Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection provisions, is:

Toleron, [Legal form, e.g. GmbH], IFC – Innovations- und Forschungs-Centrum, Katharinenstraße 2, 78532 Tuttlingen, Germany.

Phone: [Phone number]. E-mail: info@toleron.de.

Authorised managing director(s): [Authorised managing director(s)].

Data protection officer: [Data protection officer, if appointed].

2. General Information on Data Processing and Definitions

As a general rule, we only process personal data of our users to the extent necessary to provide a functional website and our content and services, or where we have obtained the user's express consent to do so. The processing of our users' personal data regularly takes place only with the user's consent pursuant to Art. 6 (1)(a) GDPR, for the performance of a contract or pre-contractual measures pursuant to Art. 6 (1)(b) GDPR, or insofar as processing is necessary to safeguard our legitimate interests and the interests, fundamental rights and freedoms of the user do not override those interests, pursuant to Art. 6 (1)(f) GDPR.

"Personal data" means any information relating to an identified or identifiable natural person, such as name, IP address or e-mail address. "Processing" means any operation performed on personal data, whether or not by automated means, such as collection, storage or transmission.

3. Hosting and Server Log Files

This website is operated as a containerised application on Google Cloud Run, a service provided by Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland ("processor"). Processing takes place in the region europe-west1 (Belgium, European Union); the server infrastructure is therefore located within the EU.

A data processing agreement pursuant to Art. 28 GDPR has been concluded with the processor. Should personal data exceptionally be transferred to third countries within the scope of this processing arrangement, such transfer is based on the EU Standard Contractual Clauses issued by the European Commission or an equivalent adequacy mechanism.

Each time our website is accessed, the hosting service automatically collects information in what are known as server log files, which your browser automatically transmits. These are: IP address, date and time of the request (timestamp), the requested URL or resource, the user agent (browser and operating system identifier), and the referrer URL (previously visited page).

This data is processed to ensure the smooth operation of the website, to deliver the requested content, to ensure system security and stability, and to defend against attacks and misuse. The legal basis is our legitimate interest pursuant to Art. 6 (1)(f) GDPR in the technically error-free presentation and the security of our website.

This data is not combined with other data sources. The server log files are retained for the period necessary for operation and security purposes and are then deleted or anonymised.

4. Contact (Contact Form and E-mail)

On our website we provide a contact form through which you can get in touch with us. In the form we collect the following data: name, company (optional), e-mail address, message, and optionally a subject/topic for your enquiry. Mandatory fields are marked accordingly; all other information is provided voluntarily.

The data you enter in the contact form is transmitted by e-mail to Toleron and processed to handle and respond to your enquiry. If you instead contact us by e-mail at info@toleron.de, the personal data transmitted in that context is processed in the same manner.

Together with your message we transmit the page from which you submitted the form, your IP address and your browser identifier (user agent). We use this information to fend off misuse (spam) and to classify your enquiry; the legal basis is our legitimate interest pursuant to Art. 6 (1)(f) GDPR.

If you have consented to the "Statistics" category, your enquiry additionally includes how you reached our website (landing page, referrer, campaign parameters) and which pages you viewed in the current session, so that we can understand which content was relevant to your enquiry. The legal basis for this is your consent pursuant to Art. 6 (1)(a) GDPR.

The legal basis for the processing is Art. 6 (1)(b) GDPR, insofar as the contact serves to initiate or perform a contract. In all other cases, the processing is based on our legitimate interest in responding to enquiries pursuant to Art. 6 (1)(f) GDPR.

We do not send any newsletter via the contact form and do not use the submitted data for advertising purposes. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected, i.e. generally once the respective enquiry has been conclusively handled and no further clarification is required. This is without prejudice to statutory retention obligations, in particular under commercial and tax law.

5. Local Storage in the Browser (localStorage) and Consent Management

We store your decisions in the consent banner and on our "Cookie & Privacy Settings" page — for example regarding statistics and marketing services or loading the external map view — in your browser's local storage (localStorage), not in a cookie.

This is technically necessary storage that allows us to recognise your chosen selection on a subsequent visit to the website, so that you do not have to make it again. Only your consent or refusal decisions are stored; no tracking of your usage behaviour takes place.

The legal basis for this technically necessary storage is § 25 (2) of the German Telecommunications-Digital-Services-Data-Protection Act (TDDDG) in conjunction with our legitimate interest pursuant to Art. 6 (1)(f) GDPR in a user-friendly and functional management of your settings.

The data stored in localStorage remains exclusively on your device and is not transmitted to us or to third parties. You can delete this data at any time via your browser settings. You may also change or withdraw your consent decisions at any time via our "Cookie & Privacy Settings" page.

6. Integration of OpenStreetMap (External Map View)

On our contact page, we would like to show you the location of our company using an interactive map. For data protection reasons, the map is not loaded automatically. Instead, only a placeholder is initially displayed.

Only once you actively click the "Load map" button is a map view loaded from the provider OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom ("OSMF"). Loading the map establishes a connection to OSMF's servers, in the course of which your IP address is transmitted to OSMF. Without this transmission, the map could not be technically displayed.

As the United Kingdom is a third country outside the European Union, we note that an adequacy decision by the European Commission pursuant to Art. 45 GDPR exists for the United Kingdom, ensuring a level of protection comparable to the EU data protection standard.

The legal basis for loading the map and the associated data transfer is your explicit consent pursuant to Art. 6 (1)(a) GDPR, which you grant by clicking "Load map". You may withdraw this consent at any time with effect for the future via our "Cookie & Privacy Settings" page; the lawfulness of processing carried out prior to the withdrawal remains unaffected.

Further information on data protection at OpenStreetMap can be found in the OpenStreetMap Foundation's privacy policy.

7. Fonts

For a consistent and accessible display of typefaces, we use so-called web fonts. These fonts are exclusively self-hosted: they are permanently bundled into our website and embedded into our application already at build time.

At no point is a connection established to Google Fonts servers or any other external font provider. Consequently, when you access our website, no data — in particular no IP address — is transmitted to third parties for the purpose of providing fonts.

8. Analytics and Marketing Services (Only With Your Consent)

On your first visit, a consent banner asks whether we may use optional services. The "Statistics" category covers Google Analytics and Microsoft Clarity. Until you agree, none of these services is loaded and no corresponding cookies are set. Accepting and rejecting are equally easy; rejecting has no disadvantage for using the website.

The legal basis for storing information on your device and accessing it is § 25 (1) TDDDG; for the subsequent processing of personal data it is Art. 6 (1)(a) GDPR. You may withdraw your consent at any time with effect for the future via the "Cookie & Privacy Settings" page (linked in the footer of every page); cookies already set by these services are then deleted as far as technically possible. The lawfulness of processing carried out before the withdrawal remains unaffected.

Where the providers process data in the USA, the transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which the respective US companies are certified.

If you have consented to the "Statistics" category, we additionally keep, in your browser's session storage (sessionStorage), the page and referral (referrer, campaign parameters such as utm_source) through which you reached our website and the pages you have viewed in this session. This information is deleted when you close the browser and only leaves your device if you send us an enquiry via the contact form (see section "Contact").

9. Web Analytics With Google Analytics 4

If you have consented to the "Statistics" category, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It lets us analyse how our website is used in order to improve it and to measure the success of our content and campaigns.

The data processed includes in particular: pages viewed and time spent, scroll depth, clicks on external links and e-mail addresses, downloads, the origin of the visit (referrer, campaign parameters), approximate location (country, region, city — derived from the IP address), information on device, operating system, browser, language and screen resolution, and a pseudonymous identifier that recognises your browser on later visits. We also record whether an enquiry was sent via the contact form (without its content). According to Google, Google Analytics 4 does not store the IP addresses of users in the EU.

For this purpose Google sets the cookies _ga and _ga_<ID> with a lifetime of up to 2 years. Event data stored in Google Analytics is deleted automatically after 14 months. We have concluded a data processing agreement with Google.

Google also processes the data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent pursuant to Art. 6 (1)(a) GDPR and § 25 (1) TDDDG, which you may withdraw at any time with effect for the future. Further information: https://policies.google.com/privacy

10. Usage Analysis With Microsoft Clarity (Heatmaps and Session Recordings)

If you have consented to the "Statistics" category, we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft").

Clarity records how visitors interact with our website — in particular mouse movements, clicks, scrolling, pages viewed and time spent — and presents this as heatmaps and as replays of individual visits (session recordings). It also processes information on device, browser, operating system and screen size, the referrer, and approximate location (country). Input in the contact form is masked and not recorded.

For this purpose Clarity sets the cookies _clck (lifetime 1 year) and _clsk (1 day) as well as cookies on the clarity.ms domain, so that page views can be assigned to a session and to returning visits. According to Microsoft, session recordings are deleted after 30 days and aggregated reports after 13 months.

Microsoft also processes the data in the USA; Microsoft Corporation is certified under the EU-US Data Privacy Framework. The legal basis is your consent pursuant to Art. 6 (1)(a) GDPR and § 25 (1) TDDDG, which you may withdraw at any time with effect for the future. Further information: https://privacy.microsoft.com/en-us/privacystatement

11. Storage Period

Unless a more specific storage period has been stated in this policy, your personal data will only be stored by us for as long as necessary for the respective processing purpose. Where the data is required for the performance of contractual or statutory obligations, the storage period is determined by the applicable statutory retention periods; upon expiry of these periods, the data is routinely deleted, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in its continued storage.

12. Your Rights as a Data Subject

You have the following rights vis-à-vis us as the controller with regard to the processing of your personal data:

• The right of access to the data stored about you, pursuant to Art. 15 GDPR
• The right to rectification of inaccurate or completion of incomplete personal data, pursuant to Art. 16 GDPR
• The right to erasure of your personal data stored by us, pursuant to Art. 17 GDPR
• The right to restriction of the processing of your personal data, pursuant to Art. 18 GDPR
• The right to data portability, provided you have consented to the processing or the processing is carried out to perform a contract, pursuant to Art. 20 GDPR
• The right to object to the processing of your personal data, insofar as it is based on Art. 6 (1)(f) GDPR, pursuant to Art. 21 GDPR
• The right to withdraw any consent given at any time with effect for the future, pursuant to Art. 7 (3) GDPR, without affecting the lawfulness of processing carried out prior to the withdrawal
• The right to lodge a complaint with a data protection supervisory authority, pursuant to Art. 77 GDPR

13. Competent Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

14. Data Security

During your visit to the website, we use the widely adopted Transport Layer Security (TLS) encryption protocol, in its respective current version, which encrypts the entire connection to our hosting provider. This is typically 256-bit encryption. Whether an individual page of our website is transmitted in encrypted form can be recognised by the closed padlock or key symbol in your browser's address bar.

We further employ appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or against unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

15. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to ensure that it always complies with current legal requirements, or to reflect changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to your next visit.

The date of the current version of this privacy policy is stated at the top of this page.