Privacy Policy | Expat Advice

This is an English translation of our German privacy policy (Datenschutzerklärung). In case of any discrepancy, the German version published at invia24.com/datenschutz prevails.

Scope

This privacy policy explains the nature, scope and purpose of the processing of personal data (hereinafter referred to as "data") within our online offering and the websites, functions and content connected with it, as well as our external online presences, for example on social media (hereinafter jointly referred to as "online offering").

It applies uniformly to invia24.com and to all portals operated by InVia Medien & Marketing GmbH. The portals display this privacy policy under their own address; the authoritative version is the one published on invia24.com. An overview of the websites covered by this privacy policy is available at invia24.com/portale (in German).

Not every service described here is used on every portal. Which analytics and marketing services are actually active on a portal is shown in the consent management of the respective portal. With regard to the terms used, such as "processing" or "controller", we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

InVia Medien & Marketing GmbH
Am Hubengut 3
76149 Karlsruhe
Germany
Represented by the managing directors Christian Fröhner and Thomas Barth

Contact:
Phone: +49 721 75401200
Email: info@invia24.com

Commercial register:
Registered in the commercial register.
Register court: Amtsgericht Mannheim
Register number: HRB 736134

VAT ID:
VAT identification number pursuant to Section 27a of the German VAT Act (UStG): DE329242914

InVia Medien & Marketing GmbH is registered in the German insurance intermediary register (Vermittlerregister) as an insurance broker licensed under Section 34d (1) of the German Trade Regulation Act (GewO) (registration number D-9V5B-HZJU3-19, competent authority: IHK Karlsruhe, Chamber of Industry and Commerce Karlsruhe). Full details are available in our imprint.

Data protection officer

We have appointed an external data protection officer. You can reach him at:

Mr Daniel Ramirez Ziegler
ERS Rechtsanwaltsgesellschaft mbH
Hahnenstr. 27–29
50171 Kerpen
Germany

Email: datenschutz@ers.law
Phone: +49 2237 97583-0

You may contact our data protection officer directly and confidentially at any time if you have questions about data protection or about exercising your rights.

Description of our core services

InVia Medien & Marketing GmbH offers comparison services on the internet. Interested parties can submit comparison requests for certain products and services. The comparison requests are then forwarded to licensed companies, intermediaries or other providers of these products or services, who in turn may make offers to the interested parties.

Types of data processed

Master data (e.g. names, addresses).
Contact data (e.g. email, phone numbers).
Content data (e.g. text entries and details of the requested product).
Application data, where you submit an application via a portal (e.g. bank details and, only with your explicit consent, health information).
Usage data (e.g. websites visited, interest in content, access times).
Meta and communication data (e.g. device information, IP addresses, campaign identifiers).

Categories of data subjects: visitors and users of the online offering, interested parties who submit a request, and our business partners (hereinafter we also refer to the data subjects collectively as "users").

Purpose of processing

Provision of the online offering, its functions and content.
Handling of comparison requests and forwarding them to partner intermediaries.
Responding to contact requests and communicating with users.
Security measures and protection against abusive requests.
Reach measurement and marketing, in each case only with your consent.

Definitions

"Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data.

"Pseudonymisation" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

"Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

"Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Personal data you provide to us via a form

We receive your personal data when you enter it into the forms on our websites and thus make it available to us. Exactly which data this is depends on the service you are interested in.

For offers, comparisons or advice in the areas of private health insurance, supplementary health insurance, dental insurance, occupational disability and civil service disability insurance, retirement provision (including Riester, Rürup, life and pension insurance), commercial property insurance, long-term care insurance, term life insurance, construction financing, investments, dread disease, accident insurance, private property insurance and statutory health insurance, we collect the following data depending on the form:

your gender or form of address,
your full and correct name,
your email address,
your full and correct postal address,
your phone number,
your date of birth,
your occupation,
your company, company size, industry,
your nationality,
other product-related data where applicable.

When a form is submitted, we also store the time, the page visited including campaign parameters, the source of the visit and your IP address (see the sections "Campaign identifiers" and "Protection against abusive requests").

Purposes for which we use your personal data

We may only process personal data with your permission or a statutory permission under the GDPR, the German Federal Data Protection Act (BDSG) or any other law governing data protection.

a) Processing based on your consent (Art. 6(1)(a) GDPR)
The forwarding of your request to a partner intermediary and the intermediary contacting you are based on the consent you give in the form. The following are also based on your consent: the use of analytics and marketing services (see "Consent management"), an optional marketing consent, the newsletter and, where you provide health information, the processing of that information (Art. 9(2)(a) GDPR).

b) Processing for the performance of contractual and pre-contractual obligations (Art. 6(1)(b) GDPR)
We collect your personal data primarily in order to have the comparison and brokerage service you request provided by our partner intermediaries. Without this information, your request cannot be processed. With regard to our business partners, we process data to perform the contracts concluded with them.

c) Processing to safeguard legitimate interests (Art. 6(1)(f) GDPR)
In certain cases, we process your data in order to safeguard our interests or those of a third party. Examples are checking phone numbers to verify the validity of the data you have provided (see the section "Verification of the phone number provided"), protection against abusive requests and the attribution of a request to its source for billing and quality control. We also process certain data generated when you use our websites in order to enable you to use them or to ensure the security of our IT systems.

d) Based on legal requirements (Art. 6(1)(c) GDPR)
Finally, we process your data in order to comply with tax and commercial bookkeeping and record-keeping obligations and to be able to demonstrate consents given (Art. 7(1) GDPR).

Relevant legal bases

In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. Unless the legal basis is stated in this privacy policy, the following applies: the legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; the legal basis for processing to perform our services and carry out contractual measures and to respond to enquiries is Art. 6(1)(b) GDPR; the legal basis for processing to comply with our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing to safeguard our legitimate interests is Art. 6(1)(f) GDPR. In the event that vital interests of the data subject or of another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis. Where information is stored on or read from your terminal device, the admissibility is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Security measures

In accordance with Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data, as well as controlling access to the data, its input, its disclosure, the securing of its availability and its separation. We have also established procedures to ensure the exercise of data subjects' rights, the deletion of data and the response to threats to the data. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in line with the principle of data protection by design and by default (Art. 25 GDPR).

You may of course withdraw your consent at any time. You can send your withdrawal in writing to InVia Medien & Marketing GmbH, Abteilung Datenschutz, Am Hubengut 3, 76149 Karlsruhe, Germany. An email to datenschutz@invia24.com is also sufficient.

Cooperation with processors and third parties

If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them or otherwise grant them access to the data, this is done only on the basis of a statutory permission (e.g. if a transfer of the data to third parties, such as payment service providers, is necessary for the performance of a contract pursuant to Art. 6(1)(b) GDPR), if you have consented, if a legal obligation provides for this, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

We use processors and conclude data processing agreements with them pursuant to Art. 28 GDPR.

Service providers we use

The following service providers process data on our behalf. Where processing takes place outside the EU or the EEA, it is additionally subject to Art. 44 et seq. GDPR (see the section "Transfers to third countries").

Leadnodes GmbH, Sudetenstr. 31, 64839 Münster / Altheim, Germany: CRM and lead management system. Your request data is stored and managed there and made available to the responsible partner intermediary. Purpose: handling and follow-up of your request.
DigitalOcean LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA: sub-processor of Leadnodes GmbH for operating the infrastructure. The data is located in a data centre in Frankfurt am Main. As DigitalOcean is a US company, access from the USA cannot be ruled out; such access is safeguarded by the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
Supabase Inc., 970 Trestle Glen Rd, Oakland, CA 94610, USA: database hosting. Request, application and consent data is stored in an encrypted database in the EU region Frankfurt. Particularly sensitive information is additionally encrypted with AES-256-GCM.
Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA: sending of confirmation and notification emails. Your email address and the content of the respective message are processed.
Vercel Inc., 340 Pine Street, Suite 900, San Francisco, CA 94104, USA: hosting of our online offerings and server-side processing of form data, see the section "Hosting".
ALL-INKL.COM Neue Medien Münnich, owner René Münnich, Hauptstrasse 68, 02742 Friedersdorf, Germany: registration and management of our domains and web hosting of individual websites, see the section "Hosting".
Usercentrics GmbH (service "Cookiebot"), Sendlinger Straße 7, 80331 Munich, Germany, phone +49 89 21 54 01 20: management of your consents on our portals, see the section "Consent management".
HLR Lookups, operated by Velocity Made Good Ltd., Unit B, 23rd Floor, Two Chinachem Plaza, 68 Connaught Road Central, Hong Kong: technical check of whether the phone numbers provided can be reached, see the section "Verification of the phone number provided".
numverify, operated by apilayer Data Products GmbH, Elisabethstrasse 15/5, 1010 Vienna, Austria: check of the format and validity of phone numbers provided, see the section "Verification of the phone number provided".
Zippopotam.us: looking up the town for a postcode entered, see the section "Town for the postcode".
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace): email correspondence and office applications, see the section "Email correspondence".
Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland: payment processing when topping up credit in the partner area. This concerns exclusively data of our business partners, not data of interested parties.

The providers of the analytics and marketing services are named in the respective sections below.

Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this occurs in the context of using third-party services or disclosing or transferring data to third parties, this only takes place if it is necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to statutory or contractual permissions, we only process data in a third country, or have it processed there, if the special requirements of Art. 44 et seq. GDPR are met. This means that processing takes place, for example, on the basis of special guarantees, such as the officially recognised determination of a level of data protection equivalent to that of the EU (for the USA, in the case of companies certified under the "EU-US Data Privacy Framework"), or compliance with officially recognised special contractual obligations (so-called "Standard Contractual Clauses", Art. 46(2)(c) GDPR).

This concerns in particular Vercel, Supabase, Resend, DigitalOcean (as sub-processor of Leadnodes GmbH), HLR Lookups (Hong Kong) and, where you have consented, Google, Microsoft, Meta, Hotjar and Mouseflow or their group companies in the USA. There is no adequacy decision of the EU Commission for Hong Kong; we base the transfer of the phone number there on EU Standard Contractual Clauses.

Internal recipients and general external service providers

Internally, all departments that need your data to fulfil the purposes stated above have access to it. We also use external service providers to process the data for these purposes. These external service providers are primarily providers of IT services and telecommunications as well as services for checking phone numbers. In addition, we use external service providers for the technical delivery of our email newsletter.

Email correspondence

For our individual email correspondence, we use Google Workspace from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parts of the data processing may take place in the USA by Google LLC. Google participates in the EU-US Data Privacy Framework, which ensures an adequate level of protection for the data processing. If you do not wish this data processing to take place, you may object to it by email to the address stated above. However, we will then no longer be able to correspond with you by email. We will inform you of this consequence separately by email before implementing your objection.

Forwarding your request to our partner intermediaries

So that we can provide the comparison and brokerage service you request, InVia Medien & Marketing GmbH forwards your request, with your consent, to a partner intermediary suitable for your concern. Partner intermediaries are insurance brokers, multi-tied and tied agents and, in individual cases, the providers of the requested products themselves. The selection is based on professional specialisation, availability and usually your postcode area; which partner intermediary receives your request is therefore only determined after you have submitted it. We forward each request to one partner intermediary only.

The partner intermediary processes your data under its own data protection responsibility and contacts you via one of the contact channels you provided (post, email, phone including mobile, or WhatsApp/SMS) in order to send you your individual information or an offer.

We ourselves, InVia Medien & Marketing GmbH, may also contact you about your request by phone or email, for example to clarify questions about your details, to confirm that you can be reached or to inform you that your request has been forwarded to the partner intermediary. We only contact you for advertising purposes if you have given separate consent to this (see the section "Marketing consent in the form").

If a partner intermediary operates as a sales organisation or broker pool, it may pass your request on to an intermediary affiliated with it. This affiliated intermediary is then also a separate controller for the processing of your data and for contacting you.

The companies that are currently our partner intermediaries are listed on the page "Unsere Partnervermittler" (invia24.com/partner, in German). Your data is not passed on for other advertising purposes. You may object to the forwarding or to being contacted at any time with effect for the future, and you may withdraw your consent at any time (see the section "How to withdraw your consent").

No other purposes

Your data (comparison request data and any voluntary information) is processed exclusively to prepare and send you the comparison you requested and, where applicable, to prepare corresponding individual offers. Processing, use or disclosure for other purposes is excluded unless this privacy policy describes otherwise. Data is only processed for advertising purposes if you have given separate consent to this (see the section "Marketing consent in the form").

When you submit a request, a request for a quote or an application via one of our forms, we store a record of your consent (proof of consent). It records:

which consent and notice texts were shown to you, each with its version (version identifier) and a checksum of the wording, and which boxes you ticked,
the version of this privacy policy and of our list of partner intermediaries valid at that time,
the page on which you submitted the form (address without campaign parameters), the form and the label of the button you used to submit it,
the time of submission,
technical characteristics: your IP address in shortened form (the last digits are removed), a shortened browser identifier, the screen size and the status of your cookie settings,
the result of the check of your phone number and, where available, the check identifier from the protection against abusive requests.

The record does not contain your name, phone number, email address or full IP address in plain text, only as a fingerprint. This is a check value that we generate with a secret key (HMAC) and from which the details cannot be recalculated. It only allows us to check whether a record belongs to certain contact details. Your answers to health questions and your bank details are not included in the record; for applications we only record that, and in which version, the questions were shown.

Each record is linked to the previous one by a checksum and cannot be changed or deleted afterwards. This makes it possible to prove that a record is unchanged.

We must be able to prove that you consented and with which text (Art. 7(1) GDPR). For consent to calls for advertising purposes, Section 7a of the German Act against Unfair Competition (UWG) additionally requires that the consent is appropriately documented and retained. To this extent, the legal basis is Art. 6(1)(c) GDPR. Where we also make the record available to the partner intermediaries who contact you in response to your request, and use it to defend against unjustified claims, this is based on our legitimate interest (Art. 6(1)(f) GDPR).

The record is stored in a separate area of our database at Supabase Inc. that is not publicly accessible. The database is located in the EU region Frankfurt am Main (see the section "Service providers we use").

Together with your request, Leadnodes GmbH and the partner intermediary who receives your request are given the identifier and checksum of the record as well as the version of the consent text, the time and the form page. We make the complete record available to the partner intermediary on request, for example if it has to fulfil its own obligation to provide proof.

We keep the record for five years. The period begins when the consent is given and starts again each time the consent is used, for example when your request is assigned to a partner intermediary (Section 7a(2) UWG). When the period expires, we remove all details that can be related to you (fingerprints, IP details, browser identifier, check identifier). Only the sequence number, checksums, text versions and time remain, so that the chain of records can still be verified.

If you request the erasure of your data, the record remains in place, restricted, until the end of the period and is only used as proof and to defend against claims (Art. 17(3)(b) and (e) GDPR).

Suppression list after a withdrawal

If you withdraw your consent or object to being contacted, we note this with the date on your consent records and add you to our suppression list. The suppression list does not contain any contact details in plain text, only fingerprints of your phone number and email address (as described above), together with the date, the reason and the case number. If your data reaches us again later, the match is recorded and your withdrawal is respected: we will then not use your data for advertising and will not forward it again on the basis of the withdrawn consent. Without this entry, we would no longer know after an erasure that you do not wish to be contacted.

If you later submit a new request yourself, we will process it. It is based on your new consent and receives its own record.

The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(3) and Art. 21(3) GDPR as well as our legitimate interest in reliably respecting your withdrawal and objection over time (Art. 6(1)(f) GDPR). The entry remains in place for as long as we broker requests. It serves no other purpose and is only removed if you expressly request this.

You can withdraw your consent at any time with effect for the future and object to being contacted, most easily via our form at invia24.com/widerruf (in German) or by email to datenschutz@invia24.com (English is fine). We confirm receipt with a case number.

If we have already forwarded your request to a partner intermediary, we inform it of your withdrawal, objection or request for erasure without undue delay (Art. 19 GDPR). It stops contacting you and erases your data unless it is entitled to continue processing it on its own grounds, for example because you have already concluded a contract with it. On request, we will tell you the recipients to whom we have forwarded your request.

In some forms, you can additionally and separately from your request consent to being informed about further offers by email or phone. Who may contact you in this case is stated in the respective consent text. This consent is voluntary and not a prerequisite for your request. Your contact details as well as the time and version of the consent are stored. The legal basis is consent (Art. 6(1)(a) GDPR, Section 7(2) UWG). You may withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in every email. After a withdrawal, we add you to our suppression list so that you are not contacted again (see the section "Suppression list after a withdrawal").

Health information and application data

In some application processes, for example for dental insurance, health information is requested (e.g. on the condition of your teeth or ongoing treatment) which the insurer needs in order to accept the application. This is a special category of personal data under Art. 9(1) GDPR. We only process this information if you have explicitly consented to the processing (Art. 9(2)(a) GDPR), and only to forward your application to the partner intermediary or insurer. Application processes may also request your bank details for the collection of premiums (Art. 6(1)(b) GDPR). Health information and bank details are additionally stored in encrypted form.

Confirmation emails

After you have submitted a calculator, offer or application, some portals send you a confirmation or a summary of your details by email. The emails are sent via Resend Inc. The legal basis is Art. 6(1)(b) GDPR.

Protection against abusive requests

Requests are checked for obvious abuse (including frequency per IP address, completion time and a check field invisible to humans). We do not use an external captcha service for this.

On our form pages, we embed a script from Leadnodes GmbH (so-called Leadcert) which is intended to detect abusive and automatically generated requests. In doing so, your IP address and technical characteristics of your device and browser are processed and condensed into a check identifier, which is stored with the request. The legal basis is our legitimate interest in protection against fraud and in the quality of the requests we broker (Art. 6(1)(f) GDPR). The data is not used for advertising or analytics purposes.

Verification of the phone number provided

So that we only forward your request if you can actually be reached, we technically check whether the phone number you provided can be reached while you fill in the form or immediately after you submit it (so-called HLR lookup). Only the phone number is transmitted, no name and no other information. The only information returned is whether the number is assigned and reachable. Your line is not called and no message is delivered.

The service providers are HLR Lookups, operated by Velocity Made Good Ltd., Hong Kong, and numverify, operated by apilayer Data Products GmbH, Vienna. The legal basis is our legitimate interest in avoiding undeliverable and obviously incorrect requests and in protecting our partner intermediaries from failed contacts (Art. 6(1)(f) GDPR). For the transfer to a third country, see the section "Transfers to third countries". The result of the check is not used for advertising purposes.

Town for the postcode

So that you do not have to type in your town yourself, we fill it in for the postcode you enter. For this we use our own table or the public service Zippopotam.us. The query to Zippopotam.us is made via our server; only the postcode is transmitted, neither your IP address nor any other information about you. The legal basis is our legitimate interest in simple and error-free data entry (Art. 6(1)(f) GDPR).

Campaign identifiers (click IDs)

If you reach our websites via an advertisement, the address contains a campaign identifier of the advertising network, e.g. "gclid" (Google), "msclkid" (Microsoft) or "fbclid" (Meta), as well as campaign parameters (e.g. campaign, ad group, search term, device type). We store this information together with your request, a random session identifier and the address of the form page and pass it on to Leadnodes GmbH and to our own database. The purpose is to attribute the request to its source for billing, quality control and the evaluation of our campaigns. The legal basis is our legitimate interest in transparent billing and management of our advertising (Art. 6(1)(f) GDPR).

We only transmit these identifiers together with information about your request to Google, Microsoft or Meta on the basis of your consent (see the sections "Google Ads", "Offline conversions", "Microsoft Advertising" and "Meta Pixel and Conversions API").

Rights of data subjects

You have the right to request confirmation as to whether data concerning you is being processed and to obtain access to this data as well as further information and a copy of the data in accordance with Art. 15 GDPR.

In accordance with Art. 16 GDPR, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.

In accordance with Art. 17 GDPR, you have the right to request that data concerning you be erased without undue delay or, alternatively, in accordance with Art. 18 GDPR, to request a restriction of the processing of the data.

You have the right to receive the data concerning you that you have provided to us in accordance with Art. 20 GDPR and to request its transfer to other controllers.

You also have the right under Art. 77 GDPR to lodge a complaint with the competent supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Right to withdraw consent

You have the right to withdraw consents given with effect for the future in accordance with Art. 7(3) GDPR. A withdrawal does not affect the lawfulness of processing carried out before the withdrawal. For consents given in our forms, simply write to datenschutz@invia24.com or use invia24.com/widerruf (see the section "How to withdraw your consent").

Right to object

You may object to the future processing of data concerning you at any time in accordance with Art. 21 GDPR. The objection may in particular be made against processing for the purposes of direct marketing.

Cookies and right to object to direct marketing

"Cookies" are small files that are stored on users' computers. Different information can be stored within cookies. A cookie is primarily used to store information about a user (or the device on which the cookie is stored) during or after their visit to an online offering. Temporary cookies, or "session cookies" or "transient cookies", are cookies that are deleted after a user leaves an online offering and closes their browser. "Permanent" or "persistent" cookies are cookies that remain stored even after the browser is closed. Such a cookie may, for example, store users' interests, which are used for reach measurement or marketing purposes. "Third-party cookies" are cookies offered by providers other than the controller operating the online offering (otherwise, if they are only the controller's cookies, they are referred to as "first-party cookies").

We may use temporary and permanent cookies and explain this in our privacy policy. We only use cookies and similar technologies that are not strictly necessary with your consent (see the section "Consent management").

If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser's system settings. Stored cookies can be deleted in the browser's system settings. Excluding cookies may lead to functional restrictions of this online offering.

A general objection to the use of cookies employed for online marketing purposes can be declared for a large number of services, especially in the case of tracking, via the US site https://www.aboutads.info/choices/ or the EU site https://www.youronlinechoices.com/.

Deletion of data

The data processed by us is deleted or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated in this privacy policy, the data stored by us is deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations preventing deletion. If the data is not deleted because it is required for other and legally permissible purposes, its processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.

According to statutory requirements in Germany, data is retained in particular for 10 years in accordance with Sections 147(1) of the German Fiscal Code (AO), 257(1) Nos. 1 and 4, (4) of the German Commercial Code (HGB) (books, records, management reports, accounting vouchers, commercial books, documents relevant for taxation, etc.) and for 6 years in accordance with Section 257(1) Nos. 2 and 3, (4) HGB (commercial letters). We keep proof of consent for five years (Section 7a(2) UWG).

According to statutory requirements in Austria, data is retained in particular for 7 years in accordance with Section 132(1) of the Austrian Federal Fiscal Code (BAO) (accounting documents, vouchers/invoices, accounts, receipts, business papers, statement of income and expenditure, etc.), for 22 years in connection with real estate and for 10 years for documents in connection with electronically supplied services, telecommunications, radio and television services provided to non-entrepreneurs in EU member states and for which the Mini One-Stop Shop (MOSS) is used.

Business-related processing

In addition, we process

contract data (e.g. subject matter of the contract, term, customer category),
payment data (e.g. bank details, payment history)

of our customers, interested parties and business partners for the purpose of providing contractual services, service and customer care, marketing, advertising and market research.

Agency services

We process our customers' data within the scope of our contractual services, which include conceptual and strategic consulting, campaign planning, software and design development/consulting or maintenance, implementation of campaigns and processes/handling, server administration, data analysis/consulting services and training services.

In doing so, we process master data (e.g. customer master data such as names or addresses), contact data (e.g. email, phone numbers), content data (e.g. text entries, photographs, videos), contract data (e.g. subject matter of the contract, term), payment data (e.g. bank details, payment history), usage and metadata (e.g. in the context of evaluating and measuring the success of marketing measures). We generally do not process special categories of personal data unless they are part of a commissioned processing. The data subjects include our customers, interested parties and their customers, users, website visitors or employees as well as third parties. The purpose of the processing is the provision of contractual services, billing and our customer service. The legal bases of the processing are Art. 6(1)(b) GDPR (contractual services) and Art. 6(1)(f) GDPR (analysis, statistics, optimisation, security measures). We process data that is necessary to establish and fulfil the contractual services and point out the necessity of providing it. Disclosure to external parties only takes place if it is necessary within the scope of an order. When processing data provided to us within the scope of an order, we act in accordance with the instructions of the clients and the legal requirements for processing on behalf pursuant to Art. 28 GDPR and do not process the data for any purposes other than those of the order.

We delete the data after the expiry of statutory warranty and comparable obligations. The necessity of retaining the data is reviewed every three years; in the case of statutory archiving obligations, deletion takes place after their expiry (6 years pursuant to Section 257(1) HGB, 10 years pursuant to Section 147(1) AO). In the case of data disclosed to us by the client within the scope of an order, we delete the data in accordance with the specifications of the order, generally after the end of the order.

Brokerage services

We process the data of our customers, clients and interested parties (uniformly referred to as "customers") in accordance with Art. 6(1)(b) GDPR in order to provide our contractual or pre-contractual services to them. The data processed, the nature, scope, purpose and necessity of its processing are determined by the underlying order. This generally includes customers' master data (name, address, etc.) as well as contact data (email address, phone, etc.), contract data (content of the order, fees, terms, information on the brokered companies/insurers/services) and payment data (commissions, payment history, etc.). We may also process information on the characteristics and circumstances of persons or items belonging to them if this is part of the subject matter of our order. This may include, for example, information on personal circumstances or movable or immovable assets.
Within the scope of our order, it may also be necessary for us to process special categories of data pursuant to Art. 9(1) GDPR, in particular information on a person's health. Where necessary, we obtain the customers' explicit consent for this pursuant to Art. 6(1)(a), Art. 7, Art. 9(2)(a) GDPR.
Where necessary for the performance of the contract or required by law, we disclose or transfer customers' data in the context of coverage enquiries, the conclusion and processing of contracts to providers of the brokered services/objects, insurers, reinsurers, broker pools, technical service providers, other service providers such as cooperating associations, as well as financial service providers, credit institutions and investment companies, social security institutions, tax authorities, tax advisers, legal advisers, auditors, insurance ombudsmen and the Federal Financial Supervisory Authority (BaFin). We may also engage subcontractors, such as sub-agents. We obtain customers' consent where this is required for the disclosure/transfer (which may be the case, for example, for special categories of data pursuant to Art. 9 GDPR).
Data is deleted after the expiry of statutory warranty and comparable obligations, with the necessity of retaining the data being reviewed every three years; otherwise the statutory retention obligations apply.
In the case of statutory archiving obligations, deletion takes place after their expiry. Under German law, in the insurance and financial sector in particular, advice records must be retained for 5 years, broker contract notes for 7 years and brokerage contracts for 5 years, and in general documents relevant under commercial law for 6 years and documents relevant under tax law for 10 years.

Administration, financial accounting, office organisation, contact management

We process data in the context of administrative tasks and the organisation of our business, financial accounting and compliance with legal obligations such as archiving. In doing so, we process the same data that we process in the course of providing our contractual services. The legal bases for processing are Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. Customers, interested parties, business partners and website visitors are affected by the processing. The purpose of and our interest in the processing lie in administration, financial accounting, office organisation and archiving of data, i.e. tasks that serve to maintain our business activities, perform our tasks and provide our services. The deletion of data with regard to contractual services and contractual communication corresponds to the information given for these processing activities.

In doing so, we disclose or transfer data to the tax authorities, advisers such as tax advisers or auditors, as well as other fee offices and payment service providers.

Furthermore, on the basis of our business interests, we store information on suppliers, event organisers and other business partners, e.g. for the purpose of contacting them later. We generally store this predominantly company-related data permanently.

Business analyses and market research

In order to operate our business economically and to identify market trends and the wishes of contractual partners and users, we analyse the data available to us on business transactions, contracts, enquiries, etc. In doing so, we process master data, communication data, contract data, payment data, usage data and metadata on the basis of Art. 6(1)(f) GDPR, with the data subjects including contractual partners, interested parties, customers, visitors and users of our online offering.

The analyses are carried out for the purpose of business evaluations, marketing and market research. The analyses serve to increase user-friendliness, optimise our offering and improve business efficiency. The analyses serve us alone and are not disclosed externally unless they are anonymous analyses with aggregated values.

Insofar as these analyses are personal, they are deleted or anonymised as soon as they are no longer required for the purpose, at the latest after two years. Otherwise, overall business analyses and general trend determinations are prepared anonymously wherever possible.

Registration as a partner

Intermediaries and companies that wish to obtain requests from us can sign up or register on invia24.com. As part of the registration, the required mandatory information is communicated and processed on the basis of Art. 6(1)(b) GDPR for the purposes of initiating and performing the contract and providing access. This includes in particular company name, name of the contact person, address, email address, phone number and information on the trade licence. Access to the partner area is provided via the system of Leadnodes GmbH. We also store the confirmation of the terms and conditions and of this privacy notice with time and version (Art. 6(1)(c) GDPR).

Users may be informed by email about information relevant to their access, such as technical changes. If users have terminated their access, their data relating to the access is deleted, subject to any statutory retention obligation.

Contacting us

When you contact us (e.g. via contact form, email, phone or social media), the user's details are processed for handling the contact request and its processing in accordance with Art. 6(1)(b) GDPR. The users' details may be stored in a customer relationship management system ("CRM system") or a comparable enquiry organisation.

We delete the enquiries when they are no longer required. We review the necessity every two years; statutory archiving obligations also apply.

With the following information, we inform you about the content of our newsletter as well as the registration, delivery and statistical evaluation procedures and your rights to object. By subscribing to our newsletter, you agree to receive it and to the procedures described.

Content of the newsletter: We only send newsletters, emails and other electronic notifications containing advertising information (hereinafter "newsletter") with the consent of the recipients or a statutory permission. If the contents of the newsletter are specifically described when registering, they are decisive for the users' consent. Otherwise, our newsletters contain information about our services and about us.

Double opt-in and logging: Registration for our newsletter takes place in a so-called double opt-in procedure. This means that after registering, you will receive an email asking you to confirm your registration. This confirmation is necessary so that no one can register with someone else's email address. Newsletter registrations are logged in order to be able to prove the registration process in accordance with the legal requirements. This includes storing the time of registration and confirmation as well as the IP address. Changes to your data stored with the delivery service provider are also logged.

Registration data: To register for the newsletter, it is sufficient to provide your email address. Optionally, we ask you to provide a name so that we can address you personally in the newsletter.

The newsletter is sent and its success measured on the basis of the recipients' consent pursuant to Art. 6(1)(a), Art. 7 GDPR in conjunction with Section 7(2) No. 2 UWG, or on the basis of the statutory permission pursuant to Section 7(3) UWG.

The registration procedure is logged to prove consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR) and on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. Our interest lies in the use of a user-friendly and secure newsletter system that both serves our business interests and meets the expectations of users.

Cancellation/withdrawal: You can cancel receipt of our newsletter at any time, i.e. withdraw your consent. You will find a link to cancel the newsletter at the end of each newsletter. We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of a possible defence against claims. An individual request for deletion is possible at any time, provided that the former existence of a consent is confirmed at the same time.

Newsletter: delivery service provider

The newsletter is sent via external delivery service providers. The delivery service provider is used on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR; we conclude a data processing agreement with it pursuant to Art. 28(3) sentence 1 GDPR.

The delivery service provider may use the recipients' data in pseudonymous form, i.e. without assignment to a user, to optimise or improve its own services, e.g. for the technical optimisation of the delivery and presentation of the newsletter or for statistical purposes. However, the delivery service provider does not use the data of our newsletter recipients to write to them itself or to pass the data on to third parties.

Hosting

The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, security services and technical maintenance services, which we use for the purpose of operating this online offering.

In doing so, we or our hosting provider process master data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors of this online offering on the basis of our legitimate interests in the efficient and secure provision of this online offering pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR.

The hosting provider is Vercel Inc., 340 Pine Street, Suite 900, San Francisco, CA 94104, USA. Vercel collects server log files (IP address, browser, access time); these are deleted after 7 days at the latest. For the transfer to the USA, see the section "Transfers to third countries".

Collection of access data and log files

We, or our hosting provider, collect data on every access to the server on which this service is located (so-called server log files) on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. The access data includes the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.

For security reasons (e.g. to investigate misuse or fraud), log file information is stored for a maximum of 7 days and then deleted. Data whose further retention is required for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.

Measurement of form usage

If you have consented to the "Statistics" category in our consent management, we record, in order to improve our enquiry forms, which steps of a form are opened and completed, how long a step takes, whether input errors are shown and how quickly the page loads. Without this consent, none of this data is sent. We do not store any entries, IP addresses or our own cookies. Steps are linked via a random identifier that only exists while the page is open. In addition, we process the identifier of the advertising campaign through which you reached us (without the click ID itself) as well as browser type, operating system, device type and connection type. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via the cookie settings. Individual records are deleted after 90 days; afterwards only aggregated figures without reference to individual visits remain.

We only use analytics and marketing services with your consent. To obtain, document and manage these consents, we use one of two tools depending on the portal. Both lead to the same result: without your consent, no analytics or marketing services are loaded. Until you make your choice, all categories requiring consent are set to "denied" via Google Consent Mode.

Our own consent tool. On some portals, including invia24.com, we use a tool we developed ourselves. Your choice is stored on your device in a cookie named "iv24_consent" and is valid for twelve months. It contains the categories you selected, the time of your choice, the version of the notice and a randomly generated identifier of your browser. In addition, we record every choice because we must be able to demonstrate consent under Art. 7(1) GDPR. We record the random identifier of your browser, the selected categories, time and version and, in shortened form that cannot be reversed, a check value derived from your IP address and your browser identifier. We do not store your IP address itself. The records are kept in our database at Supabase Inc. (EU region Frankfurt, see "Service providers we use"); we delete them four years after the choice. You can change or withdraw your choice at any time via the cookie symbol on every page or via "Cookie settings" in the footer.

Cookiebot. On the other portals, we use Cookiebot from Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, phone +49 89 21 54 01 20. Cookiebot stores your choice for twelve months and logs it for verification purposes (consent ID, time, shortened IP address, browser information). There you can change your choice via the link in the cookie banner or in the footer of the respective page. Privacy notice: https://www.cookiebot.com/en/privacy-policy/.

Legal bases. For the services consented to, the legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Storing your choice on your device does not require consent under Section 25(2) No. 2 TDDDG, because without this storage we could not respect your choice. Logging your choice is based on our legal obligation to be able to demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). A withdrawal applies to the future; it does not retroactively render processing carried out lawfully until then inadmissible.

Google Tag Manager

Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), is a solution that allows us to manage so-called website tags via an interface. It does not set any cookies itself and does not evaluate any usage data; however, the IP address is transmitted to Google when it is loaded. The Tag Manager only triggers the services described below in accordance with the consents you have given. With regard to the processing of users' personal data, please refer to the following information on the individual services. Terms of use: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/.

Google Analytics 4

With your consent, we use Google Analytics 4, a web analytics service from Google Ireland Limited. Google Analytics uses cookies and statistically evaluates the use of our online offering (e.g. pages visited, time spent, source, device type, approximate location). Pseudonymous usage profiles may be created from the processed data. IP addresses are processed by Google in the EU and are not stored. The data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/).

We may also use Google Analytics to show advertisements within Google's advertising services only to users who have shown an interest in our online offering (so-called "remarketing" or "Google Analytics audiences").

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Users' personal data is deleted or anonymised after 14 months. Further information on data use by Google, settings and objection options can be found in Google's privacy policy (https://policies.google.com/technologies/ads) and in the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).

Google Ads and conversion measurement

With your consent, we use Google Ads from Google Ireland Limited to place advertisements in the Google advertising network (e.g. in search results, in videos, on websites) and measure whether a visit via an advertisement has led to a request (conversion measurement). Visitors can also be addressed again with advertisements (remarketing). For this purpose, cookies or similar technologies are stored on your device and information on pages visited, clicks on advertisements, browser and operating system, referring websites and time of visit is transmitted to Google.

Enhanced conversions: When you submit a request, we additionally transmit, only with this consent, contact details from the form (email address, phone number and, depending on the form, name and address) to Google. Before transmission, the data is hashed (pseudonymised) in your browser using the SHA-256 method. Google matches the hash values with signed-in Google accounts in order to attribute the conversion of an advertisement more precisely and does not use them for any other purpose.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Further information on data use by Google, settings and objection options can be found in Google's privacy policy (https://policies.google.com/technologies/ads) and in the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).

Offline conversions

We only know whether a request was ultimately usable after it has been processed. So that Google and Microsoft can align their advertisements accordingly, we subsequently transmit feedback on requests from our database and from the system of Leadnodes GmbH to Google (Google Ads, also via the Google Data Manager) and to Microsoft (Microsoft Advertising). The data transmitted is the campaign identifier (gclid or msclkid), time, type and value of the conversion, as well as the email address and phone number in hashed (SHA-256) form. No plain-text data is transmitted.

The legal basis is your consent to marketing services (Art. 6(1)(a) GDPR). The providers process the data to attribute and evaluate our campaigns. For the transfer to the USA, see the section "Transfers to third countries".

Microsoft Advertising

With your consent, we use the conversion and tracking tool "Universal Event Tracking" (UET) of Microsoft Advertising from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft stores cookies on users' devices in order to recognise whether a visit via an advertisement on Bing has led to a request (so-called "conversion measurement") and to be able to address visitors again with advertisements. When you submit a request, your email address may additionally be transmitted to Microsoft in hashed form, only with this consent, in order to attribute the conversion more precisely (enhanced conversions).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Microsoft Corporation is certified under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/). Opt-out: https://account.microsoft.com/privacy/ad-settings. Further information: https://privacy.microsoft.com/en-gb/privacystatement.

Meta Pixel and Conversions API

With your consent, we use the "Meta Pixel" and the "Conversions API" from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). With the Meta Pixel, Meta can determine visitors to our online offering as a target group for displaying advertisements on Facebook and Instagram (so-called "Custom Audiences"), and we can track whether a visit via a Meta advertisement has led to a request (so-called "conversion"). Via the Conversions API, we additionally transmit the same events directly from our server to Meta. The data transmitted includes information on the event (e.g. request submitted, time, page), the campaign identifier "fbclid", technical information on browser and device and, where available, email address and phone number in hashed form.

Joint controllership: We and Meta are joint controllers for the collection of data on our websites and its transmission to Meta (Art. 26 GDPR). The essential content of the joint controllership agreement ("Controller Addendum") can be found at https://www.facebook.com/legal/controller_addendum. Under this agreement, Meta is in particular responsible for enabling you to exercise your rights with regard to the data stored by Meta; however, you may also contact us with your concerns. Meta is solely responsible for the subsequent processing by Meta.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The data may be transferred to Meta Platforms, Inc. in the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. Meta privacy policy: https://www.facebook.com/privacy/policy/. Ad settings: https://www.facebook.com/adpreferences/.

Hotjar

On some of our online offerings, we use Hotjar from Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St Julian's STJ 3141, Malta, with your consent. Hotjar creates heatmaps and session recordings in order to understand how our pages are used; mouse movements, clicks and scrolling behaviour are recorded. Entries in form fields are automatically masked and IP addresses shortened. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Further information: https://www.hotjar.com/legal/policies/privacy/.

Mouseflow

On some of our online offerings, we may use Mouseflow, a web analytics tool from Mouseflow ApS, Flaesketorvet 68, 1711 Copenhagen, Denmark, with your consent. The data processing serves the purpose of analysing this website and its visitors. Mouseflow records randomly selected individual visits (only with an anonymised IP address). This creates a log of mouse movements and clicks with the intention of replaying individual website visits on a random basis and deriving potential improvements for the website. Pseudonymous usage profiles may be created from this data; cookies may be used for this purpose. The data collected with Mouseflow is not used to personally identify the visitor to this website and is not merged with personal data about the bearer of the pseudonym. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). In addition, you can globally deactivate recording on all websites that use Mouseflow for the browser you are currently using: https://mouseflow.com/opt-out/.

Online presences on social media

We maintain online presences within social networks and platforms in order to communicate with the customers, interested parties and users active there and to inform them about our services. When you access the respective networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply.

Unless otherwise stated in our privacy policy, we process users' data if they communicate with us within the social networks and platforms, e.g. write posts on our online presences or send us messages.

Integration of third-party services and content

Within our online offering, we use content or service offerings from third-party providers in order to integrate their content and services, such as videos, maps, fonts or graphics (hereinafter uniformly referred to as "content"). This always requires that the third-party providers of this content perceive the users' IP address, as they could not send the content to their browser without the IP address. The IP address is therefore required for the display of this content. We endeavour to use only content whose respective providers use the IP address solely for the delivery of the content.

We only integrate content for which the provider sets cookies or uses the data for its own purposes after you have given your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Pure graphics without cookies, such as the Google Partner badge on invia24.com, which is loaded from servers of Google Ireland Limited, are integrated on the basis of our legitimate interest in an appealing presentation (Art. 6(1)(f) GDPR).

YouTube

On some pages, we embed videos from the YouTube platform of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in privacy-enhanced mode (youtube-nocookie.com) and with a two-click solution. Before you actively click on a video, no connection to YouTube is established; only a preview image from our own server is displayed. Only when you click on the video are your IP address, the page visited and technical information about your browser transmitted to YouTube, and YouTube may store cookies or similar technologies on your device. The legal basis is the consent you give by clicking on the video (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Privacy policy: https://policies.google.com/privacy.

Google Fonts

We generally deliver fonts from our own servers. Where fonts ("Google Fonts") from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, are loaded from Google servers on individual portals, your IP address is transmitted to Google. The legal basis is our legitimate interest in a uniform presentation (Art. 6(1)(f) GDPR). Privacy policy: https://policies.google.com/privacy.

Google Maps

We may embed maps from the "Google Maps" service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded once you have consented (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The data processed may include in particular users' IP addresses and location data, which, however, are not collected without their consent (usually given in the settings of their mobile devices). The data may be processed in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Privacy policy: https://policies.google.com/privacy, opt-out: https://adssettings.google.com/authenticated.

Parts of this privacy policy were created with Datenschutz-Generator.de by RA Dr. Thomas Schwenke.