Privacy Policy

Some pages of our website include fonts (“Google Fonts”) from the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google does not collect any data because these fonts are downloaded from an internal company server.

Google Analytics and Fingerprint

The web analysis (also known as “range measurement”) is used to evaluate visitor flows from itdesign.de and the subdomains and can include behavior, interests or demographic information about the visitors, such as age or gender, as pseudonymous values. With the help of the range analysis, we can, for example, recognize at which time our online service or its functions or content are used most often or invite you to reuse these services. We can also understand which areas need optimization. Furthermore, through the use of so-called fingerprinting, we can with high probability achieve device identification to better protect our website against malicious activities.

In addition to web analysis, we can also use test procedures, for example, to test and optimize different versions of our online service or its components.

For these purposes, so-called user profiles can be created and stored in a file (so-called “cookie”) or similar processes can be used for the same purpose. This information can include, for example, content viewed, websites visited and elements and technical information used there, such as the browser used, the computer system used and information on times of use, and data that is automatically transmitted during a server request, such as screen, OS, device name (so-called basic identification input signals). If users have consented to their location data being collected, this can also be processed, depending on the provider.

We use the data to maintain, improve, and protect our website, to evaluate user interaction with the website and to evaluate our marketing strategies. The data that we receive via Google Analytics or fingerprinting can be merged with other data, e.g., data that you voluntarily provide to us via the website or that is automatically transmitted during your visit to our website. See section “Merging Data”.

The IP addresses of the users are also saved. However, we use an IP masking process (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear user data (such as email addresses or names) are stored in the context of web analysis, A/B testing and optimization; only pseudonyms are stored. This means that we and the providers of the software used do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Otherwise, user data will be processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would like to draw your attention to the information on the use of cookies in this Data protection policy.

• Processed data types: usage data (e.g., websites visited, interest in content, search terms, access times), meta/communication data (e.g., device information, IP addresses).
• Affected persons: users (e.g., website visitors, users of the free trial).
• Purposes of processing: Range measurement (e.g., access statistics, recognition of returning visitors), tracking (e.g., interest/behavior-related profiling, use of cookies), conversion measurement (measurement of the effectiveness of marketing activities), creation of user profiles, interest-based and behavior-related marketing, click tracking, A/B tests, feedback (e.g., collecting feedback via an online form), heat maps (mouse movements by the user, which are summarized into an overall picture.), surveys and questionnaires (e.g., surveys with input options, multiple-choice questions).
• Security measures: IP masking (pseudonymization of the IP address), Masking of all individual user input (e.g. data entered in forms or project names in the free trial).
• Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).
• Storage period: The user and event data collected by Google Analytics will be deleted within a period of 26 months. All data at Microsoft Clarity is automatically deleted after 365 days.

Used services and service providers:

• Google Analytics
  Online Marketing and Web Analysis.
  Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA
  Website: https://marketingplatform.google.com/about/analytics/
  Data protection policy: https://policies.google.com/privacy
  Opt-out:
  Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=en
  Settings for the display of advertisements: https://adsettings.google.com/authenticated
  Another possibility to object to web analysis by Google Analytics is to not allow cookies from Google Analytics. You can use the following “Borlabs” switch to specify whether you want to allow analysis by Google Analytics (On) or not (Off).
• Google BigQuery
  Temporary storage of web analytics data.
  Service provider: Google Cloud EMEA Ltd., 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
  Website: https://cloud.google.com/
  Data protection policy: https://cloud.google.com/terms/cloud-privacy-notice
  We use an automated data export from Google Analytics to BigQuery. This process affects data that was captured by Google Analytics.
• Microsoft Clarity
  Testing and Optimization with Heat Maps and Click Maps.
  Service Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA
  Website: https://clarity.microsoft.com/
  Privacy Policy: https://privacy.microsoft.com/en-us/privacystatement
  Cookie Policy: https://privacy.microsoft.com/en-us/privacystatement
  Deletion of data: The cookies that Microsoft Clarity uses have different “lifetimes”; some remain valid for up to 365 days, some only during the current visit.
  Opt-Out: Choose Microsoft here: https://optout.aboutads.info/?c=2&lang=EN
• Help Center Manager
  Track which Help Center articles are popular and helpful, and which are not. 
  Service provider: Swifteq Ltd., 51 Bracken Road, Sandyford, Dublin, D18 CV48, Ireland 
  Website: https://www.swifteq.com/ 
  Privacy Policy: https://www.swifteq.com/privacy-policy 
  Security Policy: https://www.swifteq.com/security-policy
• Fingerprint
  Online marketing, web analysis, network and information security.
  Service provider: FingerprintJS, Inc. 1440 W. Taylor St 735, Chicago, IL 60607, USA
  Website: https://fingerprint.com/
  Data protection policy: https://dev.fingerprint.com/docs/privacy-policy

Contracts for order processing under Article 28 GDPR were concluded with Google, Microsoft, Fingerprint and Swifteq.

You can find more information about the cookies used by itdesign in our cookie statement: https://itdesign.de/en/privacy-policy/cookie-policy/

For Google and Microsoft, the information generated in the cookie is transferred to a server in the USA (third country) and stored there. It is possible that Google and Microsoft use this data for any of its own purposes and links it to other data records, e.g., your search history or your personal accounts known to Google or Microsoft. We have no influence on this data processing. The data processing is mainly done by Google and Microsoft. An adequate level of data protection for data transfers to the USA is guaranteed by the certifications of Google and Microsoft under the adequacy decision (EU-U.S. Data Privacy Framework).

Online Marketing and Online Advertising

We process personal data for online marketing purposes, which can include, in particular, the marketing of advertising space or the presentation of advertising and other content (collectively referred to as “content”) based on the potential interests of users and the measurement of their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (called a “cookie”) or similar processes are used, by means of which the user information relevant to the presentation of the aforementioned content is saved. This information can include content viewed, websites visited, online networks used, but also communication partners and technical information such as the browser used, the computer system used and information on usage times. If users have consented to their location data being collected, this can also be processed.

The IP addresses of the users are also saved. However, we use available IP masking procedures (ie, using a pseudonym by shortening the IP address) to protect users. In general, no clear user data (such as email addresses or names) are stored in the online marketing process, but only pseudonyms. This means that we and the providers of online marketing processes do not know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is usually stored in the cookies or by means of similar processes. These cookies can later generally also be read out on other websites that use the same online marketing process, analyzed for the purpose of displaying content and supplemented with additional data and stored on the server of the online marketing process provider.

You can find more information about the cookies used by itdesign in our cookie statement: https://itdesign.de/en/privacy-policy/cookie-policy/

As an exception, clear data can be assigned to the profiles. This is the case if the users are, for example, members of a social network whose online marketing process we use and the network connects the profiles of the users with the aforementioned information. We ask you to note that users can make additional agreements with the providers, e.g., by giving their consent during registration.

Unless otherwise stated, we ask you to assume that the cookies used will be stored for a period of two years.

Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Otherwise, user data will be processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would like to draw your attention to the information on the use of cookies in this data protection policy.

Target group formation with Google Analytics: We use Google Analytics in order to display the advertisements placed by Google and its partners’ advertising services only to users who have also shown an interest in our online service or who have certain characteristics (e.g., interests in certain topics or products which are determined on the basis of the websites visited) which we transmit to Google (so-called “remarketing” or “Google Analytics audiences”). With the help of remarketing audiences, we would also like to ensure that our ads correspond to the potential interest of the users.

In the case of Google, the information generated in the cookie is transferred to a Google server in the USA (third country) and stored there. It is possible that Google uses this data for any of its own purposes and links it to other data records, e.g., your search history or your personal accounts known to Google. We have no influence on this data processing. The data processing is mainly done by Google. An adequate level of data protection for data transfers to the USA is guaranteed by the certification of Google under the adequacy decision (EU-U.S. Data Privacy Framework).

Conversion tracking: In principle, we only have access to summarized information about the success of our advertisements. However, we can use conversion measurements to check which of our online marketing processes have led to a conversion, i.e., for example, to a contract with us. The conversion measurement is used solely to analyze the success of our marketing measures. If you reach our website via advertisements from certain providers, the respective provider places a cookie on your computer, which is used to generate statistics on the effectiveness of advertisements based on your behavior.

This currently affects the following advertising platforms that are tracked in Google Tag Manager for a day:

• Google Analytics Universal Analytics Tag
• Bing Ads or Microsoft Advertising Universal Event Tracking
• LinkedIn Insight Tag
• X Pixel
• Capterra Conversion Tracking

Meta Pixel and target group formation (custom audiences): With the help of Meta Pixel (or comparable functions, for the conversion of event data or contact information via interfaces in apps), Meta is on the one hand able to identify the visitors of our online service as a target group. To determine the presentation of advertisements (called “Facebook Ads”). Accordingly, we use Meta Pixel only to send Facebook ads to users on Facebook and within the services of the partners cooperating with Meta (called “Audience Network”) https://www.facebook.com/audicencenetwork/) who have also shown an interest in our online service or who have certain characteristics (e.g., interest in certain topics or products that can be seen from the websites visited) that we transmit to Meta as what is called “Custom Audiences” of Meta Pixel. We also want to ensure that our Facebook ads correspond to the potential interest of the user and are not annoying. With the help of Meta Pixel, we can also understand the effectiveness of the Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook advertisement (so-called “conversion measurement”).

We are jointly responsible, together with Meta Platforms Ireland Ltd., for the collection or receipt of “event data” through Meta Pixel and similar functions (e.g., interfaces) that are executed or obtained as part of a transmission for the following purposes as part of a transfer: a) display of content advertising information that corresponds to the presumed interests of users; b) delivery of commercial and transactional messages (e.g., addressing users via Facebook Messenger); c) Improving the delivery of ads and personalization of functions and content (e.g., improving the recognition of which content or advertising information is presumed to be in the interests of users). We have concluded a special agreement with Meta (“Additional For Persons Responsible”, https://www.facebook.com/legal/controller_addendum) which regulates in particular which security measures Meta must observe (https://www.facebook.com/legal/terms/data_security_terms) and in which Meta has agreed to comply with the affected rights (i.e., users can, for example, send information or deletion requests directly to Meta). Note: If Meta provides us with metrics, analyses and reports (which are aggregated, i.e., do not receive information about individual users and are anonymous to us), then such processing does not take place within the scope of joint responsibility, but on the basis of an order processing contract (“Data Processing Conditions “, https://www.facebook.com/legal/terms/dataprocessing) , “Data Security Conditions” (https://www.facebook.com/legal/terms/data_security_terms) and with regard to processing in the USA on the basis of standard contractual clauses (“Meta-EU data transfer https://www.facebook.com/legal/EU_data_transfer_addendum). The rights of users (in particular to information, deletion, opposition and complaint to the competent supervisory authority) are not restricted by the agreements with Meta.

• Processed data types: usage data (e.g., websites visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses), location data (information on the geographical position of a device or a person), social data (data subject to social secrecy and processed, e.g., by social security institutions, social assistance institutions or pension authorities), event data (Facebook) (“event data” is data sent to us, for example, via Meta Pixel (via apps or in other ways) and can relate to people or their actions. The data includes e.g., information about website visits, interactions with content, functions, installations of apps, purchases of products, etc. The event data is used for the purpose of creation of target groups for content and advertising information (custom audiences) processed; event data does not contain the actual content (such as written comments), no login information and no contact information (i.e., no names, email addresses and phone numbers). Event data is deleted by Meta after a maximum of two years, the target groups formed from them are deleted with the deletion of our Meta account).
• Affected persons: users (e.g., website visitors, users of online services), interested parties, customers, employees (e.g., employees, applicants, former employees), communication partners.
• Purposes of processing: Tracking (e.g., interest/behavior-related profiling, use of cookies), remarketing, conversion measurement (measurement of the effectiveness of marketing measures), interest-based and behavior-related marketing, profiling (creation of user profiles), range measurement (e.g., access statistics, recognition of returning visitors), Target group formation (determination of target groups relevant for marketing purposes or other output of content), cross-device tracking (cross-device processing of user data for marketing purposes).
• Security measures: IP masking (pseudonymization of the IP address).
• Legal basis: Consent (Art. 6 Para. 1 S. 1 lit. a. GDPR), legitimate interests (Art. 6 Para. 1 S. 1 lit. f. GDPR).
• Opt-out): We refer to the data protection information of the respective provider and the options for objection given to the provider (called “opt-out”). If no explicit opt-out option has been specified, you have the option of switching off cookies in your browser settings. However, this can restrict the functions of our online service. We therefore also recommend the following opt-out options, which are offered in summary for the respective areas:
  a) Europe: https://youronlinechoices.eu.
  b) Canada: https://www.youradchoices.ca/choices.
  c) USA: https://www.aboutads.info/choices.
  d) Cross-regional: https://optout.aboutads.info
• Storage period: The user and event data collected by Google Tag Manager will be deleted within a period of 26 months. We have no influence on the storage period of your data, which is stored by the operators of the advertising platforms for their own purposes. For details, please contact the operators of the tools directly.

Used services and service providers:

• Google Tag Manager
  Google Tag Manager is a solution with which we manage website tags via an interface and thus integrate other services into our online service (please refer to further information in this data protection policy). With the Tag Manager itself (which implements the tags) no user profiles are created or cookies are stored. Google only learns the user’s IP address, which is necessary to run Google Tag Manager.
  Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA
  Website: https://marketingplatform.google.com
  Data protection policy: https://policies.google.com/privacy
• Google Analytics:
  Online Marketing and Web Analysis.
  Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA
  Website: https://marketingplatform.google.com/about/analytics/
  Data protection policy: https://policies.google.com/privacy
  Opt-out:
  Opt-out plug-in: https://tools.google.com/dlpage/gaoptout?hl=en
  Settings for the display of advertisements: https://adssettings.google.com/authenticated
  Another way to object to web analysis by Google Analytics is to not allow cookies from Google Analytics. You can use the following “Borlabs” switch to specify whether you want to allow analysis by Google Analytics (On) or not (Off).
• Google Signals
  We use the “Google Signals” service within Google Analytics. This extends existing Google Analytics functions to merge cross-device data. This only affects users who have agreed to personalized ads in their Google account.
  Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Mother Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
  Website: https://marketingplatform.google.com
  Privacy Policy: https://policies.google.com/privacy.
• Google Ads and conversion measurement
  We use the online marketing process “Google Ads” to place advertisements in the Google advertising network (e.g., in search results, in videos, on websites, etc.) so that they are displayed to users who are suspected of being interested in the ads. We also measure the conversion of the ads. However, we only learn the anonymous total number of users who clicked on our ad and were forwarded to a page with a so-called “conversion tracking tag”. However, we do not receive any information that could be used to identify users.
  Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA
  Website: https://marketingplatform.google.com
  Data protection policy: https://policies.google.com/privacy
• Meta Pixel and Target Group Formation (Custom Audiences) (integrated via Google Tag Manager)
  Service provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland, parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA
  website: https://about.meta.com/de/
  Privacy Policy: https://www.facebook.com/about/privacy
  Opt-out: https://www.facebook.com/settings?tab=ads
• LinkedIn (integrated via Google Tag Manager)
  Insights Tag/Conversion Measurement.
  Service provider: LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA
  Website: https://www.linkedin.com
  Security measures: IP masking (pseudonymization of the IP address)
  Data protection policy: https://www.linkedin.com/legal/privacy-policy
  Cookie Policy: https://www.linkedin.com/legal/cookie-policy
  Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
• Microsoft Advertising (integrated via Google Tag Manager)
  Temarketing/Conversion Measurement.
  Service Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA
  Website: https://about.ads.microsoft.com/
  Privacy Policy: https://privacy.microsoft.com/privacystatement/
  Opt-out: https://choice.microsoft.com/opt-out.
• X (integrated via Google Tag Manager)
  X Marketing and Advertisements
  Service provider: Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, parent company: X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA
  Website: https://x.com/
  Data protection policy: https://x.com/de/privacy
  Opt-out: https://x.com/settings/account/personalization
• Capterra (integrated via Google Tag Manager)
  Capterra Conversion Tracking.
  Service Provider: Capterra Inc., 1201 Wilson Blvd, 9th Floor, Arlington, VA 22209
  Website: https://www.capterra.com/
  Privacy Policy: https://www.capterra.com/legal/privacy-policy

A contract for order processing under Article 28 GDPR was concluded with Google.

For Google, the information generated in the cookie is transferred to a Google server in the USA (third country) and stored there. It is possible that Google uses this data for any of its own purposes and links it to other data records, e.g., your search history or your personal accounts known to Google. We have no influence on this data processing. The data processing is mainly done by Google. An adequate level of data protection for data transfers to the USA is guaranteed by the certification of Google under the adequacy decision (EU-U.S. Data Privacy Framework).

We use plug-ins from various other platforms, e.g. social media, on our website. The purpose is to increase the level of awareness of our services or to access content. Your data will not be transferred solely by accessing our website because we rely on the Easy Social Share solution when using social media plug-ins. This gives you the opportunity to share our content. However, a data transfer takes place once you click on the corresponding button. The legal basis for this is Art. 6, Para. 1, Sent. 1(f) GDPR.

Our legitimate interest lies in presenting our content to a wide audience and providing you the opportunity to express your opinion.

Please note that clicking a share icon or an embedded YouTube video will result in certain data being transferred to the respective social media service provider, for example:

• the address of the website where the activated social plug-in is located,
• date and time the website was accessed or the social plug-in was activated,
• information about the browser and operating system used,
• your current IP address.

If you are already logged in to the corresponding social media service at the time the social plug-in is activated, the social media service provider is also able to determine your user name and possibly even your real name from the above data.

This data can also be processed by the social media service provider in countries outside the European Union. We have no influence on the scope, type and purpose of data processing by the social media service provider. Please note that the social media service provider is able to create anonymous and even individualized user profiles with the above mentioned data.