Please note that this is a translation of the original German version. We've made every effort to ensure accuracy, but in case of any discrepancies, the German version will take precedence.

Privacy Policy

1. Introduction

With the following information, we would like to give you, as a "data subject", an overview of how we process your personal data and of your rights under data protection law. In principle, you can use our websites without providing any personal data. However, if you wish to use special services of our company via our website, the processing of personal data may become necessary. Where processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain your consent.

Personal data, for example your name, address or email address, is always processed in accordance with the General Data Protection Regulation (GDPR) and in line with the country-specific data protection provisions applicable to "Trisor GmbH". With this Privacy Policy, we would like to inform you about the scope and purpose of the personal data we collect, use and process.

As the controller, we have implemented numerous technical and organisational measures to ensure the most complete protection possible of the personal data processed via this website. Nevertheless, internet-based data transmissions can in principle have security gaps, so absolute protection cannot be guaranteed. For this reason, you are free to send personal data to us by alternative means, for example by telephone or by post.

You, too, can take simple and easy-to-implement measures to protect your data against unauthorised access by third parties. We would therefore like to give you some tips on handling your data securely:

Protect your account (login, user or customer account) and your IT system (computer, laptop, tablet or mobile device) with secure passwords.
Only you should have access to your passwords.
Make sure that you only ever use each password for one account (login, user or customer account).
Do not use the same password for different websites, applications or online services.
When using publicly accessible IT systems or systems shared with other people in particular, you should always log out after every login to a website, application or online service.

Passwords should consist of at least 12 characters and be chosen so that they cannot easily be guessed. They should therefore not contain common everyday words or your own name or the names of relatives, but should contain a mix of upper and lower case letters, numbers and special characters.

2. Controller

The controller within the meaning of the GDPR is:

Trisor GmbH
represented by the Managing Directors: Marco Wild, Dr. Justus Westerburg
Bachstraße 12
10555 Berlin

3. Data Protection Officer

You can reach the Data Protection Officer as follows:

External Data Protection Officer of Trisor GmbH
c/o TÜV SÜD Akademie GmbH
80339 Munich
Email: datenschutz@trisor.de

You can contact our Data Protection Officer directly at any time with any questions or suggestions regarding data protection.

4. Definitions

This Privacy Policy is based on the terms used by the European legislator when adopting the General Data Protection Regulation (GDPR). Our Privacy Policy is intended to be easy to read and understand for the public as well as for our customers and business partners. To ensure this, we would like to explain the terms used in advance.

Among others, we use the following terms in this Privacy Policy:

1. Personal data

Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2. Data subject

A data subject is any identified or identifiable natural person whose personal data is processed by the controller (our company).

3. Processing

Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

4. Restriction of processing

Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future.

5. Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

6. Pseudonymisation

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

7. Processor

A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

8. Recipient

A recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

9. Third party

A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

10. Consent

Consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

5. Legal Basis for Processing

Art. 6(1)(a) GDPR (in conjunction with Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG)) serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose.

Where the processing of personal data is necessary for the performance of a contract to which you are a party, as is the case, for example, for processing operations that are necessary for the delivery of goods or the provision of any other service or consideration, the processing is based on Art. 6(1)(b) GDPR. The same applies to processing operations that are necessary for the implementation of pre-contractual measures, for example in the case of enquiries about our products or services.

Where our company is subject to a legal obligation that requires the processing of personal data, for example to fulfil tax obligations, the processing is based on Art. 6(1)(c) GDPR.

In rare cases, the processing of personal data may become necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance details or other vital information had to be passed on to a doctor, a hospital or other third parties. The processing would then be based on Art. 6(1)(d) GDPR.

Finally, processing operations could be based on Art. 6(1)(f) GDPR. This legal basis applies to processing operations that are not covered by any of the aforementioned legal bases, if the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests, fundamental rights and freedoms of the data subject. We are permitted to carry out such processing operations in particular because they have been specifically mentioned by the European legislator. In this respect, the legislator took the view that a legitimate interest could be assumed where you are a customer of our company (Recital 47, sentence 2 GDPR).

Our offer is generally aimed at adults. Persons under the age of 16 may not transmit any personal data to us without the consent of their parents or legal guardians. We do not request personal data from children and young people, we do not collect it, and we do not pass it on to third parties.

6. Disclosure of Data to Third Parties

Your personal data is not disclosed to third parties for purposes other than those listed below.

We only pass on your personal data to third parties if:

you have given us your express consent to do so pursuant to Art. 6(1)(a) GDPR,
the disclosure is permitted under Art. 6(1)(f) GDPR to safeguard our legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in your data not being disclosed,
in the event that there is a legal obligation for the disclosure pursuant to Art. 6(1)(c) GDPR, and
this is legally permissible and necessary for the performance of contractual relationships with you pursuant to Art. 6(1)(b) GDPR.

In the context of the processing operations described in this Privacy Policy, personal data may be transferred to the USA. Companies in the USA only have an adequate level of data protection if they are certified under the EU-US Data Privacy Framework and the adequacy decision of the EU Commission pursuant to Art. 45 GDPR therefore applies. We have expressly stated this for the relevant service providers in this Privacy Policy. To protect your data in all other cases, we have concluded data processing agreements based on the Standard Contractual Clauses of the European Commission. If the Standard Contractual Clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49(1)(a) GDPR may serve as the legal basis for the transfer to third countries. In some cases, this does not apply to data transfers to third countries for which the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR.

7. Technology

When you use our website for information purposes only, that is, when you do not register or otherwise send us information, or do not give consent to processing that requires consent, we only collect data that is technically strictly necessary to provide the service. This is regularly data that your browser transmits to our server ("so-called server log files"). Each time you or an automated system accesses a page, our website collects a range of general data and information. This general data and information is stored in the server's log files. The data collected includes, among other things:

the browser types and versions used,
the operating system used by the accessing system,
the website from which an accessing system reaches our website (so-called referrer),
the sub-pages that are accessed on our website via an accessing system,
the date and time of access to the website, and
an Internet Protocol address (IP address).

When using this general data and information, we do not draw any conclusions about you as a person. Rather, this information is needed, among other things, to

deliver the content of our website correctly,
optimise the content of our website and the advertising for it,
ensure the long-term functionality of our IT systems and the technology of our website, and
provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyberattack.

We therefore evaluate this collected data and information statistically and, in addition, with the aim of increasing data protection and data security in our company, in order to ultimately ensure an optimal level of protection for the personal data we process.

The legal basis for the data processing is Art. 6(1) sentence 1 point (f) GDPR. Our legitimate interest follows from the purposes of data collection listed above.

7.1 Amazon Web Services (AWS) - Hosting of Individual Components

Components of Amazon Web Services (AWS) are integrated into our website; in addition, we host our website with AWS. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg. The purposes of use include having applications and services hosted at AWS, renting resources for compute-intensive tasks and displaying our website. We also use Amazon CloudFront as a content delivery network (CDN), which routes the transfer of information between your browser and our website via its network, which reduces latency when delivering static and dynamic content and provides additional security through traffic encryption and access controls. For this purpose, CloudFront stores cookies on your device to optimise the service; you can delete cookies in your browser at any time or restrict their storage.

In addition to hosting, we also use Amazon Web Services (AWS) among other things to send SMS messages, for example to verify telephone numbers or to transmit system-relevant information. In this context, AWS is the first provider for SMS delivery (alongside Twilio, see below).

As part of this use, your personal data is processed on AWS servers, including your IP address, the website accessed, referrer URL, browser type, operating system and device type. We have deactivated separate logging of this access data for our own purposes (access logs); however, AWS itself evaluates this data internally to produce statistics on access numbers, platforms used and countries of origin, which we can view. In this context, personal data may also be transferred to AWS's parent company in the USA.

AWS is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in displaying our website as reliably and performantly as possible, in hosting individual components, in renting computing resources and in using a content delivery network to reduce latency and increase security without having to operate such a network ourselves.

We have concluded a data processing agreement with AWS. This is a contract required by data protection law, which ensures that AWS processes the personal data of our website visitors only on our instructions and in compliance with the GDPR.

This US company is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Art. 45 GDPR is therefore in place, so that personal data may be transferred without further safeguards or additional measures.

You can find more information on AWS's privacy policy at: https://aws.amazon.com/de/privacy/?nc1=f_pr.

8. Cookies

8.1 General Information on Cookies

Cookies are small files that your browser creates automatically and that are stored on your IT system (laptop, tablet, smartphone or similar) when you visit our site.

The cookie stores information that results from the specific device used. However, this does not mean that we thereby obtain direct knowledge of your identity.

The use of cookies serves to make the use of our offer more pleasant for you. For example, we use so-called session cookies to recognise that you have already visited individual pages of our website. These are deleted automatically when you leave our site.

In addition, we also use temporary cookies to optimise user-friendliness, which are stored on your device for a specified period of time. If you visit our site again to use our services, it is automatically recognised that you have already been with us and which entries and settings you have made, so that you do not have to enter them again.

On the other hand, we use cookies to record the use of our website statistically and to evaluate our offer for you for the purpose of optimisation. These cookies enable us to automatically recognise, when you visit our website again, that you have already visited it. The cookies set in this way are deleted automatically after a defined period of time. The respective storage period of the cookies can be found in the settings of the consent tool used.

8.2 Legal Basis for the Use of Cookies

The data processed by cookies that is required for the proper functioning of the website is therefore necessary to safeguard our legitimate interests and those of third parties pursuant to Art. 6(1)(f) GDPR.

For all other cookies, you have given your consent via our opt-in cookie banner within the meaning of Art. 6(1)(a) GDPR.

8.3 Cookiebot (Consent Management Tool)

We use the consent management tool "Cookiebot" of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. This service enables us to obtain and manage the consent of website visitors to data processing.

Cookiebot collects data generated by end users who use our website. When an end user gives consent via the cookie consent tool, the following data is automatically logged at Cookiebot:

The end user's IP number in anonymised form (the last three digits are set to 0)
Date and time of the consent.
User agent of the end user's browser.
The URL from which the consent was sent.
An anonymous, random and encrypted key.
The end user's consent status, which serves as proof of consent.

The key and the consent status are also stored in the end user's browser in the "CookieConsent" cookie, so that the website can automatically read and follow the end user's consent for all subsequent page requests and future end user sessions for up to 12 months. The key is used to provide proof of consent and for an option that checks whether the consent status stored in the end user's browser is unchanged compared to the original consent that was transmitted to Usercentrics.

The functionality of the website cannot be guaranteed without this processing. The "CookieConsent" cookie set by Cookiebot is classified as necessary. The user has no right to object as long as there is a legal obligation to obtain the user's consent to certain data processing operations (Art. 7(1), Art. 6(1) sentence 1 point (c) GDPR).

Usercentrics is a recipient of your personal data and acts as a processor on our behalf.

You can find detailed information on the use of Cookiebot at: https://www.cookiebot.com/de/privacy-policy/.

9. Content of Our Website

9.1 Registration as a User

You have the option to register on our website by providing personal data.

The personal data transmitted to us in this process is determined by the respective input form used for the registration. The personal data you enter is collected and stored exclusively for internal use by us and for our own purposes. We may arrange for the data to be passed on to one or more processors, for example a parcel service provider, who also use the personal data exclusively for internal purposes attributable to us.

By registering on our website, the IP address assigned by your internet service provider (ISP) and the date and time of registration are also stored. This data is stored because it is the only way to prevent misuse of our services, and because, where necessary, this data makes it possible to investigate criminal offences that have been committed. In this respect, the storage of this data is necessary to protect us. This data is generally not passed on to third parties. This does not apply where we are legally obliged to pass it on or where the disclosure serves criminal prosecution.

Your registration, with the voluntary provision of personal data, also serves us to offer you content or services which, by their nature, can only be offered to registered users. Registered persons are free to change the personal data provided during registration at any time or to have it deleted completely from our database.

On request, we will provide you at any time with information about which personal data is stored about you. Furthermore, we will correct or delete personal data at your request, insofar as this does not conflict with statutory retention obligations. A Data Protection Officer named in this Privacy Policy and all other employees are available to the data subject as contact persons in this context.

Your data is processed in the interest of convenient and easy use of our website. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR.

9.2 Data Processing When Opening a Customer Account and for Contract Performance

Pursuant to Art. 6(1)(b) GDPR, personal data is collected and processed when you provide it to us for the performance of a contract or when opening a customer account. Which data is collected can be seen from the respective input forms. You can have your customer account deleted at any time, for example by sending a message to the controller's address given above. We store and use the data you provide for the performance of the contract. After the contract has been fully performed or your customer account has been deleted, your data will be blocked, taking tax and commercial law retention periods into account, and deleted after these periods have expired, unless you have expressly consented to further use of your data or we have reserved the right to a legally permitted further use of data, about which we inform you accordingly below.

9.3 Data Processing for Contract Performance

The personal data we collect is stored in our system as part of contract performance. We pass on your payment data to the commissioned service providers as part of payment processing (see sections 16.1 and 16.2) where this is necessary for payment processing. Where payment service providers are used, we inform you of this expressly below. The legal basis for passing on the data is Art. 6(1)(b) GDPR.

When a rental agreement is concluded, we additionally use the service of the provider Twilio Inc., 101 Spear Street, 5th Floor, San Francisco, California, 94105, USA ("Twilio") to confirm individual contract components: an SMS with a confirmation code is sent to your mobile phone number, which our on-site advisor enters to activate the contract. Twilio is the second provider for SMS delivery alongside Amazon Web Services (AWS).

As stated above, the legal basis is Art. 6(1)(b) GDPR. We have concluded a data processing agreement (Art. 28 GDPR) with Twilio; Twilio is also certified under the EU-US Data Privacy Framework, so that an adequacy decision pursuant to Art. 45 GDPR is in place.

Further information: https://www.twilio.com/en-us/legal/privacy.

9.4 Data Processing for Identity Verification and Activation of the Safe Deposit Box

Where necessary, we verify your identity on the legal basis of Article 6(1)(b) and (f) GDPR, using information from service providers. The justification for this arises from the protection of your identity and the prevention of attempted fraud to our detriment. The fact and the result of our enquiry are added to your customer account or guest account and stored there for the duration of the contractual relationship.

a) Identity Verification of Private Customers (Onfido)

To verify your identity in the context of activating the safe deposit box, we use, among others, the service of Onfido GmbH, an Entrust company, Lütticher Str. 132, 40547 Düsseldorf ("Onfido").

For this purpose, you upload an image of your identity document and an image of your face via the Onfido integration in our application. Your data and the uploaded image are then compared with the photo on the identity document and checked for a match. In addition, Onfido checks whether the uploaded identity document is registered as stolen, forged, lost or otherwise compromised.

The legal basis for this processing is pre-contractual measures pursuant to Art. 6(1)(b) GDPR, as clear identification is required for the conclusion of the contract. We have concluded a data processing agreement (DPA) with Onfido pursuant to Art. 28 GDPR.

You can view Onfido's privacy policy at: https://onfido.com/privacy/.

b) KYC Verification of Companies (Kerberos)

If you deal with us as a company or as a representative of a company (for example as a business customer or business partner), we use the service of Kerberos Compliance-Managementsysteme GmbH, Im Zollhafen 24, 50678 Cologne ("Kerberos") to carry out the required due diligence (KYC).

As part of this verification, information about the respective company and the business contact details of the natural persons acting for the company are processed. Kerberos is not used to check private individuals outside a business context.

The provider necessarily gains knowledge of the aforementioned data to the extent provided for within the scope of our data processing agreement (Art. 28 GDPR) with Kerberos.

You can find further information on data processing by Kerberos at: https://www.kerberos-compliance.com/rechtliches/.

9.4.1 Activation of the Safe Deposit Box for Customers (Biometric Data)

If you have given your consent, your fingerprint is captured by an electronic scanner when you first access the safe deposit box and is stored together with an additional PIN on your customer card. You need this customer card to access the self-service terminal room and your safe deposit box. The fingerprint is stored exclusively on the customer card.

A fingerprint is personal data, more precisely biometric data within the meaning of Art. 4(13) and (14) GDPR. Pursuant to Art. 9 GDPR, biometric data falls into the special category of personal data that merits particular protection.

We process your personal data in the context of activating the safe deposit box for the initiation, performance and handling of the rental agreement (Art. 6(1)(b) and (f) GDPR), in particular for your verification when activating and using the safe deposit box. We process your fingerprint as biometric data on the basis of your previously given explicit consent (Art. 9(2)(a) GDPR).

For individual services, we may use commissioned service providers to whom we forward your personal data. They act exclusively on our instructions and are contractually obliged pursuant to Art. 28 GDPR to comply with data protection provisions.

9.4.2 Fingerprint Capture for Authorised Representatives

If you have been named as an authorised representative by a customer and have given your consent, your fingerprint will also be captured when you first access the safe deposit box and stored with an additional PIN on your own customer card. You need this customer card to access the self-service terminal room and the customer's safe deposit box. The fingerprint is stored exclusively on your customer card.

As described above, this is biometric data pursuant to Art. 4(13) and (14) GDPR, which falls into the special category of personal data that merits particular protection under Art. 9 GDPR. We process the fingerprint for your verification when activating and using the safe deposit box on the basis of your previously given consent (Art. 9(2)(a) GDPR).

9.4.3 Access to the Rented Property

We process your personal data when you authenticate yourself in the terminal area with your customer card and the fingerprint stored on it in order to gain access to the self-service terminal room and your safe deposit box. The legal basis is your consent to the processing of the biometric data (Art. 9(2)(a) GDPR) and, where you are a customer, the performance and handling of the rental agreement (Art. 6(1)(b) GDPR).

9.4.4 Recording and Disclosure Obligations

Before a safe deposit box is activated, we are obliged to establish the identity and address of each person authorised to dispose of the box and of each beneficial owner within the meaning of the German Anti-Money Laundering Act (Geldwäschegesetz) and to record the information required for this purpose. For this purpose, we keep an alphabetical register of names of the authorised persons and beneficial owners.

In this respect, we process your data to fulfil our legal obligations (recording and disclosure obligations pursuant to Section 154(1) of the German Fiscal Code (Abgabenordnung)). Competent authorities may request information at any time about who is authorised to dispose of the safe deposit boxes; we are obliged to provide this.

9.4.5 Video Surveillance in the Terminal Area

The terminal area is under video surveillance. The persons entering the area are recorded, but not the placing of items in or the removal of items from the safe deposit box cassette. The video surveillance serves to investigate and prevent criminal offences and to protect our business premises.

As part of the required balancing of interests, we have weighed your interest in the confidentiality of your personal data against our interest in monitoring and securing the terminal area; your interest in confidentiality takes second place. The legal basis is our overriding legitimate interest (Art. 6(1)(f) GDPR).

The recordings are generally stored for 72 hours and then deleted, provided they are no longer needed for the original purpose.

9.5 Contact / Contact Form

When you contact us (for example via contact form or email), personal data is collected. Which data is collected when a contact form is used can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your enquiry or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact aims at the conclusion of a contract, an additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted after your enquiry has been finally dealt with; this is the case when it can be inferred from the circumstances that the matter concerned has been conclusively resolved and there are no statutory retention obligations to the contrary.

Twilio (see above, supplement to section 9.3) is already used when you contact us via our contact form. As stated in section 9.5, the legal basis for this is Art. 6(1)(f) GDPR or, where your contact aims at the conclusion of a contract, Art. 6(1)(b) GDPR.

9.6 Services / Digital Goods

We only transmit personal data to third parties if this is necessary in the context of contract performance, for example to the service providers commissioned for payment processing.

Any further transmission of data does not take place, or only if you have expressly agreed to the transmission. Your data is not passed on to third parties without your express consent, for example for advertising purposes.

The basis for the data processing is Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

9.7 Application Management / Job Board

We collect and process the personal data of applicants for the purpose of handling the application process. The processing may also take place electronically. This is the case in particular if an applicant sends us the relevant application documents electronically, for example by email or via a web form on the website. If we conclude an employment contract or service contract with an applicant, the data transmitted will be stored for the purpose of handling the employment relationship in compliance with the statutory provisions. If we do not conclude a contract with the applicant, the application documents will be automatically anonymised no later than six months after the rejection decision has been communicated, provided that no other legitimate interests on our part prevent anonymisation. Another legitimate interest in this sense is, for example, a duty to furnish evidence in proceedings under the German General Equal Treatment Act (AGG).

The legal basis for the processing of your data is Art. 6(1)(b) and Art. 88 GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG).

9.8 App Redirection (Magic Links)

To redirect you conveniently to our mobile app, we use so-called "Magic Links" provided by the service onelink.to, operated by OLTO AB, Höjdvägen 1, SE-17760 Järfälla, Sweden ("onelink.to").

When you click on such a link, you are automatically redirected, depending on your device, to the Apple App Store or the Google Play Store.

According to its own information, onelink.to processes the data generated during the redirection as an independent controller and not as our processor within the meaning of Art. 28 GDPR, since onelink.to determines the purposes and means of the processing itself and independently of us, and the processing takes place for its own business purposes (operation of its own SaaS platform). A data processing agreement is not applicable in this case.

We ourselves receive from onelink.to only aggregated, anonymised statistical evaluations, in particular device numbers, distribution by country, referrer domains and campaign-related parameters (for example UTM parameters). No personal data of individual users is transmitted to us.

According to onelink.to, the IP address is used only temporarily to determine the country of origin and is then discarded immediately; according to onelink.to, the IP address is not stored or logged.

The legal basis for our provision of the Magic Link service is our overriding legitimate interest in the user-friendly provision of digital service offerings pursuant to Art. 6(1)(f) GDPR.

You can find further information on the independent data processing by onelink.to in its privacy notices.

9.9 URL Shortening (Bitly)

To shorten URLs, we use the service Bitly (Bitly Inc., 601 W. 26th Street, Suite 357, New York, NY 10001, USA; for requests from the EU additionally Bitly Europe GmbH, Pariser Str. 47, 10719 Berlin) ("Bitly").

Bitly processes users' personal data as an independent controller, in particular the IP address, location information, device and browser information and referrer information.

We receive only aggregated statistical evaluations from Bitly. No assignment to individual customers takes place.

Bitly is a provider based in the USA. The transfer takes place on the basis of the EU Standard Contractual Clauses.

The legal basis for the processing is Art. 6(1)(f) GDPR.

You can find further information on data processing by Bitly at: https://bitly.com/pages/privacy.

10. Promotional Emails

10.1 Email Marketing for Promotions

We do not offer a newsletter that you can subscribe to. If you have provided us with your email address when renting a safe deposit box, we reserve the right to send you offers for our services from time to time as part of promotions. We do not need to obtain separate consent from you for this pursuant to Section 7(3) of the German Act against Unfair Competition (UWG). If you have booked a consultation appointment via our website but have not yet concluded a rental agreement, we likewise reserve the right to send you offers for our services from time to time as part of promotions to the email address given when booking the appointment. For this purpose, we process your name, your email address and the information on whether you have rented a safe deposit box with us or booked a consultation appointment. In both cases, the data is processed on the basis of our legitimate interest in personalised direct marketing pursuant to Art. 6(1)(f) GDPR. We use the data used for this purpose exclusively for sending these offers. It is not passed on to third parties; for the technical delivery, we use our service provider SendGrid (see section 10.2).

Our promotional emails contain a so-called tracking pixel, and the links they contain are redirected via SendGrid. This allows us to see whether and when you have opened an email and which links you have clicked; your IP address and technical details about your device are also processed in the process. We use this information to evaluate the success of our promotions.

You are entitled to object to the use of your email address for the aforementioned advertising purpose at any time with effect for the future by replying to the sender of the email or by contacting our customer service at support@trisor.de. The objection is free of charge for you. At most, the normal costs of your own internet or telephone provider are incurred. After we receive your objection, the use of your email address for advertising purposes will be stopped without delay.

10.2 Email Delivery Service Provider SendGrid

For the technical delivery of our promotional emails, we use the platform "SendGrid" of Twilio Inc., 101 Spear Street, 5th Floor, San Francisco, California, 94105, USA ("SendGrid"). SendGrid is a customer communication platform through which emails are delivered reliably. In addition to sending our promotional emails, we also use SendGrid to send transactional emails (for example confirmation and system messages in the context of contract performance).

As part of the sending process, your email address and the technical delivery data required for delivery (including delivery status) are transmitted to SendGrid.

The legal basis for sending the promotional emails is, as stated in section 10.1, Art. 6(1)(f) GDPR; for sending transactional emails, the legal basis is Art. 6(1)(b) GDPR, as this sending serves contract performance.

The provider necessarily gains knowledge of the aforementioned data to the extent provided for within the scope of our data processing agreement (Art. 28 GDPR).

Twilio Inc. (SendGrid) is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Art. 45 GDPR is therefore in place, so that personal data may be transferred without further safeguards or additional measures.

You can view the privacy policy of SendGrid/Twilio at: https://www.twilio.com/en-us/legal/privacy.

11. Our Activities on Social Networks

So that we can also communicate with you on social networks and inform you about our services, we maintain our own pages there. When you visit one of our social media pages, we are jointly responsible with the provider of the respective social media platform, within the meaning of Art. 26 GDPR, for the processing operations triggered by this.

We are not the original provider of these pages, but merely use them within the scope of the options offered to us by the respective providers.

We therefore point out as a precaution that your data may also be processed outside the European Union or the European Economic Area. Use may therefore involve data protection risks for you, as the enforcement of your rights, for example to access, erasure, objection, etc., may be made more difficult, and the processing on social networks is often carried out by the providers directly for advertising purposes or to analyse user behaviour, without us being able to influence this. If the provider creates usage profiles, cookies are often used, or the usage behaviour is assigned to your own member profile on the social networks.

The described processing operations of personal data are carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest and the legitimate interest of the respective provider in being able to communicate with you in a contemporary manner and to inform you about our services. If you, as a user, have to give consent to data processing to the respective providers, the legal basis is Art. 6(1)(a) GDPR in conjunction with Art. 7 GDPR.

Since we have no access to the providers' data, we point out that it is best for you to exercise your rights (for example to access, rectification, erasure, etc.) directly with the respective provider. We have listed further information on the processing of your data on social networks below for each social network provider we use:

11.1 Facebook

(Joint) controller for data processing in Europe:

Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Meta (Facebook) may, unless an objection is made, process content of adult users from the EU, for example photos, posts or comments, to train its own AI models. The basis is a legitimate interest pursuant to Art. 6(1)(f) GDPR. As a company, we have no influence on this specific data processing by Meta. Users can object to this via an online form on the Meta platforms.

https://www.facebook.com/about/privacy

11.2 Instagram

(Joint) controller for data processing in Germany:

Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Meta (Instagram) may, unless an objection is made, process content of adult users from the EU, for example photos, posts or comments, to train its own AI models. As a company, we have no influence on this specific data processing by Meta. The basis is a legitimate interest pursuant to Art. 6(1)(f) GDPR. Users can object to this via an online form on the Meta platforms.

https://instagram.com/legal/privacy/

11.3 LinkedIn

(Joint) controller for data processing in Europe:

LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland

https://www.linkedin.com/legal/privacy-policy

12. Social Media Plugins

12.1 LinkedIn Plugin

We have integrated components of LinkedIn Corporation into this website. LinkedIn is an internet-based social network that enables users to connect with existing business contacts and to make new business contacts.

The operating company of LinkedIn is LinkedIn Corporation, 2029 Stierlin Court Mountain View, CA 94043, USA. For privacy matters outside the USA, LinkedIn Ireland, Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland, is responsible.

Each time our website, which is equipped with a LinkedIn component (LinkedIn plugin), is accessed, this component causes the browser you are using to download a corresponding representation of the component from LinkedIn. Further information on the LinkedIn plugins can be found at https://developer.linkedin.com/product-catalog. As part of this technical process, LinkedIn learns which specific sub-page of our website you have visited.

If you are logged in to LinkedIn at the same time, LinkedIn recognises with every visit to our website, and for the entire duration of your stay on our website, which specific sub-page of our website you are visiting. This information is collected by the LinkedIn component and assigned by LinkedIn to your LinkedIn account. If you click a LinkedIn button integrated into our website, LinkedIn assigns this information to your personal LinkedIn user account and stores this personal data.

LinkedIn always receives information via the LinkedIn component that you have visited our website if you are logged in to LinkedIn at the same time at the time you access our website; this takes place regardless of whether or not you click on the LinkedIn component. If you do not want this information to be transmitted to LinkedIn, you can prevent the transmission by logging out of your LinkedIn account before accessing our website.

Data may be transferred to the USA and Singapore as part of the processing via LinkedIn. This US company is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Art. 45 GDPR is therefore in place, so that personal data may be transferred without further safeguards or additional measures. In addition, the security of the transfer is regularly safeguarded through so-called Standard Contractual Clauses, which ensure that the processing of personal data is subject to a level of security equivalent to that of the GDPR. If the Standard Contractual Clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49(1)(a) GDPR will be obtained.

Personal data is processed by means of the social media buttons exclusively after your express consent pursuant to Art. 6(1)(a) GDPR.

At https://www.linkedin.com/psettings/guest-controls, LinkedIn offers the option to unsubscribe from email messages, SMS messages and targeted advertisements and to manage ad settings. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua and Lotame, which may set cookies. Such cookies can be rejected at https://www.linkedin.com/legal/cookie-policy. LinkedIn's applicable privacy policy is available at https://www.linkedin.com/legal/privacy-policy. LinkedIn's cookie policy is available at https://www.linkedin.com/legal/cookie-policy.

13. Web Analytics

13.1 LinkedIn Pixel (Insight Tag)

This website uses LinkedIn Insights of LinkedIn Corporation, 1000 W Maude Ave Sunnyvale, CA 94085, USA (LinkedIn). If express consent is given, this allows the behaviour of users to be tracked.

The procedure serves to evaluate the effectiveness of advertisements for statistical and market research purposes and can help to optimise future advertising measures. Through the LinkedIn Pixel, we obtain extended information about the people interested in our products, including job title, employer or the industry in which they work.

When you visit the website, the following data, among others, may also be processed by the LinkedIn Pixel:

IP address
Interactions on our website (for example page views, clicks, conversions)
Browser type/version
Operating system used
Referrer URL (previously visited page)
Time of the server request

Direct identifiers are automatically removed from the data set by LinkedIn within seven days, and the data is deleted after 180 days. For the storage period of the cookie, please refer to the consent solution we use. The data is stored and processed by LinkedIn, so that a connection to the respective user profile is possible.

These processing operations take place exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR.

LinkedIn is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Art. 45 GDPR is therefore in place, so that personal data may be transferred without further safeguards or additional measures.

You can view further information and the privacy policy of LinkedIn Pixel at: https://de.linkedin.com/legal/privacy-policy.

13.2 Google Analytics 4 (GA4)

On our websites, we use Google Analytics 4 (GA4), a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

In this context, pseudonymised usage profiles are created and cookies are used (see the section "Cookies"). The information generated by the cookie about your use of this website may include, among other things:

a short-term capture of the IP address without permanent storage
Location data
Browser type/version
Operating system used
Referrer URL (previously visited page)
Time of the server request

The pseudonymised data may be transferred by Google to a server in the USA and stored there.

The information is used to evaluate the use of the website, to compile reports on website activity and to provide further services associated with website use and internet use for the purposes of market research and the needs-based design of these websites. This information may also be transferred to third parties where this is required by law or where third parties process this data on our behalf.

These processing operations take place exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR.

The storage period of the data preset by Google is 14 months. Otherwise, personal data is kept for as long as is necessary to fulfil the purpose of the processing. The data is deleted as soon as it is no longer required to achieve the purpose.

The parent company Google LLC is certified as a US company under the EU-US Data Privacy Framework. An adequacy decision pursuant to Art. 45 GDPR is therefore in place, so that personal data may be transferred without further safeguards or additional measures.

You can find further information on data protection when using GA4 at: https://support.google.com/analytics/answer/12017362?hl=de.

13.3 Google Analytics Remarketing

We have integrated Google Remarketing services into this website. The operating company of the Google Remarketing services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Remarketing is a feature of Google Ads that allows a company to display advertising to internet users who have previously visited the company's website. The integration of Google Remarketing therefore allows a company to create user-related advertising and consequently to have interest-relevant advertisements displayed to the internet user. The audiences are created in Google Analytics and transmitted to Google Ads.

The purpose of Google Remarketing is to display interest-relevant advertising. Google Remarketing enables us to display advertisements via the Google advertising network or to have them displayed on other websites, tailored to the individual needs and interests of internet users.

Google Remarketing sets a cookie on the data subject's IT system. By setting the cookie, Google is able to recognise the visitor to our website when they subsequently visit websites that are also members of the Google advertising network. Each time a website on which the Google Remarketing service has been integrated is accessed, your internet browser automatically identifies itself to Google. As part of this technical process, Google gains knowledge of personal data, such as your IP address or browsing behaviour, which Google uses, among other things, to display interest-relevant advertising.

Personal information, for example the websites you have visited, is stored by means of the cookie. A transfer of personal data, including your IP address, to Google in the United States of America cannot be ruled out. This personal data is stored by Google in the United States of America.

These processing operations take place exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR.

The privacy policy of Google Analytics Remarketing can be accessed at https://policies.google.com/privacy.

13.4 Hotjar

This website uses Hotjar, a Contentsquare company. The provider is Hotjar Ltd., Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta.

Hotjar is a tool for analysing your user behaviour on this website. With Hotjar, we can record, among other things, your mouse and scroll movements and clicks. Hotjar can also determine how long you kept the mouse pointer in a particular spot. From this information, Hotjar creates so-called heatmaps, which can be used to determine which areas of the website the website visitor prefers to look at.

Furthermore, we can determine how long you stayed on a page and when you left it. We can also determine at what point you abandoned your entries in a contact form (so-called conversion funnels). In addition, Hotjar can be used to obtain direct feedback from website visitors. This function serves to improve the website operator's web offerings.

Hotjar uses cookies. Cookies are small text files that are placed on your computer and stored by your browser. They serve to make our offer more user-friendly, effective and secure. These cookies can be used in particular to determine whether this website has been visited with a particular device or whether the functions of Hotjar have been deactivated for the relevant browser. Hotjar cookies remain on your device until you delete them.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when you close the browser. If cookies are deactivated, the functionality of this website may be restricted.

These processing operations take place exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR.

You can find more information on Hotjar at: https://help.hotjar.com/hc/en-us/sections/35766945134481-About-Hotjar.

13.5 HubSpot Services (HubSpot, HubSpot CMS, HubSpot Forms)

Functions of the HubSpot service are used on this website. The provider is HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA.

When using HubSpot, various services may be provided, in particular a content management system (CMS), forms for contacting us, and tracking and analytics functions.

Content of this website may be delivered via the HubSpot CMS. In this process, technical access data (for example IP address, time of access, content requested) is transmitted to HubSpot servers. This processing serves the technical provision of the website, Art. 6(1)(f) GDPR.

When you fill in a form, the email address you enter is used to match it to an existing contact profile, provided one has already been created at HubSpot. If you have additionally consented to the use of HubSpot tracking cookies, earlier page visits are also assigned to the contact profile. The processing takes place on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

If you give your consent pursuant to Art. 6(1)(a) GDPR, HubSpot sets cookies to analyse your user behaviour. On your first visit, a check is made as to whether a HubSpot tracking cookie is present; if not, a cookie is set. This allows your visits to our website and any form submissions to be linked to one another.

The following special features should be noted with regard to HubSpot tracking:

Your visit to our websites is only traced using the HubSpot cookie if you have given your consent to the setting of the HubSpot cookie or of all tracking cookies.
If you fill in and submit one of the forms on our websites (for example a contact form) and have given your consent to the setting of the HubSpot cookie, HubSpot assigns your earlier page views resulting from the tracking cookie to the form you submitted.
If you have already been in contact with us, the email address you submit via the form will be matched with the information already stored by us.
If you delete all of your cookies or specifically the HubSpot cookies, you will be regarded as a new visitor on our website and a new cookie will be set. However, HubSpot automatically deduplicates all form submissions coming from the same email address, even if different browser cookies were assigned to these submissions.
Since cookies are only set once on a browser, submissions from two people who share a single computer are assigned to one and the same contact record. This deduplication by cookie ensures that, if a contact person submits forms to your website from different email addresses, all submissions are assigned to a single contact record in HubSpot.
HubSpot assigns page views to a contact person if the contact person clicks a link in a tracked marketing email that leads to a page on which the HubSpot tracking code is installed.

You can find more information on HubSpot at: https://legal.hubspot.com/privacy-policy.

13.6 LinkedIn Analytics

On this website, we use the retargeting tool and conversion tracking of LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Ireland (LinkedIn).

For this purpose, the LinkedIn Insight Tag is integrated into our website, which enables LinkedIn to collect statistical data about your visit and your use of our website and to provide us with corresponding aggregated statistics on this basis. The service also serves to be able to show you interest-specific and relevant offers and recommendations after you have obtained information on the website about certain services, information and offers. The relevant information is stored in a cookie.

As a rule, the following data is collected and processed in this process:

IP address
Device information
Browser information
Referrer URL and
Timestamp

These processing operations take place exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR. Your data is stored until you withdraw your consent.

You can find more information on LinkedIn's privacy policy at: https://de.linkedin.com/legal/privacy-policy.

14. Advertising

14.1 Google Ads (AdWords) Remarketing/Retargeting

We have integrated Google Ads into this website. The operating company of the Google Ads services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

With this, we advertise this website in Google search results as well as on third-party websites. For this purpose, Google places a cookie in the browser of your device, which enables interest-based advertising automatically by means of a pseudonymous cookie ID and on the basis of the pages you have visited.

Any further data processing only takes place if you have agreed with Google that your internet and app browsing history is linked by Google to your Google account and that information from your Google account is used to personalise ads that you view on the web. If you are logged in to Google during your visit to our website in this case, Google uses your data together with Google Analytics data to create and define audience lists for cross-device remarketing. For this purpose, your personal data is temporarily linked by Google with Google Analytics data in order to form audiences.

These processing operations take place exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR.

You can view the privacy policy and further information on Google Ads at: https://www.google.com/policies/technologies/ads/

14.2 Google Ads with Conversion Tracking

We have integrated Google Ads into this website. The operating company of the Google Ads services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ads is an internet advertising service that allows advertisers to place ads both in Google's search engine results and in the Google advertising network. Google Ads allows an advertiser to define certain keywords in advance, by means of which an ad is displayed in Google's search engine results only when the user retrieves a keyword-relevant search result using the search engine. In the Google advertising network, ads are distributed to topic-relevant websites by means of an automatic algorithm and in accordance with the previously defined keywords.

The purpose of Google Ads is to promote our website by displaying interest-relevant advertising on the websites of third-party companies and in the search engine results of the Google search engine, and to display third-party advertising on our website.

If you reach our website via a Google ad, Google places a so-called conversion cookie on your IT system. A conversion cookie expires after thirty days and is not used to identify you. If the cookie has not yet expired, the conversion cookie is used to trace whether certain sub-pages, for example the shopping cart of an online shop system, have been accessed on our website. The conversion cookie allows both us and Google to trace whether a user who reached our website via an AdWords ad generated revenue, that is, completed or abandoned a purchase of goods.

The data and information collected through the use of the conversion cookie is used by Google to compile visit statistics for our website. We in turn use these visit statistics to determine the total number of users who were referred to us via Ads ads, that is, to determine the success or failure of the respective Ads ad and to optimise our Ads ads for the future. Neither our company nor other Google Ads customers receive information from Google by means of which you could be identified.

Personal information, for example the websites you have visited, is stored by means of the conversion cookie. Each time you visit our websites, personal data, including the IP address of the internet connection you use, is therefore transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may pass on the personal data collected through the technical process to third parties.

These processing operations take place exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR.

You can view the privacy policy and further information on Google Ads at: https://www.google.de/intl/de/policies/privacy/.

14.3 Google Ads with Enhanced Conversions

We have integrated Google Ads into this website. The operating company of the Google Ads services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads is an internet advertising service that allows advertisers to place ads both in Google's search engine results and in the Google advertising network. The purpose of Google Ads is to promote our website by displaying interest-relevant advertising on the websites of third-party companies and in the search engine results of the Google search engine, and to display third-party advertising on our website.

If you reach our website via a Google ad, Google places a so-called conversion cookie on your IT system. A conversion cookie expires after thirty days and is not used to identify you. If the cookie has not yet expired, the conversion cookie is used to trace whether certain sub-pages, for example the shopping cart of an online shop system, have been accessed on our website. The conversion cookie allows both us and Google to trace whether a user who reached our website via a Google Ads ad generated revenue, that is, completed or abandoned a purchase of goods.

We use the enhanced conversions feature of Google Ads. For this purpose, we transmit personal data collected by ourselves, such as telephone numbers or email addresses, to Google. This data is matched with event data on Google ads in order to capture more conversions.

Each time you visit our websites, personal data, including the IP address of the internet connection you use, is therefore transmitted to Google in the United States of America. Google may pass on the personal data collected through the technical process to third parties.

These processing operations take place exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR.

You can view the privacy policy and further information on Google Ads at: https://www.google.de/intl/de/policies/privacy/ or https://support.google.com/adspolicy/answer/9755941?hl=de&ref_topic=7012636&sjid=9061832235671554201-EU.

14.4 Microsoft Bing Ads

We have integrated Microsoft Bing Ads into this website. The operating company is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521, Ireland.

Bing Ads is an internet advertising service that allows advertisers to place ads both in Bing's search engine results and in the Bing advertising network. The purpose of Bing Ads is to promote our website by displaying interest-relevant advertising on the websites of third-party companies and in the search engine results of the Bing search engine, and to display third-party advertising on our website.

Through Microsoft Bing Ads conversion tracking, we and Microsoft can recognise whether users have carried out certain actions. For example, we analyse which buttons on our website are clicked frequently and which products are viewed or purchased particularly often. This information is used to create conversion statistics. We receive the total number of users who clicked on our ads, as well as details of the actions performed. Users' personal identification data is not collected in the process. Microsoft uses cookies or similar technologies for recognition.

The following data, among others, may be processed:

IP address (without permanent storage),
Browser details,
URL visited,
Referrer URL (previously visited page),
Time of the server request,
User behaviour.

These processing operations take place exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR.

Microsoft generally processes the data within the European Union under the so-called EU Data Boundary. To provide and secure the services and to fulfil legal obligations, Microsoft Ireland may transfer personal data to affiliated companies of Microsoft Corporation (Redmond, Washington, USA). The intra-group data transfer takes place on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and supplementary technical and organisational measures, as set out in the Microsoft Data Protection Addendum.

Microsoft Corporation is additionally certified under the EU-US Data Privacy Framework (DPF). An adequacy decision pursuant to Art. 45 GDPR is therefore in place for data transfers to the USA. Transfers of personal data to Microsoft in the USA are therefore also permissible without further safeguards or additional measures.

You can view the privacy policy and further information on Microsoft Bing Ads at: https://about.ads.microsoft.com/en-us/resources/policies/remarketing-in-paid-search-policies.

14.5 Reddit Ads

We use Reddit Ads, an advertising service of Reddit Inc., 548 Market Street, San Francisco, CA 94104, USA.

As part of Reddit Ads, tracking technologies (for example cookies or pixels) may be used to measure the effectiveness of advertising campaigns and to display interest-based advertising. In particular, information about pages visited, interactions, the truncated IP address and device and browser information may be processed.

The data collected is used to analyse and optimise our advertising campaigns on Reddit. Reddit may assign this data to a Reddit user account if the user is logged in during use.

The processing takes place exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR. Consent can be withdrawn at any time via the cookie settings.

Reddit processes personal data partly in the USA. The transfer takes place on the basis of appropriate safeguards pursuant to Art. 46 GDPR.

You can find further information in Reddit's privacy policy.

15. Plugins and Other Services

15.1 Review Reminders by Trusted Shops (Without Consent)

To display Trusted Shops services and to remind you of the option to submit a review, we use the service provider Trusted Shops GmbH, Subbelrather Str. 15c, 50823 Cologne, Germany.

The service provider is used on the basis of Art. 6(1)(f) GDPR and a data processing agreement pursuant to Art. 28 GDPR.

The data processing agreement can be accessed at: https://business.trustedshops.de/hubfs/legal-documents/joint-controllership/de/joint_controllership_trustedshops_de_20260508.pdf.

The Trustbadge is provided by a US content delivery network (CDN) provider. An adequate level of data protection is ensured by standard data protection clauses and further contractual measures.

After an order is completed, order information (order total, order number, and where applicable the product purchased) and the email address, hashed by means of a cryptographic one-way function, are transmitted to Trusted Shops. The legal basis is Art. 6(1) sentence 1 point (f) GDPR. This serves to check whether visitors are already registered for services at Trusted Shops and is therefore necessary to fulfil our and Trusted Shops' overriding legitimate interests in providing the buyer protection linked to the specific order and the transactional review services. If you are not yet registered for the services, you will be given the opportunity to do so for the first time after the order. Further processing after registration is governed by the contractual agreement with Trusted Shops, Art. 6(1) sentence 1 point (b) GDPR. If you do not register, all transmitted data is automatically deleted by Trusted Shops and it is then no longer possible to identify you.

The reviews received are analysed by an AI-supported system in order to suggest reply comments that match the review. After approval by the controller, suitable reply comments are published. The legal basis for the analysis of the review comment is Art. 6(1) sentence 1 point (f) GDPR.

You can find more information on Trusted Shops' privacy policy at: https://help.etrusted.com/hc/de/articles/23970819574290-FAQ-zum-Datenschutz-bei-Trusted-Shops.

Trusted Shops also provides additional information in its help centre.

15.2 Google Meet - Video Conferences

To conduct our communication in the form of telephone conferences, online meetings, video conferences and webinars (hereinafter: "online meetings"), we use the tool "Google Meet". The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, California, USA.

Various types of data are processed when using "Google Meet". The scope of the data also depends on what information you provide before or during participation in an "online meeting". The following personal data may be processed:

A personal "Google account" is mandatory for the use of "Google Meet". User details such as first name, last name, telephone number (optional), email address, password and profile picture (optional) that were entered in the "Google account" are also transferred to the "Google Meet" profile.
Meeting metadata such as topic, description (optional), participant IP addresses, device/hardware information.
For recordings (optional), all video, audio and presentation recordings and text files of the online meeting chat may be processed.
When dialling in by telephone, details of the incoming and outgoing telephone number, country name, and start and end time are processed. Further connection data, such as the IP address of the device, may also be stored where applicable.
You may have the option (optional) to use the chat, question or survey functions in an "online meeting". The text entries you make are processed in order to display them in the "online meeting" and, where applicable, to log them. To enable the display of video and the playback of audio, the data from the microphone of your device and from any video camera of the device are processed accordingly for the duration of the meeting. You can switch off or mute the camera or microphone yourself at any time via "Google Meet".

Where corresponding consent has been requested, the processing takes place exclusively on the basis of Art. 6(1)(a) GDPR. In the context of an employment relationship, corresponding data processing takes place on the basis of Section 26 of the German Federal Data Protection Act (BDSG). The legal basis for the use of "Google Meet" in the context of existing or prospective contractual relationships is Art. 6(1)(b) GDPR. In all other cases, the legal basis for the processing of your personal data is Art. 6(1)(f) GDPR. Our interest here lies in the effective conduct of "online meetings".

If we record "online meetings", we will inform you of this before the start and, where necessary, ask for your consent to the recording. If you do not wish this, you can leave the "online meeting".

The personal data concerning you is stored until the purpose of the data processing no longer applies. The storage period of recorded online meetings will be communicated to you before the recording begins. You have the option to withdraw your consent to the recording at any time, with the result that we will delete the recording.

The provider of "Google Meet" necessarily gains knowledge of the aforementioned data to the extent provided for within the scope of our data processing agreement (Art. 28 GDPR) with "Google Meet". This includes in particular the purpose of providing, optimising and securing the service. The participation information you provide is used for the purpose of identification in the "online meeting". Data processing by "Google Meet" takes place in the USA and thus in a third country (outside the EU and the EEA). Furthermore, we cannot rule out that data is routed via internet servers located outside the EU / EEA, which may be the case in particular if participants in "online meetings" are located in a third country. However, the data is encrypted during transport over the internet and is thus protected against unauthorised access by third parties.

To the extent that "Google Meet" processes personal data in connection with the legitimate business operations of "Google Meet", "Google Meet" is an independent controller for this use and, as such, is responsible for compliance with applicable laws and obligations of a controller. If you visit the provider's other websites or install the provider's tool on your device, the processing of personal data is governed exclusively by the provider's privacy policy.

You can find further information on "Google Meet" at: https://policies.google.com/privacy.

15.3 Google reCAPTCHA

We use the reCAPTCHA function on this website. The operating company of Google reCAPTCHA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The reCAPTCHA function serves above all to distinguish whether an entry is made by a natural person or is made abusively by machine and automated processing. The service also includes the transmission of the IP address and, where applicable, further data required by Google for the reCAPTCHA service to Google.

These processing operations take place exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR.

You can find further information on Google reCAPTCHA and Google's privacy policy at: https://www.google.com/intl/de/policies/privacy/.

15.4 Google Tag Manager

We use the Google Tag Manager service on this website. The operating company of Google Tag Manager is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

This tool allows "website tags" (that is, keywords that are embedded in HTML elements) to be implemented and managed via an interface. By using Google Tag Manager, we can automatically trace which button, link or personalised image you have actively clicked and can then record which content on our website is of particular interest to you.

The tool also triggers other tags, which in turn may collect data under certain circumstances. Google Tag Manager does not access this data. If you have deactivated tracking at domain or cookie level, this remains in place for all tracking tags implemented with Google Tag Manager.

These processing operations take place exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR.

You can find further information on Google Tag Manager and Google's privacy policy at: https://www.google.com/intl/de/policies/privacy/.

15.5 HubSpot CRM System

We use the CRM software of the provider HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA ("HubSpot").

HubSpot is a software CRM solution for managing customer relationships and includes, among others, the following functions:

Deal management, lead management and task management,
Email tracking and notifications,
Email templates and appointment scheduling,
Shared use of documents,
Online booking system for appointments,
Telephony solutions such as automatic call recording and logging.

All departments (including, for example, marketing, sales, customer service and online and in-store retail) work together using the software described.

The provider of HubSpot necessarily gains knowledge of the aforementioned data to the extent provided for within the scope of our data processing agreement (Art. 28 GDPR) with HubSpot. This may include names, addresses, email addresses and telephone numbers. The processing of the personal data therefore also takes place in a third country (outside the EU and the EEA).

Where corresponding consent has been requested, the processing takes place exclusively on the basis of Art. 6(1)(a) GDPR. The legal basis for the use of HubSpot in the context of contractual relationships is Art. 6(1)(b) GDPR. In all other cases, the legal basis for the processing of your personal data is Art. 6(1)(f) GDPR. Our interest here lies in the effective coordination of internal and external communication and the management of customer relationships.

To the extent that HubSpot processes personal data in connection with its own legitimate business operations, HubSpot is an independent controller for this use and, as such, is responsible for compliance with applicable laws and obligations of a controller.

You can view HubSpot's privacy policy at: https://legal.hubspot.com/de/privacy-policy.

15.6 Microsoft Teams

To conduct our communication both in written form (chat) and in the form of telephone conferences, online meetings and video conferences, we use the tool "Microsoft Teams" ("MS Teams"). The operating company of the service is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft").

When using MS Teams, the following personal data is processed:

Meetings, chats, voicemails, shared files, recordings and transcriptions.
Data that is shared about you. Examples include your email address, your profile picture and your telephone number.
A detailed history of the telephone calls you make.
Call quality data.
Support/feedback data: information related to troubleshooting tickets or feedback sent to Microsoft.
Diagnostic and service data: diagnostic data related to the use of the service.

To enable the display of video and the playback of audio, the data from the microphone of your device and from a video camera of the device are processed for the duration of the meeting. You can switch off or mute the camera or microphone yourself at any time via the "Microsoft Teams" applications.

Where corresponding consent has been requested, the processing takes place exclusively on the basis of Art. 6(1)(a) GDPR. In the context of an employment relationship, corresponding data processing takes place on the basis of Section 26 of the German Federal Data Protection Act (BDSG). The legal basis for the use of "MS Teams" in the context of contractual relationships is Art. 6(1)(b) GDPR. In all other cases, the legal basis for the processing of your personal data is Art. 6(1)(f) GDPR. Our interest here lies in the effective conduct of online meetings.

If we record online meetings, we will inform you of this before the start and, where necessary, ask for your consent to the recording. If you do not wish this, you can leave the online meeting.

As a cloud-based service, "MS Teams" processes the data mentioned in the context of providing the service. To the extent that "MS Teams" processes personal data in connection with Microsoft's legitimate business operations, Microsoft is an independent controller for this use and, as such, is responsible for compliance with applicable laws and obligations of a controller. If you access the MS Teams website, Microsoft is responsible for the data processing. Accessing the website is necessary in order to download the MS Teams software.

You can find detailed information on data protection at Microsoft in connection with "MS Teams" at: https://docs.microsoft.com/de-de/microsoftteams/teams-privacy.

15.7 Zapier

We use the integration service "Zapier" of Zapier Inc., 548 Market Street #62411, San Francisco, CA 94104, USA ("Zapier") to connect different databases and web tools with each other. Zapier is a web service that automatically links actions between different web tools and synchronises their applications with each other so that they carry out the desired processes. We use Zapier to automate processing operations and to design work processes in our processing system efficiently.

The provider necessarily gains knowledge of the aforementioned data to the extent provided for within the scope of our data processing agreement (Art. 28 GDPR) with Zapier.

The legal basis for the use of Zapier is our overriding legitimate interest in an efficient and automated design of our internal work processes pursuant to Art. 6(1)(f) GDPR.

Zapier Inc. is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Art. 45 GDPR is therefore in place, so that personal data may be transferred without further safeguards or additional measures.

You can view Zapier's privacy policy at: https://zapier.com/privacy.

15.8 Acuity Scheduling

To book appointments for safe deposit box viewings, we use the tool "Acuity Scheduling", a Squarespace company. The provider is therefore Squarespace, Inc., 225 Varick Street, New York, NY 10014, USA.

Via Acuity Scheduling, prospective customers can book an appointment online for a viewing at one of our locations. As part of the appointment booking, the data you enter in the booking form is processed, namely name, email address, telephone number and the desired appointment and location.

The legal basis for the use of Acuity Scheduling is Art. 6(1)(b) GDPR, as the appointment booking is a pre-contractual measure for initiating a rental relationship.

The provider necessarily gains knowledge of the aforementioned data to the extent provided for within the scope of our data processing agreement (Art. 28 GDPR).

Squarespace, Inc. is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Art. 45 GDPR is therefore in place, so that personal data may be transferred without further safeguards or additional measures.

You can view the privacy policy of Squarespace/Acuity Scheduling at: https://www.squarespace.com/privacy.

15.9 Confluence

For internal project and task organisation, we use the service "Confluence" of Atlassian Pty Ltd, c/o Atlassian US, Inc., 350 Bush Street, Floor 13, San Francisco, CA 94104, USA ("Atlassian"). As part of the internal organisation of our business relationships with cooperation partners, contact data of our B2B business partners is also processed there.

The legal basis for the processing is our overriding legitimate interest in efficient internal project and task organisation pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement (DPA) with Atlassian pursuant to Art. 28 GDPR.

Atlassian is certified under the EU-US Data Privacy Framework. An adequacy decision pursuant to Art. 45 GDPR is therefore in place, so that personal data may be transferred without further safeguards or additional measures.

You can view Atlassian's privacy policy at: https://www.atlassian.com/legal/privacy-policy.

16. Payment Providers

16.1 Stripe

For payment processing, we use, among others, the payment service provider "Stripe". Payment processing via Stripe is carried out by Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA. For customers within the EU, Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland is responsible. With Stripe, it is possible to accept various payment methods in our customer portal. Stripe handles the entire payment process.

The personal data exchanged with Stripe consists of the payment method (that is, credit card, debit card or account number), bank code, currency, the amount and the date of the payment. In a transaction, your name, your email address, your billing or shipping address and sometimes also your transaction history may also be transmitted. This data is necessary for payment processing and fraud prevention. We will also transmit other personal data to Stripe if there is a legitimate interest in doing so. The personal data exchanged between Stripe and us may be transmitted by Stripe to credit reference agencies. The purpose of this transmission is identity and credit checks.

Stripe may pass on the personal data to affiliated companies and service providers or subcontractors where this is necessary to fulfil contractual obligations or where the data is to be processed on its behalf.

You have the option to withdraw your consent to the handling of personal data at any time with Stripe. A withdrawal does not affect personal data that must necessarily be processed, used or transmitted for (contractual) payment processing.

Stripe is used in the interest of proper and smooth payment processing. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. Your personal data is transmitted exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR. In addition, we have concluded a data processing agreement (DPA) with Stripe pursuant to Art. 28 GDPR.

You can view Stripe's privacy policy at: https://stripe.com/de/privacy.

16.2 Mollie

For payment processing, we use, among others, the payment service provider "Mollie". Payment processing via Mollie is carried out by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands ("Mollie"). Mollie is supervised as a regulated electronic money institution by the Dutch central bank (De Nederlandsche Bank). With Mollie, it is possible to accept various payment methods in our customer portal; Mollie handles the entire payment process.

The personal data exchanged with Mollie consists of the payment method (for example account number, credit card or debit card data), bank code, currency, amount and date of the payment. In a transaction, your name, your email address and your billing or shipping address may also be transmitted.

You have the option to withdraw your consent to the handling of personal data at any time with Mollie. A withdrawal does not affect personal data that must necessarily be processed, used or transmitted for (contractual) payment processing.

Mollie is used in the interest of proper and smooth payment processing. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. Your personal data is transmitted exclusively if express consent has been given pursuant to Art. 6(1)(a) GDPR. In addition, we have concluded a data processing agreement (DPA) with Mollie pursuant to Art. 28 GDPR.

Since Mollie B.V. is based in the Netherlands and thus within the European Union, no personal data is generally transferred to a third country in the context of payment processing via Mollie.

You can view Mollie's privacy policy at: https://www.mollie.com/de/privacy.

17. Your Rights as a Data Subject

17.1 Right to Confirmation

You have the right to request confirmation from us as to whether personal data concerning you is being processed.

17.2 Right of Access, Art. 15 GDPR

You have the right to obtain from us, at any time and free of charge, information about the personal data stored about you and a copy of this data, in accordance with the statutory provisions.

17.3 Right to Rectification, Art. 16 GDPR

You have the right to request the rectification of inaccurate personal data concerning you. Furthermore, you have the right, taking into account the purposes of the processing, to request the completion of incomplete personal data.

17.4 Erasure, Art. 17 GDPR

You have the right to request that we delete the personal data concerning you without undue delay, provided that one of the statutory grounds applies and insofar as the processing or storage is not necessary.

17.5 Restriction of Processing, Art. 18 GDPR

You have the right to request from us the restriction of processing where one of the statutory conditions is met.

17.6 Data Portability, Art. 20 GDPR

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, to whom the personal data has been provided, provided that the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, in exercising your right to data portability pursuant to Art. 20(1) GDPR, you have the right to have the personal data transmitted directly from one controller to another controller, where technically feasible and provided that this does not adversely affect the rights and freedoms of other persons.

17.7 Right to Object, Art. 21 GDPR

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) (data processing in the public interest) or (f) (data processing on the basis of a balancing of interests) GDPR.

This also applies to profiling based on these provisions within the meaning of Art. 4(4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

In individual cases, we process personal data for direct marketing purposes. You can object at any time to the processing of personal data for the purpose of such advertising. This also applies to profiling insofar as it is related to such direct marketing. If you object to us to the processing for direct marketing purposes, we will no longer process the personal data for these purposes.

In addition, you have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you that is carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Art. 89(1) GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

You are free, in connection with the use of information society services, and notwithstanding Directive 2002/58/EC, to exercise your right to object by automated means using technical specifications.

17.8 Withdrawal of Consent Under Data Protection Law

You have the right to withdraw consent to the processing of personal data at any time with effect for the future.

17.9 Complaint to a Supervisory Authority

You have the right to lodge a complaint with a supervisory authority responsible for data protection about our processing of personal data.

18. Routine Storage, Deletion and Blocking of Personal Data

We process and store your personal data only for the period necessary to achieve the purpose of storage or where this is provided for by the laws and regulations to which our company is subject.

If the purpose of storage no longer applies or a prescribed retention period expires, the personal data is routinely blocked or deleted in accordance with the statutory provisions.

19. Storage Period of Personal Data

The criterion for the storage period of personal data is the respective statutory retention period. After the period has expired, the corresponding data is routinely deleted, provided it is no longer required for the performance or initiation of a contract.

20. Currency and Amendment of the Privacy Policy

This Privacy Policy is currently valid and is dated: October 2026.

Due to the further development of our websites and offerings, or due to changed statutory or regulatory requirements, it may become necessary to amend this Privacy Policy. The current Privacy Policy can be accessed and printed by you at any time on the website at "https://trisor.de/datenschutz/".