Privacy Statement

2.1. Visiting our website / Connection data

With every use of our website, we collect the connection data that your browser automatically transmits to enable you to visit the website. This connection data includes the so-called HTTP header information, including the User-Agent, and includes in particular:

The processing of this connection data is necessary to enable the visit of the website, to ensure the permanent functionality and security of our systems, as well as to generally administrate our website. The connection data is also temporarily and restricted to the necessary minimum stored in internal log files for the purposes described above, to create statistical information about the usage of our website, to further develop our website in terms of the usage habits of our visitors (e.g., if the share of mobile devices accessing the pages increases), and to generally administrate our website.

The legal basis is Art. 6 para. 1 lit. b GDPR, provided that the page visit occurs during the initiation or execution of a contract, and otherwise Art. 6 para. 1 lit. f GDPR due to our legitimate interest in enabling website visits, as well as the permanent functionality and security of our systems. However, the automatic transmission of connection data and the resulting log files does not constitute access to information on the user's end device as defined by the implementation laws of the EU member states for the ePrivacy Directive, and in Germany § 25 TTDSG. Nevertheless, it would be absolutely necessary.

For data protection reasons, log files are not stored or analyzed by us permanently.

2.2. Making contact

You have various options to get in touch with us, such as through the contact form or by phone. In this context, we process data solely for the purpose of communication with you.

The legal basis is Art. 6 para. 1 lit. b GDPR, insofar as your information is required to answer your inquiry or to initiate or execute a contract, and otherwise Art. 6 para. 1 lit. f GDPR due to our legitimate interest in enabling you to contact us and allowing us to respond to your inquiry. We only make promotional phone calls if you have given your consent for this. If you are not an existing customer, we will send you promotional emails only with your consent. The legal basis is Art. 6 para. 1 lit. a GDPR in conjunction with § 7 para. 2 No. 1 or 2 UWG.

The data collected by us when using the contact form will be automatically deleted after your request has been fully processed, unless we still need your request to fulfill contractual or legal obligations (see section 7 “Storage period”).

2.3. Newsletter

With our newsletter, we primarily aim to inform you about the latest developments in data protection, articles from our specialist areas, as well as events, news, offers, and other important information. To subscribe to the newsletter, we collect your email address and, in the case of events, additionally, your name and, if applicable, your company name. 

For newsletter subscriptions, we use the double opt-in procedure, meaning we will only send you newsletters by email if you confirm that you are the owner of the provided email address by clicking a link in our confirmation email. Once you confirm your email address, we will store your email address, the time of registration, and the IP address used for registration until you unsubscribe from the newsletter. This storage serves the sole purpose of sending you the newsletter and being able to verify your registration. The legal basis for processing is your consent under Art. 6 para. 1 lit. a GDPR. You can unsubscribe from the newsletter at any time. An appropriate unsubscribe link is included in each newsletter. A message to the contact details provided above or in the newsletter (e.g., by email or letter) is also sufficient.

In our newsletters, we use pixels (tiny, invisible image files) to measure the opening rate, as well as links with which we can measure clicks on the link before being redirected to the target page. Sendinblue collects data at the individual recipient level for this purpose. However, data analysis is carried out exclusively in aggregated form for statistical evaluation and optimization to further develop our content and customer communication. Usage analysis at the individual recipient level does not take place. Furthermore, it is also recorded whether newsletters could be delivered and for which email addresses delivery was not possible. There is no linkage with other data. You can prevent the measurement of the opening rate by disabling the loading of images in your email client.

Once you unsubscribe from the newsletter, your registration data will be deleted. Deletion also occurs promptly if you have not confirmed the newsletter subscription. 

We use Sendinblue, a service provided by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany (“Sendinblue”), for sending our newsletter. We have concluded a data processing agreement with Sendinblue. Your data is stored by Sendinblue in encrypted form in the European Union and transmitted in encrypted form. Where Sendinblue works with sub-processors whose parent company is not based in the European Union, Sendinblue and its sub-processors have entered into standard contractual clauses and have taken additional measures to protect the data.

The legal basis for the delivery of the newsletter, the aggregated usage analysis and the determination of deliverability is your consent pursuant to Art. 6(1)(a) GDPR.

Further information on data protection and data security can be found at:

https://de.sendinblue.com/legal/privacypolicy/ and https://www.sendinblue.com/security/

Email marketing to existing customers

When you enter into a contract with us for the use of the "caralegal" software, we also use your contact information to send you further relevant information about our products and services via email ("customer retention marketing"). This may include updates, promotions, offers, as well as feedback and other surveys.

The legal basis for this data processing is Art. 6 para. 1 lit. f GDPR in conjunction with Section 7 (3) Act Against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb - UWG), which allows data processing for the legitimate interest of storing and further using data for advertising purposes. You can object to the use of your data for marketing purposes at any time by using the appropriate link in the emails or by notifying us through the contact details provided above (e.g., via email or letter), without incurring any costs other than the transmission fees at basic rates.

We do not perform an evaluation or analysis of user behaviour or open and click rates.

For sending customer retention marketing, we use Sendinblue, a service of Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany ("Sendinblue"). We have entered into a data processing agreement with Sendinblue. Your data is stored and transmitted by Sendinblue in encrypted form within the European Union. If Sendinblue collaborates with subcontractors whose parent company is not located in the European Union, Sendinblue and its subcontractors have entered into standard contractual clauses and additional measures for data protection.

For more information on data protection and data security, please refer to:

https://www.sendinblue.com/security/ and https://www.sendinblue.com/legal/privacypolicy/.

3.1 Utilised technologies

This website utilises various services and applications (collectively referred to as "Tools"), which are offered by either us or third parties. These tools include technologies that store or access information on the end user's device:

With the help of these technologies and the mere connection to a page, so-called "fingerprints" can be created, which are user profiles that can recognize visitors even without the use of cookies or web storage. Fingerprinting due to the connection setup cannot be entirely prevented manually.

Most browsers are initially configured to accept cookies, run scripts, and display images. However, you can usually adjust your browser settings to reject all or certain cookies, block scripts, and images. If you completely block the storage of cookies, the display of images, and the execution of scripts, our services may not function properly or at all.

Below, we provide a categorized list of the tools we use, along with information about the tool providers, the storage duration of cookies or data in local storage and session storage, as well as data sharing with third parties. We also explain the instances where we obtain your voluntary consent to use the tools and how you can revoke this consent.

If - even despite the greatest care - the information in the consent banner contradicts that said in this data privacy policy, the information in this data privacy policy prevails.

Legal basis and withdrawal

3.2.1. Legal basis

We use tools necessary for website operation based on our legitimate interest under Art. 6 para. 1 lit. f GDPR to provide the essential functions of our website. In specific cases, these tools may also be required for the performance of a contract or for the implementation of pre-contractual measures, in which case the processing is carried out under Art. 6 para. 1 lit. b GDPR. Access to and storage of information on the end device is essential in these cases and is based on the implementing acts of the ePrivacy Directive of EU member states, in Germany, pursuant to § 25 para. 2 TTDSG.

All other non-essential (optional) tools that provide additional functions are used with your consent under Art. 6 para. 1 lit. a GDPR. Access to and storage of information on the end device is then based on the implementing acts of the ePrivacy Directive of EU member states, in Germany, pursuant to § 25 para. 1 TTDSG. Data processing using these tools only takes place when we have obtained your prior consent.

If personal data is transferred to third countries, we refer to Section 6 ("Transfer of Data to Third Countries") also in terms of the potential associated risks. We will inform you if there is an adequacy decision for the respective third country or if standard contractual clauses or other safeguards have been put in place for the use of specific tools. If you have given your consent for the use of specific tools and the associated transfer of your personal data to third countries, we transfer the data processed when using the tools (also) to third countries based on this consent under Art. 49 para. 1 lit. a GDPR.

3.2.2. Obtaining your consent

We use the WordPress plugin "Borlabs Cookie" to obtain and manage your consents. This plugin generates a banner that informs you about data processing on our website and provides you with the option to consent or decline to individual or all data processing activities conducted by optional tools. This banner is displayed on your first visit to our website and when you revisit our site to change your preferences or revoke consents. The banner will also reappear during subsequent visits if you have disabled cookie storage or if the cookies or information stored in the local storage by "Borlabs Cookie" have been deleted or have expired.

Additionally, the WordPress plugin "Borlabs Cookie" utilises a necessary cookie (named "borlabs-cookie") to store your granted consents and withdrawals. If you delete your cookies, we will request your consent again when you revisit our site.

The data processing carried out by the WordPress plugin "Borlabs Cookie" is necessary to provide you with the legally required consent management and to fulfill our documentation obligations. The legal basis is Art. 6 para. 1 lit. f GDPR based on our interest in complying with the legal requirements for consent management. Accessing and storing information on your device is essential in these cases and is carried out in accordance with the implementing laws of the ePrivacy Directive of EU member states, or, in Germany, according to § 25 para. 2 TTDSG.

3.2.3. Withdrawal of your consent or changing your selection

3.3. Essential tools

We use certain tools to enable the basic functions of our website (referred to as "essential tools"). Without these tools, we would not be able to provide our service. Therefore, essential tools are used without the need for consent.

The legal basis for essential tools is the necessity to fulfill our legitimate interests in providing the respective basic functions and operating our website, as per Art. 6 para. 1 lit. f GDPR. In cases where the provision of specific website functions is necessary to fulfill a contract or to carry out pre-contractual measures, the legal basis for data processing is Art. 6 para. 1 lit. b GDPR. Access to and storage of information on the user's device is absolutely necessary in these cases and is carried out based on the implementation laws of the EU member states' ePrivacy Directive and in Germany under § 25 para. 2 TTDSG.

In the event of personal data being transferred to third countries (such as the United States), we refer to Section 6 ("Data Transfer to Third Countries") for additional information.

3.3.1. Google Tag Manager

Our website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for users from the European Economic Area and Switzerland, and for all other users by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (collectively "Google").

The Tag Manager is used solely for the management of website tools through the integration of so-called website tags. A tag is an element embedded in the source code of our website to execute a tool, for example through scripts. If these are optional tools, they are only integrated by Google Tag Manager with your consent. Google Tag Manager uses JavaScript and generally operates without the use of cookies.

The legal basis is Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in easily integrating and managing multiple tags on our website.

For the purpose of ensuring stability and functionality in the use of Google Tag Manager, Google collects information about which tags are integrated through our website. However, Google Tag Manager does not generally store personal data beyond the basic connection, particularly not data about user behavior or the pages visited.

We have entered into a data processing agreement with Google Ireland Limited. In the event that personal data is transferred from Google Ireland Limited to the USA or other third countries, Google Ireland Limited and Google LLC have entered into standard contractual clauses (Commission Decision (EU) 2021/914, Module 3) in accordance with Art. 46 para. 2 lit. c GDPR. 

For more information, please refer to Google's information on Tag Manager.

3.5. Marketing Tools

We also use optional tools for advertising purposes ("Marketing Tools"). Some of the access data generated when using our website is used to create user profiles, which store information about your usage behavior, the advertisements you have viewed or clicked on, and, based on that, your categorization into advertising categories, interests, and preferences. Through the analysis and evaluation of this access data, we are able to display personalised advertisements on our website and on the websites and services of other providers, which correspond to your actual interests and needs. We also analyze your usage behavior to recognise you on other sites and address you in a personalised manner based on your use of our site (known as retargeting). Furthermore, we evaluate the effectiveness and success of our advertising campaigns, especially conversions and leads.

Marketing tools also include optional tools from social networks that are used to share posts and content through these networks ("Social Media plugins").

The legal basis for the marketing zools is your consent according to Art. 6 para. 1 lit. a GDPR, which you provide via the consent banner or directly at the respective tool by allowing its use through an overlay banner. Access to and storage of information on your device is then based on the implementation laws of the ePrivacy Directive of EU member states, in Germany, according to § 25 para. 1 TTDSG. For revoking your consent, please see 3.2.3: " Withdrawal of your consent or changing your selection."

In the event that personal data is transferred to third countries (such as the USA), your consent explicitly extends to the data transfer (Art. 49 para. 1 lit. a GDPR). Please refer to section 6 ("Data Transfer to Third Countries") for associated risks.

In the following section, we would like to explain the tools and the providers used in more detail. The collected data may include in particular:

However, the collected data is stored pseudonymously, so no immediate conclusions about individuals are possible.

3.5.1. Linkedin Insight Tag

Our website uses the LinkedIn Insight Tag service provided by LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland ("LinkedIn"). This service allows us to collect and analyze statistical data about your visit and usage of our website. It enables us to display interest-based and relevant offers, recommendations, and advertising on LinkedIn (retargeting). Additionally, it involves an analysis of the effectiveness of advertising (conversion tracking). LinkedIn uses cookies, pixels, and JavaScript for this purpose.

The following cookies are set and read by LinkedIn:

“lang” (Session): stores the language setting;
“lidc” (24 hours): optimises the selection of the data center;
“lissc” (180 days): a cookie that ensures all cookies in the same browser use the same SameSite attribute;
“bcookie” (2 years): prevents misuse;
“UserMathHistory” (30 days): usage analysis, synchronisation of IDs with LinkedIn Ads;
“li_gc” (2 years): stores user consent;
“AnalyticsSyncHistory” (30 days): stores information synchronisation for LinkedIn members.

For more information about cookies, please visit: https://www.linkedin.com/legal/l/cookie-table.

The legal basis for this data processing is your consent in accordance with Art. 6 para. 1 lit. a GDPR. Access to and storage of information on your device is based on the implementation laws of the ePrivacy Directive of EU member states, in Germany, according to § 25 para. 1 TTDSG.

If you are logged into LinkedIn while visiting our website, LinkedIn may link the collected information to your member account and use it for targeted advertising on LinkedIn. You can view and adjust your privacy settings on LinkedIn at the following link: https://www.linkedin.com/psettings/enhanced-advertising.

We have entered into a data processing agreement with LinkedIn in accordance with Article 28 of the GDPR. In the context of this agreement, data that is collected may be transferred to a server in the United States and stored there. In the event that personal data is transferred to the USA or other third countries, we have also concluded Standard Contractual Clauses with LinkedIn, as provided for in Implementing Decision (EU) 2021/914, Module 2, in accordance with Art. 46 para. 2 lit. c GDPR. In addition to this, we obtain your explicit consent, as required by Art. 49 para. 1 lit. a GDPR, for the transfer of your data to third countries.

For further information, please refer to LinkedIn's privacy policy.

3.5.2. Google Ads Conversion Tracking

Our website uses the "Google Ads Conversion Tracking" service, which is offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland for individuals from the European Economic Area and Switzerland, and by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA for all other individuals ("Google").

This service allows us to track and analyse defined customer actions, such as clicking on a button and subsequently submitting a form. This helps us evaluate the success of campaigns and advertisements and optimize the design of our website. Additionally, we use and analyse parameters in the URL (such as the source of the visitor, e.g., a domain, the type and name of the campaign) to better measure campaigns and attribute them to users.

The service uses cookies, JavaScript, pixels, and other technologies for this purpose. Google processes the data to improve the quality and accuracy of conversions. Data collected in this context may be transferred to a server in the USA and stored there.

The following cookies are set and read by Google:

"_gcl_au" (90 days): conversion tracking, storage of ad clicks;
"IDE" (1 year): a cookie for recognising and distinguishing visitors through a user ID across different pages, tracking interactions with advertisements, and displaying personalised ads.

The legal basis for this data processing is your consent in accordance with Art. 6 para. 1 lit. a GDPR. Access to and storage of information on your device is based on the implementation laws of the ePrivacy Directive of EU member states, in Germany, according to § 25 para. 1 TTDSG. The transfer of your data to the USA is based on an adequacy decision (Google LLC is certified under the EU-US Data Privacy Framework).

For further information, please refer to Google's privacy policy.

3.5.3. Microsoft Conversion Tracking

Our website uses Microsoft Conversion Tracking, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft").

This service allows us to track and analyse defined customer actions, such as clicking on a button and subsequently submitting a form. This helps us evaluate the success of campaigns and advertisements and optimise the design of our website. Additionally, we use and analyse parameters in the URL (such as the source of the visitor, e.g., a domain, the type and name of the campaign) to better measure campaigns and attribute them to users. The service uses cookies, JavaScript, and local storage for this purpose. Data collected in this context may be transferred to a server in the USA and stored there.

The following cookies are set and read by Microsoft Conversion Tracking for the specified purposes, along with their respective storage durations:

"_uetsid" (24 hours): session ID;
"_uetvid" (13 months): visitor recognition, usage analysis, displaying personalised ads;
"MUID" (13 months): visitor recognition, usage analysis, displaying personalised ads.

he following information is stored and read in local storage by Microsoft Conversion Tracking:

"_uetsid", "_uetvid": used for the same purposes as the corresponding cookies;
"_uetsid_exp", "_uetvid_exp": information about the expiration date of the information in local storage.

The legal basis for this data processing is your consent in accordance with Art. 6 (1) lit. a GDPR. Access to and storage of information on your device is based on the implementation laws of the ePrivacy Directive of EU member states, in Germany, according to § 25 para. 1 TTDSG. The transfer of your data to the USA is based on an adequacy decision (Microsoft Corporation is certified under the EU-US Data Privacy Framework).

Further information can be found in Microsoft's privacy policy: Microsoft Privacy Statement.

3.5.4. Leadfeeder - B2B visitor identification

On our website, we utilise the service Leadfeeder from Finnish company Liidio Oy / Leadfeeder, located at Keskuskatu 6 E, 00100 Helsinki, Finland ("Leadfeeder"). This service allows us to identify the names of companies visiting our website, enabling us to implement more targeted B2B marketing initiatives. It involves recording the behaviour of website visitors, such as the pages they visit, their origin, and the duration of their stay on our website. Additionally, the IP addresses of visitors are recorded to determine the company and geographic location. To achieve this, cookies and local storage are also used.

Leadfeeder performs the service as a subcontractor of Pipedrive OÜ Mustamäe tee 3a 10615 Tallinn Estonia, with whom we have concluded a contract for processing. All data is stored by Leadfeeder in encrypted form in the European Union and transmitted in encrypted form.

The following cookies are set and read by Leadfeeder for the specified purpose with the respective storage period:

"_lfa" (24 months): Visitor recognition

The following information in local storage is stored and read by Leadfeeder:

"_lfa_expiry": Contains the expiry date for the cookie described above.

The legal basis for this data processing is your consent in accordance with Art. 6 para. 1 lit. a GDPR.

4.1. Online presence on social networks

We maintain an online presence on social networks to communicate with customers and interested parties and to provide information about our products and services.

User data is typically processed by the respective social networks for market research and advertising purposes. This allows user profiles to be created based on user interests. For this purpose, cookies and other identifiers are stored on users' computers. Based on these user profiles, advertisements can be displayed within the social networks and on third-party websites.

As part of operating our online presences, we may have access to information such as statistics on the usage of our online presences provided by the social networks. These statistics are aggregated and may include demographic information (e.g., age, gender, region, country), as well as data on interaction with our online presences (e.g., likes, subscriptions, shares, viewing of images and videos), and the content and posts shared on them. This information can also provide insights into the interests of users and which content and topics are particularly relevant to them. We may use this information to adapt the design and content of our online presence and optimize it for our audience. Details and links to the data provided by the social networks that we can access as operators of the online presences can be found in the list below. The collection and use of these statistics is usually subject to joint responsibility. If applicable, the respective contract is listed below.

The legal basis for data processing is Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in effective information and communication with users, or Art. 6 para. 1 lit. b GDPR, to stay in contact with our customers, inform them, and conduct pre-contractual activities with future customers and interested parties.

If you have an account with the social network, it is possible that we can see your publicly available information and media when we access your profile. In addition, the social network may allow us to contact you under certain circumstances. This can be done through direct messages or through posted posts. The content communication via the social network and the processing of content data is the responsibility of the social network as a messenger and platform service. Once we import or further process your personal data into our own systems, we are independently responsible for it, and this is done to perform pre-contractual activities and fulfill a contract in accordance with Art. 6 para. 1 lit. b GDPR.

Please refer to the data protection information of the respective social network for the legal basis of data processing carried out by the social networks in their own responsibility. You can also find more information about the respective data processing and how to object to it through the links below.

We would like to point out that data protection inquiries are most efficiently addressed to the respective provider of the social network, as only these providers have access to the data and can directly take corresponding measures.

Below is a list of information about the social networks on which we maintain online presences::

4.2. Forms for inquiries and registrations on LinkedIn.

On the social network LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, we use LeadGen Forms. These are advertisements on LinkedIn with integrated form fields. LeadGen Forms allow you to directly sign up for our services and events or make inquiries through the advertisements. This includes the request for a demo of our software in particular.

In the provided form field, you can voluntarily enter your contact information, such as your name, company, and email address, so that we can contact you. This allows us to send you the date and link for the demo or the information to participate in our events.

Data processing in this context is LinkedIn's own responsibility as the platform operator and as a telecommunications service provider for sending and receiving messages on LinkedIn. You can voluntarily choose to enter your contact information via the LeadGen Forms. We expressly point out that you can also contact us at any time through the contact options on our website.

If we process the data you entered in the LeadGen Forms for the purposes mentioned above on our own responsibility, this is based on our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR, to inform you about our services and to contact you through our ads, or based on Art. 6 para. 1 lit. b GDPR , to initiate a contract with you.

For further information regarding data processing on LinkedIn, please refer to their privacy policy:: https://de.linkedin.com/legal/privacy-policy.

The disclosure of the data we collect generally only occurs when there is a legal basis for data protection, especially in cases where: