Privacy Policy
Privacy Policy of the falkemedia Group
As of: October 2026
This Privacy Policy informs you about the processing of personal data on our websites and
digital services. We strictly comply with the provisions of the UK General Data Protection
Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) as well as, in addition,
the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
1. Controllers
As the falkemedia Group consists of legally independent companies, which company is the
controller depends on which service you use.
Which company is responsible for a service is set out in the overview below and in the legal
notice (Impressum) of the respective service.
Services that are not listed are not covered by this Privacy Policy. The privacy policy
published on the respective service applies to them.
For data protection enquiries and to exercise your data subject rights, you can contact all of
the above companies at datenschutz@falkemedia.de. Please state which service your
enquiry relates to.2. Data Protection Officer
We have appointed a data protection officer for our companies in the falkemedia Group:
Mr JĂĽrgen Koch
VogesenstraĂźe 1
77781 Biberach
Email: datenschutz@falkemedia.de
3. Scope
This Privacy Policy applies to all websites, apps and subdomains of the falkemedia Group
that refer to it. Services of the Group with their own privacy policy are not covered by it. For
those services, the version published on the respective service applies. Which company is
responsible for the service you use can be found in the overview in section 1 and in the legal
notice (Impressum) of the service. Supplementary information may apply to individual brands
or services with a different range of functions. The version published on the specific website
or in the app always prevails.
4. Hosting and Server Log Files
4.1 Hosting
Our websites and digital services are hosted by Hetzner Online GmbH. Processing takes
place in data centres in the EU or the EEA (locations: Nuremberg, Falkenstein and Helsinki).
When you visit our website, our hosting provider's servers record various connection data
(see section 4.2). We use these hosting services on the basis of Article 6(1)(f) UK GDPR
(legitimate interests in the reliable, secure, fast and efficient provision of our online services).
4.2 Server Log Files
The providers of the pages automatically collect and store information in so-called server log
files, which your browser automatically transmits to us. These are usually:
•browser type and browser version
•operating system used
•referrer URL (the previously visited page)
•host name of the accessing computer
•time of the server request
•IP address
When you use our apps, corresponding technical access data is transmitted to our servers,
in particular the device and operating system version, the app version and a device identifier.
This server log data is not combined with other data sources or with your user account. This
does not affect the analytics and advertising services described in section 7. This data is
collected on the basis of Article 6(1)(f) UK GDPR. The respective website operator in the
falkemedia Group has a legitimate interest in the technically error-free presentation, system
security and optimisation of its website. For this purpose, the server log files must be
recorded. The server log files are deleted no later than 30 days after their collection. They
are only stored for longer where this is necessary to investigate specific security incidents.5. Cookies and Consent Management
Some of our websites use so-called cookies and similar tracking technologies. For
technically necessary cookies, consent is not required under paragraph 4 of Schedule A1 to
PECR (storage or access that is strictly necessary for the service you have requested). We
base the associated processing on Article 6(1)(f) UK GDPR (legitimate interests in a
functioning service). For all other cookies and technologies, the legal basis is your consent
under regulation 6 of, and paragraph 2 of Schedule A1 to, PECR. The subsequent
processing of the data collected in this way is based on Article 6(1)(a) UK GDPR.
In addition to cookies, we use comparable technologies, in particular entries in your
browser's local storage and session storage. The above legal bases apply accordingly to
these technologies.
We store your decision to give or refuse consent for a maximum of twelve months. After that,
we ask you to decide again.
You can manage your preferences at any time via our consent management platform and
withdraw your consent with effect for the future.
Depending on the service and the type of page, we use one or more of the following
platforms. On some brands, two platforms are operated in parallel, for example one on the
main editorial site and another on the associated landing pages. You can tell which platform
is used on the page you are visiting from the consent banner displayed there and from the
provider's privacy information linked in it:
•Sourcepoint (Sourcepoint Technologies, Inc., 228 Park Avenue South, New York, NY
10003, USA; German branch: Sourcepoint GmbH, FriedrichstraĂźe 68, 10117 Berlin) on
the Drupal-based services. As Sourcepoint is based in the USA, the information in the
section "General Principles for Transfers to Third Countries" applies to this transfer.
•Borlabs Cookie (Borlabs GmbH, Hamburger Str. 11, 22083 Hamburg) on the
WordPress-based services.
•consentmanager (consentmanager AB, Håltegelvägen 1b, 72348 Västerås, Sweden) on
individual shop services (Shopware). The provider is based within the European Union.
Under UK data protection law, transfers to the EEA are approved by UK adequacy
regulations (see section 19).
Consent in our apps:
In our apps, we use our own consent dialogue instead of the consent management platforms
described above. If an app displays content from our website (a so-called webview), the
website's consent banner may also appear there. There too, services that are not strictly
necessary for operating the app are only used on the basis of your consent (regulation 6
PECR, Article 6(1)(a) UK GDPR). We obtain consent via a consent dialogue when you first
start the app. There, you can agree or use the settings to choose which categories
(audience measurement, third-party providers) you consent to. You can change your
decision at any time in the app's privacy settings and withdraw your consent with effect for
the future (Article 7(3) UK GDPR). Independently of this, you can use your device settings to
control whether apps may access your advertising identifier: on iOS via App Tracking
Transparency, on Android via the advertising ID settings. This device setting applies in
addition to your consent and does not replace it.6. External Logins and Social Media (Single Sign-On)
Where we offer you the option on one of our services to register or log in using the login
details of an external provider (so-called single sign-on), you can use this function instead of
creating your own password with us. If you use this function, you give your express consent
(Article 6(1)(a) UK GDPR) to us receiving profile information.
•Meta (Facebook Connect): single sign-on via Meta Platforms Ireland Limited, Merrion
Road, Dublin 4, D04 X2K5, Ireland. In this process, data is transferred to Meta
Platforms, Inc. in the United States. Meta Platforms, Inc. is certified under the EU-US
Data Privacy Framework, but does not participate in the UK Extension. For transfers of
UK data between us and Meta Platforms, Inc., Meta's Platform Terms incorporate the
International Data Transfer Addendum to the EU standard contractual clauses (UK
Addendum) (Article 46(2)(d) UK GDPR). For details, see section 19.
•Google Sign-In: single sign-on via Google Ireland Limited, Gordon House, Barrow Street,
Dublin 4, Ireland. A transfer to Google LLC in the USA cannot be ruled out. The
information in the section "General Principles for Transfers to Third Countries" applies to
this.
•Sign in with Apple: single sign-on via Apple Distribution International Ltd., Hollyhill
Industrial Estate, Hollyhill, Cork, Ireland. Depending on what you choose to share, we
receive your name, your email address and a user identifier from Apple. You can hide
your email address. We then receive a relay address generated by Apple. When you
first sign in, Apple also sends us a simple assessment that helps to prevent misuse. A
transfer to Apple Inc. in the USA cannot be ruled out. The information in the section
"General Principles for Transfers to Third Countries" applies to this.
Embedded content from social networks: On some pages, we embed posts from
Instagram. To display them, your browser establishes a connection to Instagram. In doing
so, your IP address and the page you are visiting are transmitted, even if you do not have an
account there. We only load this content on the basis of your consent (Article 6(1)(a) UK
GDPR, regulation 6 PECR), which you give via our consent tool and can withdraw at any
time. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5
Ireland. A transfer to the USA cannot be ruled out. The information in the section "General
Principles for Transfers to Third Countries" applies to this.
7. Analytics Tools and Advertising on Our Websites and in Our Apps
The analytics, tracking, conversion and advertising services described below are used
exclusively on the basis of your consent pursuant to Article 6(1)(a) UK GDPR in conjunction
with regulation 6 PECR. Consent is given via our consent tool and can be withdrawn or
adjusted there at any time with effect for the future. Different rules apply to the services in
our apps (section 7.14), to advertising based on customer lists (section 7.15) and to
audience measurement (section 7.17).
Not all of the services listed below are used on every one of our offerings. You can view and
change which services are used on the offering you are visiting at any time via the privacy
settings of that offering. For our apps, the information in section 7.14 applies.
These services are used in particular for audience measurement, statistical analysis,
conversion measurement, the optimisation of our online services and the delivery of
advertising and measurement of its success.On services with a members' area, we also use these services within the logged-in area. If
you are logged in, the data collected may be linked to your user account and thus to an
identified person. This only happens if you have consented to the relevant services. You can
withdraw your consent at any time via the consent tool with effect for the future.
7.1 Google Tag Manager
We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street,
Dublin 4, Ireland. It does not analyse anything itself or display advertising, but only ensures
that the services listed in this section are loaded and started on our website and in our apps.
As soon as Google Tag Manager is loaded, Google receives your IP address. We therefore
only load it once you have consented (Article 6(1)(a) UK GDPR in conjunction with
regulation 6 PECR). For recipients with their registered office or parent company outside the
United Kingdom and the EEA, a transfer to a third country cannot be ruled out. The
information in the section "General Principles for Transfers to Third Countries" applies to
this.
7.2 Server-Side Tagging
We do not integrate some of the services mentioned in this section directly in your browser,
but via a detour. Your browser first sends the data to an address that belongs to our own
website (for example fmserv.zaubertopf.de). From there, we forward it to the respective
service. Depending on the service, the recipients are Google (Google Analytics 4 and
Google Ads), Meta, TikTok, Pinterest and AWIN as well as OpenAI. This procedure is called
server-side tagging.
Depending on the service, we operate the server through which the data passes (tagging
server) via the Google Cloud Run service of Google Cloud EMEA Limited, 70 Sir John
Rogerson's Quay, Dublin 2, Ireland, and via Stape Europe OĂś, Sepapaja tn 6, 15551 Tallinn,
Estonia. Both process the data on our behalf. According to its own information, Stape uses
servers of Scaleway S.A.S. in France for hosting. For certain additional functions, Stape may
use sub-processors in the United States.
In this process, we process in particular your IP address, the pages you visit, information
about your device and your browser, the time of access and identification numbers by which
your browser can be recognised. These identification numbers (FPID, FPAU, FPLC and
FPGSID) are set under our own name, not under Google's.
Storage period: FPID up to two years, FPAU 90 days, FPLC 20 hours and FPGSID 90 days.
For Meta, the cookies
_
fbp and
_
fbc are also set, each with a storage period of 90 days.
For Meta, TikTok and Pinterest, we also use their server-side interfaces (Meta Conversions
API, TikTok Events API and Pinterest Conversions API).
Through these interfaces, we also transmit information that you have provided to us yourself,
such as your email address, your telephone number, your first and last name and your
postcode. This information is converted into hash values using a hashing method (SHA-256)
before transmission and is not transmitted in plain text. So that this information can also be
assigned to later events at Meta, our server may store it in a cookie under the address of our
own website (_gtmeec, storage period up to three months). In addition, we store a randomly
generated identifier (externalID) in your browser's local storage and transmit it to Meta so
that events can be assigned to your browser.Meta, TikTok and Pinterest use this information to assign events on our website to existing
accounts on their platforms.
The same applies to Google Ads enhanced conversions under section 7.6. In addition, the
information on Meta in section 7.5 and on TikTok and Pinterest in section 7.10 applies.
We transmit some events not via your browser, but directly from our own systems to the
platforms, for example when a purchase or subscription is concluded, renewed or cancelled
in our shop or subscription system. In this process, the type and time of the event, the
product and amount, an order or customer number and your email address and telephone
number in hashed form may be transmitted. The recipients are the platforms named in this
section. We only do this if you have consented (Article 6(1)(a) UK GDPR).
Because the data passes through an address of our own website, it is not readily apparent
from the outside that it is subsequently forwarded to the services mentioned. This is
precisely why we expressly point this out to you here. We only use this procedure if you
have consented (Article 6(1)(a) UK GDPR in conjunction with regulation 6 PECR).
A transfer to the USA cannot be ruled out for the recipients mentioned that have their
registered office or parent company outside the United Kingdom and the EEA. The
information in the section "General Principles for Transfers to Third Countries" applies to
this.
7.3 Google Analytics 4
We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon
House, Barrow Street, Dublin 4, Ireland. Google Analytics 4 enables us to analyse the use of
our website and to evaluate interactions with our online services. In particular,
pseudonymous user identifiers, device information, browser information, referrer URLs,
pages visited, time spent, interactions, events, conversions and approximate location data
may be processed. On some services, we link Google Analytics 4 with Google Ads in order
to create target groups for advertising from the usage data (section 7.6). In our configuration,
the retention period for user and event data is 14 months. The setting that resets the
retention period on new user activity is activated. A transfer to Google LLC (USA) cannot be
ruled out. The information in the section "General Principles for Transfers to Third Countries"
applies to this.
7.4 Upscore
Where used on a service, we use the content intelligence platform of Upscore GmbH,
SchellingstraĂźe 43, 22089 Hamburg. The service is used to analyse the use of editorial
content and to manage and optimise subscription and paid offers. In particular, pages
visited, time spent, interactions, device and browser data, time stamps and pseudonymous
identifiers may be processed. According to the contractual agreement with the provider,
processing takes place exclusively on servers in Germany. Under UK data protection law,
transfers to the EEA are approved by UK adequacy regulations (see section 19).
7.5 Meta Pixel
We use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04
X2K5. The service is used to measure the effectiveness of our advertising, to create target
groups and to optimise the delivery of interest-based advertising. In particular, informationabout your usage behaviour on our website, pages visited, interactions, conversion events,
device information, browser data, referrer information, time stamps and pseudonymous
identifiers may be processed. In addition, we may use advanced matching or automatic
advanced matching as part of the Meta Pixel. In this process, certain customer data you
have provided, in particular email address, telephone number, first and last name, place of
residence, postcode or similar identifiers, may be converted into a hash value using a
hashing method, in particular SHA-256, before transmission to Meta and then transmitted to
Meta. Meta uses these hash values to assign website visits and conversion events to
existing Meta accounts, to improve conversion measurement, to create target groups and to
optimise remarketing campaigns. This customer data is not transmitted in plain text. With
regard to the Meta Pixel, we and Meta are joint controllers within the meaning of Article 26
UK GDPR for certain processing operations. Meta is solely responsible for its own
subsequent processing. You can view the essence of the joint controllership arrangement at
https://www.facebook.com/legal/controller
_
addendum. You can exercise your data subject
rights both against us and against Meta. Meta has taken over the fulfilment of the information
obligations under Articles 13 and 14 UK GDPR. A transfer to Meta Platforms, Inc. in the
United States cannot be ruled out. The information in the section "General Principles for
Transfers to Third Countries" applies to this.
7.6 Google Ads, Conversion Tracking, Remarketing and Google Advertising Products
We use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland,
to measure the effectiveness of our advertising, to recognise users after they have clicked
on an ad, to create target groups and to optimise the delivery of interest-based advertising.
In particular, cookie IDs, advertising IDs, device information, browser information, interaction
data, referrer information, pages visited, conversion data and approximate location data may
be processed. In addition, we may use enhanced conversions for Google Ads. In this
process, certain customer data you have provided, in particular email address, telephone
number, first and last name or address, may be converted into a hash value using a one-way
hashing method, in particular SHA-256, before transmission to Google and then transmitted
to Google. Google uses these hash values to better assign conversion events to Google
accounts where users have interacted with one of our ads. This serves more accurate
conversion measurement, the optimisation of our advertising campaigns and the
improvement of automated bidding strategies. This customer data is not transmitted in plain
text.
A transfer to Google LLC (USA) cannot be ruled out. The information in the section "General
Principles for Transfers to Third Countries" applies to this.
7.7 Taboola
On some services, we use the Taboola service of Taboola Europe Limited, Aldgate House,
2nd Floor, 33 Aldgate High Street, London EC3N 1DL, United Kingdom, to recommend
further content to you at the end of articles. The content recommended consists of editorial
articles from our own services.
According to the provider, this involves the processing in particular of cookie identifiers, the
IP address, device and operating system information, the pages accessed on our services,
the referring link, the date and time of access, interactions with the content displayed
(visibility and clicks), general location information at city and region level and the browsing
history within the Taboola network. In addition, Taboola queries your browser's Topicsinterface, through which your browser provides interest categories, and matches identifiers
with the Google advertising network. According to its own information, the provider also uses
this data to recognise users across devices, to create interest segments and to offer these to
its own customers. It is participant no. 42 of the IAB Europe Transparency & Consent
Framework. In addition to cookies, the provider also uses your browser's local storage and
recognises devices on the basis of automatically transmitted information. The persistent
identifiers set by the provider have a lifetime of up to twelve months.
The legal basis for storing information on your device and accessing it, as well as for the
selection and personalisation of content and advertising, audience and effectiveness
measurement and target group analysis, is your consent (Article 6(1)(a) UK GDPR,
regulation 6 PECR). For ensuring security and detecting fraud, the technical delivery of
content and the storage and transmission of your privacy choices, the provider states that it
relies on its legitimate interests (Article 6(1)(f) UK GDPR). According to the provider, the data
is stored for a maximum of 396 days from your last interaction with the service and is then
anonymised or aggregated.
As Taboola Europe Limited is based in the United Kingdom, this is not a transfer to a third
country under UK data protection law. According to the provider, data is also stored in Israel,
for which UK adequacy regulations also exist, and in the United States. For processing in the
United States, Taboola, Inc. participates in the UK Extension to the EU-US Data Privacy
Framework; transfers to it are approved by UK adequacy regulations (Article 45A UK
GDPR). In addition, the information in the section "General Principles for Transfers to Third
Countries" applies.
Independently of your consent, you can object to interest-based delivery via the provider's
portal at accessrequest.taboola.com.
7.8 Marketing of Advertising Space
On some services, we market advertising space to third parties. The ads are delivered via
Google Ad Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4,
Ireland.
When you visit a page with advertising space, data is transmitted to Google and to other
marketers and advertising networks, which decide on the delivery of advertising in an
automated process. In particular, your IP address, the page visited, information about your
device and browser, the format and position of the advertising space and the privacy choices
you have made in the consent banner are transmitted. In addition, we transmit a
pseudonymous user identifier assigned by us, which enables recognition across several
page views.
You can view and change which companies are involved and which of them you consent to
at any time in the privacy settings.
The legal basis is your consent (Article 6(1)(a) UK GDPR, regulation 6 PECR). Some of the
companies involved have their registered office or a parent company outside the United
Kingdom and the EEA. A transfer to a third country therefore cannot be ruled out. The
information in the section "General Principles for Transfers to Third Countries" applies to
this.
7.9 Microsoft Advertising UETWe use Universal Event Tracking (UET) from Microsoft Advertising, a service of Microsoft
Ireland Operations Limited, One Microsoft Place, South County Business Park,
Leopardstown, Dublin 18, Ireland. The service is used to measure the effectiveness of our
advertising, to create target groups and to optimise the delivery of interest-based advertising.
In particular, information about your usage behaviour, pages visited, interactions, conversion
events, device and browser data, time stamps and pseudonymous identifiers may be
processed. A transfer to Microsoft Corporation (USA) cannot be ruled out. The information in
the section "General Principles for Transfers to Third Countries" applies to this.
7.10 TikTok and Pinterest
We use tracking and marketing functions of TikTok (TikTok Technology Limited, 10 Earlsfort
Terrace, Dublin, D02 T380, Ireland) and Pinterest (Pinterest Europe Ltd., Waterloo
Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland). These services are used to measure
the effectiveness of our advertising, to create target groups and to optimise the delivery of
interest-based advertising. In particular, information about your usage behaviour, content
accessed, interactions, conversion events, technical device information, browser data, time
stamps and pseudonymous identifiers may be processed. For TikTok and Pinterest, we also
use their server-side interfaces. The information in section 7.2 applies to this.
According to its own information, TikTok stores data of users from the European Economic
Area in data centres in Norway, Ireland and the United States. In addition, TikTok group
companies in the People's Republic of China have remote access to part of this data. There
are no UK adequacy regulations for the People's Republic of China. Where TikTok acts as
our processor, TikTok's terms for business customers provide for the UK Addendum to the
EU standard contractual clauses for transfers to TikTok group companies (Article 46(2)(d)
UK GDPR). For remote access from the People's Republic of China, further details and the
option to request information on the safeguards used can be found in the section "General
Principles for Transfers to Third Countries"
.
For Pinterest, a transfer to the United States cannot be ruled out. The information in the
section "General Principles for Transfers to Third Countries" applies to this.
7.11 X (formerly Twitter)
We use the Universal Website Tag of X (Twitter International Unlimited Company, One
Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland). The service is used to
measure the effectiveness of our advertising, to create target groups and to optimise the
delivery of interest-based advertising. In particular, information about your usage behaviour,
pages visited, interactions, conversion events, device and browser data, time stamps and
pseudonymous identifiers may be processed. A transfer to X Corp. (USA) cannot be ruled
out. The information in the section "General Principles for Transfers to Third Countries"
applies to this.
7.12 Affiliate and Marketing Services
We work with affiliate networks and with providers of advertising and conversion
measurement. Affiliate networks make it possible to track orders placed via a link on our
services and to settle the corresponding commission. Providers of advertising and
conversion measurement such as AdRoll also make it possible to show our advertising again
to visitors to our services on other websites (retargeting) and to measure the success of this
advertising. In particular, referrer information, pages visited, click and conversion data,technical device and browser information, time stamps and pseudonymous identifiers are
processed. A transfer to third countries cannot be ruled out for some of these providers; the
information in the section "General Principles for Transfers to Third Countries" applies to
this. The providers used on the respective service are listed by name in the settings of our
consent tool.
We currently work with the following providers: AWIN AG, Otto-Ostrowski-StraĂźe 1A, 10249
Berlin; Firstlead GmbH (ADCELL), Rosenfelder StraĂźe 15-16, 10315 Berlin, NextRoll Limited
(AdRoll), Floor 3, Block 3, Miesian Plaza, Dublin 2, D02 Y754, Ireland. As part of the
integration of AWIN, a script of the service Lantern (SingleView Tech Ltd, formerly R.O.EYE
Limited, 4th Floor, 2 Thomas More Square, London E1W 1YN, United Kingdom) is also
loaded. It transmits an identifier of your device and sets the cookies lantern (storage period
30 days) and 121016
_
lantern (storage period 6 months). These serve to assign orders to the
advertising contacts through which they came about.
Not every one of these providers is used on every service. You can find out which providers
are used on the service you are visiting from the settings of the consent tool displayed there.
7.13 GetResponse
Where GetResponse is used for marketing, analytics or conversion purposes, we use
services of GetResponse S.A. to measure the effectiveness of our marketing, to analyse
user interactions, to create target groups and to optimise the delivery of marketing. Where
GetResponse is used exclusively to send newsletters, data processing takes place
exclusively in accordance with the section on sending newsletters.
For marketing and analytics purposes, we use GetResponse web tracking (Web Connect)
on some services. It displays pop-ups for signing up to our newsletter and records which
pages you visit. For this purpose, GetResponse stores identifiers in cookies, in local storage
and in the session storage of your browser (for example gaVisitorUuid). In some cases, we
load the script via an address under our own domain (mails.falkemedia.de). From there, the
actual script is loaded from GetResponse servers. If you have subscribed to our newsletter,
this information may be assigned to your email address. We only use the web tracking if you
have consented (Article 6(1)(a) UK GDPR in conjunction with regulation 6 PECR).
7.14 Services in Our Apps
In our apps, we use third-party services that serve to analyse app usage and measure
stability, to measure app installations and the success of advertising campaigns, to manage
in-app subscriptions and purchases and to send push notifications. These currently include
in particular Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4,
Ireland), Adjust (Adjust GmbH, SaarbrĂĽcker Str. 37a, 10405 Berlin) and RevenueCat
(RevenueCat, Inc., USA). In addition, the server-side tagging described above is used.
In particular, device and usage data, device identifiers (for example device ID), advertising
identifiers (IDFA on iOS, AAID on Android), event and interaction data and technical
information about the device, operating system and app version are processed. Where the
processing is not technically essential, the legal basis is your consent under Article 6(1)(a)
UK GDPR in conjunction with regulation 6 PECR; otherwise, it is our legitimate interests in
the stable and secure operation of our apps under Article 6(1)(f) UK GDPR.
Adjust transmits some of the events recorded in our apps to the advertising platforms we use
so that the success of our advertising can be measured there. The recipients are Meta,TikTok and Google Ads as well as Apple (Apple Search Ads) and OpenAI (ChatGPT Ads). In
particular, information about events triggered, device and advertising identifiers and
information about the associated advertising campaign are transmitted. A special feature
applies to Apple Search Ads: here, Adjust uses an identifier that Apple generates on your
device (attribution token) to ask Apple whether the installation originated from an ad in the
App Store. Apple then provides information about the campaign, such as the campaign, ad
group and search term. We only receive the time of your contact with the ad if you have
agreed to App Tracking Transparency. This transmission takes place exclusively on the
basis of your consent. A transfer to the USA cannot be ruled out for these recipients. The
information in the section "General Principles for Transfers to Third Countries" applies to
this.
Section 5 applies to obtaining and withdrawing consent in the apps.
7.15 Target Groups Based on Customer Lists (Google Customer Match and Meta
Custom Audiences)
We use the "Customer Match" function of Google Ads and "Custom Audiences" from
customer lists of Meta. In this process, we transmit data from our customer base to Google
Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or to Meta Platforms Ireland
Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. This concerns
subscribers to our digital and print services, buyers in our shops, newsletter subscribers and
users of our apps with a customer account. The data comes from our shop, subscription and
customer systems, in particular from the systems of dsb ebusiness GmbH and ablefy GmbH
(section 10) and from Customer.io and GetResponse (section 8).
Your email address and, where applicable, your telephone number, your first and last name
and your postcode is transmitted. This information is converted into hash values using a
hashing method (SHA-256) before transmission and is not transmitted in plain text. The
exception is the postcode: it is not converted into a hash value for Google. Google or Meta
compare these hash values with the data of their user accounts. If there is a match, the
respective account is assigned to a target group.
We use these target groups to show you advertising for further services on the platforms of
Google and Meta or to address you again if you have not used a service for some time. We
also use them to exclude you from advertising for services you already use. In addition,
Google and Meta can use this as a basis to identify further people who are similar to the
people on our lists and show them our advertising. At Google, the lists are also used for the
automated targeting and bid optimisation of our campaigns. At Meta, this is called Lookalike
Audiences.
The transmission only takes place if you have consented to it (Article 6(1)(a) UK GDPR). You
can withdraw your consent at any time with effect for the future, for example by email to
datenschutz@falkemedia.de. After you withdraw your consent, we will remove you from the
customer lists at the next update.
A transfer to Google LLC or Meta Platforms, Inc. in the USA cannot be ruled out. The
information in the section "General Principles for Transfers to Third Countries" applies to
this.
7.16 OpenAI Ads (Measuring the Success of Advertising in ChatGPT)On some services, we use the measurement pixel (OpenAI Pixel) and the Conversions API
of OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper,
Dublin 1, D01 YC43, Ireland. We use it to measure whether our ads in ChatGPT lead to you
buying something on our service, taking out a subscription or registering.
If you click on one of our ads in ChatGPT, OpenAI appends an identifier to the address of the
page called up. The pixel stores this identifier in a cookie (__
oppref, storage period 30 days)
and sets another cookie with a randomly generated identifier of your browser (__
obref,
storage period 365 days). If you then buy something or take out a subscription, the pixel
transmits this event to OpenAI. In particular, the type of event, amount, currency and
product, the page called up, the time and the identifiers mentioned are processed. In
addition, data you have provided, such as your email address, telephone number and first
and last name, may be transmitted. This data is converted into hash values in your browser
using a hashing method (SHA-256) before transmission and is not transmitted in plain text.
Country, region, city and postcode are transmitted without hashing.
We may also transmit these events directly from our server to OpenAI via the server-side
tagging described in section 7.2 (Conversions API). In this process, your IP address and
information about your browser may also be transmitted.
OpenAI assigns the events to the clicks on our ads and provides us with analyses of the
success of our campaigns. The behaviour of individual persons cannot be identified in these
analyses. OpenAI processes the transmitted data under its own responsibility, including to
improve and deliver its advertising services. According to its own information, OpenAI does
not currently use this data to personalise advertising for individual persons. Further
information can be found in OpenAI's privacy policy at
https://openai.com/policies/eu-privacy-policy/.
We only use the service if you have consented (Article 6(1)(a) UK GDPR in conjunction with
regulation 6 PECR). A transfer to OpenAI group companies in the USA cannot be ruled out.
The information in the section "General Principles for Transfers to Third Countries" applies to
this.
7.17 Audience Measurement (INFOnline)
On some services, for example zaubertopf.de, we measure audience reach using the
INFOnline Measurement procedure of INFOnline GmbH, Rathausgasse 1, 12529
Schönefeld. This counts how often our pages are accessed. The measurement data is first
transmitted to an address under our own domain and forwarded from there to INFOnline.
Without your consent, only an anonymous count of page views takes place (census
measurement). Your IP address is removed before the data is forwarded to INFOnline. Only
if you have consented can a pseudonymous measurement also take place using an identifier
by which your device can be recognised. The legal basis for the census measurement is our
legitimate interest in measuring the reach of our services (Article 6(1)(f) UK GDPR), and for
the pseudonymous measurement it is your consent (Article 6(1)(a) UK GDPR in conjunction
with regulation 6 PECR).
8. Newsletters and Push Notifications
To send personalised newsletters, push notifications and messages within our apps (in-app
messages), we use the services GetResponse (GetResponse S.A. Gdansk, Poland) andCustomer.io, a service of Peaberry Software, Inc., 9450 Southwest Gemini Drive, Suite
43920, Beaverton, OR 97008, USA.
The newsletters of the individual brands and titles of the falkemedia Group are managed via
a shared sending account. The controller for the processing of your registration data is the
company that operates the service through which you signed up. The overview in section 1
is decisive. Where sending is technically carried out by falkemedia GmbH & Co. KG for
another company of the Group, this is done on the basis of a separate agreement between
the companies involved.
If you sign up for our email notifications or agree via your device to receive push
notifications, the data required for this (such as your email address, IP address, device
ID/token and information on your user behaviour) is transmitted to servers of GetResponse
and Customer.io and processed there. These enable us to address our users in a targeted
manner and to evaluate the success of our campaigns statistically (e.g. open and click
rates).
In addition, information on your subscription status from RevenueCat (see section 7.14) is
fed into Customer.io. On this basis, we group recipients together (segmentation). We trigger
messages manually, based on events or on the basis of such groups.
Data processing and the sending of promotional and informational messages take place on
the basis of your express consent pursuant to Article 6(1)(a) UK GDPR. This must be
distinguished from messages we send you to handle an existing contractual relationship with
you, such as order and shipping confirmations or information about your subscription. We
send these on the basis of Article 6(1)(b) UK GDPR. They are necessary to perform the
contract and therefore cannot be unsubscribed from. You can withdraw this consent at any
time with effect for the future. For emails, you can use the unsubscribe link in the respective
message. You can deactivate the receipt of push notifications at any time in the system
settings of your browser or mobile device.
Independently of any consent, we use your email address to inform you about our own
similar goods or services if we obtained it from you in connection with the sale of goods or a
service. The legal basis is our legitimate interests in direct marketing (Article 6(1)(f) UK
GDPR in conjunction with regulation 22(3) PECR). You can object to this use at any time
free of charge, except for the costs of transmitting your objection. We remind you of your
right to object each time we use your email address for this purpose.
When you sign up for email notifications, you first receive an email with a confirmation link.
We only add you once you have clicked on it. This means that nobody can sign you up with
someone else's address (so-called double opt-in procedure). As proof of your consent, we
store when you signed up and when you confirmed, as well as the IP address used (Article
5(2), Article 7(1) UK GDPR).
Customer.io processes your data for us on servers in the European Union. As the provider is
based in the United States, access from the USA nevertheless cannot be ruled out. The
information in the section "General Principles for Transfers to Third Countries" applies to
this.
GetResponse is based in the EU (Poland). Under UK data protection law, transfers to the
EEA are approved by UK adequacy regulations (see section 19). Peaberry Software, Inc.(Customer.io) participates in the UK Extension to the EU-US Data Privacy Framework.
Transfers to it are approved by UK adequacy regulations (Article 45A UK GDPR).
We store your data for sending newsletters and push notifications until you withdraw your
consent. We then add your address to a suppression list to prevent further mailings. We
delete the other data, including the proof of your consent, three years after you unsubscribe.
9. Plugins and External Services
These services are integrated on the basis of your consent (Article 6(1)(a) UK GDPR,
regulation 6 PECR):
•Google Fonts: On some services, we integrate fonts from Google (Google Ireland
Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When these pages are
accessed, a connection to Google's servers is established and your IP address is
transmitted to Google. According to Google, the Google Fonts Web API does not set or
log cookies. On other services, we deliver the fonts from our own servers. In this case,
there is no connection to Google.
•Adobe Fonts: On some services, we load fonts from Adobe Systems Software Ireland
Ltd. for a consistent visual presentation. When these pages are accessed, a connection
to the provider's servers is established and your IP address is transmitted. A transfer to
Adobe Inc. (USA) cannot be ruled out. The information in the section "General Principles
for Transfers to Third Countries" applies to this.
•Font Awesome: On some services, we integrate icons and characters from Font
Awesome (Fonticons, Inc., USA). When these pages are accessed, a connection to the
provider's servers is established and your IP address is transmitted; the information in
the section "General Principles for Transfers to Third Countries" applies to this transfer.
On the other services, we deliver the files from our own servers, so that there is no
connection to the provider and your IP address is not transmitted.
•Bunny Fonts: The GetResponse pop-ups (section 7.13) load fonts from Bunny Fonts of
BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. In this process, a
connection to the provider's servers is established and your IP address is transmitted.
According to the provider, Bunny Fonts does not log user data and does not set cookies.
•cdnjs: On some services, we load program libraries via the cdnjs service, which is
provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. In
this process, a connection to Cloudflare's servers is established and your IP address is
transmitted. The information in the section "General Principles for Transfers to Third
Countries" applies to this.
•jsDelivr: On some services, we load program libraries via the jsDelivr service of Volentio
JSD Limited, Suite 2a1, Northside House, Mount Pleasant, Barnet EN4 9EB, United
Kingdom. In this process, a connection to the provider's servers is established and your
IP address is transmitted. As the provider is based in the United Kingdom, this is not a
transfer to a third country under UK data protection law (section 19).
•Google Maps: To display interactive maps and to make it easier to find us, we integrate
Google Maps (Google Ireland Limited). When a map is accessed, a connection to
Google's servers is established and your IP address is transmitted. A transfer to GoogleLLC (USA) cannot be ruled out. The information in the section "General Principles for
Transfers to Third Countries" applies to this.
•YouTube: We embed videos from YouTube (Google Ireland Limited, Gordon House,
Barrow Street, Dublin 4, Ireland). When a video is started, data is transmitted to Google.
The videos are only embedded after you have consented. A transfer to Google LLC
(USA) cannot be ruled out; the information in the section "General Principles for
Transfers to Third Countries" applies to this.
10. Payment Service Providers
On our services with a shop or ordering function, we pass on payment-related data to the
payment service provider you have chosen in order to process the contract (Article 6(1)(b)
UK GDPR) and on the basis of our legitimate interests in secure payment transactions
(Article 6(1)(f) UK GDPR). We currently use the following payment service providers for this
purpose: PayPal (Europe) S.Ă r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449
Luxembourg, PAYONE GmbH, Lyoner StraĂźe 15, 60528 Frankfurt am Main, and Stripe
Payments Europe, Limited and Stripe Technology Europe, Limited, One Wilton Park, Wilton
Place, Dublin 2, D02 FX04, Ireland. Which payment methods are available and which
provider processes the payment will be shown to you in the ordering process before you
complete your order. The payment service providers process your data partly under their
own responsibility. In this respect, their own privacy information applies. Where a payment
service provider processes personal data outside the United Kingdom and the European
Economic Area, the information in the section "General Principles for Transfers to Third
Countries" applies.
Subscriptions: We handle the ordering, payment and management of our subscriptions via
dsb ebusiness GmbH, Carl-Zeiss-StraĂźe 2, 74172 Neckarsulm, and, for some services, via
ablefy GmbH, Potsdamer StraĂźe 125, 10783 Berlin. The checkout pages for subscriptions
on our websites are provided by this service provider. The service provider processes your
order, contract and payment data on our behalf. Our systems check whether you have
access to paid content using our own data or by querying the respective service provider.
The legal basis is the performance of the subscription contract (Article 6(1)(b) UK GDPR).
In-app purchases and app subscriptions: Paid subscriptions and purchases within our
apps are processed via the billing systems of the respective app stores (Apple App Store or
Google Play). In this respect, Apple or Google process the payment data under their own
responsibility. We receive information about the purchase, such as the product, the time and
the status of your subscription, but no information about your means of payment. On our
side, subscriptions are managed via RevenueCat (see section 7.14).
11. Use of AI Services
We use artificial intelligence (AI) tools to optimise our internal processes, our editorial
content creation and our customer service. We only use paid business and developer
accounts of the providers. For the accounts we use, the providers have contractually
undertaken not to use the content transmitted to train their models.
11.1 Image Generation and Visual Content
In certain areas (e.g.
"Eigene Rezepte" (own recipes)), we use external AI services to create
images and for visual illustration. The core editorial content continues to come from our owntest kitchens. No personal data of our website visitors is transmitted to the AI services for
pure image generation.
11.2 Customer Service and Internal Processes
When you contact our customer service, we process your details, in particular the content of
your enquiry and your contact details, with the support of AI-based tools. The legal basis is
Article 6(1)(b) UK GDPR where the handling serves the performance of a contract or the
answering of a pre-contractual enquiry, and otherwise Article 6(1)(f) UK GDPR on the basis
of our legitimate interests in handling enquiries quickly and efficiently.
In addition, our employees use AI-based tools as work tools in internal processes. Personal
data of our users is only processed insofar as it forms part of the matter being handled. The
same legal bases as above apply.
The providers store the inputs transmitted and the outputs generated in order to process the
request and to detect misuse, and then delete them. The storage period is a maximum of 55
days. If, in an individual case, there is a suspicion of a breach of the respective provider's
terms of use, storage may continue until the investigation of the incident has been
completed.
To exercise your right to object under Article 21(1) UK GDPR, please refer to the section
"Right to object" under your data subject rights.
11.3 Providers Used and Transfers to Third Countries
For this purpose, we use services of specialised providers of language and image models.
Currently, these are Anthropic, PBC, San Francisco, United States, OpenAI Ireland Ltd, 1st
Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland,
Mistral AI SAS, 15 rue des Halles, 75001 Paris, France, and Google Cloud EMEA Limited,
70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland. The current composition may
change. We will tell you which providers are used at any given time on request to
Insofar as personal data is transferred to the United States in this context, the information in
the section "General Principles for Transfers to Third Countries (USA and Other Third
Countries)" applies.
11.4 AI Functions in the Air Fryer Club App (Recipes from Photos, Speech and Links)
In the Air Fryer Club app, you can use artificial intelligence to create or import recipes. You
can type or dictate ingredients, read out a recipe, photograph a recipe from a cookbook, a
magazine or your notes, photograph a dish or share a link to a post on TikTok, Instagram or
another website with the app. An AI model then creates a structured recipe or suggests a
suitable recipe to you.
Our server forwards your input, i.e. the text, the photo, the voice recording or the link, to an
AI model via an intermediary service (AI gateway) of Requesty Ltd, 71-75 Shelton Street,
London WC2H 9JQ, United Kingdom. Your IP address and information about your customer
account are not transmitted in this process. We currently use models of Mistral AI SAS, 15
rue des Halles, 75001 Paris, France, and Gemini models from Google via Vertex AI (of
Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). We store your
inputs and the results in your customer account.If you share a link, our server retrieves the linked page and passes its content, such as the
description, subtitles or video, to the AI model. The provider of the linked page, for example
TikTok or Instagram, receives the address of our server in this process, not yours.
For photos and voice input, the app asks for access to your camera, your photos or your
microphone. You can withdraw this access at any time in your device settings.
Please make sure that your photos only show the dish or the recipe, in particular no other
people if you take photos in a restaurant or at friends' homes, and no personal details such
as names or addresses on notes, and no information about your health, such as medicines
or medical documents. We do not need such content for the function.
Requesty processes your inputs on our behalf and uses the model providers mentioned for
this purpose. Your inputs are not used to train the AI models. Where logging is activated,
Requesty stores inputs and outputs in encrypted form in the European Union for a maximum
of 30 days. Mistral AI stores inputs and outputs for 30 days to detect misuse, unless it has
been agreed that no data is stored (zero data retention). Google may cache inputs and
outputs for up to 24 hours. The legal basis is Article 6(1)(b) UK GDPR, as the function is part
of the service you use. As Requesty Ltd is based in the United Kingdom, the transmission to
Requesty is not a transfer to a third country under UK data protection law. For the transfer to
Google LLC in the United States, the information in the section "General Principles for
Transfers to Third Countries" applies.
12. Photos and User-Generated Content
We publish our own photos as well as user photos and other user-generated content in
community areas, for example as reviews, comments, forum posts or competition entries.
User photos are only published with your express consent or to perform the participation
relationship in accordance with our conditions of participation (Article 6(1)(b) UK GDPR).
AI-generated images are sometimes used for visual illustration (e.g. for recipes). No
biometric data is processed in this context.
The following sections 13 to 16 supplement this Privacy Policy with processing operations
that arise depending on the service used (contact, orders, customer accounts, competitions,
print and subscriptions). They only apply if you use the relevant function.
13. Contact and Contact Forms
On many of our services, you can reach us via a contact form or by email. We process the
data you provide in this context (e.g. name, email address, subject and content of the
message) exclusively to handle your enquiry. The legal basis is Article 6(1)(b) UK GDPR
where your enquiry is aimed at concluding or performing a contract, and otherwise our
legitimate interests in answering your enquiry (Article 6(1)(f) UK GDPR). The data is deleted
as soon as it is no longer required for handling the enquiry and no statutory retention
obligations prevent this. We usually delete enquiries from prospective customers that do not
result in a contract after six months.
To handle enquiries to our customer service, we use the ticket system Freshdesk of
Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA. Your
enquiry is stored there as a case (ticket), together with your contact details and ourcorrespondence with you. Freshworks processes the data on our behalf. The data is stored
in a data centre in the European Union. A transfer to the USA cannot be ruled out. The
information in the section "General Principles for Transfers to Third Countries" applies to
this.
14. Orders, Customer Accounts and Shop Functions
On our services with a shop or subscription function (in particular falkemedia-shop.de,
falkemedia-abo.de, zaubertopf.de, plugins-samples.com), we process the data required to
process the contract (e.g. name, address, email address, order and payment data).
Providing a telephone number is voluntary. You can complete your order without restriction
without it. If you create a customer account, we store the data held there until the account is
deleted. The legal basis is Article 6(1)(b) UK GDPR (performance of a contract) and, for
statutory retention obligations, Article 6(1)(c) UK GDPR. Providing the data required to
process the contract is necessary to conclude and perform the contract with you. Without
this information, we cannot process your order or your customer account (Article 13(2)(e) UK
GDPR).
For our shops, we use the shop software of shopware AG, Ebbinghoff 10, 48624
Schöppingen. The shops are hosted by Internex GmbH, Lagerstraße 15, 3950 Gmünd,
Austria. Both process your order data on our behalf.
Offers from partners after your order: In our shop falkemedia-shop.de, we show you
vouchers and special offers from other companies after you have completed your order. The
offers come from the networks of Sovendus GmbH, Bahnhofplatz 12, 76137 Karlsruhe, and
salenti GmbH, Armenhausgasse 14, 86150 Augsburg. So that suitable offers can be
selected, we transmit, in pseudonymised and encrypted form, a hash value of your email
address, your IP address, your form of address, your country and your postcode and, for
billing purposes, the order number, the order value with currency, a session identifier, any
voucher code used and the time of the order. Only when you click on an offer are your form
of address, your name, your address, your telephone number and your email address
transmitted so that your request to the provider of the offer can be prepared. The legal basis
is our legitimate interests in marketing partner offers (Article 6(1)(f) UK GDPR). Sovendus,
salenti and the respective provider of the offer are themselves responsible for any further
processing.
Intra-group responsibility: Within the falkemedia Group, falkemedia GmbH & Co. KG
performs central commercial and technical tasks for the other companies, in particular
accounting, back office and IT operations. Insofar as your order, subscription and invoice
data is processed in this context, the company named in the legal notice (Impressum) of the
respective service and falkemedia GmbH & Co. KG are joint controllers within the meaning
of Article 26 UK GDPR. The companies have set out in an arrangement who fulfils which
obligations under the UK GDPR. The company named in the legal notice provides the
information under Article 13 UK GDPR and handles your data subject rights. However, you
can exercise your rights against any of the companies involved. We will provide you with the
essence of the arrangement on request at datenschutz@falkemedia.de (Article 26(2) UK
GDPR).
15. CompetitionsWhere we offer competitions (in particular on zaubertopf.de), we process the data required
for participation and for handling prizes (e.g. name, contact details and any entries
submitted). The legal basis is Article 6(1)(b) UK GDPR (performance of the participation
relationship) or your consent under Article 6(1)(a) UK GDPR. The respective conditions of
participation also apply. To draw winners from comments, we sometimes use the tool Facelift
of Facelift bbt GmbH (Hamburg). In this process, the profile name and the respective
comment of the participating profiles are processed. In this respect, Facelift is a recipient of
your data within the meaning of Article 13(1)(e) UK GDPR. Facelift is based in Germany;
under UK data protection law, transfers to the EEA are approved by UK adequacy
regulations (see section 19). The information in the section "Minors" also applies to
participation in competitions. Where we offer goods or digital content in return for signing up
to a newsletter, we will inform you of this in advance and provide you with an alternative way
of obtaining them without signing up to the newsletter. Your consent is therefore voluntary
within the meaning of Article 7(4) UK GDPR.
We store participation data for the duration of the respective competition or campaign. We
keep winners' data for the duration of the statutory retention periods to document the
handling of prizes. We delete participation data no later than three years after the
competition has taken place, unless you have consented to receive newsletters or products.
For the internal handling of competitions, in particular the management of entries and the
handling of prizes, we also use the task and project management tool Asana of Asana, Inc.
(San Francisco, USA). In this respect, Asana is a recipient of your data within the meaning of
Article 13(1)(e) UK GDPR and acts as our processor. A transfer to the USA cannot be ruled
out in this context. The information in the section "General Principles for Transfers to Third
Countries" applies to this.
16. Print, Subscriptions and Distribution
To dispatch print products and handle subscriptions, we pass on the necessary data (e.g.
name and delivery address) to our service providers. The recipients are our distribution and
production partner as well as service providers for subscription management and the
customer hotline. This disclosure is necessary to fulfil your subscription or order and to
deliver the products to you. The legal basis is Article 6(1)(b) UK GDPR.
The information on intra-group responsibility in the section "Orders, Customer Accounts and
Shop Functions" applies accordingly to the handling of subscriptions.
17. Postal Advertising
We use your address data to send you offers for our own products by post. In this process,
your name, postal address, customer number and information about the products you have
purchased are processed.
The legal basis is Article 6(1)(f) UK GDPR. Our legitimate interest lies in informing existing
and former customers about our own offers. Prior consent is not required for advertising by
post.To prepare the address data, print and dispatch, we use service providers who act as our
processors. In this respect, the recipient is a direct marketing service provider (Article
13(1)(e) UK GDPR).
The controller is the company with which your subscription or order was concluded. The
overview in the section "Controllers" is decisive.
We use your address data for advertising purposes for as long as the business relationship
with you exists and for a period of 3 years thereafter.
With regard to your right to object to direct marketing, the section "Data Subject
Rights" applies. After an objection, we add the details required for this purpose to a
suppression list so that we can respect your objection permanently.
18. Minors
Our services are not aimed at children. AirFryer Club may only be used by persons aged 13
or over (see the AirFryer Club terms).
Where we base processing on your consent, the consent of a child under the age of 13 is
only valid if it is given or authorised by the holder of parental responsibility (Article 8(1) UK
GDPR). This applies in particular to participating in competitions, signing up to newsletters,
creating a customer account and uploading your own photos and posts.
If we become aware that we are processing personal data of a child without the required
consent of the holder of parental responsibility, we will delete this data without undue delay.
If you are a holder of parental responsibility and have reason to believe that we hold data
about your child, please contact datenschutz@falkemedia.de.
19. General Principles for Transfers to Third Countries (USA and Other
Third Countries)
The companies of the falkemedia Group are based in Germany. If you use our services from
the United Kingdom, you provide your personal data directly to us in Germany. UK adequacy
regulations exist for the EEA, which includes Germany. Where we pass your data on to
recipients outside the United Kingdom and the EEA, the following principles apply.
These principles apply to all services mentioned in this Privacy Policy where a transfer to a
third country may take place. Some of the service providers we use are based in, or process
data in, the USA or other third countries. For the United States, UK adequacy regulations
exist for the UK Extension to the EU-US Data Privacy Framework (The Data Protection
(Adequacy) (United States of America) Regulations 2023, which have effect as regulations
under Article 45A UK GDPR). However, these regulations only cover a transfer if the specific
recipient is shown on the Data Privacy Framework List as participating in the UK Extension
and the data concerned is covered by its certification. They do not apply to any other
transfers to the United States. Where a provider does not participate in the UK Extension or
processes data in another third country for which there are no UK adequacy regulations, we
base the transfer on the International Data Transfer Agreement (IDTA) or the International
Data Transfer Addendum to the European Commission's standard contractual clauses (UK
Addendum). These are standard data protection clauses issued under section 119A DPA
2018 (Article 46(2)(d) UK GDPR). They form part of the contract concluded with therespective recipient. You can see which transfer mechanism applies to which recipient in the
overview below. The certification must be renewed annually and can be terminated by the
companies. You can check the current status at any time in the official list of certified
companies at dataprivacyframework.gov. We review the status of the recipients listed below
at least once a year and update this Privacy Policy accordingly. On request to
datenschutz@falkemedia.de, we will provide you with a copy of the IDTA or UK Addendum
agreed for a specific recipient, unless confidentiality interests prevent this; in that case, you
will receive a version from which the information concerned has been removed (Article
13(1)(f), Article 46 UK GDPR).
For the individual recipients where a transfer to a third country may take place, the following
also applies:
•Google: Google LLC participates in the UK Extension to the EU-US Data Privacy
Framework. Transfers to it are approved by UK adequacy regulations (Article 45A UK
GDPR). This concerns the services mentioned in sections 6, 7.1, 7.2, 7.3, 7.6, 7.8, 7.14,
7.15, 9, 11 and 11.4. This also applies to Google Cloud EMEA Limited (sections 7.2 and
11) insofar as it uses Google LLC as a sub-processor.
•Meta: Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework, but does
not participate in the UK Extension. For single sign-on (section 6), the UK Addendum is
incorporated into Meta's Platform Terms. For the other Meta services (sections 6, 7.2,
7.5, 7.14 and 7.15): the general principles set out above apply; you can request further
information on the safeguards used from us at datenschutz@falkemedia.de.
•Microsoft: Microsoft Corporation participates in the UK Extension to the EU-US Data
Privacy Framework. Transfers to it are approved by UK adequacy regulations (Article
45A UK GDPR). (section 7.9).
•Pinterest: Pinterest, Inc. participates in the UK Extension to the EU-US Data Privacy
Framework. Transfers to it are approved by UK adequacy regulations (Article 45A UK
GDPR). (sections 7.2 and 7.10).
•Adobe: Adobe Inc. participates in the UK Extension to the EU-US Data Privacy
Framework. Transfers to it are approved by UK adequacy regulations (Article 45A UK
GDPR). (section 9).
•Font Awesome: Fonticons, Inc. (listed as "Font Awesome") participates in the UK
Extension to the EU-US Data Privacy Framework. Transfers to it are approved by UK
adequacy regulations (Article 45A UK GDPR). (section 9).
•Adjust: AppLovin Corporation, the parent company of Adjust GmbH, participates in the UK
Extension to the EU-US Data Privacy Framework. Transfers to it are approved by UK
adequacy regulations (Article 45A UK GDPR). (section 7.14).
•Customer.io: Peaberry Software, Inc. participates in the UK Extension to the EU-US Data
Privacy Framework. Transfers to it are approved by UK adequacy regulations (Article
45A UK GDPR). (section 8).
•TikTok: There are no UK adequacy regulations for the People's Republic of China. Where
TikTok acts as our processor, TikTok's Jurisdiction Specific Terms provide for the UK
Addendum for transfers to TikTok group companies. For remote access from the
People's Republic of China: the general principles set out above apply; you can request
further information on the safeguards used from us at datenschutz@falkemedia.de
(sections 7.2, 7.10 and 7.14).•PayPal: The contractual partner is PayPal (Europe) S.à r.l. et Cie, S.C.A., based in
Luxembourg. PayPal processes the payment data as an independent controller and may
also transfer it to group companies in the United States in this context. PayPal is not
certified under the EU-US Data Privacy Framework. According to its privacy statement,
PayPal bases transfers of personal data of UK residents outside the United Kingdom on
the International Data Transfer Agreement (IDTA) or the UK Addendum issued by the
UK Information Commissioner, as applicable. (section 10).
•Stripe: The contractual partners are Stripe Payments Europe, Limited and Stripe
Technology Europe, Limited, based in Ireland. A transfer to Stripe, LLC in the United
States cannot be ruled out. Stripe, LLC participates in the UK Extension to the EU-US
Data Privacy Framework. Transfers to it are approved by UK adequacy regulations
(Article 45A UK GDPR). (section 10).
•RevenueCat: Not certified under the EU-US Data Privacy Framework. For transfers to
RevenueCat, Inc., the UK Addendum to the EU standard contractual clauses is
incorporated into RevenueCat's Data Processing Addendum (Article 46(2)(d) UK
GDPR). (sections 7.14 and 10).
•Apple: Purchases in the App Store are billed by Apple under its own responsibility. Your
payment data is not transmitted by us to Apple, but provided by you directly to Apple.
Apple's privacy information applies to this processing (section 10). When you sign in
with Apple (section 6) and when the success of campaigns is measured via Apple
Search Ads (section 7.14), a transfer to Apple Inc. in the United States cannot be ruled
out. Apple Inc. is not certified under the EU-US Data Privacy Framework. According to
Apple's privacy policy, Apple's international transfers of personal data collected in the
United Kingdom are governed by standard contractual clauses.
•Sourcepoint: Not certified under the EU-US Data Privacy Framework. Insofar as data is
transferred to Sourcepoint Technologies, Inc. in the United States: the general principles
set out above apply; you can request further information on the safeguards used from us
at datenschutz@falkemedia.de (section 5).
•Anthropic: The contractual partner is Anthropic, PBC, based in the United States.
Anthropic is not certified under the EU-US Data Privacy Framework. Anthropic's Data
Processing Addendum incorporates the UK Addendum to the EU standard contractual
clauses for processing that is subject to the UK GDPR; it is deemed to have been
executed by the parties (Article 46(2)(d) UK GDPR). (section 11).
•OpenAI: The contractual partner is OpenAI Ireland Ltd, based in Ireland. A transfer to
group companies in the United States cannot be ruled out. These are not certified under
the EU-US Data Privacy Framework. According to OpenAI's Data Processing
Addendum, UK data is processed by OpenAI OpCo, LLC under the EU standard
contractual clauses as amended by the UK Addendum, which are deemed to have been
entered into (Article 46(2)(d) UK GDPR). (section 11). OpenAI Ireland Ltd is
independently responsible for the measurement of advertising success under section
7.16. It has contractually undertaken to use a permissible transfer mechanism for
onward transfers to countries without an adequate level of data protection. For UK data,
OpenAI OpCo, LLC carries out this processing as an independent controller; OpenAI's
advertising data processing terms incorporate the UK Addendum.
•X: The contractual partner is Twitter International Unlimited Company, based in Ireland. A
transfer to X Corp. in the United States cannot be ruled out. X Corp. participates in theUK Extension to the EU-US Data Privacy Framework. Transfers to it are approved by
UK adequacy regulations (Article 45A UK GDPR). (section 7.11).
•AdRoll: AdRoll is a brand of NextRoll, Inc., based in San Francisco, United States. The
contractual partner in the European Union is NextRoll Limited, Floor 3, Block 3, Miesian
Plaza, Dublin 2, D02 Y754, Ireland. A transfer to NextRoll, Inc. in the United States
cannot be ruled out. NextRoll, Inc. is not certified under the EU-US Data Privacy
Framework. NextRoll's Data Protection Addendum incorporates the UK Addendum to
the EU standard contractual clauses where the UK GDPR applies; the parties are
deemed to have executed it (Article 46(2)(d) UK GDPR). (section 7.12).
•Taboola: The contractual partner is Taboola Europe Limited, based in the United Kingdom.
Under UK data protection law, transfers to it are therefore not transfers to a third country
(section 7.7).
•Freshworks: The contractual partner is Freshworks Inc., based in the United States
(section 13). Freshworks Inc. participates in the UK Extension to the EU-US Data
Privacy Framework. Transfers to it are approved by UK adequacy regulations (Article
45A UK GDPR).
•Requesty: The contractual partner is Requesty Ltd, based in the United Kingdom. Under
UK data protection law, transfers to it are therefore not transfers to a third country
(section 11.4).
•Lantern: The recipient is SingleView Tech Ltd (formerly R.O.EYE Limited), based in the
United Kingdom. Under UK data protection law, transfers to it are therefore not transfers
to a third country (section 7.12).
•Cloudflare: Cloudflare, Inc. participates in the UK Extension to the EU-US Data Privacy
Framework. Transfers to it are approved by UK adequacy regulations (Article 45A UK
GDPR). (section 9).
•jsDelivr: The contractual partner is Volentio JSD Limited, based in the United Kingdom.
Under UK data protection law, transfers to it are therefore not transfers to a third country
(section 9).
•Stape: Stape Europe OÜ is based in Estonia. Under UK data protection law, transfers to
the EEA are approved by UK adequacy regulations. For certain optional functions, it
uses sub-processors in the United States (Cloudflare, Inc., Google Cloud Platform and
Amazon Web Services). Cloudflare, Inc. participates in the UK Extension to the EU-US
Data Privacy Framework; transfers to it are approved by UK adequacy regulations
(Article 45A UK GDPR). For Google Cloud Platform and Amazon Web Services: the
general principles set out above apply; you can request further information on the
safeguards used from us at datenschutz@falkemedia.de (section 7.2).
The following recipients are based in, and process data within, the European Union or the
European Economic Area. Under UK data protection law, transfers to the EEA are approved
by UK adequacy regulations (Article 45A UK GDPR): Hetzner Online GmbH (section 4.1),
Borlabs GmbH and consentmanager AB (section 5), Upscore GmbH (section 7.4), AWIN AG
and Firstlead GmbH (sections 7.2 and 7.12), GetResponse S.A. (sections 7.13 and 8),
PAYONE GmbH, dsb ebusiness GmbH and ablefy GmbH (section 10), Mistral AI SAS
(section 11.4), BunnyWay d.o.o. (section 9), shopware AG and Internex GmbH (section 14),
Sovendus GmbH and salenti GmbH (section 14), INFOnline GmbH (section 7.17) and
Facelift bbt GmbH (section 15).20. Storage Period
We only store your personal data for as long as is necessary for the respective processing
purpose. If the purpose no longer applies or you withdraw your consent, the data is deleted
unless statutory retention periods prevent this. The most important statutory retention
obligations include:
•10 years for commercial books, inventories, annual financial statements and management
reports (section 257(4) of the German Commercial Code (HGB), section 147(3) of the
German Fiscal Code (AO)).
•8 years for accounting records and invoices (section 257(4) HGB, section 147(3) AO,
section 14b(1) of the German Value Added Tax Act (UStG)).
•6 years for commercial and business letters received and sent, including emails (section
257(4) HGB, section 147(3) AO).
As long as we still have to retain your data because of these statutory periods, its processing
for other purposes is restricted.
21. Security
We use technical and organisational security measures (such as SSL or TLS encryption) to
protect your data against manipulation, loss, destruction or access by unauthorised persons.
You can recognise an encrypted connection by the address bar of your browser changing
from "http://" to "https://" and by the padlock symbol in your browser bar.
22. Data Subject Rights
Within the framework of the applicable statutory provisions, you have the following rights at
any time:
•Access (Article 15 UK GDPR): to the data we hold about you.
•Rectification (Article 16 UK GDPR): of inaccurate data.
•Erasure (Article 17 UK GDPR) and restriction of processing (Article 18 UK GDPR).
•Data portability (Article 20 UK GDPR).
•Withdrawal of consent (Article 7(3) UK GDPR), without affecting the lawfulness of
processing carried out on the basis of the consent before its withdrawal.
Right to object (Article 21 UK GDPR): You have the right to object at any time, on grounds
relating to your particular situation, to the processing of personal data concerning you which
is based on Article 6(1)(e), (ea) or (f) UK GDPR. We will then no longer process the data
unless we can demonstrate compelling legitimate grounds for the processing which override
your interests, rights and freedoms, or the processing serves the establishment, exercise or
defence of legal claims.
Where your data is processed for direct marketing purposes, you have the right to object to
this processing at any time. After such an objection, your data will no longer be processed
for direct marketing purposes. The objection can be sent informally to
Right to lodge a complaint: You also have the right to lodge a complaint with the
competent supervisory authority. In the United Kingdom, this is the Information Commission(ICO), 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL,
Complaints to us: If you are dissatisfied with how we handle your personal data, you can
complain to us directly by email to datenschutz@falkemedia.de. We will acknowledge receipt
of your complaint within 30 days, take appropriate steps without undue delay and inform you
of the outcome.
No automated decision-making: We do not take any significant decisions about you that
are based solely on automated processing, including profiling, within the meaning of Articles
22A to 22D UK GDPR (decisions that produce a legal effect for you or have a similarly
significant effect for you).
23. Status of this Privacy Policy
Status of this Privacy Policy: October 2026. It may become necessary to amend this Privacy
Policy as our websites are developed further or as a result of changes in legal or regulatory
requirements.