Privacy policy

1. Controller
2. Data protection officer
3. General information on data processing
4. Your rights
5. Hosting and content delivery networks (CDN)
6. Data collection on this website
7. Arranging insurance and contacting us
8. Using My account
9. Using the conversational assistant
10. Analytics tools and advertising
11. Plugins and tools
12. Newsletter
13. Our own services
14. Changes
15. Definitions

The provider of this website is Alteos GmbH (hereinafter Alteos)

Alteos GmbH
Tauentzienstr. 7 b/c
10789 Berlin
Web: https://hannadirekt.de
Email: fragen@hannadirekt.de

The controller for the processing of your personal data in connection with insurance offers is AXA Versicherung AG (hereinafter AXA).

www.axa.de

You can reach our data protection officer, Dr. Jana Jentzsch, MARAIT Rechtsanwaltsgesellschaft mbH, at:

Email: jana.jentzsch@marait.de
Phone: +49 (0)40 228 683 860

3.1 Scope and purpose of the processing of personal data

When you use this website, we generally process your personal data only to the extent that this is necessary to provide a functioning website and our content and services. We process your personal data only after you have given your consent for a specific purpose, unless the law permits the processing without obtaining consent first. The purposes of the processing follow from the processing activities described in more detail below.

3.2 Legal basis for the processing of personal data

Where we ask for your consent to processing operations involving personal data, the legal basis is Art. 6 Abs. 1 a) DSGVO (the EU General Data Protection Regulation, GDPR). Where the processing of your data is necessary for the performance of a contract to which you are party, the legal basis is Art. 6 Abs. 1 b) DSGVO. This also applies to processing operations that are necessary to take steps prior to entering into a contract. Where processing of your personal data is necessary for compliance with a legal obligation to which we are subject, the legal basis is Art. 6 Abs. 1 c) DSGVO. Where vital interests of yours or of another natural person make processing of personal data necessary, the legal basis is Art. 6 Abs. 1 d) DSGVO. Where the processing is necessary for the purposes of a legitimate interest of our company or of a third party, and your interests, fundamental rights and freedoms do not override the first-mentioned interest, the legal basis for the processing is Art. 6 Abs. 1 f) DSGVO.

3.3 Erasure of data and storage period

Your personal data is erased or blocked as soon as the purpose of storage no longer applies. Data may also be stored beyond that where this is provided for by laws or other legal provisions that are binding on us. Data is also blocked or erased when a storage period prescribed by those legal provisions expires, unless further storage of the data is necessary for entering into or performing a contract.

3.4 Types of data processed

• Customer data (e.g. name, address);
• Contact data (e.g. email address, phone number);
• Content data (e.g. text entries, photos, videos);
• Usage data (e.g. pages visited, access times, personal interests);
• Communication data and metadata (e.g. IP addresses, device information)
• Conversation data (e.g. transcripts from call recordings, chat histories).

3.5 Purposes of the processing

• Providing the online service, its functions and content;
• Answering contact requests and communicating with users;
• Recording, handling and documenting claims;
• Security measures; audience measurement/marketing;
• Data-based analysis to detect and prevent insurance fraud.

3.6 Categories of data subjects

Visitors to and users of the online service (hereinafter “users”).

3.7 Requirements to provide data and consequences of not providing it

Providing personal data is partly required by law (e.g. tax rules) or may also result from contractual provisions (e.g. information on the contracting party). To enter into a contract, it may be necessary for you to provide us with personal data that we then have to process. For example, you are obliged to provide us with personal data when our company enters into a contract with you. Not providing the personal data would mean that the contract could not be concluded.

3.8 Automated decision-making

We do not carry out any decision-making based solely on automated processing within the meaning of Art. 22 DSGVO. We use language models in a supporting role, for example in fraud detection and claims handling; we always review the language models' assessment. Assessments that affect benefits, and legal assessments, are carried out exclusively by qualified specialists, who are responsible for them; a human always makes the decision. If, in an individual case, we also use purely automated processing to reach a decision, we will inform you of this wherever such processing is used.

3.9 Disclosure of data

Data is passed on to service providers only on the basis of a proper data processing agreement under Art. 28 DSGVO. Data is passed on to affiliated companies / group companies either on the basis of consent you have given, in which case the legal basis is Artikel 6 Absatz 1 a) DSGVO, or on the basis of our interest in complying with group policies and ensuring appropriate IT security within the group. The legal basis is then Art. 6 Abs. 1 f) DSGVO.

Apart from the processing operations described here, we do not pass on your data to recipients based outside the European Union or the European Economic Area. The processing operations named here involve a transfer of data to the servers of the providers of tracking or targeting technologies we have engaged. These servers are located in the USA if the provider is based there. The data transfer takes place on the basis of so-called standard contractual clauses of the European Commission or the Data Privacy Framework.

We only pass on your personal data to third parties if:

• you have given your express consent to this under Artikel 6 Abs. 1 a) DSGVO,
• the disclosure under Art. 6 Abs. 1 f) DSGVO is necessary for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest, worthy of protection, in your data not being passed on,
• there is a legal obligation for the disclosure under Artikel 6 Abs. 1 c) DSGVO, or the disclosure is permitted by law and necessary under Art. 6 Abs. 1 b) DSGVO for handling contractual relationships with you.

3.10 Transfer of personal data to the USA

Data transfers to the USA are currently governed by the US-EU Data Privacy Framework. The European Commission has adopted an adequacy decision for it. This requires the US company concerned to be certified accordingly.

Whenever data is transferred to the USA, we make sure to work with service providers that are certified at least under the Data Privacy Framework. This is noted below for each service we use.

In addition, and in particular where there is no certification, we make sure that the standard contractual clauses of the European Commission are included in the contracts.

You can find more information on the Data Privacy Framework (DPF) here: https://www.dataprivacyframework.gov/s/participant-search/participantdetail?contact=true&id=a2zt0000000GnbGAAS&status=Active

When your personal data is processed, you have the following rights, which we are happy to explain below. For this, you can contact us as the controller or the data protection officer; you will find the contact details above under 1. and 2.

4.1 Right of access (Art. 15 DSGVO)

On request, we will confirm to you whether personal data concerning you is being processed. If so, you have the right to be informed of the following

• the purpose(s) of the data processing,
• the categories of data processed, and
• where applicable, the recipients or categories of recipients to whom data is disclosed on the basis of legal obligations or contractual relationships, in particular recipients in third countries,
• the planned storage period or, if that is not possible, the criteria used to determine that period,
• the existence of the right to request rectification or erasure of personal data concerning you or restriction of processing by us, or to object to such processing,
• the existence of the right to lodge a complaint with the supervisory authority,
• where the personal data is not collected from the data subject: any available information as to the source of the data,
• the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject,
• in the case of a transfer to a third country or to an international organisation, the appropriate safeguards relating to the transfer.

On request, you will also receive a copy of the data collected and processed about you. This is generally free of charge.

4.2 Right to rectification (Art. 16 DSGVO)

You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement.

4.3 Right to erasure (Art. 17 DSGVO) (the so-called right to be forgotten)

On request, or once the contract with us has been performed or cancelled, your personal data will be erased without delay, unless retention or documentation obligations under tax or commercial law prevent this or erasure would put at risk the safeguarding of the controller's legitimate interests. A right to erasure exists under the following conditions:

• The personal data was collected or otherwise processed for purposes for which it is no longer necessary.
• You withdraw your consent on which the processing was based under Art. 6 Abs. 1 a) DSGVO or Art. 9 Abs. 2 a) DSGVO, and there is no other legal basis for the processing.
• You object to the processing under Art. 21 Abs. 1 DSGVO and there are no overriding legitimate grounds for the processing, or an objection to the processing was lodged under Art. 21 Abs. 2 DSGVO.
• The personal data was processed unlawfully.
• The personal data has to be erased for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data was collected in relation to the offer of information society services under Art. 8 Abs. 1 DSGVO (the consent was given by a child).

4.4 Right to restriction of processing (Art. 18 DSGVO) (blocking)

You have the right to request restriction of processing, that is, the blocking of your personal data for processing, under the following conditions:

• You contest the accuracy of the personal data, for a period that enables us to verify the accuracy of the personal data.
• The processing is unlawful, you oppose the erasure of the personal data and request the restriction of the use of the personal data instead.
• The controller no longer needs the personal data for the purposes of the processing, but you need it for the establishment, exercise or defence of legal claims.
• The user has objected to the processing under Art. 21 Abs. 1 DSGVO and it has not yet been established whether the legitimate grounds of the controller override those of the user.

4.5 Right to data portability (Art. 20 DSGVO)

On request, your data can be made available in a structured, commonly used and machine-readable format, for you and for a service provider who takes over afterwards, to allow a quick transfer. This applies in any event where the processing is based on consent under Art. 6 Abs. 1 a) DSGVO or Art. 9 Abs. 2 a) DSGVO or on a contract under Art. 6 Abs. 1 b) DSGVO and the processing is carried out by automated means.

4.6 Right to withdraw your consent (Art. 7 Abs. 3 DSGVO)

You can withdraw any consent you have given at any time by notifying us. As a result, we may no longer continue the data processing based on that consent in the future.

4.7 Right to lodge a complaint with the supervisory authority (Art. 77 DSGVO)

If you believe that data protection provisions have been infringed, you have the right to lodge a complaint with the competent supervisory authority. For companies in Berlin, for example, this is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Friedrichstr. 219, 10969 Berlin, phone: 030 13889-0, email: mailbox@datenschutz-berlin.de, website: https://www.datenschutz-berlin.de.

4.8 Right to object (Art. 21 DSGVO)

You also have the right to object to the processing of your personal data. Where the processing is carried out for direct marketing purposes (e.g. newsletters), this right exists at any time. Otherwise, you may also have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you. This applies only where the processing is based on Art. 6 Abs. 1 e) oder f) DSGVO (performance of a task in the public interest or legitimate interests pursued by the controller). We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise this right to object, you can also send us an informal message that makes your intention clear, stating your email address, through the contact options given in section 1 or 2.

5.1 We host our server services with the following provider:

Amazon Web Services

To host the database and web content, including all customer data, we use the service Amazon Web Services EMEA S.à.r.l, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The data is stored exclusively in a data centre in Germany (AWS region eu-central-1, Frankfurt) that is certified to ISO 27001, 27017 and 2018 and PCI DSS Level 1. On our side, access rights are tightly restricted and the data is encrypted automatically. We have a data processing agreement with Amazon.

The contract with the provider contains standard contractual clauses adopted by the European Commission (Art. 46 Abs. 2 lit. c DSGVO), which ensure that data is passed on securely. Amazon Web Services Inc is also certified under the US-EU Privacy Framework. You can find more information on AWS and data protection at https://aws.amazon.com/de/compliance/eu-data-protection/ and at https://aws.amazon.com/de/privacy/.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically sends to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not combined with other data sources.

This data is collected on the basis of Art. 6 Abs. 1 lit. f) DSGVO. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website; for this, the server log files must be recorded.

Storage period: The server log files of our application at Amazon Web Services are stored for 14 days and then deleted automatically. Logs of our web application firewall, which contain the IP address and the request, are stored for 30 days and then deleted automatically. They cover blocked and suspicious requests and every check during the order process of whether a contract already exists for an e-mail address; the checked e-mail address itself is not logged.

5.2 We host the content of our website with the following provider:

Google Cloud CDN

We use the content delivery network Google Cloud CDN. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google offers a globally distributed content delivery network. Technically, the transfer of information between your browser and our website is routed through Google's network. This allows us to increase the worldwide availability and performance of our website.

The use of Google Cloud CDN is based on our legitimate interest in providing our website as error-free and securely as possible (Art. 6 Abs. 1 lit. f) DSGVO).

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Google LLC is also certified under the US-EU Privacy Framework. You can find details here: https://policies.google.com/privacy/frameworks

You can find details of Google Ireland Limited's privacy policy here: https://policies.google.com/privacy?hl=de

You can find more information on Cloud CDN here: https://docs.cloud.google.com/cdn/docs/overview

Vercel

Vercel is a tool for hosting web applications.

Vercel Inc. 440 N Barranca Avenue #4133 Covina, CA 91723 stores cookies or other recognition technologies that are necessary to display the page, to provide certain website functions and to ensure security (strictly necessary cookies).

For details, see Vercel's privacy policy: https://vercel.com/legal/privacy-policy

Vercel is used on the basis of Art. 6 Abs. 1 lit. f) DSGVO. We have a legitimate interest in presenting our website as reliably as possible. Where corresponding consent has been requested, the processing is based exclusively on Art. 6 Abs. 1 lit. a) DSGVO and § 25 Abs. 1 TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the German Telecommunications Digital Services Data Protection Act (TDDDG). Consent can be withdrawn at any time.

Vercel is certified under the US-EU Data Privacy Framework.

Our agreement with Vercel also includes the standard contractual clauses of the European Commission. You can find details here: https://vercel.com/legal/dpa

Cookies

Our websites use so-called “cookies”. Cookies are small data packets and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are deleted automatically at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically.

Cookies can come from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable certain services of third-party companies to be integrated into websites (e.g. cookies for handling payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping basket function or the display of videos). Other cookies can be used to analyse user behaviour or for advertising purposes.

Cookies that are necessary to carry out the electronic communication process, to provide certain functions you have requested (e.g. the shopping basket function) or to optimise the website (e.g. cookies to measure the web audience) (strictly necessary cookies) are stored on the basis of Art. 6 Abs. 1 lit. f) DSGVO, unless another legal basis is stated. The website operator has a legitimate interest in storing strictly necessary cookies for the technically error-free and optimised provision of its services. Where consent to the storage of cookies and similar recognition technologies has been requested, the processing is based exclusively on this consent (Art. 6 Abs. 1 lit. a) DSGVO and § 25 Abs. 1 TDDDG); consent can be withdrawn at any time. You can change or withdraw your consent at any time under “Cookie settings” on our website.

You can set your browser so that you are informed about cookies being set and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when you close the browser. If cookies are deactivated, the functionality of this website may be limited.

You can find out from this privacy policy which cookies and services are used on this website.

Consent through our cookie banner

We obtain your consent to cookies and similar technologies through our own cookie banner; no external consent management provider is used. You can choose between the categories “Strictly necessary” (always on), “Analytics” and “Marketing”. Tools in the Analytics and Marketing categories are only loaded after you have given your consent. You can change or withdraw your choice at any time using the “Cookie settings” link in the page footer.

Storage in the browser: Your choice, the time, the version of the consent text and a random event ID are stored in your browser's local storage under the key “hanna_consent”, for no more than 12 months. If we change the scope of the consent (new version), we will ask you again.

Evidence of consent: To document your decision, we store an anonymous entry on our server with the event ID, the action chosen (accept all, reject all, save choices), the consent status for each category, the version of the consent text, the path of the page (without parameters) and the time. No IP address, browser identifier, customer number or other information about you is stored; we can only link the entry to you through the event ID stored in your browser.

Legal basis: Art. 6 Abs. 1 lit. c) DSGVO in conjunction with Art. 7 Abs. 1 DSGVO (evidence of consent) and § 25 Abs. 2 Nr. 2 TDDDG for the technically necessary storage in the browser.

Storage period: The evidence entries are deleted three years after they are recorded.

Hubspot CRM

We use Hubspot CRM on this website. The provider is Hubspot Inc. 25 Street, Cambridge, MA 02141 USA (hereinafter Hubspot CRM).

Hubspot CRM enables us, among other things, to manage existing and potential partners/customers and partner and customer contacts. With the help of Hubspot CRM, we are able to record, sort and analyse customer interactions by email, social media or phone across various channels. The personal data collected in this way can be evaluated and used for communication with potential partners/customers or for marketing measures (e.g. sending newsletters).

With Hubspot CRM, we are also able to record and analyse the user behaviour of our contacts on our website.

Hubspot uses cookies for this purpose. Hubspot CRM is used on the basis of your express consent under Art. 6 Abs. 1 lit. a) DSGVO. Consent can be withdrawn at any time.

Data is transferred to the USA on the basis of the standard contractual clauses of the European Commission. HubSpot is also certified under the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”). You can find details here: https://legal.hubspot.com/de/privacy-policy?hubs_content=www.hubspot.de/data-privacy/gdpr&hubs_content-cta=Datenschutzbestimmungen.

The contract with Hubspot also includes a data processing agreement, which sets out the framework for the data processing. It is available at https://legal.hubspot.com/de/dpa.

Zapier

To integrate different tools, we use Zapier, a service of Zapier Inc., 548 Market St #62411, San Francisco, California 94104, USA (“Zapier Inc.”).

Zapier is used in the interest of structuring the tools we use efficiently. This constitutes a legitimate interest within the meaning of Artikel 6 Absatz 1 lit. f) DSGVO. We have concluded a data processing agreement with Zapier Inc. The contract with the provider contains standard contractual clauses adopted by the European Commission (Art. 46 Abs. 2 lit. c) DSGVO), which ensure that data is passed on securely. Zapier is also certified under the US-EU Privacy Framework.

You can find more information on data protection at Zapier at https://www.zapier.com/privacy.

Google Places API

To validate retailer and repair shop names from uploaded invoices as part of claim assessment, we use the Google Places API. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Company names from invoices, and in individual cases also names of sole traders, are transmitted for validation. Some of the processing takes place outside the EU.

Data processed: retailer or company name from uploaded invoices.

Legal basis: Art. 6 Abs. 1 lit. f) DSGVO (legitimate interest in checking the authenticity of claim documents and preventing fraud).

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Google LLC is also certified under the EU-U.S. Data Privacy Framework. You can find details at: https://policies.google.com/privacy/frameworks

You can find details of Google Ireland Limited's privacy policy here: https://policies.google.com/privacy

Google Maps Places Autocomplete

In our application process, we use the Google Maps JavaScript API with the Places Autocomplete function to complete address entries. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the address step is opened, the script is loaded from Google; your entries in the address field, the selected address and your IP address are transmitted directly from your browser to Google. Some of the processing takes place outside the EU.

Data processed: entries in the address field, selected address, IP address, browser information.

Legal basis: Art. 6 Abs. 1 lit. f) DSGVO (legitimate interest in correct and convenient address entry).

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Google LLC is also certified under the EU-U.S. Data Privacy Framework. You can find details at: https://policies.google.com/privacy/frameworks.

You can find details of Google Ireland Limited's privacy policy here: https://policies.google.com/privacy

Arranging insurance

If you apply to take out insurance through this website and send us your personal data for that purpose, we process that data only to handle your application and, if the contract is concluded, to carry out the contract, that is, to perform the insurance contract or to take steps prior to entering into a contract (Art. 6 Abs. 1 b) DSGVO).

For this purpose, the data has to be processed by

• Alteos as the insurance intermediary.
• AXA as the insurer and risk carrier.

Your data is stored for the term of the contract and within the statutory retention obligations and rights. Otherwise, our general information on the processing of your personal data applies. You can also find further information in the privacy information provided by AXA.

If you came to us through an advert, we also store the click ID and campaign parameters with the contract (see section 10, storing the ad click ID when you take out a contract).

Contacting us by post

You can contact us by post. If you contact us in this way, we use the personal data you voluntarily provide to us in this context solely to get in touch with you and to handle your enquiry.

Data processed: name, address, content of your message

Legal basis: Art. 6 Abs. 1 b) DSGVO (handling your enquiry under the insurance contract) or Art. 6 Abs. 1 lit. f) DSGVO (legitimate interest in handling incoming enquiries).

Storage period: Your data is deleted once it is no longer needed for the purpose of the processing and no statutory retention obligation prevents this.

Contacting us by email and phone

Contact by email and phone is handled by our digital assistant. Please note the separate information in section 9 (using the conversational assistant) and, where the recording of phone calls is concerned, in section 9.1 (call recording and transcription).

On our website (hannadirekt.de) we offer you My account, a protected area in which you can manage your insurance contracts, change your personal details, view documents and report claims.

8.1 Logging in

You do not need to register separately to use My account. My account is set up for you automatically when you take out your insurance contract. After you take out the contract, we send you an email with a direct link to My account. You then log in with a one-time code or a magic link.

Legal basis for setting up My account: Art. 6 Abs. 1 lit. b) DSGVO (performance of the insurance contract. In My account, we provide your insurance documents, send you messages and handle claims).

Logging in with a one-time code (OTP) or magic link

Access to My account is password-free. There are two ways to log in:

• One-time code (OTP): You enter the email address you gave when taking out the contract and receive a 6-digit one-time code (OTP) at that address. Once you enter the code, you have access to My account.
• Magic link: Alternatively, you can request a personal access link, which is sent to you by email and logs you in to My account automatically with a single click.

Both methods use your email address for authentication.

Data processed: email address, one-time code (OTP) or magic link token, timestamp of the request, validity period of the code or link.

Legal basis: Art. 6 Abs. 1 lit. b) DSGVO (performance of the contract or authentication as a condition of access to My account for managing your contract and handling claims).

Storage period: One-time codes (OTP) and magic link tokens are valid for 15 minutes and can be used once. They are stored only as cryptographic hashes and, once used, become invalid and are removed from the authentication system. In addition, a hash of the email address and a timestamp relating to an authentication request are stored for no more than 60 minutes and then deleted.

Sending authentication emails

Authentication emails (one-time codes, magic links) are sent through Amazon Web Services SES (Simple Email Service), a service of Amazon Web Services EMEA S.à.r.l, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Processing takes place only in the EU region (AWS region eu-central-1, Frankfurt).

A data processing agreement under Art. 28 DSGVO is in place. Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Amazon Web Services Inc. is also certified under the US-EU Privacy Framework (see also section 5.1). You can find further information at: https://aws.amazon.com/de/privacy/.

8.2 Two-factor authentication (2FA)

To increase security and protect against unauthorised access, we may use a 2-factor authentication procedure. In this case, when you log in or make security-relevant changes, we send a code by SMS to the mobile number you have given us.

Data processed: mobile number, timestamp of sending, confirmation code.

Legal basis: Art. 6 Abs. 1 lit. c) DSGVO in conjunction with Art. 32 DSGVO (compliance with the legal obligation to take appropriate security measures) and Art. 6 Abs. 1 lit. f) DSGVO (legitimate interest in preventing fraud).

8.3 Technical infrastructure of My account

Supabase

We use Supabase as the technical platform for running My account. The provider is Supabase Inc., San Francisco, USA. Supabase provides the database infrastructure (PostgreSQL), the authentication component and the storage for uploaded documents. For logging in to My account with a magic link or one-time password (OTP), Supabase acts as the identity provider: the code or link is generated by Supabase and sent to you by email. Data processing takes place only within the European Union (AWS region eu-central-1, Frankfurt). A data processing agreement under Art. 28 DSGVO is in place. The transfer of data to the USA is based on the standard contractual clauses of the European Commission (Art. 46 Abs. 2 lit. c) DSGVO).

Legal basis: Art. 6 Abs. 1 lit. b) DSGVO (performance of the contract, in particular providing My account and secure login).

Further information on data protection at Supabase is available at: https://supabase.com/privacy.

8.4 Managing your contract, uploading documents and reporting claims

In My account, you can view and change contract details, upload documents (e.g. proof of damage or cancellations) or send us messages. You can also report insured events (claims) directly online.

Data processed: contract data, uploaded content including file metadata (content data), communication data, claims data. Do not upload documents that contain special categories of personal data within the meaning of Art. 9 DSGVO, in particular health data.

Recipients: Where this is necessary to manage your insurance policies (e.g. a change of address or a claim), we automatically pass these changes on to the insurer, AXA Versicherung AG.

Legal basis: Art. 6 Abs. 1 lit. b) DSGVO (performance of the insurance contract, claims settlement and the service agreement for My account). If, contrary to our instructions, you share content containing special categories of personal data with us, the processing is based on Art. 9 Abs. 2 lit. f) DSGVO (establishment, exercise or defence of legal claims in the course of claims settlement).

On our website and in My account, we offer a digital, interactive assistant that you can use to ask questions about insurance products, retrieve contract information, report claims and sort out general requests. The assistant is available in several channels:

Web chat: On our website, a chatbot is available to help you with general questions about your insurance, for example about the application process, your contract or reporting a claim. The chatbot is run by a language model and is clearly labelled as such. You are not communicating with a human. If you wish, you can switch to a human member of staff at any time.

Chat in My account and email: In My account and by email, the same digital assistant is available to handle requests about your contract.

Phone: For phone enquiries, a digital voice assistant is also available. You will find information on call recording and transcription separately in section 9.1.

Please note that you should only enter personal data if the assistant expressly asks for it. In other cases, no personal data is required. Do not enter special category data, such as health data.

The assistant is not trained on your personal data in the sense of model training. We review samples of conversation logs for quality assurance.

Data processed: content of your chat messages, time of the conversation and technical connection data (e.g. IP address).

Purpose: answering your enquiries, helping you use our platform, reporting claims and handling other requests about your contract.

Legal basis: Art. 6 Abs. 1 lit. b) DSGVO where the request concerns the performance of your insurance contract (e.g. contract information, claims, corrections to your data). Art. 6 Abs. 1 lit. f) DSGVO (legitimate interest in quality assurance and the proper operation of the assistant and in answering customer enquiries).

Storage period: Conversation histories from the web chat on our website and from My account are stored for the term of the insurance contract and, after the contract ends, until the standard limitation period expires (usually three years under § 195 BGB, the German Civil Code) and then deleted, unless statutory retention obligations prevent deletion.

9.1 Call recording and transcription (phone channel)

When you contact us by phone, you are connected to our digital, interactive assistant. So that the digital assistant can understand and process your request, the call is recorded and automatically converted into text with the help of a language model (transcription). At the start of the call, an automated announcement tells you that you are connected to our digital voice assistant and not to a human. Calls are recorded or transcribed only with your consent, which we ask for at the start of the call through an automated announcement. You can refuse your consent at any time or withdraw it later without any disadvantage to you; this does not affect the lawfulness of the processing carried out before the withdrawal.

Purpose: The recording and the transcripts are used to handle your request, to document claims and for our internal quality assurance.

Data processed: content of the call, time and duration of the call and, where mentioned in the call, personal data such as your name or policy number.

Legal basis: The call is recorded and transcribed on the basis of your consent (Art. 6 Abs. 1 lit. a DSGVO). We additionally base the subsequent use of the information you give in the call to perform your insurance contract (e.g. contract information, claims, corrections to your data) on Art. 6 Abs. 1 lit. b) DSGVO. Where recordings are analysed for quality assurance and the proper operation of the assistant and to preserve evidence of statements relevant to a claim, we base this on Art. 6 Abs. 1 lit. f) DSGVO (legitimate interest in a working, verifiable use of the digital assistant). Do not share special category data, such as health data; claims are handled by a member of staff.

Recording and transcription are carried out with the speech processing service ElevenLabs Conversational AI (see section 9.2), with which a data processing agreement under Art. 28 DSGVO has been concluded. The recordings and transcripts are not passed on to third parties, except to AXA Versicherung AG where this is necessary to handle a claim.

Storage period: The call recordings are processed for quality assurance and then automatically deleted, at the latest after 12 months. The transcripts are stored to perform the contract and to establish, exercise or defend legal claims for the term of the insurance contract and, after the contract ends, until the standard limitation period expires (usually three years under § 195 BGB) and then deleted, unless statutory retention obligations prevent this. If you withdraw your consent early, the data is deleted before this period ends, unless a statutory retention obligation or a legitimate interest in preserving evidence prevents this.

9.2 Technology used

Customer conversations (web chat, the sales side chat, the chat in My account, email, phone) are processed by large language models, with policy terms and conditions, claim descriptions and uploaded documents included in the prompts. We use the following service providers as processors to run the assistant:

Google Cloud Vertex AI (Gemini)

To run our assistant, which is based on a language model, we use Google Cloud Vertex AI with the Gemini language model. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The service is used to process customer enquiries with the language model in the areas of advice, contract management, claims reporting and email communication. Your input and the contract data relevant to answering your enquiry are sent to the language model, which generates an answer based on them.

When you report a claim, we process the documents and photos you upload (e.g. proof of damage, photos of the damage, invoices) with Google Cloud Vertex AI. The processing covers automatic classification and text recognition (OCR) of documents, an assessment of the extent of the damage and a system-supported plausibility check to prevent fraud. The results of the automated check, including a risk assessment and a handling recommendation, are stored in our system and can be viewed by the staff handling the claim. This risk assessment and handling recommendation are not binding on the responsible specialist: they examine each claim independently on the basis of the documents available and can depart from the system-supported assessment at any time. The final decision on settling the claim is always made by a human. The system-supported analysis serves only to prepare and support this examination, not to replace it. No fully automated decision-making within the meaning of Art. 22 DSGVO takes place; the final assessment of the claim always lies with our staff.

When claims are handled, Google Cloud Vertex AI is used to produce the system-supported assessment. The requests and results processed in this way are not stored permanently by Google. However, technical caching for a period of up to 24 hours may take place by default. We continue to process the requests and results to perform the contract, in particular to handle and document the claim. To that extent, section 9 applies accordingly.

Data processed: To answer your enquiries, the assistant can draw on contract data, claims history and documents you have uploaded, where these are needed to handle the request. Uploaded documents and photos, including the metadata they contain (e.g. where and when a photo was taken), may also be processed. Do not upload documents that contain special categories of personal data within the meaning of Art. 9 DSGVO, in particular health data.

We use Google Cloud Vertex AI on the basis of Art. 6 Abs. 1 lit. b) DSGVO (performance of the insurance contract) and Art. 6 Abs. 1 lit. f) DSGVO (legitimate interest in handling customer requests efficiently and to a high standard). When you report a claim, you may, contrary to our instructions, share special categories of data (e.g. health data of injured persons). In this case, we process this data on the basis of Art. 9 Abs. 2 lit. f) DSGVO where this is necessary for the establishment, exercise or defence of legal claims in the course of claims settlement.

A data processing agreement under Art. 28 DSGVO is in place with Google Ireland Limited. Processing generally takes place on servers within the European Union (region europe-west1/ EU multi-region).

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Google LLC is also certified under the EU-U.S. Data Privacy Framework. For details, see: https://policies.google.com/privacy/frameworks

Details of the privacy policy of Google Ireland Limited are available here: https://policies.google.com/privacy

Langfuse Cloud

To provide prompt templates, we use the cloud service Langfuse from Langfuse GmbH, Linienstraße 145, 10115 Berlin, Germany. Processing takes place within the European Union. A data processing agreement under Art. 28 DSGVO is in place with Langfuse GmbH.

Data processed: technical prompt templates only. No personal customer data is processed through Langfuse Cloud. Templates are combined with customer data only locally, within our own system environment.

Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in the structured management and maintenance of the digital assistant).

ElevenLabs Conversational AI

To provide the digital voice assistant (voice channel), we use ElevenLabs Conversational AI. The provider is ElevenLabs Inc., 169 Madison Avenue, Suite 2895, New York, NY 10016, USA. Data is generally processed within the European Union. In individual cases, processing may also take place outside the EU, for example for technical support or for content review by the ElevenLabs security team.

The service is used for speech processing in customer interactions by phone. Voice recordings are processed in real time, recorded and converted into text (transcription). The voice recordings and the transcripts made from them are stored and used for the further handling and documentation of the customer interaction. The generated answers are output as synthetic speech.

Data processed and storage period: voice recordings, call transcripts, technical connection metadata (e.g. timestamps, session length). Data requested for authentication (e.g. policy number, date of birth) is held in a separate technical cache for the duration of the session, no more than 60 minutes, and then automatically deleted; where it is mentioned in the call, it becomes part of the call transcript and is subject to its storage period. Call transcripts and voice recordings are stored in the ElevenLabs environment for a period of 12 months and then automatically deleted. We continue to process the call transcripts in our own system environment; to that extent, section 9.1 applies accordingly.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO is the legal basis for processing voice data in real time (speech recognition, answer generation and speech output serve to perform the insurance contract and to handle customer requests). Call transcripts are recorded and stored only on the basis of your express consent under Art. 6 Abs. 1 lit. a DSGVO, which is obtained before the call begins. You can withdraw your consent at any time with effect for the future. Samples of transcripts are analysed for quality assurance and to ensure the proper operation of the voice assistant on the basis of Art. 6 Abs. 1 lit. f DSGVO (legitimate interest). Customer data is not used to develop or train the language model.

Processing is based on a data processing agreement under Art. 28 DSGVO. As ElevenLabs Inc. is based in the USA, the data transfer is additionally based on the standard contractual clauses of the European Commission (Art. 46 Abs. 2 lit. c DSGVO). ElevenLabs Inc. is also certified under the EU-U.S. Data Privacy Framework. Further information on data protection at ElevenLabs is available at: https://elevenlabs.io/privacy-policy.

Twilio

To provide the telephony infrastructure for the voice channel, we use Twilio. Twilio provides our phone numbers and connects incoming calls to our voice assistant. The provider is Twilio Inc., 375 Beale Street, Suite 300, San Francisco, CA 94105, USA

Data processed: connection data (phone number of the caller, time and duration of the call) and the audio stream during transmission.

Legal basis: Art. 6 Abs. 1 lit. b DSGVO (providing the voice channel to handle customer requests under the insurance contract).

Processing is based on a data processing agreement under Art. 28 DSGVO. Processing takes place in the EU (Twilio region Ireland).

The data transfer to the USA is also based on the standard contractual clauses of the European Commission (Art. 46 Abs. 2 lit. c DSGVO). Twilio also has binding corporate rules (BCR) approved by the competent EU data protection authority. Twilio Inc. is also certified under the EU-U.S. Data Privacy Framework. Further information on data protection at Twilio is available at: https://www.twilio.com/de-de/gdpr.

Advertising with consent

We process your data for marketing purposes only on the basis of your express consent to these purposes under Art. 6 Abs. 1 a) DSGVO.

We have concluded proper data processing agreements with the service providers we engage to deliver advertising, who process data on our behalf and strictly on our instructions.

Notice of your right to object

You can object to the use of your personal data for the advertising purposes above at any time, free of charge and with effect for the future, using the contact details given in section 1. If you object, your data will be blocked from further processing for advertising. Please note that in exceptional cases, advertising material may still be sent for a short time even after we have received your objection. This is for technical reasons, owing to the lead time needed for the selection process, and does not mean that we have not acted on your objection.

Google Analytics

On our websites we use Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies. The information generated by the cookie about how users use the online service is usually transferred to a Google server in the USA and stored there.

The information generated by the cookie about your use of this website includes, for example

• browser type and version,
• operating system used,
• referrer URL (the page visited before),
• host name of the accessing computer (IP address),
• time of the server request

However, we use Google Analytics with the “anonymizeIp” extension. With this extension, Google shortens and anonymises the IP address of the data subject's internet connection when our websites are accessed from a member state of the European Union or from another state party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there.

Google will use this information on our behalf to evaluate how users use our online service, to provide us with reports on the activities within this online service and, where applicable, to provide further related services to us. For this purpose, pseudonymous user profiles may be created from the processed data.

The use of this service is based on your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. You can withdraw your consent at any time.

The (shortened) IP address transmitted by the user's browser is not merged with other Google data. You can prevent cookies from being stored by adjusting your browser software settings accordingly, and you can prevent Google from collecting and processing the data generated by the cookie about your use of the online service by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

As an alternative to the browser add-on, in particular for browsers on mobile devices, you can prevent Google Analytics from collecting data by opening the Cookie settings and withdrawing your consent.

You can find more information on how Google uses data, and on the available settings and ways to object, in the following privacy policy: https://policies.google.com/technologies/ads and in Google's settings for the display of ads (https://adssettings.google.com/authenticated).

Users' personal data is deleted or anonymised after 14 months.

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Google LLC is also certified under the US-EU Privacy Framework. You can find details here: https://policies.google.com/privacy/frameworks

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that lets us integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any analyses of its own. It only serves to manage and deliver the tools integrated through it. However, Google Tag Manager does collect your IP address, which may also be transferred to Google's parent company in the United States.

The legal basis is your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. You can withdraw your consent at any time.

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Google LLC is also certified under the EU-U.S. Data Privacy Framework. You can find details at: https://policies.google.com/privacy/frameworks

You can find details of Google Ireland Limited's privacy policy here: https://policies.google.com/privacy

Google AdSense

We use Google AdSense on our website. Google AdSense is a service of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland, for embedding advertisements. Google AdSense uses cookies, that is, text files that are stored on your computer and enable an analysis of how you use our website. Google AdSense also uses so-called web beacons. These web beacons enable Google to analyse information such as the flow of visitors on our site. This information, along with your IP address and a record of the ad formats displayed, may be transferred to Google LLC in the USA, stored there and passed on to contractual partners. You can prevent cookies from being installed by adjusting your browser settings accordingly; however, please note that in this case you may not be able to use all the features of our website to their full extent. You can object to the use of your information here at any time.

The use of this service is based on your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. You can withdraw your consent at any time.

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Google LLC is also certified under the US-EU Privacy Framework. You can find details here: https://policies.google.com/privacy/frameworks

You can find details of Google Ireland Limited's privacy policy here: https://policies.google.com/privacy

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising programme of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. We have concluded a data processing agreement with “Google” regarding the use of Google Ads.

Google Ads allows us to display ads in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). In addition, targeted ads can be displayed based on the user data available to Google (e.g. location data and interests) (audience targeting). As the website operator, we can evaluate this data quantitatively, for example by analysing which search terms led to our ads being displayed and how many ads led to corresponding clicks.

The use of this service is based on your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. You can withdraw your consent at any time.

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Google LLC is also certified under the US-EU Privacy Framework. You can find details here: https://policies.google.com/privacy/frameworks

You can find details of Google Ireland Limited's privacy policy here: https://policies.google.com/privacy

Google Ads remarketing

This website uses the features of Google Ads remarketing. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With Google Ads remarketing, we can assign people who interact with our online service to specific target groups in order to then have interest-based advertising shown to them in the Google advertising network (remarketing or retargeting). For this purpose, the data collected by Google Analytics is processed (see above).

In addition, the advertising audiences created with Google Ads remarketing can be linked to Google's cross-device features. In this way, interest-based, personalised advertising messages that have been tailored to you based on your previous usage and browsing behaviour on one device (e.g. mobile phone) can also be shown on another of your devices (e.g. tablet or PC).

If you have a Google account, you can object to personalised advertising at the following link: https://www.google.com/settings/ads/onweb/.

The use of this service is based on your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. You can withdraw your consent at any time. For data transfers to the USA, the information on Google Analytics applies.

We have concluded a data processing agreement with “Google” regarding the use of Google Ads.

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Google LLC is also certified under the EU-U.S. Data Privacy Framework. You can find details at: https://policies.google.com/privacy/frameworks

You can find details of Google Ireland Limited's privacy policy here: https://policies.google.com/technologies/ads

Google conversion tracking

This website uses Google conversion tracking. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can recognise whether the user has performed certain actions. For example, we can evaluate which buttons on our website were clicked how often and which products were viewed or purchased particularly often. This information is used to create conversion statistics. We learn the total number of users who clicked on our ads and which actions they performed. We do not receive any information that would allow us to identify the user personally. Google itself uses cookies or comparable recognition technologies for identification.

The use of this service is based on your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. You can withdraw your consent at any time.

We have also concluded a data processing agreement with “Google” regarding the use of Google Ads.

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Google LLC is also certified under the EU-U.S. Data Privacy Framework. You can find details at: https://policies.google.com/privacy/frameworks

You can find details of Google Ireland Limited's privacy policy here: https://policies.google.com/privacy

Storing the ad click ID when you take out a contract

If you reach our website through an ad (e.g. Google Ads or Meta), the web address you open contains a click ID assigned by the advertising platform (Google: “gclid”, “gbraid” or “wbraid”; Meta: “fbclid”) and, where applicable, campaign parameters (“utm_source”, “utm_medium”, “utm_campaign”, “utm_term”, “utm_content”). We keep this information in your browser's memory during your visit. It is stored persistently in your browser (local storage, for no more than 90 days) only if you have consented to the “Marketing” category in our “Cookie settings”.

If you take out an insurance contract, we store the click ID and the campaign parameters present during that visit together with the contract: the IDs and parameters themselves, the path of the first page you opened, the time it was opened, the address of the page on which you completed the purchase, your consent status for Marketing and Analytics at the time of purchase, and the time of storage. This storage takes place regardless of your cookie consent. No further information about you is derived from the IDs.

Purpose: attributing purchases to our advertising campaigns, checking and billing advertising services, and documenting which advertising data we have reported to advertising platforms for a contract.

Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in measuring the success of our advertising and in its billing, and in being able to prove what we reported). You can object to this processing at any time (see section 4, right to object).

Storage period: for the term of the insurance contract; after that, the information is deleted, provided that no statutory retention obligations prevent this.

Datadog

We use the web monitoring tool Datadog. The service provider is the American company Datadog Inc., New York Times Bldg., 620 8th Ave 45th Floor, New York, NY, 10018, USA.

Datadog collects data such as server logs, the device used, the IP address and other session information in order to improve the performance of our websites. The legal basis for this processing is our legitimate interest in improving the performance of our websites and in fixing errors under Art. 6 Abs. 1 lit.f DSGVO.

Our contract with Datadog includes a data processing agreement, which sets out the framework conditions for the data processing. It is available at https://www.datadoghq.com/legal/data-processing-addendum/#data-transfers

Datadog also processes personal data in the USA, among other places. Datadog is an active participant in, and certified under, the EU-US Data Privacy Framework, which governs the correct and secure transfer of personal data of EU citizens to the USA. You can find more information on this at: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

Datadog also uses so-called standard contractual clauses (Art. 46. Abs. 2 und 3 DSGVO). Standard contractual clauses (SCC) are model templates provided by the European Commission and are intended to ensure that personal data meets data protection standards even when it is transferred to and stored in third countries (such as the USA). Through the EU-US Data Privacy Framework and the standard contractual clauses, Datadog undertakes to comply with the European level of data protection when processing relevant personal data, even if the data is stored, managed and processed in the USA. These clauses are based on an implementing decision of the European Commission. You can find the decision and the corresponding standard contractual clauses here, among other places: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de

You can find more information on data processing at: https://www.datadoghq.com/legal/privacy/.

PostHog

We use PostHog, a service of PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA, to understand how visitors use our website and to improve our service. For this, PostHog records page views, clicks, scroll and mouse movements and technical information about the device (screen size, device type, browser, country) and uses it to create pseudonymised usage profiles and session recordings in which the course of a visit can be traced. Entries in form fields are masked before transmission and are not recorded; IP addresses are not stored. Processing takes place on PostHog servers in the European Union (Frankfurt am Main). We have concluded a data processing agreement with PostHog under Art. 28 DSGVO. Neither PostHog nor we use the information to identify individual users or merge it with other data about individual users. Session recordings are deleted after 30 days. You can find more information in PostHog's privacy policy at https://posthog.com/privacy.

The use of this service is based on your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG, which you give in our “Cookie settings” (“Analytics” category) and can withdraw at any time with effect for the future.

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. PostHog Inc. is also certified under the EU-U.S. Data Privacy Framework.

Meta Pixel (formerly Facebook Pixel)

This website uses the visitor action pixel from Facebook/Meta for conversion measurement. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, however, the collected data is also transferred to the USA and to other third countries.

This allows the behaviour of site visitors to be tracked after they have been redirected to the provider's website by clicking on a Facebook ad. In this way, the effectiveness of Facebook ads can be evaluated for statistical and market research purposes and future advertising measures can be optimised.

The collected data is anonymous to us as the operator of this website; we can draw no conclusions about the identity of the users. However, the data is stored and processed by Facebook, so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook data use policy (https://de-de.facebook.com/about/privacy/). This enables Facebook to place ads on Facebook pages and outside Facebook. We, as the site operator, cannot influence this use of the data.

The use of this service is based on your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. You can withdraw your consent at any time.

We use the advanced matching feature within the Meta Pixel.

Advanced matching allows us to transmit various types of data (e.g. place of residence, federal state, postcode, hashed email addresses, names, gender, date of birth or phone number) of our customers and prospective customers that we collect through our website to Meta (Facebook). By activating it, we can tailor our advertising campaigns on Facebook even more precisely to people who are interested in our offers. Advanced matching also improves the attribution of website conversions and extends Custom Audiences.

Insofar as personal data is collected on our website with the help of the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are joint controllers for this processing (Art. 26 DSGVO). The joint controllership is limited exclusively to the collection of the data and its transfer to Facebook. The processing by Facebook that takes place after the transfer is not part of the joint controllership. The obligations incumbent on us jointly have been set out in a joint processing agreement. You can find the wording of the agreement at: https://www.facebook.com/legal/controller_addendum. Under this agreement, we are responsible for providing the privacy information when using the Facebook tool and for implementing the tool on our website in a way that is secure under data protection law. Facebook is responsible for the data security of Facebook products. You can assert your rights as a data subject (e.g. requests for access) regarding the data processed by Facebook directly with Facebook. If you assert your rights as a data subject with us, we are obliged to forward them to Facebook.

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381. Meta Platforms Inc. is also certified under the US-EU Privacy Framework.

You can find further information on protecting your privacy in Facebook's privacy notice: https://de-de.facebook.com/about/privacy/.

In addition, in the ad settings section at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen you can deactivate the “Custom Audiences” remarketing feature. To do so, you must be logged in to Facebook.

If you do not have a Facebook account, you can deactivate usage-based advertising from Facebook on the website of the European Interactive Digital Advertising Alliance: http://www.youronlinechoices.com/de/ praferenzmanagement/.

Meta Conversions API (server-side transmission)

In addition to the Meta Pixel, when you take out an insurance contract through our website, we transmit a purchase event (“Purchase”) directly from our server to Meta (Conversions API). The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. The transmission only takes place if you have consented to the “Marketing” category in our “Cookie settings”.

Data transmitted: your email address and your customer number in hashed form (SHA-256, not readable in plain text by Meta), your IP address, the identifier of your browser (user agent), the Meta cookie values “_fbp” and “_fbc” (the click ID of a Meta ad, if available), the address of the page on which you completed the purchase, the annual premium and currency of the contract taken out, the plan chosen and an event ID. The event ID matches that of the Meta Pixel so that Meta counts the purchase only once.

Purpose: measuring and optimising our advertising campaigns on Meta, even if the Meta Pixel is blocked in the browser.

Legal basis: your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. You can withdraw your consent at any time; once you withdraw it, no further server-side transmission takes place.

The joint controllership described above for the Meta Pixel (Art. 26 DSGVO) applies to the collection of the data and its transfer to Meta. Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. Meta Platforms Inc. is also certified under the EU-US Data Privacy Framework.

Facebook Custom Audiences

We use Facebook Custom Audiences. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

When you visit or use our websites and apps, take advantage of our free or paid offers, send data to us or interact with our company's Facebook content, we collect your personal data in the process. If you give us your consent to the use of Facebook Custom Audiences, we will transmit this data to Facebook, which Facebook can use to show you relevant advertising. In addition, target groups can be defined with your data (Lookalike Audiences).

Facebook processes this data as our processor. Details can be found in Facebook's terms of use: https://www.facebook.com/legal/terms/customaudience.

The use of this service is based on your consent under Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG. You can withdraw your consent at any time.

Where the data is processed within the group in the USA, the transfer is additionally based on the standard contractual clauses of the European Commission. You can find details here: https://www.facebook.com/legal/terms/customaudience and https://www.facebook.com/legal/terms/dataprocessing. Meta Platforms Inc. is also certified under the US-EU Privacy Framework.

LinkedIn Insight Tag

This website uses the LinkedIn Insight Tag. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Data processing by LinkedIn Insight Tag

With the help of the LinkedIn Insight Tag from LinkedIn Corporation, we receive information about the visitors to our website. If a website visitor is registered with LinkedIn, we can, among other things, analyse the key professional data (e.g. career level, company size, country, location, industry and job title) of our website visitors and so better align our site with the respective target groups. We can also use LinkedIn Insight Tags to measure whether visitors to our websites make a purchase or take some other action (conversion measurement). Conversion measurement can also take place across devices (e.g. from PC to tablet). LinkedIn Insight Tag also offers a retargeting feature that lets us have targeted advertising shown to visitors to our website outside the website; according to LinkedIn, the person receiving the ad is not identified in the process.

LinkedIn itself also collects so-called log files (URL, referrer URL, IP address, device and browser characteristics and time of access). The IP addresses are shortened or (if they are used to reach LinkedIn members across devices) hashed (pseudonymised). LinkedIn deletes the direct identifiers of LinkedIn members after seven days. The remaining pseudonymised data is then deleted within 180 days.

As the website operator, we are not able to assign the data collected by LinkedIn to specific individuals. LinkedIn will store the collected personal data of website visitors on its servers in the USA and use it for its own advertising measures. For details, see LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy#choices-oblig.

Legal basis

The use is based exclusively on your consent to the processing of your personal data for this purpose under Art. 6 Abs. 1 lit. a DSGVO and § 25 TDDDG. You can withdraw your consent at any time.

Data transfers to the USA are based on the standard contractual clauses of the European Commission. You can find details here: https://www.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs. LinkedIn is also certified under the US-EU Privacy Framework.

Objecting to the use of LinkedIn Insight Tag

You can object to the analysis of your usage behaviour and to targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

LinkedIn members can also control the use of their personal data for advertising purposes in their account settings. To prevent LinkedIn from linking data collected on our website with your LinkedIn account, you must log out of your LinkedIn account before you visit our website.

Trustpilot A/S

We may invite you by email to review all the services we provide (the “Purpose”). As we work with an external company, Trustpilot A/S, Pilestræde 58, floor 5, 1112 Copenhagen K, Denmark (“Trustpilot”), to collect customer feedback, we pass on data such as your name, your email address and your reference number to Trustpilot for this Purpose.

Alteos GmbH is the controller for the transfer of your data to Trustpilot and for sending the review invitation. In this phase, Trustpilot acts as a processor under Art. 28 DSGVO and processes your data solely on our instructions. A data processing agreement (DPA) between Alteos and Trustpilot governs the details of this processing, including technical and organisational protective measures, deletion periods and sub-processors.

The processing is based on your consent to the processing of your personal data for this Purpose under Art. 6 Abs. 1 lit. a DSGVO. You can withdraw your consent at any time.

If you create a Trustpilot account on the basis of our invitation and submit a review, Trustpilot becomes an independent controller for the processing of your platform data.

We may also use published reviews in other advertising media and materials for advertising and sales promotion purposes. This is based on our legitimate interest in showing customer satisfaction under Art. 6 Abs. 1 lit. f DSGVO. You can object to this processing at any time.

As Trustpilot A/S is a company based in the EEA, all data transfers are subject to the GDPR.

You can find more information at: https://corporate.trustpilot.com/legal/for-reviewers/privacy-policy-end-user/mar-2026

Google Fonts

This site uses Google Fonts, provided by Google, to display fonts consistently. Our Google Fonts are embedded locally on the website.

Google Fonts is used on the basis of Art. 6 Abs. 1 lit. f DSGVO. The website operator has a legitimate interest in displaying the typeface consistently on its website. If consent has been requested for this, processing takes place only on the basis of Art. 6 Abs. 1 lit. a DSGVO and § 25 Abs. 1 TDDDG, where the consent covers the storage of cookies or access to information on the device of the user (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

If your browser does not support Google Fonts, a standard font from your computer is used.

Further information on Google Fonts is available at https://developers.google.com/fonts/faq and in the privacy policy of Google: https://policies.google.com/privacy?hl=de.

Typekit by Adobe

We use certain fonts from the provider Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland (Adobe Fonts) to give our website an attractive design. Our Adobe Fonts are embedded locally, so your IP address is not transmitted to Adobe servers.

Further information on Typekit is available at: https://www.adobe.com/de/privacy/policies/typekit.html and in the other privacy provisions of Adobe: https://www.adobe.com/de/privacy/policy.html.

Newsletter data

If you would like to receive the newsletter offered on the website, we need an email address from you and information that allows us to verify that you are the owner of the email address given and agree to receive the newsletter. No further data is collected, or only on a voluntary basis. To handle the newsletters, we use newsletter service providers, which are described below.

Mailjet

The newsletters are sent through the mailing service provider Mailjet (SAS Mailjet, 13-13bis, Rue de l’Aubrac, 75012 Paris, France).

The mailing service provider may use your data in pseudonymised form, that is, without assigning it to a user, to optimise or improve its own services, for example to optimise the technical sending and the presentation of the newsletters or for statistical purposes. For this, the following data, among others, is processed:

• email addresses,
• customer names,
• postal addresses,
• phone numbers,
• IP addresses and
• connection and navigation data.

We use the double opt-in principle for sending the newsletter. The data is therefore processed only on the basis of your consent under Art. 6 Abs. 1 lit.a DSGVO.

The mailing service provider uses your data from your newsletter subscription only to process it on our behalf, and not to write to you itself or to pass the data on to third parties.

We have also concluded a data processing agreement with Mailjet.

The privacy policy of Mailjet is available at https://www.mailjet.de/privacy-policy/.

Handling applicant data

You can apply to work with us (e.g. by email, by post or through an online application form). Below, we inform you about the scope, purpose and use of the personal data collected during the application process. We assure you that your data is collected, processed and used in accordance with applicable data protection law and all other statutory provisions and that your data is treated in strict confidence.

Scope and purpose of data collection

If you send us an application, we process the personal data associated with it (e.g. contact and communication data, application documents, notes from job interviews), where this is necessary to decide whether to establish an employment relationship. The legal basis for this is § 26 BDSG, the German Federal Data Protection Act (initiating an employment relationship), Art. 6 Abs. 1 lit. b DSGVO (initiating a contract in general) and, if you have given consent, Art. 6 Abs. 1 lit. a DSGVO. Consent can be withdrawn at any time. Within our company, your personal data is passed on only to people involved in handling your application.

If your application is successful, the data you submitted is stored in our data processing systems on the basis of § 26 BDSG and Art. 6 Abs. 1 lit. b DSGVO for the purpose of carrying out the employment relationship.

Data retention period

If we cannot offer you a job, you decline a job offer or you withdraw your application, we reserve the right to keep the data you sent us for up to 6 months from the end of the application process (rejection or withdrawal of the application) on the basis of our legitimate interests (Art. 6 Abs. 1 lit. f DSGVO). The data is then deleted and the physical application documents destroyed. The data is kept in particular as evidence in the event of a legal dispute. If it is clear that the data will be needed after the 6-month period has ended (e.g. because of a threatened or pending legal dispute), it is deleted only when the purpose of keeping it longer no longer applies.

Data may also be kept for longer if you have given your consent to this (Art. 6 Abs. 1 lit. a DSGVO) or if statutory retention obligations prevent deletion.

The controller reserves the right to adapt security and data protection measures where this becomes necessary because of technical or legal developments. In such cases, the controller will also adapt this privacy policy accordingly. Please therefore refer to the current version of our privacy policy.

To help you understand this policy, we set out below the definitions of the GDPR, as far as they are relevant to our privacy policy.

Personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Put simply, personal data is individual information about the personal or factual circumstances of a specific or identifiable natural person, that is, not legal persons such as a limited company (GmbH). Personal data includes above all details such as your name, postal address and email address, but also your IP address.

Processing

Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Restriction of processing

Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future (in the sense of blocking)

Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning the performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements of that natural person.

Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Controller

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processor

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Recipient

Recipient means a natural or legal person, public authority, agency or another body to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients.

Third party

Third party means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Consent

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the wishes of the data subject by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Supervisory authority

“Supervisory authority” means an independent public authority established by a Member State under Art. 51 DSGVO.