Data protection

CompuGroup Medical (hereinafter referred to as CGM) appreciates your visit to our website and your interest in our company, products and services. The protection of your personal data is an important concern for us and we want you to feel secure when visiting our website. In the following, we present to you what information we collect at CGM during your visit to our website and how it is used.

Scope of Application

This data protection statement applies to the websites of CompuGroup Medical SE & Co. KGaA and its companies and the connected online services. It does not apply to any links to external companies that may exist.

Personal Data

Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an address and phone number. Information that is not directly related to your real identity - such as preferred websites or number of users of a page - are not personal data.

Collection and Processing of Personal Data

When visiting our website, our webservers will by default and for the purpose of system security temporarily store the connection data of the requesting device, the webpages you are visiting, the date and time of your visit, information on the type of browser and operating system used, as well as the referring website you visited before. Data such as your name, address, phone number, or e-mail-address are not collected unless you have freely disclosed that information, e.g. for the purpose of an account registration, a survey, for the execution of a contract or an information request.

Use and Transfer of Personal Data

The personal data provided by you is used exclusively for the purpose of the technical administration of the web pages and for the fulfillment of your wishes and requirements, so usually for processing the contract concluded with you or for answering your request. Only if you have given us your consent or if you - as far as statutory regulations provide for this - have not objected, we also use this data for product-related surveys and marketing purposes.

The retention time of your data depends on its purpose. Contract data is only stored for the period necessary for the fulfillment of the contract (we will inform you in detail when closing the contract) or if we are obliged by law. Data collected and processed on the basis of your consent will be kept only as long as your consent remains effective.

Your personal data will not be transferred or sold to third parties unless required for the purpose of the contractual agreement or based on your explicit consent. As an example, it may be necessary to transfer your address and order data to our sales and service partners when placing an order with us. We will inform you about the recipients of your data in the order confirmation.

Information from CGM Group

CGM companies would like to contact you for offers and news on our products and services. When registering on our website we will therefore ask you for the permission to send you direct marketing messages. Information on important changes in connection with your existing contract as a customer of CGM (e.g. software releases) do of course not depend on the marketing permission.

Use of cookies and other end device accesses  

Our website uses cookies for providing core functions and for web tracking. Cookies are small files that enable us to store specific user-related information on your device when you visit one of our websites. Cookies help us determine how often our websites are used and how many users we have. They also help us make our offers more convenient and efficient for you. 
 
Cookies and other tags, such as local storage on your end device, are necessary to provide the services you require. Session cookies are a necessary part of enabling you to log in and navigate the site in a user-friendly manner. According to para. 25 II No. 2 of the New German Telecommunications-Telemedia Data Protection Act (TDDDG) we set such cookies without your consent. This also applies to a so-called “consent cookie”, which we use to record your selection in the cookie banner displayed at the beginning. For all other cookies and tags we will ask for your consent (para. 25 I TDDDG in conjunction with Art. 7 GDPR). We will inform you which cookies these are, for what purpose they are used, and for how long we process which information. You can access this information via our website in the cookie banner. 

You can also withdraw your consent in whole or in part at any time via the cookie banner. It is also possible to use our offers without non-required cookies. You can deactivate the storage of cookies in your browser, restrict it to certain websites or set your browser so that it notifies you as soon as a cookie is sent. You can also delete cookies from your end device at any time. Please be aware that in this case, you will have to accept a limited display of the page and limited user guidance. 

In the table below, we have listed the different categories of cookies that we use on our website: 

Essential cookies 

Cloudflare 

We use the Content Delivery Network (CDN) of Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich Germany (Cloudflare) on our website to increase the security and speed of our website. 

This corresponds to our legitimate interest (Art. 6 para. 1 lit. f GDPR).  

A CDN is a network of distributed servers which delivers optimized content to the website user. Cloudflare stores your information mainly in the European Economic Area and is based on the current location of the website visitor. By using SSL certificates, the protection of the data is guaranteed along the entire transport route.   

Cloudflare gains access to the data traffic between our company and the website visitors. The following data is collected: 

• the IP address
• the website accessed
• the type of browser used
• the operating system
• the referrer URL
• the requesting provider

Cloudflare does not store any personal data and does not pass on any user data to third parties. The necessary data logs are deleted after 24 hours in most cases.  

The functionality of the website is not guaranteed without the processing operations by Cloudflare.  

Cloudflare has implemented compliance safeguards for international data transfers. These apply to all global activities where Cloudflare processes personal data in the EU. These safeguards include the EU Standard Contractual Clauses (SCCs). Further information can be found at: https://www.cloudflare.com/trust-hub/gdpr/ 

Usercentrics 

This is a consent management service. On our website, Usercentrics GmbH (Sendlinger Str. 7, 80331 Munich, Germany) is used as a processor to ensure consent management.   

The following data may be processed: IP address, browser and device information, and consent history.  

The legal basis for processing is legal obligations pursuant to Art. 6 para. 1 lit. c GDPR. 

You can find more information at https://usercentrics.com/privacy-policy/  

The processing of personal data takes place exclusively in a member state of the European Union or in another state party to the Agreement on the European Economic Area. 

Google Tag Manager 

We use the “Google Tag Manager (GTM)” tag management system from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) on our website.   

The Google Tag Manager collects data on the website and forwards it to the connected analysis tools listed below. This may result in the IP address being processed.   

The Google Tag Manager is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the fast and uncomplicated integration and management of various tools on its website. 

Details on the terms of use of Google Tag Manager can be found here: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/ 

Further information on the privacy policy and terms of use of Google services, such as Google Tag Manager, can be found here: https://policies.google.com/privacy?hl=en 

Any transfer by the service provider to the USA is carried out on the basis of suitable compliance safeguards in accordance with Art. 46 para. 2 GDPR or by an adequacy decision in accordance with Art. 45 GDPR. 

Details on the legal framework for data transfers to third countries can be found here: https://policies.google.com/privacy/frameworks?hl=en   

Cookies for analytics and marketing: web tracking services 

The web tracking services are generally provided by service providers who process the data in accordance with the controller's instructions as so-called processors. This is ensured by means of data processing contracts. If the service providers process your data outside the European Union or the European Economic Area (hereinafter referred to as “EU or EEA”), a so-called third country transfer takes place. This is permitted if you have consented to this and the service provider has created guarantees for a level of data protection appropriate to the European standard or the EU Commission has classified the respective third country as a safe third country. The third country transfer of the respective service is indicated below. 

In the following text you will find an overview of the services used, what these are, for what purpose they are used, what information they process and what legal basis we rely on. 

Analytics cookies 
 

Matomo 
 

This website uses the self-hosted web analysis service Matomo from InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand.  
Matomo enables the evaluation of user behavior on our website and thus the optimization of our Internet presence. 

The following data may be processed for this purpose: Anonymized IP address, date and time, title, URL and referrer of the page, device and browser information, pseudo-anonymized location data.   

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner. 

You can find further information at https://matomo.org/privacy-policy  

The processing of personal data in our self-hosted version takes place exclusively in a member state of the EU or in another state party to the Agreement on the EEA. 

Marketing cookies 

Meta Pixel 

Our website uses the conversion tool Meta Pixel from Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. 

This is a tracking technology offered by Meta and used by other Meta services. It is used to track visitors' interactions with websites (“events”) after they have clicked on an ad placed on Facebook or other services provided by Meta (“conversion”). 

The following data may be processed: Viewed Ads, Viewed Content, Device Information, Geographic Location, HTTP Header, Interactions with Ads, Services and Products, IP Address, Clicked Elements, Marketing Information, Pages Visited, Pixel ID, Referrer URL, Usage Data, User Behavior, Facebook Cookie Information, Facebook User ID, Usage/Click Behavior, Browser Information, Device Operating System, Device ID, User Agent and Browser Type. 

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner. Click here to read the data processor's privacy policy: https://www.facebook.com/privacy/explanation  

Click here to read the data processor's cookie policy: https://www.facebook.com/policies/cookies  

If you do not have a Facebook account, you can deactivate usage-based advertising from Facebook on the website of the European Interactive Digital Advertising Alliance: https://www.youronlinechoices.com/ 

According to Meta, the data collected is also transferred to the USA and other third countries. The data transfer is based on compliance safeguards such as the standard contractual clauses of the EU Commission; data transfers to the Meta Platforms Inc in the US is based on the EU-US Data Privacy Framework. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum  and https://www.facebook.com/help/566994660333381?locale=en_US&cms_id=566994660333381 

Facebook Custom Audiences 

We use a remarketing tag from Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. 

It is used to record and analyze website visitors in order to display interest-based advertising on Facebook, or to display ads to users who have also shown an interest in our website or who have certain characteristics (e.g. interests in certain products determined on the basis of the websites visited), which we transmit to Meta (so-called “Custom Audiences”). In addition, we can track the effectiveness of the advertisements for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook/Instagram advertisement (so-called “conversion”). The following data may be processed: IP address, pages visited (pseudonymized), device and browser information. 

Other customer data such as name, telephone number or email can be transmitted in hashed form as hash values. No clear data is transmitted. 

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner..  

The user can deactivate the remarketing function “Custom Audiences” on Facebook under “Settings”. Further information: https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0 

Personal data may be processed by this provider in third countries outside the European Union, e.g. by subcontractors. Any transfer by the service provider takes place on the basis of suitable guarantees in accordance with Art. 46 para. 2 GDPR or an adequacy decision in accordance with Art. 45 GDPR. 

Google Ads 

We use the “Google AdWords Conversion” function of Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Dublin (Google).   

This is a conversion tracking service. This service records what happens after a click on an ad placed by us via Google Ads when users subsequently visit the website. With conversions, we measure whether users perform a specific action on the website specified by us (e.g. whether services are ordered) after clicking on an ad placed by us via Google Ads. This allows the user to understand which keywords, ads, ad groups or campaigns lead to the desired user interaction.  

The following personal data is collected: Advertisements viewed, cookie ID, date and time of visit, device information, geographic location, IP address, search terms, advertisements displayed, customer ID, impressions, online identifiers and browser information.  

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner..  

Further information and the data protection provisions can be found in Google's privacy policy at https://policies.google.com/technologies/ads?hl=en  

Personal data may be processed by this provider in third countries outside the EU, e.g. by subcontractors, may take place. Any transfer by the service provider takes place on the basis of suitable guarantees in accordance with Art. 46 para. 2 GDPR or an adequacy decision in accordance with Art. 45 GDPR. 
 

Google Ads Remarketing 

This website uses the functions of Google Ads Remarketing. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. 

With Google Ads Remarketing, we can assign people who interact with our online offer to specific target groups in order to subsequently display interest-based advertising in the Google advertising network (remarketing or retargeting). 

The data collected and used for targeting includes, for example, URLs and referral URLs for websites that trigger a tag, as well as the user-defined parameters of your tracking tag and the resulting affiliations to data segments. Furthermore, the advertising target groups created with Google Ads Remarketing can be linked to Google's cross-device functions. In this way, interest-based, personalized advertising messages that have been adapted to you depending on your previous usage and surfing behavior on one device (e.g. cell phone) can also be displayed on another of your devices (e.g. tablet or PC).  

If you have a Google account, you can object to personalized advertising by clicking on the following link: https://www.google.com/settings/ads/onweb/  

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner.  

Further information and the data protection provisions can be found in Google's privacy policy at https://policies.google.com/technologies/ads?hl=en  

Personal data may be processed by this provider in third countries outside the European Union, e.g. by subcontractors, may take place. Any transfer by the service provider takes place on the basis of suitable guarantees in accordance with Art. 46 para. 2 GDPR or an adequacy decision in accordance with Art. 45 GDPR. 

Microsoft Ads 

We use the Microsoft Advertising service of the provider Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521.  

Microsoft Advertising is an online marketing service that uses the Universal Event Tracking (UET) tool to help us display targeted advertisements via the Microsoft Bing search engine. 

Personal data is processed in the form of online identifiers (including cookie identifiers), IP addresses, device identifiers and information about device and browser settings.  

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner.  

Further information on data protection at Microsoft can be found in Microsoft's privacy policy at https://privacy.microsoft.com/  

For Microsoft services, the transfer of data to Microsoft Corp. in the USA cannot be ruled out. Personal data may be processed by this provider in third countries outside the EU, e.g. by subcontractors. Any transfer by the service provider is carried out on the basis of suitable guarantees in accordance with Art. 46 para. 2 GDPR or by an adequacy decision in accordance with Art. 45 GDPR. 

LinkedIn Insight Tag 

This website uses the Insight tag from LinkedIn. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.  

With the help of the LinkedIn Insight Tag, we receive information about visitors and their interactions on our website. This allows our advertising measures to be analyzed and played out in a targeted manner. In addition, LinkedIn offers the possibility of retargeting via the Insight Tag. 

The following personal data is processed for this purpose Log files (URL, referrer URL, IP address, device and browser properties and time of access). The IP addresses are shortened or (if they are used to reach LinkedIn members across devices) hashed (pseudonymized).   

Details can be found in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy#choices-oblig 

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner..  

You can object to the analysis of usage behavior and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out  

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa  and https://www.linkedin.com/legal/l/eu-sccs  

Salesloft (Drift Chatbot) 

We use Drift as a chatbot on our website to interact and communicate with interested visitors. The provider of this service is Salesloft, 1180 West Peachtree Street NW, Suite 2400, Atlanta, GA, United States 

Personal data is processed in the form of the conversation history, IP address and contact information.   

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner.   

Further information on data protection at Salesloft can be found here: https://www.salesloft.com/legal/privacy-notice 

Personal data may be processed by this provider in third countries outside the EU, e.g. by subcontractors. Any transfer by the service provider is based on suitable guarantees in accordance with Art. 46 para. 2 GDPR or by an adequacy decision in accordance with Art. 45 GDPR.  

Use of YouTube

We use YouTube.com, a video sharing site to post our own videos and make them publicly available. YouTube is a service provided by YouTube, LLC, a subsidiary of Google, Inc., a third party not affiliated with us.

Some Internet pages of our corporate website contain links to the YouTube site. As a general rule, we are not responsible for the content of websites to which links are provided. In the event that you follow a link on YouTube, please be aware that YouTube stores the data of its users (e.g. personal information, IP address) in accordance with its own data usage guidelines and uses them for its own business purposes.

On some of our websites, we also integrate videos stored on YouTube directly. In this instance, content from the YouTube website is displayed in sub-areas of a browser window. However, YouTube videos are only accessed by clicking on them separately. This technique is called "framing". If you call up a sub-page of our website on which YouTube videos are integrated in this form, a connection is established to the YouTube servers and the content is displayed on the website by notifying your browser.

YouTube content is only integrated in the "extended data protection mode". YouTube provides this itself, thereby ensuring that YouTube does not initially store any cookies on your device. However, when you access the relevant pages, the IP address and the other data mentioned in Section "Use and Transfer of Personal Data" are transmitted and then informed of which of our Internet pages you have visited. This information cannot be assigned to you unless you have registered with YouTube or another Google service or are permanently registered before accessing the site.

As soon as you start the playback of an integrated video by clicking on it, YouTube only stores cookies on your device that do not contain any personally identifiable data, unless you are currently logged in to a Google service. These cookies can be prevented by appropriate browser settings and extensions.

Use of Cloudflare

We use the Content Delivery Network (CDN) of Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich Germany (Cloudflare) on our website to ensure the security and speed of our website. This corresponds to our legitimate interest (Art. 6 para. 1 lit. f DSGVO).

A CDN is a network of distributed servers that is able to optimize the delivery of content to the website user. Cloudflare stores your information mainly in the European Economic Area, based on the current location of the website visitor.

Cloudflare processes traffic data between our company and the website visitors. The following data may be collected in the process:

• the IP address,
• the accessed website,
• the type of browser used,
• the operating system,
• the referrer URL,
• the requesting provider

Cloudflare does not store any personal data and does not share user data with third parties. In most cases, the necessary data logs are deleted after 24 hours.

The functionality of our website cannot be guaranteed without this processing.

Cloudflare has implemented compliance measures for international data transfers. These apply to all global activities where Cloudflare processes personal data in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs). For more information, please visit: https://www.cloudflare.com/de-de/gdpr/introduction/.

Links to Social Networks

By clicking on the "share buttons," this will transfer information to Facebook, Twitter, Pinterest, Google, etc. in the United States of America and possibly store it there as well. We use the so-called 2-click-technique on our website, meaning that the buttons are deactivated and do not connect with the servers of the social media platforms on the first click. Only after a visual indication has been displayed and your subsequent second click will you be forwarded to the social network of your choice.

Links to Third-Party Websites (Links)

We, operator of CGM, have no influence on the content of the linked third-party websites. Before linking, these websites have been thoroughly examined. Still, it cannot be ruled out that the operators of the respective webpages have by now changed the content, which may violate applicable law or be in contradiction to our corporate philosophy.

Clicking on links of third-party websites displayed on our website or following instructions given, may subsequently lead to the collection of user data. We have no control over data collected with or without consent through third-party ads or websites. As a general rule, we recommend examining the Data Protection Guidelines of websites if you have concerns on the collection and usage of your data.

Security

CGM takes all necessary technical and organizational security measures to protect your personal data from loss or abuse. Your data is stored in a secure operating environment inaccessible for the public. In certain cases your personal data is encrypted by state-of-the-art technology during transmission. This means that communication between your computer and the CGM servers takes place by ways of an established encryption technique if supported by your browser. In case you wish to contact CGM by email, please be aware that privacy of the transmitted information cannot be guaranteed as the email content may be seen by third parties. We thus recommend using postal mail whenever you wish to transmit confidential information.

Your Rights

You have the right to information on stored personal data as well as the right to rectification, to erasure, to restriction of processing, to data portability and the right to object to processing of your personal data. If you give consent to CGM, you have the right to withdraw it at any time with effect for the future. We undertake to delete all data collected about you. In doing so, however, we are legally obliged to observe possible commercial and fiscal retention periods which can prevent immediate deletion of this data. If these reasons should affect the deletion, we will inform you. In addition, you have the right to lodge a complaint with the responsible supervisory authority if you believe that we are not processing your personal data properly.

Amendments to this Data Protection Statement

Please note that this Data Protection Statement may be amended and changed from time to time. Each version of this Data Protection Statement is to be identified by its date and version at the end of this document. We also archive all previous versions of this Data Protection Statement for your access on demand.

Responsible body

https://www.cgm.com/corp_en/imprint/compu-group-medical-se-co-k-ga-a.html

Data Protection Officer

Hans Josef Gerlitz
CompuGroup Medical SE & Co. KGaA
Maria Trost 21
D-56070 Koblenz
HansJosef.Gerlitz@CGM.com

Responsible

The responsible supervisory authority for CGM is

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34
55116 Mainz

Version: 1.5
Date: August 29, 2024