Privacy policy

We would like to inform you about the relevant data protection aspects when using the "www.diro.eu" page as follows:

1. Information on the occasion of the website visit

The data protection controller is DIRO AG (Große Bleichen 32, 20354 Hamburg, Germany, phone: +49 (0)40 41352231, fax: +49 (0)40 41352294, e-mail: diro(at)diro.eu) (hereinafter "DIRO", "we" or "us").

Your IP address is processed. The processing is carried out for the purpose of being able to present the contents of the website to you. The legal basis for the processing of the data is the protection of legitimate interests pursuant to Article 6 (1) (f) of the EU General Data Protection Regulation (DSGVO) and the processing for the implementation of pre-contractual measures pursuant to Article 6 (1) (b) of the DSGVO, insofar as you request them.

The aforementioned legitimate interest pursuant to Art. 6 para. 1 lit. f DSGVO is that technically mandatory third parties must be involved in transmissions via website (Internet server operator). Without the integration of the third parties, the display of the content in your internet browser is not possible. The involvement of third parties is limited to those directly involved in the communication process.

Your Internet browser may also send us, without our prompting, further data such as the date and time of access or the name and URL of the file accessed, as well as data about your system, e.g. browser type and version, operating system used, name of the access provider, if you have clicked on a hyperlink on a third-party site that refers to our website, the address of this third-party site ("referrer") and the name of your computer. This information is temporarily stored in a so-called log file. This data is processed for the following purposes: Ensuring a smooth connection setup of the website, ensuring a comfortable use of our website, evaluation of system security and stability. The legal basis for the processing of the data is the protection of legitimate interests according to Art. 6 para. 1 lit. f DSGVO.

The aforementioned legitimate interest pursuant to Art. 6 (1) lit. f DSGVO is that we would like to offer you a secure, functioning and conveniently usable website.

DIRO will delete the data immediately after the conclusion of the contact with you, unless otherwise stated below. If you request deletion beforehand, the data will be deleted immediately unless there is another legal basis for the processing.

DIRO uses 3st kommunikation GmbH, Taunusstrasse 59-61, 55118 Mainz, Germany, for the support of the website via order processing. This company acts strictly in accordance with instructions on behalf of DIRO. 3st kommunikation GmbH in turn uses a hosting service provider for the website via order processing, namely Hetzner Online GmbH Industriestr. 25 91710 Gunzenhausen. This hosting service provider in turn acts strictly in accordance with instructions on behalf of 3st kommunikation GmbH.

There is a right to information (Art. 15 DSGVO) as well as to correction (Art. 16 DSGVO) or deletion (Art. 17 DSGVO) or restriction of processing (Art. 18 DSGVO) or a right to object to processing (Art. 21 DSGVO) as well as a right to data portability (Art. 20 DSGVO). The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which are processed by us on the basis of legitimate interests (Art. 6(1)(f) DSGVO) ; this also applies to profiling based on these provisions.

There is a right of appeal to a data protection supervisory authority. If necessary, you have the choice between several data protection supervisory authorities. The data protection supervisory authority responsible for our headquarters in any case is "The Hamburg Commissioner for Data Protection and Freedom of Information."

The provision of personal data by you is neither legally nor contractually required or necessary for the conclusion of a contract. You and the data subject are not obliged to provide the data. Possible consequence if you do not provide the data is that you cannot access the website of DIRO in whole or in part and accordingly cannot perceive the contents.

There is no automated decision-making or profiling according to Art. 22 DSGVO.

Please also note the statements below under "Cookies", "Use of our contact form", "Matomo", "Calenso", "Vimeo", "Links to social media platforms" and "OpenStreetMap".

2. Cookies

Cookies are small identifiers that are sent to your browser and that your computer stores and later transmits back when set appropriately. Partly the cookies come from us, partly from third parties. So-called session cookies are deleted when the browser is closed the next time (i.e. after the "session").

2.1 Technically necessary cookies

Beim Besuch der Website werden von uns technisch notwendige Cookies gesetzt. Darunter versteht man solche Cookies, die grundlegende Funktionen ermöglichen und für die einwandfreie Funktion der Homepage unentbehrlich sind. Dies betrifft auf dieser Website folgendes Cookie:

Stichwort / Namen der Cookies & Gültigkeitsdauer / Anbieter / Einbindung über Dritten / Zweck

Einstellungsspeicherung / DIRO-Multisite-Cookie (1 Jahr) = dd_cookie_consent_status = 1 Jahr / diro.eu / Speichert die vom Nutzer selbst vorgenommenen Einstellungen auf der Seite (z. B. die bevorzugte Sprache) sowie die vom Nutzer zugelassenen Inhalte externer Anbieter. Insoweit werden personenbezogene Daten verarbeitet.

Die Rechtsgrundlage für die mit dem Setzen von technisch notwendigen Cookies verbundene Datenverarbeitung ist die Wahrung berechtigter Interessen gem. Art. 6 Abs. 1 lit. f DSGVO. Die Cookies verwenden wir ausschließlich zur Gewährleistung der einwandfreien Funktion unserer Website. Das genannte berechtigte Interesse gem. Art. 6 Abs. 1 lit. f DSGVO besteht darin, dass wir Ihnen gerne eine ansprechende und nutzerfreundliche Webseite bieten möchten.

Mit dem DIRO Multisite Cookie werden die von Ihnen selbst vorgenommenen Einstellungen auf dieser Website (z. B. die bevorzugte Sprache) sowie die von Ihnen zugelassenen Inhalte externer Anbieter gespeichert. Dabei werden unter dem Verarbeitungsvorgang DIRO_C_FINGERPRINT die IDs der beim letzten Seitenaufruf vorhandenen zustimmungspflichtigen Dienste, sowie deren Konfigurationseinstellungen und die Zuordnung zu Kategorien im Datenschutz Popup (als verschlüsselte Zeichenfolge) erhoben und gespeichert.

Alleiniger Zweck dieser Datenverarbeitung ist die Speicherung der vorgenommenen Einstellungen. Die Speicherung erfolgt für ein Jahr.

2.2 Technically unnecessary cookies

In addition, when visiting the website, depending on your consent, the following - not necessary - cookies may also be used:

Keyword / name of the cookies & validity period / provider / integration via third party / purpose

• OpenStreetMaps (Maps) / _ osm_location = 10 years ; _ pk_id = 1 year / OpenStreetMap Foundation / Display of addresses on a map that is integrated into the website.
• Matomo (usage analysis) / _ pk_id = 13 months ; _ pk_ref = 6 months ; _ pk_ses = 30 minutes / Matthieu Aubry u.a. / Self-hosted / website analytics / Generates statistical information about how the visitor uses the website.
• reCAPTCHA / NID (6 months) / Google Ireland Limited v Google Ireland Limited / The cookie set by Google protects our website from abusive entries in the contact form by automated machine processing.

The legal basis for the setting of technically unnecessary, i.e. statistics and performance-related cookies is your consent, Art. 6 para. 1 lit. a DSGVO.

Among other things, we know your IP address - technically necessary on the Internet. We have no direct possibility to assign the IP address to your person. Despite the communication of the IP address and the setting of cookies, you therefore remain anonymous to us when visiting our websites, as long as you do not consciously additionally communicate your identity to us.

There is a right to information (Art. 15 DSGVO) as well as to correction (Art. 16 DSGVO) or deletion (Art. 17 DSGVO) or restriction of processing (Art. 18 DSGVO) and furthermore a right to data portability (Art. 20 DSGVO) as well as a right to object to processing (Art. 21 DSGVO).

The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which are processed by us ; this also applies to any profiling based on these provisions.

There is a right of appeal to a data protection supervisory authority. If necessary, you have the choice between several data protection supervisory authorities. The data protection supervisory authority responsible for our headquarters in any case is "The Hamburg Commissioner for Data Protection and Freedom of Information."

The provision of personal data by you is neither legally nor contractually required or necessary for the conclusion of a contract. You and the data subject are not obliged to provide the data. Possible consequence if you do not provide the data is that the functions of the website of DIRO will not work completely or partially.

There is no automated decision making or profiling according to Art. 22 DSGVO.

Please note that you can completely prevent the setting of a technically unnecessary cookie by making the appropriate setting in your browser.

Further information about "reCAPTCHA":

In order to protect our website from abusive entries in the contact form by automated machine processing, we use the service reCAPTCHA of the company Google LLC. Using reCAPTCHA, we can detect whether our website is accessed by a human or abusively by a bot.

For this purpose, we send the IP address of your end device (e.g. computer or smartphone) and, if applicable, other data required by Google for the reCAPTCHA service (e.g. click path, user behavior and time spent on our website, browser language, user input, JavaScript objects, browser plug-ins) to Google. Your IP address and other data are sent pseudonymously to a Google server. The IP address transmitted by your browser as part of reCAPTCHA and, if applicable, the above-mentioned other data required by Google for the reCAPTCHA service are not merged with other data from Google.

The legal basis for the processing of the data is your consent pursuant to Art. 6 para. 1 lit. a DSGVO.

Your consent is completely voluntary. You can revoke your given consent at any time, without giving reasons. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. You can declare a revocation e.g. at our premises, by letter to DIRO AG, Große Bleichen 32, 20354 Hamburg or by e-mail to diro(at)diro.eu or fax to the fax number +49 (0) 40 41352293.

There is a right to information (Art. 15 DSGVO) as well as to correction (Art. 16 DSGVO) or deletion (Art. 17 DSGVO) or restriction of processing (Art. 18 DSGVO) and furthermore a right to data portability (Art. 20 DSGVO) as well as a right to object to processing (Art. 21 DSGVO). The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which are processed by us on the basis of legitimate interests (Art. 6(1)(f) DSGVO) ; this also applies to profiling based on these provisions.

There is a right of appeal to a data protection supervisory authority. You may have the choice between several data protection supervisory authorities. The data protection supervisory authority responsible for our headquarters in any case is "The Hamburg Commissioner for Data Protection and Freedom of Information."

The provision of personal data by you is neither legally nor contractually required or necessary for the conclusion of a contract. You and the data subject are not obliged to provide the data. Possible consequence if you do not provide the data is that no maps can be displayed to you.

There is no automated decision making or profiling according to Art. 22 DSGVO.

Please note that by transferring data to Google, the data may be transferred to the USA. There is no data protection law there (equivalent to the European one). Therefore, we cannot guarantee the security of your data. Please therefore also note the data protection provisions of Google, which can be found at https://policies.google.com/privacy.

Please also note the further explanations on "Matomo" and "OpenStreetMap" as well as the other external services below.

We offer a contact form through which you can send us a message. We would be happy to respond to your message. For this, we need your consent to process the data you provide. We inform you on the occasion of the data collection as follows:

Content of the consent you are asked for in the contact form: You consent to DIRO AG storing and using the data you provide in order to respond to your inquiry.

The granting of consent is completely voluntary. You have the right to revoke your consent at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. You can declare a revocation e.g. at our premises, by letter post to DIRO AG, Große Bleichen 32, 20354 Hamburg or by e-mail to diro(at)diro.eu or fax to the fax number +49 (0)40 41352294.

The person responsible under data protection law is DIRO AG (see above).

The processing is carried out for the following purpose: You can contact us via the contact form. This is an alternative, for example, to contacting us by e-mail. We would like to respond to you afterwards. The data concerned is the data you have entered in the contact form (the specification of an e-mail address is required) and additionally for technical reasons: Your IP address, the date and the time. The legal basis for the processing of the data is your consent pursuant to Art. 6 para. 1 lit. a DSGVO, which you give us when you send us a message, and with regard to the integration of transport companies (e.g. if we send you an e-mail to your e-mail address) also the protection of legitimate interests pursuant to Art. 6 para. 1 lit. f DSGVO.

The aforementioned legitimate interest in the involvement of carriers pursuant to Art. 6 para. 1 lit. f DSGVO is that it is technically mandatory to involve third parties in transmissions, in particular via website (Internet server operators) and via e-mail (the Internet server operators on the communication path and the providers of e-mail inboxes). Without the involvement of third parties it is not possible to contact you. The involvement of the third parties is limited to those directly involved in the communication process.

For the support of the Internet presence, DIRO integrates 3st kommunikation GmbH, Taunusstrasse 59-61, 55118 Mainz, Germany, via order processing. This company acts strictly in accordance with instructions on behalf of DIRO. 3st kommunikation GmbH in turn uses a hosting service provider for the website via order processing, namely Hetzner Online GmbH Industriestr. 25 91710 Gunzenhausen. This hosting service provider in turn acts strictly in accordance with instructions on behalf of 3st kommunikation GmbH.

DIRO will delete the data immediately after the contact with you has been completed. If you request deletion beforehand, the data will be deleted immediately unless there is another legal basis for the processing.

There is a right to information (Art. 15 DSGVO) as well as to correction (Art. 16 DSGVO) or deletion (Art. 17 DSGVO) or restriction of processing (Art. 18 DSGVO) or a right to object to processing (Art. 21 DSGVO) as well as a right to data portability (Art. 20 DSGVO). The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which are processed by us on the basis of legitimate interests (Art. 6(1)(f) DSGVO) ; this also applies to profiling based on these provisions. You have the right to object to the processing of data that we process for direct marketing purposes.

You have the right to revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until revocation.

There is a right of appeal to a data protection supervisory authority. If necessary, you have the choice between several data protection supervisory authorities. The data protection supervisory authority responsible for our headquarters in any case is "The Hamburg Commissioner for Data Protection and Freedom of Information."

The provision of personal data by you is neither legally nor contractually required or necessary for the conclusion of a contract. You and the data subject are not obliged to provide the data. Possible consequences if you do not provide the data is that you would have to contact us via another channel for existing questions or comments.

There is no automated decision-making and profiling according to Art. 22 DSGVO.

We use OpenStreetMap maps on the Website. These maps are provided by the OpenStreetMap Foundation, 132 Maney Hill Road, Sutton Coldfield, West Midlands, B72 1JU, United Kingdom, (hereinafter referred to as: "OpenStreetMap"). The integration of the maps on our website is done by means of an iframe or by retrieving the so-called tiles (map images) from the provider's server. As a result, your IP address is transmitted to the OpenStreetMap server. Furthermore, a session cookie is set (for information on cookies, see above in this privacy policy under "Cookies").

We further inform you as follows:

The person responsible under data protection law is DIRO AG (see above).

OpenStreetMap maps are used for the purpose of providing you with map material. It serves to make it easy to find the addresses we provide on the website.

The legal basis for the processing of the data is your consent pursuant to Art. 6 (1) lit. a DSGVO.

Your consent is completely voluntary. You can revoke your given consent at any time, without giving reasons. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. You can declare a revocation e.g. at our premises, by letter to DIRO AG, Große Bleichen 32, 20354 Hamburg or by e-mail to diro(at)diro.eu or fax to the fax number +49 (0) 40 41352293.

There is a right to information (Art. 15 DSGVO) as well as to correction (Art. 16 DSGVO) or deletion (Art. 17 DSGVO) or restriction of processing (Art. 18 DSGVO) and furthermore a right to data portability (Art. 20 DSGVO) as well as a right to object to processing (Art. 21 DSGVO). The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which are processed by us on the basis of legitimate interests (Art. 6(1)(f) DSGVO) ; this also applies to profiling based on these provisions.

There is a right of appeal to a data protection supervisory authority. You may have the choice between several data protection supervisory authorities. The data protection supervisory authority responsible for our headquarters in any case is "The Hamburg Commissioner for Data Protection and Freedom of Information."

The provision of personal data by you is neither legally nor contractually required or necessary for the conclusion of a contract. You and the data subject are not obliged to provide the data. Possible consequence if you do not provide the data is that no maps can be displayed to you.

There is no automated decision-making or profiling according to Art. 22 DSGVO.

For more information, see the privacy policy of the OpenStreetMap Foundation: h ttps://wiki.osmfoundation.org/wiki/Privacy_Policy

Our website uses the analysis service Matomo (formerly Piwik). Matomo is an open source software for statistical analysis of visitor access. By using Matomo, it is possible for us to learn how the website is used. This enables us to continuously improve the quality of our website and its content.

Matomo uses cookies. These text files are stored on your computer and make it possible for us to analyze the use of our website. For this purpose, the information about usage obtained by the cookie is transmitted to our servers and stored so that usage behavior can be evaluated. Information on cookies can be found above under "Cookies". Information on the processing of personal data on the occasion of calling up our website can be found above under "Information on the occasion of calling up the website".

The following data is collected when individual pages of our website are called up:

• 2 bytes of the IP address of the user's calling system.
• The called website
• The website from which the user accessed the accessed website (referrer)
• The subpages that are accessed from the accessed website
• The time spent on the website
• The frequency with which the website is accessed
• It is not possible to draw conclusions about a specific person when using Matomo, as your IP address is anonymized.

The legal basis for the processing of this data is your consent according to Art. 6 para. 1 lit. a DSGVO.

Your consent is completely voluntary. You can revoke your consent at any time without giving reasons. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. You can declare a revocation e.g. at our premises, by letter post to DIRO AG, Große Bleichen 32, 20354 Hamburg or by e-mail to diro(at)diro.eu or fax to the fax number +49 (0) 40 41352293.

If you do not agree to the storage and use of your data, you can deactivate the storage and use here. In this case, an opt-out cookie will be stored in your browser, which prevents Matomo from storing usage data. If you delete your cookies, this will have the effect that the Matomo opt-out cookie will also be deleted. The opt-out must be reactivated when you visit our site again.

Further information about Matomo can be found here: https://matomo.org/faq/general/faq_146/

We further inform you as follows:

The person responsible under data protection law is DIRO AG (see above).

Duration of storage: The data will be deleted immediately as soon as the general statistics, from which your data can no longer be taken in detail, have been compiled. If you request deletion beforehand, the data will be deleted immediately, unless there is another legal basis for the processing.

There is a right to information (Art. 15 DSGVO) as well as to correction (Art. 16 DSGVO) or deletion (Art. 17 DSGVO) or restriction of processing (Art. 18 DSGVO) and furthermore a right to data portability (Art. 20 DSGVO) as well as a right to object to processing (Art. 21 DSGVO). The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which are processed by us on the basis of legitimate interests (Art. 6(1)(f) DSGVO) ; this also applies to profiling based on these provisions.

There is a right of appeal to a data protection supervisory authority. If necessary, you have the choice between several data protection supervisory authorities. The data protection supervisory authority responsible for our headquarters in any case is "The Hamburg Commissioner for Data Protection and Freedom of Information."

The provision of personal data by you is neither legally nor contractually required or necessary for the conclusion of a contract. You and the data subject are not obliged to provide the data. Possible consequence if you do not provide the data is that your data will not be included in the general statistics and cannot be taken into account in the evaluation and thus the improvement of our website.

There is no automated decision-making and profiling according to Art. 22 DSGVO.

We also use the online booking system Calendly. The service provider is the American company Calendly Inc, 115 E. Main St., Ste A1B, Buford, GA 30518, USA.

Calendly also processes your data in the USA. Calendly is an active participant in the EU-US Data Privacy Framework, which regulates the correct and secure transfer of personal data from EU citizens to the USA. You can find more information on this at https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en .

Calendly also uses so-called standard contractual clauses (= Art. 46 (2) and (3) GDPR). Standard Contractual Clauses (SCCs) are templates provided by the EU Commission and are intended to ensure that your data complies with European data protection standards even if it is transferred to third countries (such as the USA) and stored there. Through the EU-US Data Privacy Framework and the Standard Contractual Clauses, Calendly undertakes to comply with the European level of data protection when processing your relevant data, even if the data is stored, processed and managed in the USA. These clauses are based on an implementing decision of the EU Commission. You can find the decision and the corresponding standard contractual clauses here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de .

You can find more information on the standard contractual clauses at Calendly in the data processing conditions at https://calendly.com/dpa .

We hope we have been able to provide you with the most important information about Calendly's data processing. You can find out more about the data that is processed through the use of Calendly in the privacy policy at https://calendly.com/privacy.

Order processing contract (AVV) Calendly

We have concluded a data processing agreement (DPA) with Calendly in accordance with Article 28 of the General Data Protection Regulation (GDPR). You can find out exactly what a DPA is and, in particular, what must be included in a DPA in our general section “Data processing agreement (DPA)”.

This contract is required by law because Calendly processes personal data on our behalf. It clarifies that Calendly may only process data that it receives from us in accordance with our instructions and must comply with the GDPR. You can find the link to the data processing agreement (DPA) at https://calendly.com/dpa .

We use the external service Vimeo on our website. This is a video portal of the US company Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, New York 10001, USA. By embedding Vimeo videos, cookies are set that collect and then store your IP address, browser type, operating system, click behavior and dwell time, among other things, when you call up the video.

The purpose of processing this data is the interactive presentation of various elements, in this case video material.

The legal basis for the processing of the data is your consent pursuant to Art. 6 para. 1 lit. a DSGVO.

Your consent is completely voluntary. You can revoke your given consent at any time, without giving reasons. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation. You can declare a revocation e.g. at our premises, by letter post to DIRO AG, Große Bleichen 32, 20354 Hamburg or by e-mail to diro(at)diro.eu or fax to the fax number +49 (0) 40 41352293.

The data is processed on servers located in the USA. The USA does not have any data protection laws. The security of your data can therefore not be guaranteed. For more details, please refer to the information available at https://vimeo.com/privacy.

We further inform you as follows:

The person responsible under data protection law is DIRO AG (see above).

Duration of storage: The data will be deleted immediately as soon as the general statistics, from which your data can no longer be taken in detail, have been compiled. If you request deletion beforehand, the data will be deleted immediately, unless there is another legal basis for the processing.

There is a right to information (Art. 15 DSGVO) as well as to correction (Art. 16 DSGVO) or deletion (Art. 17 DSGVO) or restriction of processing (Art. 18 DSGVO) and furthermore a right to data portability (Art. 20 DSGVO) as well as a right to object to processing (Art. 21 DSGVO). The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her which are processed by us on the basis of legitimate interests (Art. 6(1)(f) DSGVO) ; this also applies to profiling based on these provisions.

There is a right of appeal to a data protection supervisory authority. If necessary, you can choose between several data protection supervisory authorities. The data protection supervisory authority responsible for our headquarters is "The Hamburg Commissioner for Data Protection and Freedom of Information.

The provision of personal data by you is neither legally nor contractually required or necessary for the conclusion of a contract. You and the data subject are not obliged to provide the data. Possible consequence if you do not provide the data is that your data will not be included in the general statistics and cannot be taken into account in the evaluation and thus the improvement of our website.

There is no automated decision-making and profiling according to Art. 22 DSGVO.

Our website contains links to various social media platforms. This is designed in such a way that your visit to our website alone does not transmit any data to the operators of the platforms. However, platforms may collect data about your visit to our website if you yourself use a page or application of such a platform in the background.

If you click on a link of a social media platform, you will be redirected to the respective platform. On websites other than ours, only the privacy statements of those websites apply.

9. Up-to-dateness and modification of this privacy policy

This privacy policy is currently valid and has the status of March 2023.

Due to the further development of our website and offers on it or due to changed legal or regulatory requirements, it may become necessary to change this privacy policy. You can access and print out the current data protection declaration at any time on the website at diro.eu/datenschutz.html.