms if they are interested. We are currently represented in the following networks:

LinkedIn: de.linkedin.com/company/gefasoft-automatisierung-und-software-gmbh
Facebook: de-de.facebook.com/gefasoft/
YouTube: www.youtube.com/user/Gefasoft2012
Xing: www.xing.com/pages/gefasoftautomatisierungundsoftwaregmbh

All our social media channels can only be accessed by visitors to the website via an external link. We do not use any plugins or other interfaces on our website that the respective networks offer for embedding their content on websites.
We have no influence on the data collection and its further use by the social networks. There is no knowledge of the extent, location, and duration for which the data is stored, to what extent the networks comply with existing deletion obligations, what evaluations and links are made with the data, and to whom the data is passed on. We therefore expressly point out that user data (e.g., personal information, IP address) is stored by the operators of the networks in accordance with their data usage policies and used for business purposes.
We process user data in social media presences insofar as they contact and communicate with us, for example, via comments or direct messages.
The legal basis for processing user data is Art. 6 para. 1 lit. b and f GDPR.
LinkedIn
Facebook
YouTube
Xing

Within our online offering, no functions and content of the LinkedIn service, offered by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, are integrated. The LinkedIn channels are only accessible via an external link. If visitors to our website are members of the LinkedIn platform, LinkedIn can associate the access to the social media channel with the user’s profile there if they visit the LinkedIn profile while logged in. We point out that we have no influence on the content or scope of use of the data collected by LinkedIn. For further information in this regard, we refer to LinkedIn’s privacy policy: www.linkedin.com/legal/privacy-policy
You can access the social media network Facebook via external links on our website. All functions in the social media network are offered by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. The Facebook channels are only accessible via an external link. If you are logged in to Facebook with your own profile and access our social media channel, Facebook can associate your visit with your logged-in profile. If you do not wish for your user account to be associated with your IP address, please log out of your Facebook account before using our website.
For further information on the processing of your data, we refer to Facebook’s privacy policy: facebook.com/privacy/explanation and our Facebook Fanpage Data Policy, which you will find below.

Within our online offering, no functions and content of the YouTube service, offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, are integrated. The YouTube channels are only accessible via an external link. If visitors to the website are members of the YouTube platform, YouTube can associate the access to the social media channel with the user’s profile if they visit our YouTube profile while logged in. We point out that we have no influence on the content or scope of use of the data collected by YouTube. For further information in this regard, we refer to YouTube’s privacy policy: policies.google.com/privacy. Furthermore, we want to point out that you can make appropriate changes in your YouTube account to protect your privacy.
Within our online offering, no functions and content of the Xing service, offered by New Work SE, Dammtorstraße 29-32, 20354 Hamburg, Germany, are integrated. The Xing channels are only accessible via an external link. If visitors to our website are members of the Xing platform, Xing can associate the access to the social media channel with the user’s profile there if they visit the Xing profile while logged in. We point out that we have no influence on the content or scope of use of the data collected by Xing. For further information in this regard, we refer to Xing’s privacy policy: www.xing.com/app/share

XIV Facebook Fan Page Data Policy
GEFASOFT Automatisierung und Software GmbH Regensburg operates an online presence on Facebook, a so-called Facebook Fan Page. The following information on data processing applies additionally to visits to our Fan Page. General information on data protection at Facebook can be found here (https://www.facebook.com/about/privacy/).
a. Joint responsibility, contact details, operational data protection officer:
We are jointly responsible with Facebook for the operation of our Facebook Fan Page in accordance with Art. 26 GDPR. To this end, we have defined in an agreement with Facebook who fulfills which obligations with regard to data protection. This agreement can be accessed here (https://www.facebook.com/legal/terms/page_controller_addendum). According to this, Facebook is primarily responsible for providing the data subject with information about the joint processing and enabling them to exercise their data protection rights. Regardless of this, we hereby inform you about your visit to our Fan Page.
Our contact details are:

GEFASOFT Automatisierung und Software GmbH Regensburg
Franz-Mayer-Straße 10, 93053 Regensburg
info@gefasoft.com

You can reach Facebook at:
Meta Platforms Ireland Ltd.
4 Grand Canal Square,
Grand Canal Harbour,
Dublin 2, Ireland
You can reach Facebook online here (https://www.facebook.com/help/contact/2061665240770586)

You can reach our company Data Protection Officer at:
Projekt 29 GmbH & Co. KG
Ostengasse 14
D – 93047 Regensburg
Email: anfragen@projekt29.de
Tel.: 0941-2986930

You can reach Facebook’s Data Protection Officer at
www.facebook.com/help/contact/540977946302970.

b. Collection and storage of personal data as well as type and purpose and their use:

• Data collected by Facebook:
  If you are a Facebook user, Facebook collects the data described in the Facebook Data Policy under “What types of information do we collect?”. If you are not a Facebook user, cookies provided with identifiers, small text files, may still be stored in your browser, which enable so-called tracking of your user behavior.
  As a rule, user data is also processed by Facebook for market research and advertising purposes when visiting Facebook. Based on user behavior (also when visiting our Fan Page), complex user profiles are created that Facebook can use to display personalized advertisements to the visitor within and outside of Facebook. Further information on this can also be found in the Facebook Data Policy.
  If you do not agree to this, you can object here (opt-out).
• Data used by us (“Page Insights”) and legal basis:
  Facebook provides us with statistics and usage data that we can use to analyze the use of our Fan Page (so-called “Page Insights”). This enables us to continuously improve our offering on Facebook. As the operator, we do not make any decisions regarding the processing of Insights data and all other information resulting from Art. 13 GDPR, such as the storage period of cookies on user end devices. The primary responsibility under the GDPR for the processing of Insights data lies with Facebook, and Facebook fulfills all obligations under the GDPR with regard to the processing of Insights data.
  As page administrator, we have no other way, including via user tracking, to evaluate user behavior on our Fan Page. It is also generally not possible for us to identify the visitor to the Fan Page based on the Page Insights. In particular, according to the agreement, we have no right to demand the disclosure of individual visitor data from Facebook. Identification is only possible for us if we can assign individual profile pictures to “likes” for the page; however, this is only possible if our Fan Page has been marked with “like” by the corresponding visitor and the “likes” are set to “public”.
  What information Facebook uses to create Page Insights can be found here.
  The operation of the Facebook Fan Page and the use of Page Insights serves our legitimate interest in an effective external presentation and efficient communication with our customers and interested parties. This interest justifies the operation of the page both towards the legitimate interests of Facebook users and towards visitors to our Fan Page who do not have a Facebook account. The legal basis is accordingly Art. 6 para. 1 lit. f) GDPR.

c. Disclosure of data to third parties:
Data collected by Facebook is exchanged and processed within the entire Facebook group. The Facebook group also includes, for example, Instagram, WhatsApp, and Oculus. For example, information collected via Facebook is used to show the user personalized advertising on Instagram, or information from WhatsApp is used to take action on Facebook against accounts that send spam via WhatsApp. This information can be found in the Facebook Data Policy under “How do the Facebook Companies work together?”.
When data is processed by Facebook, user data may be transferred outside the European Economic Area (EEA), in particular to the USA.

d. Right to object:
If your personal data is processed on the basis of legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, provided that there are reasons arising from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right to object, which will be implemented by us without specifying a particular situation. If you wish to exercise your right of withdrawal or objection, an email to info@gefasoft.com is sufficient.

e. Data subject rights:
You have the right to withdraw your consent to us at any time. As a result, we may no longer continue the data processing based on this consent for the future. In addition, you have the right to access under Art. 15 GDPR, the right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR, the right to restriction of processing under Art. 18 GDPR, and the right to data portability under Art. 21 GDPR. Furthermore, there is a right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR).
In principle, you can assert your data subject rights both against Facebook and against us. However, since only Facebook has direct access to your user data, you can exercise your data subject rights most effectively with Facebook.

XV. Google Tag Manager