Data Protection

1.1

In the following, we inform you about the processing of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behaviour (see below).

1.2

The person responsible pursuant to Art. 4 (7) of the EU General Data Protection Regulation (GDPR) is:

PFH Private University Göttingen

Private University of Applied Sciences

Weender Landstrasse 3-7

37073 Göttingen

Sponsoring company:

Gesellschaft für praxisbezogene Forschung und wissenschaftliche Lehre GmbH

You can reach our data protection officer at datenschutz(at)pfh.de or our postal address with the addition of "the data protection officer".

1.3

If we use commissioned service providers for individual functions of our offer or would like to use your data for advertising purposes, we will inform you in detail about the respective processes below. In doing so, we will also state the defined criteria for the storage period. Where we use external service providers to process your data, they have been carefully selected and engaged by us, are bound by our instructions and are regularly monitored.

1.4

Following the example of Art. 4 of the GDPR, this data protection notice is based on the following definitions:

• "Personal data" (Art. 4 No. 1 GDPR) means any information relating to an identified or identifiable natural person ("data subject"). A person is identifiable if he or she can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or by means of information relating to his or her physical, physiological, genetic, mental, economic, cultural or social identity characteristics. The identifiability can also be given by means of a linkage of such information or other additional knowledge. The origin, form or embodiment of the information is irrelevant (photographs, video or audio recordings may also contain personal data).
• "Processing" (Art. 4 No.2 GDPR) means any operation which involves the handling of personal data, whether or not by automated (i.e. technology-based) means. This includes in particular the collection (i.e. obtaining), recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure or destruction of personal data, as well as the change of a purpose or intended use on which a data processing was originally based.
• "Controller" (Art. 4 No.7 GDPR) means the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.
• "Third party" (Art. 4 No.10 GDPR) means any natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons who are authorised to process the personal data under the direct responsibility of the controller or processor; this also includes other group-affiliated legal entities.
• "Processor" (Art. 4 No.8 GDPR) is a natural or legal person, authority, institution or other body that processes personal data on behalf of the controller, in particular in accordance with the controller's instructions (e.g. IT service provider). In the sense of data protection law, a processor is in particular not a third party.
• "Consent" (Art. 4 No. 11 GDPR) of the data subject means any freely given specific, informed and unambiguous indication of his or her wishes in the form of a statement or other unambiguous affirmative act by which the data subject signifies his or her agreement to the processing of personal data relating to him or her.

1.5

For the processing operations carried out by ourselves or by means of processors, we indicate below in each case how long the data will be stored by us and when it will be deleted or blocked. If no explicit storage period is specified below, your personal data will be deleted or blocked as soon as the purpose or legal basis for the storage no longer applies.

However, we may retain the information for longer than the above period in the event of a (threatened) legal dispute with you or other legal proceedings, or where retention is required by law to which we are subject as a responsible party (e.g. § 257 HGB, § 147 AO). If the storage period prescribed by the legal regulations expires, the personal data will be blocked or deleted unless further storage by us is necessary and there is a legal basis for this.

In principle, any processing of personal data is prohibited by law and only permitted if the data processing falls under one of the following justifications:

• Art. 6 para. 1 sentence 1 lit. a GDPR ("Consent"): Where the data subject has voluntarily, in an informed manner and unambiguously indicated by a statement or other unambiguous affirmative act that he or she consents to the processing of personal data relating to him or her for one or more specified purposes;
• Art. 6 para. 1 sentence 1 lit. b GDPR: If the processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the request of the data subject;
• Art. 6 para. 1 sentence 1 lit. c GDPR: If processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. a legal obligation to keep records);
• Art. 6 para. 1 sentence 1 lit. d GDPR: If the processing is necessary to protect the vital interests of the data subject or another natural person;
• Art. 6 para. 1 sentence 1 lit. e GDPR: Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or
• Art. 6 para. 1 sentence 1 lit. f GDPR ("Legitimate Interests"): Where processing is necessary to protect legitimate (in particular legal or economic) interests of the controller or a third party, unless the conflicting interests or rights of the data subject override (in particular where the data subject is a minor).

For the processing operations carried out by us, we indicate below the applicable legal basis in each case. A processing operation may also be based on several legal bases.

Furthermore, the storage of information on your terminal device as an end user and access to information already stored on your terminal device will only take place after you have given your consent in accordance with Section 25 (1) of the German Telecommunications Telemedia Data Protection Act (TDDDG), unless this is dispensable in accordance with Section 25 (2) of the TDDDG.

3.1

You have the following rights in relation to personal data relating to you:

• to request information about your data processed by us in accordance with Art. 15 GDPR. In particular, you can request information about the processing purposes, the category of data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
• in accordance with Art. 16 GDPR to demand the correction of incorrect or the completion of your data stored by us without delay;
• to request the deletion of your data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims;
• demand the restriction of the processing of your data in accordance with Art. 18 GDPR, insofar as the accuracy of the data is disputed by you or the processing is unlawful;
• pursuant to Art. 20 GDPR to receive your data that you have provided to us in a structured, common and machine-readable format or to request the transfer to another controller ("data portability");
• object to the processing in accordance with Art. 21 GDPR, insofar as the processing is based on Art. 6 (1) sentence 1 lit. e or lit. f GDPR. This is particularly the case if the processing is not necessary for the performance of a contract with you. Except in the case of an objection to direct marketing, we will ask you to explain the reasons why we should not process your data as we have done. In the event of your justified objection, we will review the merits of the case and either cease or adapt the data processing or show you our compelling legitimate grounds on the basis of which we will continue the processing;
• in accordance with Art. 7 (3) of the GDPR, you may at any time revoke your consent - i.e. your voluntary, informed and unambiguous will expressed by a declaration or other unambiguous act of confirmation that you consent to the processing of the personal data in question for one or more specific purposes - that you have given to us (even before the GDPR came into force, i.e. before 25 May 2018), if you have given such consent. This has the consequence that we may no longer continue the data processing based on this consent in the future.

3.2

In accordance with Art. 77 GDPR, you may complain to a data protection supervisory authority about the processing of your personal data in our company, such as the data protection supervisory authority responsible for us.

We process the personal data specified in more detail below in accordance with the provisions of the GDPR, the TDDDG and the other relevant data protection regulations only to the extent necessary. Insofar as the processing of personal data is based on Art. 6 (1) sentence 1 lit. f GDPR, the aforementioned purposes also constitute our legitimate interests, subject to further interests to be specified in more detail.

4.1

In the case of mere informational use of the website, i.e. if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. When you visit our website, we collect the following information, which is technically necessary to display our website to you and to ensure its stability and security (legal basis is Art. 6 para. 1 p. 1 lit. f GDPR):

• Host name of the accessing computer (IP address)
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Browser type/version
• Operating system used
• Referrer URL (the previously visited page)
• Content of the request (concrete page)
• Data volume transferred in each case
• Access Status/HTTP Status Code

This data is not merged with other data sources and is deleted after statistical evaluation.

4.2

In addition to the above information, cookies are stored on your terminal device when you use our website (more on this below).

When you use our website, we use cookies and comparable technologies and store information on your device. Cookies are small text files that are transmitted by a website to the user’s browser and stored there. They enable certain information, such as a unique identifier (cookie ID), to be recognized when the website is revisited or when navigating between pages.

We use different types of cookies on our website:

• Technically Necessary Cookies
  These cookies are required to provide the basic functions of our website (e.g., page navigation, security, proper display, or saving your cookie settings).
• Functional Cookies
  These cookies enable enhanced features and improved user experience, for example by storing preferences.
• Analytics and Marketing Cookies
  These cookies are used to analyze user behavior, measure reach, and deliver interest-based advertising.

Certain cookies (e.g., for web analytics or reach measurement) may be extended or re-set server-side by our technical platform Stape.io (Stape Europe OÜ, Estonia). This serves to better attribute website visits across different browsers or time periods.

The use of cookies is based on the following legal grounds:

• Technically Necessary Cookies
  The storage of information on your device or access to information already stored is carried out, where strictly necessary, on the basis of Section 25 (2) No. 2 TDDDG. The subsequent processing of personal data is carried out depending on the purpose on the basis of Art. 6 (1) lit. b GDPR (performance of a contract) or Art. 6 (1) lit. f GDPR (legitimate interest in providing a secure and functional website).
• Analytics, Marketing, and Other Non-Essential Cookies
  These cookies are used exclusively on the basis of your explicit consent pursuant to Section 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a GDPR.

When you first visit our website and at regular intervals thereafter, we inform you about the use of cookies via our cookie banner. You can generally use our website without consenting to analytics or marketing cookies. In this case, only technically necessary cookies will be used. Please note that certain convenience or analytics features may be limited in this case.

You can find more information about the cookies we use in our cookie banner.

You may withdraw or modify your consent at any time with effect for the future. Click here to change your cookie preferences for our website.

Withdrawal of your consent does not affect the lawfulness of processing carried out before the withdrawal.

If you contact us by e-mail, the information you provide (your e-mail address, name and telephone number, if applicable) will be stored by us in order to answer your questions. We will delete such data when it is no longer necessary to store it, or restrict its processing if we are required by law to retain it. The purpose of the processing is to respond to your request. The legal basis is Art. 6 para. 1 p. 1 lit. b or lit. f GDPR.

7.1

In addition to the purely informational use of our website, we offer various services that you can use if you are interested. This will usually require you to provide further personal information which we will use to provide the service and which will be subject to the data processing principles set out above.

7.2

When you order information material, contact us for advice or registering for an event, we collect your first and last name, e-mail address and, where applicable, address and telephone number.

7.3

When you register for an online event, we collect your first and last name and your e-mail address. This data is transmitted to the company "Livestorm" (24 Rue Rodier, 75009 Paris, France), whose service we use as a platform for online information events. The data is used to register you for the event (Livestorm data protection information: https://livestorm.co/privacy/livestorm-privacy-policy-DE.pdf).

7.4

When registering/applying for an educational offer, we collect the following personal data:

• Name
• Contact details
• Information on higher education entrance qualification or other information on previous education

The legal basis regarding the processing of your personal data in the cases mentioned under points 7.2 – 7.4 is Art. 6 para. 1 p. 1 lit. b and f GDPR.

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics enables us to analyse the use of our website, compile reports on website activity and optimise our website and marketing activities.

Google Analytics uses cookies and comparable technologies that may store information on or access information from your device. In particular, the following data may be processed:

• pages and content accessed,
• interactions with our website,
• date and time of access,
• referrer or originating page,
• browser type and browser settings,
• operating system and device information,
• approximate location information,
• pseudonymous online identifiers and cookie IDs.

Google Analytics uses the IP address transmitted for technical reasons when our website is accessed to determine approximate location information and select the appropriate local data collection centre. According to Google, IP addresses are discarded before the data is logged and are neither logged nor stored in Google Analytics 4.

Information is stored on or accessed from your device on the basis of your consent pursuant to Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The subsequent processing of personal data is based on your consent pursuant to Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future via our privacy settings. The lawfulness of the processing carried out before the withdrawal of your consent remains unaffected. You may also prevent Google Analytics from collecting information about your website activity by installing the Google Analytics Opt-out Browser Add-on.

We have entered into a data processing agreement with Google pursuant to Art. 28 GDPR. Google generally processes the data collected through Google Analytics on our behalf and in accordance with our instructions.

It cannot be ruled out that data may also be processed in the United States or other countries outside the European Union or the European Economic Area. For transfers to Google LLC in the United States, Google relies in particular on the EU–US Data Privacy Framework. Google LLC is certified under this framework. Where the EU–US Data Privacy Framework does not apply, Google may use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses. Further information can be found in Google’s Privacy Policy and in Google’s information about international data transfers.

User-level and event-level data associated with cookies, user IDs or advertising IDs are retained by Google for a period of 14 months and are subsequently deleted automatically. This retention setting does not affect aggregated data contained in standard reports.

User ID

We use the Google Analytics User ID feature. This enables us to associate interactions taking place during different sessions or on different devices with a pseudonymous identifier generated by us. This allows us to analyse the use of our website across sessions and devices.

The User ID transmitted to Google does not itself contain directly identifying information such as your name, email address or telephone number. Processing in connection with the User ID feature also takes place exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

We use Google Ads Conversion Tracking and, provided that you have given your consent, the “Enhanced Conversions” function provided by Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Ads Conversion Tracking enables us to measure whether users perform certain actions on our website after clicking on a Google advertisement, such as submitting a contact form, requesting information material, starting or completing an application, or carrying out another conversion-relevant action. This helps us measure the effectiveness of our advertising campaigns and optimise our marketing activities.

When Enhanced Conversions are used, additional first-party data provided by you may be processed. Depending on the form or interaction, this may include, in particular, your e-mail address and, where applicable, further information such as your name, telephone number or address. Before being transmitted to Google, this data is processed using a one-way hashing algorithm. Google uses the hashed data to match conversions with Google accounts and to improve the accuracy of conversion measurement and campaign attribution.

The Google Ads Conversion Tracking including Enhanced Conversions is technically implemented via our server-side tagging infrastructure. Further information on this technical implementation can be found in the section “Stape.io (Server-Side Tagging)”.

The processing only takes place if you have given your consent to the use of marketing cookies or marketing technologies via our consent management tool. The legal basis for storing information on your terminal device or accessing information already stored on your terminal device is Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG). The legal basis for the subsequent processing of personal data is your consent pursuant to Art. 6 (1) sentence 1 lit. a GDPR.

You may withdraw your consent at any time with effect for the future by changing your cookie settings on our website. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.

In connection with the use of Google Ads Conversion Tracking and Enhanced Conversions, personal data may be transferred to Google companies in third countries, in particular to the United States. Google states that, for certain transfers in connection with Google advertising services, it relies on the EU-U.S. Data Privacy Framework and, where applicable, on standard contractual clauses.

Further information on data processing by Google can be found in Google’s privacy policy, Google’s information on Google Ads and Google’s information on Enhanced Conversions.

Messages are sent via the WhatsApp service using Twilio, a service provided by Twilio Inc. ("Twilio"), 645 Harrison St # 3rd Floor, San Francisco, CA 94107 USA.

To do this, we will transfer your mobile phone number to Twilio, where it will be stored until your request or communication with you is complete. We will then arrange for your mobile phone number to be deleted from Twilio. The legal basis for the use of Twilio is Art. 6 para. 1 p. 1 lit. a) GDPR.

The data collected is stored on servers managed by Twilio. These servers are located in the U.S.

Where personal data is transferred to a Twilio group company, the legal basis is the binding corporate rules (BCR) in accordance with Art. 47 GDPR. Details can be found here:

https://www.twilio.com/legal/bcr/processor#twilios-binding-corporate-rules-processor-policy

For data transfers to companies that are not subject to the BCR, we base the data transfer on the standard contractual clauses that we have concluded together with a data processing contract. Details can be found here: https://www.twilio.com/legal/data-protection-addendum

You can view Twilio's general privacy policy here: https://www.twilio.com/legal/privacy

We use Lunio, a service provided by Lunio PPC (Hyphen Building, 75 Mosley St, Manchester, United Kingdom, M2 3HR), which processes data in accordance with our instructions to detect and prevent click fraud. The service helps us identify and combat fraudulent clicks and assess the value of our marketing activities. This enables us to reduce the financial losses that click fraud can cause advertisers.

For this purpose, Lunio processes user data, including your IP address and location data. Lunio analyses this data to calculate the likelihood of click fraud. Immediately after determining their origin, IP addresses are anonymised in a mathematically irreversible manner, meaning that they can no longer be linked to the user. As a result, the data cannot be combined with other personal data. Your personal data is therefore not stored beyond this point.

Your personal data is processed on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. Our legitimate interest lies in detecting and combating fraudulent clicks and assessing the value of our marketing activities.

Your data is also processed in the United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom, recognising that the country provides a level of data protection comparable to that of the European Union.

We use Cloudflare Turnstile on our website, a service provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA (“Cloudflare”). Turnstile is used to determine whether entries in our online forms are made by a natural person or by an automated program. This enables us to protect our forms and IT systems against misuse, spam and automated attacks.

For this purpose, Turnstile automatically analyses the device and browser used when a protected form is accessed. In particular, the following information may be processed:

• IP address,
• browser type and user agent,
• operating system and device properties,
• TLS and browser characteristics,
• referrer or originating page,
• date and time of access,
• Turnstile site key used,
• technical interaction and verification signals.

Cloudflare uses this information to identify automated access and assess whether the access is likely to have been made by a human or a bot. For this purpose, small, non-interactive checks may be carried out in the browser. Verification generally takes place in the background without requiring the user to solve a conventional CAPTCHA.

The processing initiated by us is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website, forms and IT systems against spam, misuse and automated attacks, as well as ensuring the proper functioning of our online services.

Where information is stored on or accessed from your device in connection with the use of Turnstile, this is done on the basis of Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as these operations are necessary to provide and secure the form functionality expressly requested by you.

Where Cloudflare processes technical signals in order to provide us with the Turnstile service and protect our website, we act as the controller and Cloudflare acts as a processor in accordance with our instructions. Cloudflare also processes certain technical signals for the further development and improvement of its own bot-detection mechanisms. For this independent purpose, Cloudflare determines the purposes and means of the processing itself and therefore acts as an independent controller. According to Cloudflare, this processing is based on its legitimate interest in improving the effectiveness of bot detection and responding to evolving threats posed by automated access.

It cannot be ruled out that data may also be transferred to the United States or other countries outside the European Union or the European Economic Area. Cloudflare uses appropriate safeguards for such data transfers in accordance with Art. 44 et seq. GDPR. Further information about data processing, the allocation of responsibilities and international data transfers can be found in the Cloudflare Turnstile Privacy Policy and the Cloudflare Data Processing Addendum.

To improve data quality when using web analytics and marketing tools (e.g. Google Analytics and Meta/Facebook), we use server-side tagging via the Stape.io platform (Stape Europe OÜ, Estonia). The data is processed on the basis of a data processing agreement concluded for this purpose and exclusively on European servers.

Tracking data is forwarded via our server to the respective services, without being transmitted directly from the user’s browser to third parties. This architecture enables usage information to be attributed more accurately, particularly in the case of complex user journeys across different devices or browsers.

As part of this solution, the duration of cookies may be extended through server-side mechanisms. However, no new cookies are set without prior consent. Data is only shared with services such as Google or Meta on the basis of the user’s consent.

Our server-side tagging setup also provides technical support for Google Ads Conversion Tracking with Enhanced Conversions. The information provided in the section “Google Ads Conversion Tracking and Enhanced Conversions” therefore also applies.

14.1

Our websites also use other services that read data from or store data in visitors' terminal devices without the use of cookies, but through other technologies such as Javascript codes, web beacons, tags and other identifiers supported by AI-based technology.

We also currently use social media plug-ins that are only loaded if you have previously activated the function by giving your consent. Via the plug-ins, we offer you the opportunity to interact with social networks and other users.

If you wish to activate the plug-in in question, an information text and a button will appear. By pressing the button, you agree to the loading of the respective cookies used by the social or multimedia service.

Unless otherwise stated below, the legal basis for the use of the plug-ins is § 25 (1) TDDDG, whereby the subsequent further processing of your data also requires your consent in accordance with Art. 6 (1) sentence 1 lit. a GDPR; i.e. the integration will only take place if you have given your consent to the storage or readout of information on your terminal device and, in addition, your consent to the subsequent further processing of the personal data for analysis and advertising purposes (so-called "2-click solution").

You can withdraw your consent at any time in the cookie settings.

14.2

For some functions on our website, we involve external service providers to whom we transfer personal data. All third party service providers commissioned by us act as order processors for us in accordance with our instructions and are in accordance with Art. 28 DSGVO in a data protection compliant manner. The contractual agreement provides, among other things, that the order processors undertake to comply with data protection, which includes securing your personal data through appropriate technical and organisational measures. Recipients of personal data may include, in particular:

• Bitninja (https://bitninja.io), whose security software we use for our web services.
• RapidMail (Augustinerplatz 2, 79098 Freiburg i.Br.) to keep in touch with our existing customers.
• Other companies within the scope of support/maintenance of EDP/IT applications, archiving, controlling, data destruction, purchasing/procurement, administration, marketing.
• Facebook Pixel (Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA): Use of the Visitor Action Pixel for the purpose of analysing our advertising activities on Facebook. For more information about Facebook's data collection and use practices, as well as your rights and choices about how you can protect your privacy, please visit Facebook's privacy policy at https://www.facebook.com/about/privacy/. Alternatively, you can opt-out of the Custom Audiences remarketing feature at https://www.facebook.com/settings/?tab=ads#_=_. You must be logged in to Facebook to do this.
• Hotjar (Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta) is used to record randomly selected individual website visits (with anonymised IP address only). This creates a log of mouse movements and clicks. This allows us to randomly replay individual website visits and derive potential improvements for the website.
• Awin (Awin AG, Eichhornstraße 3, 10785 Berlin, Germany) for Affiliate Marketing
• Zuko (Formisimo Ltd, Colony, 5 Piccadilly Place, Manchester, M1 3BR, United Kingdom) to record the viewing of our forms and interactions with the same. The information collected will allow us to identify problems that visitors to our site may have when interacting with your forms.

14.3

We also process personal data submitted via this website in Salesforce. This is a cloud-based software platform provided by Salesforce, Inc., Tower 415 Mission Street, 3rd Floor San Francisco, CA 94105, which helps us to manage customer relationships and business processes ("Customer Relationship Management"). The legal basis for the processing of your personal data in this case is Art. 6 par. 1 p. 1 lit. f DSGVO.

14.4

If you have given us your consent pursuant to Art. 6(1)(1)(a) DSGVO, we will also transfer your data to our Microsoft Power BI-based reporting tool ("Cube") in order to analyse and improve our business processes.

You may revoke your consent at any time by sending an informal e-mail to datenschutz(at)pfh.de (see below).

In the course of our business relationship, your personal data may be transferred or disclosed to third party companies. These may be located outside the European Economic Area (EEA), i.e. in third countries. Such processing is done solely for the purpose of fulfilling contractual and business obligations and maintaining your business relationship with us. We will inform you of the details of such transfers at the relevant points below.

Some third countries have been certified by the European Commission as having a level of data protection comparable to the EEA standard through so-called Adequacy Decisions (a list of these countries and a copy of the Adequacy Decisions can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). However, other third countries to which personal data may be transferred may not have a consistently high level of data protection due to a lack of legislation. Where this is the case, we ensure that adequate data protection is in place. This may be through binding corporate rules, the European Commission's standard contractual clauses for the protection of personal data, certificates or recognised codes of conduct.

The transfer of personal data to the U.S. is currently possible again based on the adequacy decision for the EU-U.S. Data Privacy Framework adopted by the European Commission on 10 July 2023. Please also note that a transfer of your personal data to a third country such as the USA cannot, in the vast majority of cases, be based on your consent pursuant to Art. 49 of the GDPR.

We will inform you about the legal basis (e.g. standard contractual clauses) on which the transfer of data to third countries takes place at the appropriate place in the individual services. Please contact our Data Protection Officer if you would like more detailed information.

16.1

If you have given your consent to the processing of your data (Art. 6 para. 1 sentence 1 lit. a GDPR), you may withdraw your consent at any time. Such a withdrawal of consent will affect the lawfulness of the processing of your personal data after you have expressed it to us.

16.2

You may object to the processing of your personal data where we are relying on the balancing of interests (Art. 6 para. 1 sentence 1 lit. f GDPR). In particular, this is the case if the processing is not necessary for the performance of a contract with you, which we will demonstrate in each case in the functional description. If you exercise such an objection, we ask you to explain the reasons why we should not process your personal data in the way we have done. If your objection is justified, we will consider the merits of the case and either stop or amend the processing or provide you with our compelling legitimate grounds for continuing the processing.

16.3

You may, of course, at any time object to the processing of your personal data for advertising purposes and the profiling associated with it. You can inform us of your objection to advertising using the following contact details: datenschutz(at)pfh.de