1. Preamble

We, AIR GmbH, wish to provide you with the following information to give you an overview of the collection, use and processing of your personal data when using our website and your rights under data protection laws.

In principle, it is possible to use our website without entering personal data.

However, if you intend to use special services of our company via the website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain your consent.

The processing of personal data, such as your name, address or e-mail address, is always carried out in accordance with the General Data Protection Regulation (GDPR) and with the country-specific data protection provisions applicable to “AIR GmbH”. We have implemented numerous technical and organisational measures to ensure the most comprehensive protection of the personal data processed. Nevertheless, internet-based data transmissions can always have security gaps, so that absolute protection cannot be guaranteed. For this reason, you are also free to send us personal data by alternative means, for example by telephone or by post.

2. Responsibility

The Data Controller within the meaning of the GDPR is:
AIR GmbH
Julius-Hatry-Straße 1
68163 Mannheim, Germany
Phone: 0621 490 85 70
E-Mail: kontakt@air-gmbh.com

Representative of the Date Controller
Horst Schneider

3. Data Protection Officer

You can contact our Data Protection Officer directly at any time with all questions and suggestions regarding data protection:

Dipl.-Kfm. Guido Babinsky
E-Mail: datenschutz@air-gmbh.com

4. Legal basis of processing
We process your personal data in accordance with the provisions of the GDPR and any national laws, including the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).

Art. 6 no. 1 (a) GDPR, in conjunction with section 15 (3) of the Telemedia Act (Telemediengesetz – TMG), serves as our legal basis for processing of data in the context of which we obtain consent for a specific processing purpose.

If the processing of personal data is necessary for the performance of a contract to which you are a party, as is the case, for example, with processing related to the delivery of goods or the provision of another service or consideration, the processing is based on Art. 6 no.1 (b) GDPR. The same applies to data processing that is necessary for the implementation of pre-contractual measures, for example, in cases of information requests about our products or services.

If our company is subject to a legal obligation through which the processing of personal data becomes necessary, such as for the fulfilment of tax obligations, the processing is based on Art. 6 no. 1 (c) GDPR.

In rare cases, the processing of personal data may become necessary to protect vital interests of the Data Subject or another natural person. This would be the case, for example, if a visitor were to be injured on our premises and, as a result, their name, age, health insurance details or other vital information needed to be passed on to a doctor, hospital or other third party. Then the processing would be based on Art. 6 no. 1 (d) GDPR.

Ultimately, data processing could be based on Art. 6 no. 1 (f) GDPR. Processing that is not covered by any of the aforementioned legal statutes is based on the above provision if the processing is necessary to protect a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the Data Subject are not predominant We are permitted to carry out such processing in particular because it has been specifically mentioned by European law. In this respect, European legislation takes the view that a legitimate interest can be assumed if the Data Subject is a customer of our company (recital 47, sentence 2 GDPR).

5. Transmission of data to third parties
Your personal data will not be transmitted to third parties for purposes other than those listed below.
We will only share your personal data with third parties if:

• you have given your express consent in accordance with Art. 6 no. 1 sentence 1 (a) GDPR,
• the disclosure is permissible in accordance with Art. 6 no. 1 sentence 1 (f) GDPR to protect our legitimate interests and there is no reason to assume an overriding interest worthy of protection in the non-disclosure of your data,
• there is a legal obligation for the disclosure pursuant to Art. 6 no. 1 sentence 1 (c) GDPR, or
• such disclosure is legally permissible and necessary according to Art. 6 no. 1 sentence 1 (b) GDPR for the processing of contractual relationships with you.
  To protect your data and allow us to transmit data to third countries (outside the EU/EEA) where appropriate, we have entered into data processing agreements based on the European Commission's standard contractual clauses.

6. Hosting
Wir hosten unsere Webseite bei Raidboxes. Anbieter ist die Raidboxes GmbH, Hafenstr. 32, 48153 Münster, Deutschland (nachfolgend: „Raidboxes“). Wenn du unsere Website besuchst, erfasst Raidboxes verschiedene Logfiles inklusive deiner IP-Adresse. Details kannst du der Datenschutzerklärung von Raidboxes entnehmen: https://raidboxes.io/datenschutzerklaerung/

Die Verwendung von Raidboxes erfolgt auf Grundlage von Art. 6 Abs. 1 lit. f DSGVO. Wir haben ein berechtigtes Interesse an einer möglichst zuverlässigen Darstellung unserer Website. Sofern eine entsprechende Einwilligung abgefragt wurde, erfolgt die Verarbeitung ausschließlich auf Grundlage von Art. 6 Abs. 1 lit. a DSGVO; die Einwilligung ist jederzeit widerrufbar.

Auftragsverarbeitung
Wir haben einen Vertrag über Auftragsverarbeitung (AVV) mit Raidboxes geschlossen. Dieser Vertrag regelt Umfang, Art und Zweck der Zugriffsmöglichkeiten von Raidboxes auf Daten. Die Zugriffsmöglichkeiten beschränken sich dabei nur auf notwendige Zugriffe, die zur Erfüllung der Hosting-Leistungen erforderlich sind.

7. Technology

7.1 SSL/TLS encryption
This site uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as: orders, login data or contact requests that you send to us. You can recognise an encrypted connection by the fact that the address line of the browser contains a "https://" instead of a "http://" and by the lock symbol in your browser.

We use this technology to protect your transmitted data.

7.2 Data collection when visiting the website
When using our website for information purposes only (i.e. if you do not register or otherwise provide us with information), we only collect the data that your browser transmits to our hosting server (in so-called “server log files”). Our website collects an assortment of general data and information each time you or an automated system access(es) a page. This general data and information is stored in the server's log files. The following can be recorded:

• browser types and versions used,
• the operating system used by the accessing system,
• the website from which an accessing system arrives at our website (so-called “referrer”),
• the sub-sites on our website that are accessed via an accessing system,
• the date and time of access to the website,
• an abbreviated internet protocol address (anonymised IP address),
• the internet service provider of the accessing system.

When using this general data and information, we do not gain any details about your person. Rather, this information is needed to

• Correctly deliver the contents of our website,
• optimise the content of our website and the advertising for it,
• ensure the permanent operability of our IT systems and the technology of our website, and
• provide law enforcement authorities with the information necessary for prosecution in the event of a cyber-attack.

Therefore, the data and information collected will be used by us for statistical purposes only and with the aim of increasing the data protection and data security of our company so as to ensure an optimal level of protection for the personal data we process. The anonymous data in the server log files is stored separately from any personal data provided by a Data Subject.

The legal basis for data processing is Art. 6 no. 1 sentence 1 (f) GDPR. Our legitimate interest follows from the data collection purposes listed above.

8. Cookies

8.1 General
We use cookies on our website. These are small files that your browser automatically creates and that are stored on your IT system (laptop, tablet, smartphone or similar) when you visit our site.

Information is stored in the cookie that arises in each case in connection with the specific end device used. This does not mean, however, that we gain direct knowledge of your identity.

The use of cookies serves to make the use of our offering more convenient for you. For instance, we use so-called session cookies to recognise that you have already visited individual pages of our website. These are automatically deleted after you leave our site.

To optimise user-friendliness, we also use temporary cookies, which are stored on your end device for a certain fixed period of time. If you visit our site again to use our services, it is automatically recognised that you have already been with us and which entries and settings you have made, so that you do not have to enter them again.
Moreover, we use cookies to statistically track the use of our website and to evaluate website use statistics for the purpose of optimising our offering to you. These cookies enable us to automatically recognise that you have already been to our site when you visit it again. These cookies are automatically deleted after a defined period of time.

8.2 Legal basis for the use of cookies
The data processed by cookies required for the proper functioning of the website is thus necessary to protect our legitimate interests as well as those of third parties in accordance with Art. 6 no. 1 sentence 1 (f) GDPR.

For all other cookies, your consent within the meaning of Art. 6 no. 1 (a) GDPR is given or denied via our opt-in cookie banner.

9. Contact / Contact form
Personal data is collected when you contact us (e.g. via contact form or e-mail). Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of answering your request or for contacting you, and for the associated technical processes. The legal basis for the processing of the data is our legitimate interest in responding to your request in accordance with Art. 6 no. 1 (f) GDPR. If your contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6 no.1 (b) GDPR. Your data will be deleted after your enquiry has been processed. This is the case when the circumstances indicate that the matter in question has been conclusively clarified and provided that there are no statutory storage obligations to the contrary.

10. Newsletter

We use marketing e-mails (hereinafter: “newsletter”) to introduce you to new AIRboard news and features that are of interest to you and to inform you about current events in the world of finance. Which personal data is transmitted to us when ordering the newsletter is determined by the input mask used for this purpose.

Our newsletter can only be received by you if

• you have a valid e-mail address and
• you have registered for the newsletter.

For legal reasons, a confirmation e-mail will be sent to the e-mail address you initially entered to register for the newsletter, using the double opt-in procedure. This confirmation e-mail is used to ascertain whether you, as the owner of the e-mail address, have indeed authorised receipt of the newsletter.

If you confirm your e-mail address, we store your e-mail address, the time of registration and the IP address used for registration. The collection of this data is necessary in order to trace any misuse of your e-mail address at a later date and therefore serves our legal protection.

The personal data collected in the context of a registration for the newsletter is used exclusively for sending our newsletter. Furthermore, subscribers to the newsletter could receive information by e-mail if this is necessary for the operation of the newsletter service or a related registration, as could be the case in the event of changes to the newsletter offering or changes in the technical circumstances. No personal data collected as part of the newsletter service will be passed on to third parties. You can cancel your subscription to our newsletter at any time. The consent to the storage of personal data that you have given us for sending the newsletter can be revoked at any time. For the purpose of revoking consent, a corresponding link can be found in each newsletter. Furthermore, it is possible to unsubscribe from the newsletter at any time directly on our website or to inform us of this in another way.

Es erfolgt keine Weitergabe der im Rahmen des Newsletter-Dienstes erhobenen personenbezogenen Daten an Dritte. Das Abonnement unseres Newsletters kann durch Sie jederzeit gekündigt werden. Die Einwilligung in die Speicherung personenbezogener Daten, die Sie uns für den Newsletter-Versand erteilt haben, kann jederzeit widerrufen werden. Zum Zwecke des Widerrufs der Einwilligung findet sich in jedem Newsletter ein entsprechender Link. Ferner besteht die Möglichkeit, sich jederzeit auch direkt auf unserer Internetseite vom Newsletter Versand abzumelden oder uns dies auf andere Weise mitzuteilen.

The legal basis of data processing for the purpose of sending the newsletter is Art. 6 no. 1 (a) GDPR.

11. Our activities in social networks
So that we can also communicate with you in social networks and inform you about our services, we have our own social media pages. If you visit one of our social media sites, we are jointly responsible with the provider of the respective social media platform within the meaning of Art. 26 GDPR for the related processing of personal data.
We are not the original provider of these sites, but merely use them within the scope of the possibilities offered to us by the respective providers.

Therefore, as a precautionary measure, please note that your data may also be processed outside the European Union or the European Economic Area. Use of these platforms may therefore entail data protection risks for you, as it may be more difficult to protect your rights, e.g. to information, deletion, objection, etc., and the processing in the social networks often directly serves advertising purposes or is used for the analysis of user behaviour by the providers, without any ability for influence on our part. If usage profiles are created by the provider, cookies are often used or the usage behaviour is directly assigned to your own member profile within the social networks (provided you are logged in).

The described processing of personal data is carried out in accordance with Art. 6 no. 1 (f) GDPR on the basis of our legitimate interest and the legitimate interest of the respective provider in order to be able to communicate with you in a timely manner or to inform you about our services. If you have to give your consent to data processing as a user with the respective providers, the legal basis is Art. 6 no. 1 (a) GDPR in conjunction with Art. 7 GDPR.

As we do not have access to the providers' databases, we would like to point out that it is best to exercise your rights (e.g. to information, correction, deletion, etc.) directly with the respective provider. Further information on the processing of your data in the social networks and the possibility of making use of your right to reject or revoke consent (opt-out) is listed below under the respective social network provider:

11.1 LinkedIn
(co-) controller for data processing in Europe:
LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Irland

Privacy Policy:
https://www.linkedin.com/legal/privacy-policy

Opt-out and advertising settings:
https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

11.2 YouTube
(co-) controller for data processing in Europe:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland

Privacy Policy:
https://policies.google.com/privacy

Opt-out and advertising settings:
https://adssettings.google.com/authenticated

11.3 Instagram
(co-) controller for data processing in Germany:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland

Privacy Policy (Data Policy):
https://instagram.com/legal/privacy/

12. Web analytics
12.1 Google Analytics
On our websites, we use Google Analytics, a web analytics service provided by Google Ireland Limited (https://www.google.de/intl/de/about/https://www.google.de/intl/de/about/) (Gordon House, Barrow Street, Dublin 4, Ireland; hereinafter "Google"). In this context, “pseudonymised” usage profiles are created and cookies (see section “Cookies”) are used. The information generated by the cookie about your use of this website, such as your

• browser type/version,
• operating system used,
• referrer URL (the previously visited page),
• host name of the accessing computer (IP address),
• time of the server request,

are transferred to a Google server in the USA and stored there. The information is used to evaluate the use of the website, to compile reports on website activity and to provide other services associated with website and internet use for the purposes of market research and demand-oriented design of these internet pages. This information may also be transferred to third parties if this is required by law or if third parties process this data on our behalf. Under no circumstances will your IP address be merged with other Google data. The IP addresses are anonymised, so that an attribution is not possible (IP masking).

You may refuse the use of cookies by selecting the appropriate settings on your browser; however, please note that if you do this you may not be able to use the full functionality of this website.
These processing operations are only carried out when explicit consent is given in accordance with Art. 6 no. 1 (a) GDPR.
You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing a browser add-on: (https://tools.google.com/dlpage/gaoptout?hl=de).

As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent Google Analytics from collecting data by clicking on the following link: deactivate Google Analytics. An opt-out cookie will be set to prevent future collection of your data when visiting this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the opt-out cookie again.
Further information on data protection in connection with Google Analytics can be found in the Google Analytics Help section (https://support.google.com/analytics/answer/6004245?hl=de).

13. Plugins and other services

13.1 Google Tag Manager
This website uses Google Tag Manager, a cookie-less domain that does not collect any personal data.

With this tool, “website tags” (i.e. keywords that are integrated into HTML elements) can be implemented and managed via an interface. By using the Google Tag Manager, we can automatically track which button, link or personalised image you have actively clicked on and can record which contents of our website are particularly interesting for you.
The tool also triggers other tags, which in turn may collect data. Google Tag Manager does not access this data. If you have implemented a deactivation at domain or cookie level, this remains in place for all tracking tags that are implemented with Google Tag Manager.

These processing operations are only carried out when explicit consent is given in accordance with Art. 6 no. 1 (a) GDPR.

13.2 YouTube (Videos)
We have integrated YouTube components on this website. YouTube is an internet video portal that allows video publishers to post video clips free-of-charge and other users to view, rate and comment on them free-of-charge. YouTube allows the publication of all kinds of videos, which is why complete film and television programmes, but also music videos, trailers or videos made by users themselves can be accessed via the internet portal.

The operating company of YouTube is YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Each time you access one of the individual pages of this website operated by us on which a YouTube component (YouTube video) has been integrated, the internet browser on your IT system is automatically prompted by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. Further information on YouTube can be found at https://www.youtube.com/yt/about/de/ . As part of this technical process, YouTube and Google receive information about which specific sub-page of our website is visited by you.

If the Data Subject is logged into YouTube at the same time, YouTube recognises which specific sub-page of our website you are visiting when you call up a sub-page that contains a YouTube video. This information is collected by YouTube and Google and assigned to your YouTube account.

YouTube and Google always receive information via the YouTube component that you have visited our website if you are logged into YouTube at the same time as calling up our website; this takes place regardless of whether you click on a YouTube video or not. If you do not want this information to be transmitted to YouTube and Google, you can prevent the transmission by logging out of your YouTube account before accessing our website.
These processing operations are only carried out when explicit consent is given in accordance with Art. 6 no. 1 (a) GDPR.

The Privacy Policy published by YouTube, which can be found at
https://www.google.de/intl/de/policies/privacy/ provides information on the collection, processing and use of personal data by YouTube and Google.

13.3 HubSpot
We use the integrated software solution HubSpot for our online marketing activities. These include e-mail marketing, social media publishing, contact management, landing pages and contact forms.

HubSpot is a software company from the USA with a branch in Ireland:

HubSpot
2nd Floor 30 North Wall Quay,
Dublin 1, Ireland
Phone: +353 1 5187500.

Our website allows visitors to our site to learn more about our company, download content and provide their contact information and other information. This information as well as the content of our website is stored on servers of our software partner HubSpot. They may be used by us to contact visitors to our website and to determine which of our company's services are of interest to them.

We use all information collected exclusively to optimise our marketing measures. As part of the optimisation of our marketing measures, the following data may be collected and processed via HubSpot:

• Aggregated use
• Login information for the HubSpot subscription service
• Pages viewed
• Operating system
• Browser type
• Clickstream data
• Files displayed on site
• Duration of the visit
• Domain names
• Events that occur within the application
• Geographical position
• Device identifier
• Device model and version
• Information about how often the application is used
• Information about where the application was downloaded from
• Internet service provider
• IP address
• Performance data
• Mobile apps data
• Navigation information
• Operating system version
• Referrer URL
• Access times

In addition, we also use HubSpot to provide contact forms.

The legal basis for processing your data via HubSpot is your consent in accordance with Art. 6 no. 1 (a) GDPR. If you do not wish the aforementioned data to be collected and processed via HubSpot, you can refuse your consent or revoke it at any time with effect for the future.

Your personal data will be kept for as long as necessary to fulfil the purpose of the processing. The data is deleted as soon as it is no longer required to achieve the purpose.

Within the scope of processing via HubSpot, data may be transmitted to the USA. The transfer is secured via so-called “standard contractual clauses”, which ensure that the processing of personal data complies with a security level equivalent to that of the GDPR. If the standard contractual clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49 no. 1 (a) GDPR can serve as the legal basis for the transfer to third countries.

HubSpot is certified under the terms of the “EU - U.S. Privacy Shield Framework” and is subject to TRUSTe ‘s Privacy Seal and the “U.S. - Swiss Safe Harbor” Framework.

You can find more information about data protection at HubSpot here:
https://legal.hubspot.com/de/privacy-policy

You can find more information about GDPR compliance at HubSpot here:
https://legal.hubspot.com/de/security

For more information about the cookies used by HubSpot, please visit:
https://knowledge.hubspot.com/de/reports/what-cookies-does-hubspot-set-in-a-visitor-s-browser
and at:
https://knowledge.hubspot.com/de/account/hubspot-cookie-security-and-privacy

 

Deactivate tracking
If you do not want your usage data to be collected by HubSpot and Google Analytics, you can deactivate the tracking of both tools by clicking on the link below. An opt-out cookie will be set to prevent future collection of your data when visiting this website.

Deactivate tracking by HubSpot:
https://air-gmbh.de/#consent-change

14. Your rights as a Data Subject
14.1 Right to confirmation
You have the right to request confirmation from us as to whether personal data relating to you is being processed.

14.2 Right to information Art. 15 GDPR
You have the right to receive free information from us at any time about the personal data stored about you, as well as a copy of this data in accordance with the statutory provisions.

14.3 Right to rectification Art. 16 GDPR
You have the right to request the rectification of inaccurate personal data concerning you. You also have the right to request the completion of incomplete personal data, taking into account the purposes of the processing.

14.4 Deletion Art. 17 GDPR
You have the right to demand that we delete the personal data concerning you without delay, provided that one of the reasons provided for by law applies and insofar as the processing or storage is not necessary.

14.5 Restriction of processing Art. 18 GDPR
You have the right to demand that we restrict processing if one of the legal requirements is met.

14.6 Data portability Art. 20 GDPR
You have the right to receive the personal data concerning you, which has been provided to us by you, in a structured, commonly used and machine-readable format. You also have the right to transfer this data to another Data Controller without hindrance from us, to whom the personal data has been provided, insofar as the processing is based on consent pursuant to Article 6 no. 1 (a) GDPR or Article 9 no. 2 (a) GDPR or on a contract pursuant to Article 6 no. 1 (b) GDPR and the processing is carried out with the aid of automated tools, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability pursuant to Article 20 no. 1 GDPR, you have the right to have the personal data transferred directly from one Data Controller to another controller, insofar as this is technically feasible and provided that this does not adversely affect the rights and freedoms of other individuals.

14.7 Objection Art. 21 GDPR
You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data relating to you which is carried out on the basis of Art. 6 no. 1 (e) (data processing in the public interest) or (f) (data processing on the basis of legitimate interests) GDPR.

This also applies to profiling based on these provisions within the meaning of Art. 4 no. 4 GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

In individual cases, we process personal data in order to carry out direct advertising. You can object to the processing of personal data for the purpose of such advertising at any time. This also applies to profiling insofar as it is associated with such direct advertising. If you object to us processing your personal data for direct marketing purposes, we will no longer process it for these purposes.

In addition, you have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you by us for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 no. 1 GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

You are free to exercise your right to object in connection with the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures using technical specifications.

14.8 Revocation of consent under data protection law
You have the right to revoke consent to the processing of personal data at any time with effect for the future.

14.9 Complaint to a supervisory authority
You have the right to complain about our processing of personal data to a supervisory authority responsible for data protection.

15. Routine storage, deletion and blocking of personal data

We process and store your personal data only for the period of time necessary to achieve the purpose of storage or as required by the legal provisions to which our company is subject.
If the purpose of storage no longer applies or if a prescribed storage period expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.

16. Duration of the storage of personal data

The criterion for the duration of the storage of personal data is the respective statutory retention period. After expiry of the period, the relevant data is routinely deleted if it is no longer required for the fulfilment or initiation of the contract.

17. Updating and amendment of the privacy policy

This privacy policy is currently valid and is dated: October 2022.

Due to the further development of our website and offerings or due to changes in legal or official requirements, it may become necessary to update or amend this data protection declaration.

The current data protection declaration can be viewed and downloaded at any time on the website at:
https://air-gmbh.com/legal/data-protection .