Privacy Policy

1 Data Protection

Welcome to our website. The protection of your data is very important to us. We would therefore like to inform you below about which data from your visit we use and for what purposes. Should you have any further questions regarding the handling of your personal data, please feel free to contact our Data Protection Officer, whose contact details can be found at the end of this Privacy Policy.

2 Controller Responsible for Data Processing

The controller within the meaning of the General Data Protection Regulation (GDPR) responsible for the use of your data in connection with this website is:

HIW Hamburg Invest Wirtschaftsförderungsgesellschaft mbH Wexstraße 7 20355 Hamburg Germany

3 General Information for Data Processing

3.1 What is Personal Data?

The term “personal data” is defined in the General Data Protection Regulation, hereinafter referred to as the “GDPR.” According to the GDPR, “personal data” means any information relating to an identified or identifiable natural person. This includes, for example, your legal name, your address, your telephone number, or your date of birth. Information about your use of this website may also constitute personal data if it is possible to draw conclusions about your person from this information.



3.2 Scope of the Processing of Personal Data

As a general rule, we process the personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The processing of our users’ personal data is generally carried out only after the user has given consent or where the processing is permitted by statutory provisions.



3.3 Legal Basis for the Processing of Personal Data

Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1) sentence 1 lit. a) GDPR serves as the legal basis.

Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, Art. 6(1) sentence 1 lit. b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.

Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1) sentence 1 lit. c) GDPR serves as the legal basis.

Where vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1) sentence 1 lit. d) GDPR serves as the legal basis.

Where processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and the interests, fundamental rights, and freedoms of the data subject do not override the first-mentioned interest, Art. 6(1) sentence 1 lit. f) GDPR serves as the legal basis for the processing.



4 Data Deletion and Storage Period

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by the European or national legislator in EU regulations, laws, or other provisions to which the controller is subject. The data will also be blocked or deleted when a storage period prescribed by the aforementioned provisions expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.



5 Provision of the Website and Creation of Log Files

5.1 Description and Scope of Data Processing

When our website is accessed, the following data is logged:

• browser type/version

• operating system used

• referrer URL, meaning the previously visited website, as well as pages accessed on our website

• IP address

• date and time of the server request

The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.



5.2 Legal Basis for Data Processing

The legal basis for the storage of the data and log files is Art. 6(1) sentence 1 lit. f) GDPR.  



5.3 Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s device. For this purpose, the user’s IP address must remain stored for the duration of the session. The data is stored in log files to ensure the functionality of the website. In addition, the data helps us optimize the website and ensure the security of our information technology systems. In this context, the data is not evaluated for marketing purposes. These purposes also constitute our legitimate interest in data processing pursuant to Art. 6(1) sentence 1 lit. f) GDPR.    



5.4 Duration of Storage

The data stored by us will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case after seven days at the latest. Storage beyond this period is possible. In this case, the users’ IP addresses will be deleted or anonymized so that assignment to the accessing client is no longer possible.



5.5 Option to Object and Request Removal

The collection of the aforementioned data is strictly necessary for the operation of the website. Consequently, the user has no option to object.



6 Use of Innoloft

As part of providing access to our web applications, we work with Innoloft GmbH, Charlottenstraße 16, 52070 Aachen, Germany,  https://innoloft.com/ . This also concerns the processing of personal data, with Innoloft acting as our processor within the meaning of Art. 28 GDPR.

The web application integrated into our website is based on the “LoftOS” platform of Innoloft GmbH. LoftOS combines the development and hosting of web applications with features of a social media platform. A central use case is the provision of communication and information platforms.



6.1 Innoloft Ecosystem and Login

One function of LoftOS is the “Innoloft Ecosystem.” This enables networking and communication functions. Users can log in to any application created with LoftOS using the same access credentials, manage a uniform profile, and communicate across applications with the operators of the web applications as well as with other users.

The following data is processed to provide these basic functions:

Login data: email address, password, IP address, log data

Purposes of processing:

• enabling users to log in to applications in Innoloft LoftOS

Legal bases:

• performance of a contract or implementation of pre-contractual measures, insofar as the use is based on a contractual relationship, Art. 6(1) sentence 1 lit. b) GDPR

• safeguarding our legitimate interests in the secure and user-friendly operation of the web application, Art. 6(1) sentence 1 lit. f) GDPR



6.2 User Profiles in Innoloft LoftOS

Description of the processing activity:

Provision and display of the user profile in Innoloft LoftOS.

Processed categories of data:

Information in the user profile, for example first name, last name, profile picture, job title, company, interests, biography.

Purposes of processing:

• displaying users as members of an application in Innoloft LoftOS

Legal bases:

• performance of a contract or implementation of pre-contractual measures, Art. 6(1) sentence 1 lit. b) GDPR

• safeguarding our legitimate interests in the effective presentation and networking of users within the platform, Art. 6(1) sentence 1 lit. f) GDPR



6.3 Interaction, Communication, and Networking Functions

Description of the processing activity:

Provision of the interaction, communication, and networking functions of the Innoloft Ecosystem for the controller’s applications in Innoloft LoftOS and for the users of these applications.

Processed categories of data:

• user data, such as first name, last name, profile picture

• usage data, such as IP address, date and time of access

• status of the user’s membership in an application

• data on the type of interaction of the user with the content of the application

• content data, such as chat messages and message content

Purposes of processing:

• enabling users to network and interact with our applications and, where applicable, with other applications in the Innoloft Ecosystem

Legal bases:

• performance of a contract or implementation of pre-contractual measures, Art. 6(1) sentence 1 lit. b) GDPR

• safeguarding our legitimate interests in providing efficient communication and networking functions, Art. 6(1) sentence 1 lit. f) GDPR



6.4 Monitoring of System Stability and Error Analysis — Sentry

Description of the processing activity:

Monitoring of system stability and error analysis using the “Sentry” service within Innoloft LoftOS.

Processed categories of data:

• user ID

• browser information

• accessed URL

• triggering error code

Purposes of processing:

• monitoring the stability of the functions of Innoloft LoftOS, the Innoloft Ecosystem, and our applications

• error analysis and troubleshooting to ensure secure and disruption-free operation

Legal bases:

• safeguarding our legitimate interests in the technical stability and security of the web applications, Art. 6(1) sentence 1 lit. f) GDPR

• where applicable, performance of a contract, insofar as the stability of the systems is necessary for the provision of contractual services, Art. 6(1) sentence 1 lit. b) GDPR



7 Contact Form and Email Contact

7.1 Description and Scope of Data Processing

Our website provides the option to contact us by email. In this case, the personal data you provide, in particular your email address and, where applicable, your name and telephone number, will be stored by us in order to respond to your inquiry and process your request.

At the time the email is sent, the following data is also stored:

• the user’s IP address

• date and time of the message

If you provide us with details of your communication channels, such as your email address or telephone number, we will use these solely to respond to your request.

In this context, no data is passed on to third parties. The data is used exclusively for processing the conversation.



7.2 Legal Basis for Data Processing

The legal basis for the processing of the data that you transmit to us when contacting us is Art. 6(1) sentence 1 lit. f) GDPR or your consent, Art. 6(1) sentence 1 lit. a) GDPR.

If the email contact is aimed at concluding a contract, the additional legal basis for processing the data is Art. 6(1) sentence 1 lit. b) GDPR.



7.3 Purpose of Data Processing

In the case of contact by email, this also constitutes the necessary legitimate interest in processing the data.



7.4 Duration of Storage

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data sent by email, this is the case when the respective conversation with the user has ended. The conversation is considered ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.



7.5 Option to Object and Request Removal

The user has the option to withdraw their consent to the processing of personal data at any time. If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

All personal data stored in the course of contacting us will be deleted in this case.



8 Use of Cookies

8.1 Description and Scope of Data Processing

We use cookies to make our website more user-friendly. Some elements of our website require the accessing browser to be identifiable even after a page change.

For example, the following data is stored and transmitted in the cookies:

• language settings

• items in a shopping cart

• login information

• cookie information banner stating that this website uses cookies

• language settings

We also use cookies on our website that enable an analysis of users’ browsing behavior. In this way, for example, the following data may be transmitted:

• search terms entered

• frequency of page views

• use of website functions



8.2 Cookies Used

The legal basis for the use of technically necessary cookies is Art. 6(1) sentence 1 lit. f) GDPR and Section 25(2) No. 2 TDDDG, essential cookies. Further processing is carried out in each case pursuant to Art. 6(1) GDPR.



8.3 Changing Cookie Settings

HIW Hamburg Invest Wirtschaftsförderung mbH offers you the option, as part of  consent management  via a “cookie banner,” to decide according to your preferences whether cookies may be set within our offering. To view and manage your consent individually, you can access our consent platform and configure your personal settings again:  Edit cookie settings .

Furthermore, you can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website in full.



9 Payment via Stripe

When paying via Stripe, your payment data will be transmitted to Stripe as part of the payment processing. Stripe is operated by Stripe, LLC, 354 Oyster Point Boulevard, South San Francisco, California, 94080, USA, and is represented in the EU by Stripe Technology Company Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. The transfer of your data to Stripe is based on Art. 6(1) lit. a GDPR, consent, and Art. 6(1) lit. b GDPR, processing for the performance of a contract. You may withdraw any consent you have already given at any time; data processing operations carried out in the past remain lawful in the event of withdrawal.

For certain payment methods, for example credit card via Stripe, direct debit via Stripe, or, if offered, “purchase on account” or “payment by installments” via Stripe, Stripe reserves the right to carry out a credit check. For this purpose, your payment data may be passed on to credit agencies pursuant to Art. 6(1) lit. f GDPR on the basis of Stripe’s legitimate interest in determining your solvency. Stripe uses the result of the credit check in relation to the statistical probability of payment default for the purpose of deciding whether to provide the respective payment method. The credit report may contain probability values, known as score values. To the extent that score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. Address data, among other data but not exclusively, is included in the calculation of the score values.

Furthermore, Stripe processes personal data in order to verify the identity of natural and legal persons and thereby comply with obligations relating to fraud monitoring, prevention, and detection; laws relating to the identification and reporting of illegal and unlawful activities, for example under anti-money laundering regulations, AML, and know-your-customer regulations, KYC; as well as financial reporting obligations.

Further data protection information, including information on the credit agencies used, can be found in Stripe’s Privacy Policy:  https://stripe.com/de/privacy 

You may object to this processing of your data at any time by sending a message to Stripe. However, Stripe may still be entitled to process your personal data where this is necessary for contractual payment processing.



10 Data Security

We use technical and organizational security measures to protect your data processed by us against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our security measures are continuously improved in line with technological developments.

11 Transfer of Data to Third Parties

As a general rule, your data is not transferred to third parties unless we are legally obliged to do so. Where external service providers come into contact with your personal data, we have ensured, through legal, technical, and organizational measures as well as regular checks, that they comply with the provisions of data protection laws. Furthermore, these service providers may use your data only in accordance with our instructions.

We attach importance to processing your data within the EU/EEA. However, it may occur that we use service providers who process data outside the EU/EEA. In such cases, we ensure that an adequate level of data protection comparable to the standards within the EU is established at the recipient before your personal data is transferred. This can be achieved, for example, through EU standard contractual clauses, binding corporate rules, or special agreements whose provisions the company may undertake to comply with.



12 Rights of Data Subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR, and you have the following rights vis-à-vis the controller:

We will gladly provide you with information as to whether and which personal data concerning you is processed by us and for what purposes, Art. 15 GDPR. In addition, subject to the respective legal requirements, you have the right to rectification, Art. 16 GDPR; the right to restriction of processing, Art. 18 GDPR; the right to erasure, Art. 17 GDPR; and the right to data portability, Art. 20 GDPR.

Subject to the legal requirements, you have the right to object to processing, Art. 21 GDPR.

To exercise the rights mentioned above, please contact us by email at  datenschutz@hamburg.marketing.de  or by post at Hamburg Marketing GmbH or HIW Hamburg Invest Wirtschaftsförderung mbH, Wexstraße 7, 20355 Hamburg, Germany. Exercising the rights mentioned above is free of charge for you.

Without prejudice to these rights and the possibility of pursuing another administrative or judicial remedy, you have the option at any time to exercise your right to lodge a complaint with a supervisory authority, in particular in the member state of your place of residence, your place of work, or the place of the alleged infringement, if you believe that the processing of personal data concerning you violates data protection regulations, Art. 77 GDPR.

The supervisory authority responsible for us is: The Hamburg Commissioner for Data Protection and Freedom of Information.



13 Changes to this Privacy Policy

This Privacy Policy is continuously adapted in the course of the further development of the internet or our offering. We will announce changes on this page in good time. To stay informed about the current status of our data use provisions, this page should be accessed regularly.



14 Contact Details of Data Protection Officer

Ms. Katrin Rammo intersoft consulting services AG Beim Strohhause 17 20097 Hamburg E-Mail:  datenschutz@hamburg.marketing.de