Data protection with us: transparent, fair and secure

1. Responsible body and joint responsibility within the SPIEGEL Group

2. Ways to use our website: "ad-free reading option”

3. Adobe-based usage and marketing campaign tracking (also known as advertising tracking)

4. Functionality of the offer

5. Contractual relationships

6. Advertising tracking

7. Our own product and sales development

8. Embedding third-party content

9. Publisher-specific processing

10. Your rights

11. Requirements of the Data Act

DER SPIEGEL GmbH & Co. KG is responsible for data protection. You can contact its data protection team at datenschutz@spiegelgruppe.de  or at the following address: Kennwort Datenschutz, Ericusspitze 1, 20459 Hamburg, Germany.

We would like to inform you that there is joint responsibility within the SPIEGEL Group for the processing of your personal data in accordance with Art. 26 of the General Data Protection Regulation (GDPR). This shared responsibility under data protection law enables us to offer you our services efficiently by allowing the controllers to jointly decide on the means and purposes of data processing and to meaningfully distribute essential responsibilities. Specifically, the responsible parties are SPIEGEL-Verlag Rudolf Augstein GmbH & Co. KG, DER SPIEGEL GmbH & Co. KG, manager magazin new media GmbH & Co. KG, 11FREUNDE Verlag GmbH & Co. KG, QS Quality Service GmbH, SPIEGEL Tech Lab GmbH and other companies of the SPIEGEL Group with little operational relevance.

These companies belonging to the SPIEGEL Group have entered into an agreement that governs the respective tasks and responsibilities when processing your data. Regardless of which company of the SPIEGEL Group actually processes your data, you can assert your rights as a data subject against any company in the Group. For more information about how to contact us, please refer to Section 9 of this data protection declaration. Further details about our joint controllership agreement are available upon request.

We offer you the opportunity to use our website in two ways:

a) Free of charge with advertising and tracking: With this option, we show you personalized advertising. To do this, we use cookies and similar technologies to analyze your usage behavior and to be able to place advertising measures tailored to your interests and needs on this basis. If you wish to use our services free of charge, we thus finance our journalism with your then obligatory to personalized advertising.

b) Ad-free reading option (subject to a fee): For a monthly fee, you can enjoy our content with virtually no ads. In the ad-free reading option, you will not see any personalized advertising, we collect significantly less data about your usage behavior and you have access to all content, just like in the free version.

The ad-free reading option is not a paywall for exclusive content, but an option for ad-free surfing with increased data protection. You get the same content as with the free version – independently of an existing subscription – but without advertising and with significantly reduced data collection. With the ad-free option, we are therefore offering you an equivalent alternative to our co-financed offer with personalized advertising at a standard market price.

We use technologies on our websites for usage- and campaign-related measurement and targeting (“usage tracking”, “web tracking”, “campaign tracking”) based on solutions from “Adobe” (Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Saggart, Dublin 24, Ireland). This enables us to track whether and how users interact with our content and advertising materials for our own publishing offerings (e.g. views, clicks, conversion/success measurement), evaluate reach and campaign performance, display advertising for publishing offerings in a target group-oriented manner, and control the delivery of advertising.

To this end – depending on the specific configuration – information is stored and read on your device (e.g. cookies, other browser storage, online identifiers) and processed together with usage data. In particular, technical information (e.g. device/browser data, IP address), interaction and event data (e.g. page views, click paths, timestamps, reading behaviour), approximate location information, as well as advertising and campaign data relating to our publishing services may be processed and combined into pseudonymous usage profiles.

A direct personal reference can generally only be established if a user account exists and you log in to our service; only in this case may information from the user context be taken into account. Without logging in, we do not have any clear data relating to your person; a combination of usage data from web tracking with data from the user context of your account may still occur even after logging out, provided the same device is used. The IP address is anonymised by truncation, so that no direct personal reference can generally be derived from it. A combination with data that directly identifies you only takes place if this is expressly described and the data protection requirements are met.

Important: We do not use Adobe-based usage and marketing campaign tracking (advertising tracking) on a ‘blanket’ basis, but exclusively for specific individual purposes, about which we provide comprehensive information in this privacy policy. In this context, we also obtain your under data protection law – where legally required – via our management platform (including, where applicable, to the storage/retrieval of information on your device); there you will also find information on how to withdraw or change your selection.

Websites in general and telemedia in particular, with their necessary technical functionalities, cannot be offered without processing personal or personally identifiable data. In the following, we would like to explain to you which processing is absolutely necessary for the technical functionality of our offer and is also used when you use the "Ad-free read option”.

A) Technical

Website Provision

In order to provide you with access to our website, we process data that is automatically generated each time you visit the site. This processing is necessary in order to deliver the website's content (including advertisements), ensure stable and secure operation, and detect and defend against disruptions and attacks (e.g. DDoS attacks).

Hosting

To ensure the stable and efficient provision of the website and its content, the security and protection of systems and data, as well as error analysis and troubleshooting, we process the following personal data:

• IP address • Date and time of access
• Page/file accessed (URL) and access method (Request)
• Amount of data transferred • Status code/error messages
• Website from which access is made (referrer URL)
• Browser and device information (e.g. User-Agent – usually contains information about the browser used, the computer’s operating system, the manufacturer and the model name of the mobile device) 
• Where applicable, technical identifiers for troubleshooting (e.g. request ID)

Processing is necessary to provide our website technically and to ensure its secure operation. The legal basis is therefore our legitimate interest, Article 6(1)(f) of the GDPR. Where processing is necessary for the performance of a contract or for the implementation of pre-contractual measures (e.g. when using areas requiring registration), Article 6(1)(b) GDPR also applies.

In this context, we work with the following service providers with whom we have data processing agreements that meet the requirements of Article 28(3) GDPR:

Hosting:

Google (Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, website: https://cloud.google.com/ )

Content Delivery Network (CDN):

This is a network of servers that delivers content from our website (e.g. images, CSS and JavaScript files) via geographically distributed nodes. This generally allows content to be delivered more quickly and reliably, and helps to safeguard operations against outages and traffic spikes.

Akamai (Akamai Technologies, Inc., 145 Broadway, Cambridge, MA 02142, USA, website: https://www.akamai.com/ )

Server log files

Every time our website is accessed, the servers and applications automatically collect data and information from the computer system of the accessing device. We use service providers as data processors for this purpose, in particular for hosting, delivery via a Content Delivery Network (CDN) and measures for DDoS protection. Further information on the specific purposes and the service providers can be found in this section. The following data is temporarily collected for the server log files:

• IP address • Date and time of access
• Name and URL of the file accessed
• Website from which access is made (referrer URL) 
• User-Agent (usually contains information about the browser used, the computer’s operating system, the manufacturer and the model name of the mobile device)
• Amount of data transferred
• Indication of whether the access/retrieval was successful (HTTP status code) 

Data processing is necessary to ensure the functionality of the website, the stability and security of our systems, to detect misuse (e.g. hacking or DDoS attacks) and to provide protection against such incidents, as well as for the purposes of error analysis and rectification. The legal basis is our legitimate interest in data processing pursuant to Article 6(1)(f) of the GDPR. The information mentioned above is stored in a log file for 30 days and then automatically deleted. As data processing is strictly necessary to ensure the security of our IT systems, you can only avoid such processing by not using our service.

Protection against automated abuse

To protect our website and, in particular, critical endpoints from automated abuse (e.g. mass requests, spam or DDoS attacks), we check whether access and inputs originate from natural persons or automated programmes (bots). For this purpose, we use two services: the service provided by Link11 GmbH (Lindleystr. 12, 60314 Frankfurt am Main, Germany) and the 'reCAPTCHA’ service provided by Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). Link11 aims to protect against automated abuse, in particular through a network-based analysis of data traffic and the use of a security cookie that distinguishes typical patterns of human usage from automated access. For this purpose, the following personal data is processed: cookie data (IP address, timestamp, date of access, referrer URL, browser and technical information about the device used). The reCAPTCHA service, on the other hand, checks user behaviour directly in the browser. To do this, we process the IP address of the device used, identification data for the browser and operating system type used, as well as the date and duration of the visit via a LocalStorage entry. This processing is necessary to ensure the security, availability and integrity of our website, to block automated malicious access and to prevent misuse and spam. The legal basis is our legitimate interest in ensuring the security of our systems, establishing individual responsibility on the internet, and preventing misuse and spam, Article 6(1)(f) of the GDPR; with regard to the use of technically necessary cookies or similar technologies, Section 25(2)(2) of the TDDDG also applies. Contracts have been concluded with the aforementioned service providers in accordance with Article 28(2) of the GDPR. Any transfers to third countries in connection with reCAPTCHA, in particular to Google group companies, are based on the EU Commission’s Standard Contractual Clauses, which are intended to ensure compliance with European data protection standards (Article 46(2)(c) of the GDPR). If you wish to delete the LocalStorage entry or the cookie, you can do so via the settings of the browser you are using ('Clear browsing data / Cookies & site data’).

Technical stability and fault analysis in the app

For the purposes of error and crash reporting, general error analysis based on technical reports, determining the scope and impact of technical errors, troubleshooting and improving the stability of our app, we process the following data:

- technical device and system data

- app and version data

- crash and error data

- time and event data

- pseudonymous installation and session identifiers Where enabled, we may also process technical log and diagnostic information, user-defined key-value pairs, information on non-fatal errors, and event logs. The legal basis for this processing is our legitimate interest in detecting technical errors and malfunctions, ensuring error analysis and rectification, and guaranteeing the stability, security, and quality of our app (Article 6(1), first sentence, point (f) of the GDPR and Section 25(2)(2) of the TDDDG). To this end, we use the 'Firebase Crashlytics' service, which is provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; www.firebase.google.com/products/crashlytics). We have entered into a data processing agreement with Google that meets the requirements of Article 28(3) of the GDPR and ensures that your rights are upheld.

Technical functionality and access security / authentication

For authentication purposes, we process your IP address and metadata in connection with the setting of the cookies required for this. Authentication involves information that enables us to identify end devices independently of user accounts and to verify whether or not has been given for their free use with advertising and tracking. On this basis, the display of our website is configured accordingly. The legal basis is our legitimate interest in presenting our offering in as personalised a manner as possible, Article 6(1)(f) GDPR, Section 25(2)(2) TDDDG.

Management

As part of management, we verify which content from cooperation partners (in particular advertising companies and social networks) we are permitted to display, ensure the functionality of integrations that are disabled by default, and, in this context, obtain and manage your data protection s. We process the date and time of your visit, device and browser information, your anonymised IP address, your profile and a randomly generated identification number to link the end device to the profile. To this end, the Management Platform (CMP) sets a technically necessary cookie to query the status and thus be able to display the relevant content. The legal basis is Article 6(1)(c) in conjunction with Article 7(1) of the GDPR, and Section 25(2)(2) of the TDDDG. For these purposes, we work with the provider "Sourcepoint” (Sourcepoint Technologies, Inc., 228 Park Avenue South, #87903, New York, NY 10003-1502, USA), with whom we have concluded a data processing agreement in accordance with Article 28(3) of the GDPR. As this involves a transfer to a third country, we have adopted the EU Commission’s Standard Contractual Clauses to ensure that the processing of your personal data is compatible with the GDPR (Article 46(2)(c) of the GDPR).

Analyses for functional purposes: Basic tracking – reach measurement

We collect and analyse usage data to determine statistical metrics regarding the use of our digital offering, in order to determine the number of visits to our website, the number of website visitors and their browsing behaviour – based on a uniform standard procedure – and thus obtain market-wide comparable figures. We process usage data to ensure the operation of the site, to assess the relevance of content in our editorial work, to analyse the use of our websites and services, to continuously optimise individual functions and services as well as the user experience, and to identify erroneous user paths. As part of this – as well as for Adobe-based advertising tracking – we process personally identifiable characteristics via the so-called 'Data Feed’, which contains browser-related [the Experience Cloud Visitor ID (EC-ID), comparable to a cookie ID, which can be used to identify the browser on your device] and user account-related (SSO-ID) identification features, which enable us to track browsing behaviour and navigation on our site. We refer to this method of tracking user behaviour as 'basic tracking’ below. Basic tracking – just like advertising tracking – is pseudonymised, meaning that we cannot draw any direct conclusions about you as a person from the information we receive, unless you are registered with us via a user account, are logged in, and have ed to the linking during registration. In this case, we also collect usage data in a cross-device profile. This profile identification enables us to comprehensively record the behavioural and reading profile of the login account used across devices and to link the user experience across all end devices. The legal basis is our legitimate interest in optimising the user experience and the technical stability of the website, in accordance with Article 6(1)(f) of the GDPR and Section 25(2)(2) of the TDDDG. For the processing of information within the scope of basic tracking, we collaborate with the provider "Adobe” (Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Saggart, Dublin 24, Ireland), with whom we have concluded a contract for commissioned data processing for these purposes in accordance with Article 28(3) of the GDPR. Further information is available in our Privacy Centre. The opt-out is implemented by setting a cookie on the device you are using. If you delete the cookie, use a different device or a different web browser, the opt-out must be set up again. With regard to our mobile apps, the opt-out must be set in the respective app settings.

B) Editorial and product-specific purposes

We also process personal data for specific editorial and/or product-related purposes. The processing activities listed below are essential for providing our products, even if you select the 'ad-free reading' option.

This includes the delivery of and access to editorial content tailored to your needs.

In some cases, we process your IP address and metadata describing the communication in order to keep the various pieces of content on our website up to date. This may include sports results, election results, editorial infographics, statistics, interactive charts and other information within our editorial content where we assume you want ongoing updates to stay informed. We also occasionally provide functions to enable you to carry out query-based searches and integrate mechanisms to detect and prevent automated requests. Such data processing is based on our legitimate interest in ensuring that we always provide our users with up-to-date information. This is necessary for this purpose. The legal basis is Article 6(1)(f) of the GDPR. Where necessary, we work with external service providers and enter into data processing agreements with them that comply with the requirements of Article 28(3) of the GDPR.

Display of editorial content in story format

We process your IP address to display certain video formats and to meet our readership’s need for brief information. This data processing establishes a connection to the server and ensures technical functionality. Furthermore, via the EC-ID (a unique browser identifier similar to a cookie within the Adobe integration framework), we collect aggregated data on views of our editorial stories. This data processing is necessary to ensure functionality. The legal basis for this is Article 6(1)(f) of the GDPR and Section 25(2)(2) of the TTDSG. In accordance with Article 28(3) of the GDPR, we have concluded a data processing agreement with the service provider "Storifyme” (Storifyme GmbH, Blutenburgstraße 68, 80636 Munich, Germany), which we use for these purposes.

Streaming of live streams and videos

In order to play videos and live streams to supplement editorial content on our websites, suggest further videos, generate reports on video activity, improve the quality of our videos, conduct analyses to identify user trends and detect technical issues in this context, and maintain and improve our services, we process statistical usage data (IP address, Local ID, Viewer ID, device type, browser type and version, and times and durations of use). The legal basis for this processing is our legitimate interest in the comprehensive design of our editorial offering (Article 6(1)(f) GDPR and Section 25(2)(2) TDDDG). For these purposes, we use the 'JW Player' service (Longtail Ad Solutions, 8 West 38th Street, 6th Floor, New York, NY 10018, USA, https://jwplayer.com/legal/privacy ), with whom we have concluded a data processing agreement that meets the requirements of Articles 28(3) and 44 et seq. of the GDPR.

Podcasts

When you listen to podcasts on our websites, we process your IP address, the type and version of your internet browser, the operating system used, which page you accessed, the referrer URL, the time of the server request, how long you spent on the website and how often you accessed it, via the setting of a cookie for playback purposes. The legal basis for this processing is our legitimate interest in designing our editorial content to meet the needs of our users (Article 6(1)(f) GDPR, Section 25(2)(2) TDDDG). To this end, we collaborate with the provider Omnystudio (Triton Digital Canada Inc., 1440 Sainte Catherine West Street, Suite 1200, Quebec, H3G 1R8, Montreal, Canada), with whom we have signed a data processing agreement under Article 28(3) of the GDPR, ensuring compliance with your rights. For Canada, the European Commission has made an adequacy decision which justifies the transfer of data to a third country in accordance with Article 45(1) of the GDPR.

Interactive graphics

We process your IP address to embed and display interactive graphics on our websites. The IP address is transmitted via a Content Delivery Network (CDN), which acts as a host and selects a suitable server in order to enable the published graphic to be accessed and forwarded to you, the user. This processing is necessary for the visualisation and publication of graphics containing editorial content. The legal basis is our legitimate interest pursuant to Article 6(1)(f) of the GDPR. In order to implement this technically, we collaborate with 'Datawrapper' (Datawrapper GmbH, Raumerstraße 39, 10437 Berlin, Germany), and we have signed a data processing agreement with them in accordance with Article 28(3) of the GDPR. If data is processed in a country outside the European Union, Datawrapper ensures that the requirements of Articles 44 et seq. of the GDPR are met.

Live blog

To provide you with a live ticker on our websites and keep you updated with the latest news, we process your IP address, the date and time, the accessed URL, and a random identifier generated on the client side (e.g. a cookie token). This processing is necessary to protect the infrastructure (e.g. to detect and defend against DDoS attacks) and to compile aggregated, anonymised access statistics. To this end, IP addresses, URLs and timestamps are stored in log data for up to four weeks and are then deleted or anonymised. The statistics derived from the anonymised data do not allow visits to be attributed to individual users. The legal basis is our legitimate interest pursuant to Article 6(1)(f) of the GDPR and Section 25(2)(2) of the TTDSG. To this end, we collaborate with 'Tickaroo' (Tickaroo GmbH, Waffnergasse 8, 93047 Regensburg, Germany, www.tickaroo.com), with whom we have signed a data processing agreement in accordance with Article 28(3) of the GDPR.

Music Distribution Analysis Tool:

To make our podcasts available, we use specially designed web pages (known as landing pages) on the Linkfire platform. These allow us to clearly display various online music services via a single link and redirect you to our podcasts. We analyse the usage behaviour of our podcast listeners in order to continuously update our editorial content in line with our users’ needs. To this end, we process metadata such as your IP address via a cookie to identify your browser. These analyses are carried out anonymously, meaning we cannot draw any conclusions about you as an individual. The legal basis for this processing is our legitimate interest in providing editorial content that is tailored to users' needs, in accordance with Article 6(1)(f) of the GDPR and Section 25(2)(2) of the TTDSG. To achieve the aforementioned, we use the music distribution analysis tool provided by Linkfire A/S (Artillerivej 86 3rd, 2300 Copenhagen, Denmark), with whom we have a data processing agreement in accordance with Article 28(3) of the GDPR.

Editorial push notifications in the app

To send editorial notifications, including providing your chosen push service and the technical routing and delivery of notifications to your device, we process the following data via a push token:

- a device or installation identifier;

- technical information about the app and the push channel used;

- data relating to your existing push subscription. If you select any preferences for receiving editorial push notifications, the categories or interests you have chosen may also be processed. The content of the notifications and the technical delivery data required for this purpose are also processed. The legal basis for this processing is Article 6(1), first sentence, point (f) of the GDPR. We use the service provider 'ethinking' (ethinking GmbH, Tucholskystraße 18–20, 10117 Berlin, www.ethinking.de) to send push notifications.

A) User account

registration and "stay signed in” function

By providing your email address and choosing a password on our website, you can create a free user account. This enables you to access personalised services and use certain services that require registration, such as digital time-based access contracts, subscriptions, ordering products, taking part in recurring quizzes with access to personal game statistics, and participating in our debate formats. The legal basis for this is Article 6(1), first sentence, point (b) of the GDPR. Further details, such as your name, address, date of birth and telephone number, are optional and therefore based on your (Article 6(1), first sentence, point (a) of the GDPR). If you use an existing user account to access a B2B subscription, the data from this account (email address, and surname and first name where applicable) will be shared with the person who invited you and displayed in the user management section. The legal basis for this is Article 6(1), first sentence, point (b) of the GDPR.

When you register for an account, we process your IP address and the date and time of registration in connection with your registration. You will then receive an e-mail from us with a link that you can use to confirm the creation of your user account. The data processing is necessary for registration and is based on Art. 6 (1) (b) GDPR.

In connection with your registration, you have the option of agreeing to the linking of the information from your user account with the data collected as part of the basic tracking. The data link based on the profile identification enables us to comprehensively record the behavioral and reading profile of the login user account used across devices and to connect the user experience across all end devices. The legal basis for this is your , Art. 6 para. 1 sentence 1 lit. a GDPR.

We use the service provider 'Frisbii' (Frisbii Media GmbH, Königstr. 4, 87435 Kempten, Germany, www.frisbii.com) for user management. We have entered into a data processing agreement with Frisbii to ensure that data processing is carried out in accordance with legal requirements.

Reader prioritization

To optimize our customer service, we use the information about digital contracts you have concluded for the internal organization of the processing of customer inquiries (reader prioritization). The reader prioritization is carried out in our legitimate interest to categorize and process customer concerns in a manner that is fair to their interests. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR.

Personal access security, abuse prevention and clarification

Our digital services, and in particular our subscriptions, may only be used in accordance with the applicable terms of use and contractual agreements. For the purposes of preventing misuse in connection with personal access security for our digital services, we process information regarding usage via your account, such as identifying characteristics within the scope of basic tracking (EC-ID, SSO ID), the number of user visits (unique users), visits, page views, browser types used, devices used, payment information, as well as the name and contact details from your subscription. Data processing is necessary for the analysis of user accounts exhibiting signs of misuse. To investigate abusive behaviour, we also process an ID that identifies you (back-office ID) so that we can identify the perpetrator in cases of PDF downloads of articles and their unlawful publication. The publication of protected content contravenes our Terms of Use and necessitates data processing. Processing for the purposes of preventing misuse and investigating abusive behaviour is carried out on the basis of the contract concluded between you and us; the legal basis is Article 6(1)(b) of the GDPR. The use of cookies and similar technologies for these purposes is permitted without your under Section 25(2)(2) of the TDDDG. For certain purposes in this context, we use the service provider “frisbii” [Frisbii Media GmbH, Königstr. 4, 87435 Kempten, Germany, www.frisbii.com], with whom we have concluded a data processing agreement for this purpose, which ensures that data processing is carried out in accordance with legal requirements.

Your data will be stored for the duration of the existing registration and will only be deleted when you close your user account, provided that statutory retention requirements do not prevent deletion. You can initiate the deletion independently in your user account.

B) Subscription

Conclusion of subscription contracts

To use digital services, time-based access contracts (e.g. weekly, monthly, multi-month or annual passes for existing paid content), the Manager+Academy subscription, or the ad-free reading option, you will need a user account. In addition to the data processing carried out in connection with your registration (see Section 5.A), we will process the following subscription data: your full name, title, form of address, information regarding any existing print subscription (where applicable), payment details, your home or business address, and the country of use. The legal basis for this processing is Article 6(1), first sentence, point (b) of the GDPR. Further details, such as additional name information and a telephone number, are optional and therefore based on your (Article 6(1), first sentence, point (a) of the GDPR). Via the 'Give an article as a gift' function, you may have the option to pass on up to 10 articles covered by this option to interested parties free of charge. We process the number of articles given as gifts to ensure that the limit is observed. The legal basis for this processing is Article 6(1), first sentence, point (b) of the GDPR.

Subscription-specific processing for trial subscriptions

When you take out a trial subscription, we reserve the right to check the conditions for claiming the discount on the basis of your e-mail address. For this purpose, we store a pseudonymized hash value of your e-mail address for 12 months. The legal basis for this is Art. 6 (1) (b) GDPR.

Subscription-specific processing for the under-30s subscription

For the age verification required for the U-30 subscription, we process a 7-digit verification number from your identity card or passport, which confirms your date of birth and thus serves as proof that you are eligible for the discount based on your age. The legal basis for this is Article 6(1)(b) of the GDPR. The verification code is deleted immediately after your age has been verified. Only the expiry date of the discount reason is stored in our customer management system, so that your subscription can continue without a discount from your 30th birthday onwards.

Subscription-specific data processing for the Duo subscription

If you take out a Duo subscription, you, as the main user, may invite another person to use the subscription, provided that you meet the requirements of the "General Terms and Conditions of Business and Delivery” (SPIEGEL, manager magazin, 11Freunde). For these purposes, we process the name and email address of the secondary user, who receives an invitation to join by email and can activate their access with the invitation code provided. To validate the subscription requirements, the secondary user must confirm the primary user's address as their own. The legal basis is Art. 6 Para. 1 S. 1 lit. b GDPR.

Subscription-specific processing for the starter subscription

If you use our starter subscription, we use parts of the data collected as part of our basic tracking (the so-called SSO ID) in addition to the subscription data in order to be able to ensure compliance with the subscription requirements, in particular the use of the activations and the provision of the items used. The legal basis is the contract between you and us (Art. 6 para. 1 sentence 1 lit. b GDPR).

Subscription-specific processing – discounts

As part of your existing digital subscription contract, we may provide you with discount codes for discounted subscriptions with other publishing and media houses with which we cooperate (»alles.plus«), or other price reductions. As part of the "alles.plus” cooperation, we process your customer number for the recurring reconciliation of the existing customer relationship as a prerequisite for the discounts and, on a one-time basis, also your e-mail address for sending you an individual discount code at your explicit request. This offer is part of our contractual services to you, so the legal basis for the data processing is Art. 6 Para. 1 S. 1 lit. b DSGVO. For the technical processing of such discounted combination subscriptions, we work with the association "alles.plus” (alles.plus e.V., c/o DER SPIEGEL GmbH & Co. KG, Ericusspitze 1, 20457 Hamburg, Germany), with whom we have concluded a contract for commissioned data processing. If we offer you discounts elsewhere, we process your subscription number for this purpose to check the conditions for the price advantage. The legal basis for this is also Art. 6 (1) sentence 1 b) GDPR.

Billing / payment transactions

As part of the performance of digital contracts, we use external payment service providers whose platforms we and you can use to carry out payment transactions (e.g. Paypal, credit cards such as Visa, Mastercard, American Express, SEPA direct debit). The data processed by the payment service providers includes: name, address, bank details, as well as transaction data such as contract- and recipient-related information. The information is required to carry out the transactions; the legal basis is Art. 6 (1) sentence 1 lit. b GDPR. The aforementioned data is processed and stored exclusively by the respective payment service provider; we only receive information about confirmation or non-execution of the payment. Under certain circumstances, the payment service provider may transfer the data to credit reference agencies. The purpose of this transfer is to verify your identity and creditworthiness. In this regard, we refer you to the terms and conditions and data protection notices of the respective payment service providers.

Bonuses

In certain cases, such as the acquisition of new readers, we may thank our subscribers with bonuses. We process your contact data for these purposes (and, in the case of cash rewards, your bank data as well) in order to send you the respective bonus. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR. We work with various service providers for these purposes, who are commissioned, for example, to send the bonuses. We have concluded contracts with the service providers that guarantee compliance with data protection requirements.

We always store your data until the end of your digital contract. Please note that deleting your user account is not the same as terminating your digital contract. It may be necessary to store your data in order to check the conditions for establishing a digital contract, for example to prevent a repeated order at the start of the subscription of discounted digital or premium subscriptions. The legal basis is Art. 6 (1) sentence 1 lit. b GDPR. In addition, we are obliged under Art. 6 (1) sentence 1 lit. c GDPR to store data due to tax and commercial law retention requirements. If the data is not deleted because it needs to be stored for other contractually or legally permissible purposes, its processing will be restricted (archiving with special access protection) and only made available to those authorized to access it using appropriate technical and organizational measures.

Frisbii Media GmbH

Königstr. 4, 87435 Kempten, Deutschland

www.frisbii.com 

Darwin CX GmbH

Von-der-Tann-Str. 2, 80539 München

www.darwin.cx 

C) Your personalized editorial content and article recommendations

As part of personalized editorial content recommendations and reviews, we would like to offer you the opportunity to have your use of our services analyzed and to suggest editorial content at selected points based on your reading behavior. To do this, we use the data collected as part of our basic tracking, which allows us to track your surfing behavior and navigation on our site. The legal basis for this is your voluntarily given (Art. 6 para. 1 sentence 1 lit. a GDPR). As explained in more detail above, we work with the provider Adobe to process the information as part of the basic tracking. You can find more information in our Privacy Center.

To carry out data analyses and to further develop our recommendation system, the TU Wien [Vienna University of Technology, Karlsplatz 13, 1040 Vienna] processes your data from the basic tracking in pseudonymized form. This means that we remove the features that identify you from the data records before passing them on to the TU Vienna and store them separately, which means that the TU Vienna is not able to establish a personal reference. The data records are processed in anonymized form within the scope of the TU Vienna's activities, and the insights gained benefit you and us through the possibility of merging them in our area of responsibility.

D) Marketing (advertising by email, telephone, letter)

We also process your personal data for marketing purposes. This includes the following activities in particular:

Email marketing: We use your contact details for advertising purposes if you have ed to this (Art. 6 (1) (a) GDPR), as well as for legally permissible direct advertising for our own and related products within the scope of the existing contractual relationship, if you have specified this when placing your order or registering (Section 7 (3) UWG as implementation of Art. 13 (2) Directive 2002/58/EC (ePrivacy Directive) and Art. 95 GDPR).

Telephone marketing: If you have given us your telephone number and given your , we may contact you by telephone for advertising purposes. The processing is carried out on the basis of Art. 6 (1) 1 lit. a GDPR.

Postal advertising: We use your postal address to send you advertising material. This is done on the basis of our legitimate interest in accordance with Art. 6 (1) (1) (f) GDPR, provided that you have not objected to this.

If you no longer wish to receive advertising, you can revoke your at any time or object to direct advertising

• by clicking on the unsubscribe link at the end of the email

• by email to: aboservice@spiegel.de  or aboservice@manager-magazin.de  or kundenservice@11freunde.de 

• in writing to: Der SPIEGEL, Customer Service, 20637 Hamburg (please provide your name and the e-mail address you used to register) or Manager Magazin, Customer Service, 20637 Hamburg or 11 Freunde Customer Service, P.O. Box 111828, 20418 Hamburg

• by telephone on 040 3007-2700 (SPIEGEL) or 040 3007-3400 (manager magazin) or 040 3007-3030 (11FREUNDE)

We use service providers to carry out the advertising measures, with whom we have concluded data processing agreements for these purposes in accordance with Art. 28 (3) GDPR. We use the following processors:

E-mail marketing: "Salesforce”

salesforce.com Germany GmbH, Erika-Mann-Straße 31, 80636 Munich, Germany

Postal advertising: ”Global TDA”

Global TDA Group Germany GmbH, Serviceware-Kreisel 1, 65510 Idstein, Germany

The data processed by us are erased as soon as they are no longer required for their intended purpose and the erasure does not conflict with any statutory retention requirements.

E) Newsletter

On our websites, you have the option of subscribing to our editorial newsletters to receive news and current information from our editorial offices and about our products. We process your e-mail address for these purposes, optionally also your name. The processing is based on your voluntary in accordance with Art. 6 (1) 1 lit. a GDPR.

We record your clicks in our newsletters and other notifications with the help of invisible image files, so-called tracking pixels. On this basis, we analyze the opening and click rates as well as other usage data. Your email address is stored in a recipient list so that we can keep track of the distribution list. It is also used to send you personalized newsletters that are adapted to your preferences and interests. The legal basis for this is also your voluntarily given in accordance with Art. 6 (1) (a) GDPR, § 25 (1) TDDDG.

For the above-mentioned purposes, we work with the service providers "Mailjet” (Mailjet GmbH, Alt-Moabit 2, 10557 Berlin, Germany) and "Salesforce” (salesforce.com Germany GmbH, Erika-Mann-Straße 31, 80636 Munich, Germany), with whom we have concluded data processing agreements in accordance with Art. 28 (3) GDPR.

You can unsubscribe from any newsletter at any time and revoke your to its delivery and analysis by clicking on the corresponding link at the end of the respective newsletter, by contacting us at newsletter@spiegel.de , or by independently unsubscribing from the respective newsletter in your "My Account” area. This also applies to editorial newsletters that were ordered as part of subscriptions and time-limited access contracts.

F) Surveys

We occasionally offer you the opportunity to participate in surveys. These surveys focus primarily on questions about our products, as well as the visual feel and design of our website and app. We use the survey results to analyze and improve our services and products holistically. As part of surveys that explicitly focus on app and web design, we process technical information such as browser version, operating system and IP address, as well as your answers and comments ("survey data”). All other surveys can be conducted without processing personal data, as long as you follow our recommendations and do not enter any personal data in possible free text fields. The legal basis is your , Art. 6 para. 1 sentence 1 lit. a GDPR. To conduct surveys that explicitly focus on app and web design, we use the tool of the service provider "Maze” (Maze.Design Inc., 800 Menlo Ave, Suite 220, Menlo Park, CA 94025, USA). For this purpose, we have concluded an order data processing contract with Maze, which guarantees the observance of your rights and the requirements of Art. 28 Para. 3 GDPR and also legally secures the transfer to a third country in accordance with Art. 44 ff. GDPR. For the creation of all other surveys and the associated evaluations, we work with the provider "Qualtrics” (Qualtrics Ireland Limited, Costello House, 1 Clarendon Row, Dublin 2, D02 TA43, Ireland, https://www.qualtrics.com ). We have also concluded a contract with Qualtrics for commissioned data processing.

G) Contact

If you wish to contact us, you can send us an e-mail to aboservice@spiegel.de , aboservice@manager-magazin.de  or Kundenservice@11freunde.de . In this case, we process your e-mail address, information about your request and, if applicable, your name for further correspondence and any measures that may arise from your request. You also have the option of contacting us by telephone (040 3007-2700). In this case, we process your telephone number, your name, your customer number if applicable, and information about your request for further correspondence. If you use the contact form on our website, we process the reason for your contact, the channel, information about your request, the salutation, your first name (optionally also your last name) and the e-mail address for further correspondence and possible requested measures regarding your request, as well as information about the date, time, browser used and URL of your request. In addition, we also process your IP address to prevent mass requests from bots. If you agree to the publication of your message, it can be published on our websites and in our magazines with your name and place of residence. You still have the option of using the ChatBot on our websites for communication. By using the bot, we process the information from your enquiry. In addition, session-related metadata (IP address, browser and device information, date and time of access) is processed by setting a cookie. If you contact us as a user or subscriber and your request is therefore within the scope of the contract between you and us, the legal basis is Art. 6 Para. 1 S. 1 lit. b GDPR. Otherwise, we process your data on the basis of our legitimate interest in contacting persons with inquiries and having the information necessary to solve purely technical problems already available. The legal basis for the data processing is then Art. 6 para. 1 sentence 1 lit. f DSGVO. We work with the "CognitoForms” service (Cognito LLC, 1310 Gadsden St Ste 100 Columbia, SC, USA, https://www.cognitoforms.com ) to provide the contact form. For this purpose, we have concluded an order data processing contract with CognitoForms, which guarantees compliance with your rights and the requirements of Art. 28 (3) GDPR and Art. 44 ff. GDPR. In addition, we use the following providers for the standardised management and processing of all enquiries and customer communication for the purposes mentioned in this section:

Zendesk Inc.
989 Market Street, Suite 300
San Francisco, CA 94103, USA
https://www.zendesk.de 

babelforce GmbH
Friedrichstr. 68
10405 Berlin, Germany
https://www.babelforce.net 

We have concluded contracts with the providers in accordance with Art. 28 para. 3 and, if applicable, Art. 44 et seq. GDPR to ensure compliance with your rights.

H) Events

We invite our readers and subscribers to events at regular intervals and you have the opportunity to register for various events on our websites. For registration, processing and execution of events, we process your full name, e-mail address and, if applicable, other event-specific mandatory information. For chargeable events, we require further data for payment processing, depending on the means of payment chosen. When you purchase or acquire a ticket free of charge, we set a cookie when you interact with the ticket shop widget. This cookie assigns your shopping cart to you and is therefore technically necessary for processing your order. We may use your e-mail address to inform you before an event about the start of the livestream. The legal basis is Art. 6 para. 1 sentence 1 lit. b DSGVO, for setting the cookie § 25 para. 2 no. 2 TDDDG.

In the case of digital offers, we process your IP address, the type and version of your internet browser, the operating system used, the page accessed, the referrer URL, the time of the server request, the time spent on the website and the frequency of access in connection with the display of the livestream for the purpose of optimizing the transmission and for visitor counting by setting a cookie. The legal basis is Art. 6 para. 1 sentence 1 lit. a GDPR, § 25 para. 1 TDDDG. During the livestream, you have the opportunity to participate interactively, for example, by asking questions. For these purposes and to ensure the functionality and security of the tool, we process your participant data (name), text data and shared content (questions, ideas, chats, etc.), information about the device used (IP address, hardware model, software used, language settings, etc.), meeting metadata (date, time, name of the event, etc.) and information about any system crashes by setting a cookie. The legal basis is Art. 6 (1) 1 lit. a GDPR, § 25 (1) TDDDG. Your will be requested during the live event. You also have the option of using the interaction tool anonymously, i.e. no personal data will be transmitted. For events that are livestreamed on our website, the recording is usually made publicly available on our website after the event. If you have opted for a non-anonymized form of participation, you simultaneously to this publication. The legal basis is your , Art. 6 (1) 1 lit. a GDPR.

In addition, you will receive an e-mail with (further) information for all offers after the event, as well as a feedback survey, in which you can of course participate absolutely voluntarily. If we organize an event together with partners or sponsors, we may pass on your data to our partners for the purpose of registering for, processing and conducting the event. The legal basis for this processing is Art. 6 (1) 1 lit. b GDPR.

We work with the following service providers for the following purposes, with whom we have concluded agreements in accordance with Art. 28 (3) GDPR that guarantee the protection of your rights and – where necessary in the context of third-country transfers – meet the requirements of Art. 44 et seq. GDPR.

Event registration / Ticketing: »pretix«

rami.io GmbH
Berthold-Mogel-Straße 1
69126 Heidelberg
Germany

www.pretix.eu 

Provision of the livestream for digital events: »JW Player«

JW Inc. / Longtail Ad Solutions Inc.
8 West 38th Street
6th Floor
NY 10018 New York
USA

www.jwplayer.com 

Interaction tool for participation during a digital event: "slido”

sli.do s.r.o.
Vajnorská 100/A
831 04 Bratislava
Slovakia

www.slido.com 

If you register for a paid event, we store your data for the duration of the contract and thereafter until the statutory limitation periods have expired or for the duration of the retention periods under tax law. The corresponding data processing beyond the term of the contract is based on our legitimate interest in storing the data for the stated purposes and thus on Art. 6 (1) (f) GDPR.

If you register for free events, we will store your data for documentation purposes and in case of follow-up questions after the event for a further six months.

Your contact details will be stored for advertising purposes on the basis of the contract between you and us in accordance with Art. 6 (1) (1) (b) GDPR. You can, of course, object to the processing for advertising purposes at any time.

A) Marketing of advertising space on our websites

Unless you have decided to book the "read ads free” option, advertisements and promotions ensure the continued existence of our offering, as described at the beginning of this data protection declaration. For the user-oriented display of advertising, we and our advertising partners need reliable information about how many users see the respective ads. In addition, we and especially our partners expect that their advertising is displayed preferentially to those users who are likely to be interested in their products or offers/topics, thus enabling an individual, user-interest-based display. If you use our site for free, we therefore need data for so-called usage-based online advertising (ads are tailored to user interests), in the context of which your usage data is processed into usage profiles (advertising tracking).

iqd, ID5

For the purposes of the advertising tracking described, we process your usage data (cookie IDs, IP address, MAC address, device IDs, information about the browser used and data such as resolution or language setting, information about the operating system, the end device used, the behavior during your visit to our website (individual clicks, subpages visited, advertising banners viewed, etc.), the referrer URL, the date and time of the visit, the length of stay and your geographical location) in order to be able to present you with advertisements tailored to your interests. So that ads can also be tailored to you or your device where cookies do not work optimally, for example in apps on smartphones, cookie-like techniques and sources such as device data may be used. To prevent this, go to the "Google settings" app on Android smartphones or scroll down to "Google" in the general settings app, tap on "Ads" and uncheck the box next to "Interest-based advertising". On iOS devices, where we use Apple's Advertising Identifier, go to the Settings app, then to "Privacy", then to "Advertising" and make your specific settings. Advertisements served in connection with the AdDefend technology we use are excluded from these measures to prevent advertising tracking (see the explanation of AdDefend in this section 6. A).

The creation of user profiles based on advertising tracking is pseudonymized, which means that the characteristics that directly identify you personally are removed from the profiles. The legal basis is your in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, § 25 para. 1 TDDDG, which is mandatory in each case unless you have booked the read-free advertising option. Our advertising partners also process personal data for their own functional purposes, in particular to ensure security, prevent and detect fraud and rectify errors on the basis of their legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR. In the marketing of advertising spaces and for processing for functional purposes, data is also processed by providers from third countries, in particular the USA. In these cases, your rights are protected in accordance with Art. 45 et seq. GDPR (adequacy decision, certification, standard contractual clauses), details on the individual providers can be found in our Privacy Center. In the Privacy Center you will also find an overview of the advertising service providers approved and currently used for the free offer, the so-called "third-party trackers". The type and functionality of these services does not change, but individual services and/or cookies may be added or removed from time to time.

With regard to the marketing of advertising space on our websites, we work together with "iqd” (iq digital media marketing gmbh, Toulouser Allee 27, 40211 Düsseldorf, Germany) in such a way that we are jointly responsible for data processing within the meaning of Art. 26 DSGVO. In this context, we and iqd have regulated the respective responsibilities in a joint agreement and determined which of us fulfills which legal obligations. This applies in particular to the exercise of the rights of the data subjects and the fulfillment of the information obligations under Articles 13 and 14 GDPR. The data protection obligations are distributed as follows:

• iqd is responsible for advertising marketing, together with third parties (so-called vendors). This includes the allocation of advertising space and the creation of user profiles (including through segment-based profiling and subsequent targeted user communication), even beyond the use of our offers.

• We are responsible for creating the data protection requirements, in particular obtaining your as the legal basis for this data processing.

You will generally receive information from the entity to which you have asserted your rights, as long as the data processing is carried out within the framework of the joint responsibility. In all other cases, you will of course receive the information from us. In addition to the information in our data protection declaration and in our privacy center, you can also find out more about the partners and tool providers used by iqd and the respective data processing in iqd's data protection declaration . In iqd's privacy policy, you will find information about the recipients of data, deletion periods, permissions and detailed information about the specific purposes of data processing by each individual partner and tool provider.

We also process personal data or other information that we collect from you, such as your email address (in hashed, pseudonymized form), your IP address and/or information about your browser or operating system, for advertising tracking purposes. The legal basis for this is your in accordance with Art. 6 (1) 1 lit. a GDPR. The data mentioned is shared by "ID5” (ID5 Technology Ltd., 8 Devonshire Square, EC2M 4YJ London, UK) and its group companies and other partners (Google, Google Advertising Products, Meta), which act as data controllers for this area. ID5 and the other partners use this information to create an ID that can be used to recognize you on your devices. This ID does not include any personally identifiable information. If you have given your , we may place this ID in our first-party cookie or use an ID5 or partner cookie and thus allow the ID to be used for the above-mentioned purposes. The ID may be shared by us or on our behalf with our advertising partners and other third-party advertising providers worldwide. Detailed information on the data processing activities of ID5 in connection with this ID and the opt-out of ID5 can be found in the data protection guidelines of the ID5 platform under the following link: https://id5.io/platform-privacy-policy , for Google Advertising Products under https://myadcenter.google.com/home?hl=d. 

Utiq

If you to its activation, the Utiq technology also processes usage data for the purposes of activating and operating the technology. The technology is based on collaboration with participating telecommunications network operators and therefore will only work if you use a supported internet connection provided by one of those telecommunications providers. Specifically, in such case your usage data (particularly your IP address) is processed in such a way that it is transmitted to your telecommunications provider. The provider then matches this data with an account reference (e.g., your phone number or contract details) to create an online identifier and pass it on to Utiq. Based on this online identifier, Utiq generates an identifier ("martechpass") that enables us to recognise you as the same visitor and collect information for the delivery of interest-based advertising across our digital property(ies). We can only use the identifier to connect your browsing across our digital property(ies) listed here, if you have given Utiq separately on each one. The legal basis for this processing is your voluntary under Article 6(1)(a) of the GDPR.

For this purpose, we collaborate with "iqd" (iq digital media marketing gmbh, Toulouser Allee 27, 40211 Düsseldorf, Germany) and "Utiq" (Utiq SA/NV, Rue aux Laines 70, 1000 Brussels, Belgium) in such a way that we are jointly responsible for certain stages of data processing within the meaning of Article 26 of the GDPR. In this context, we and Utiq have established a joint agreement that defines independent responsibilities and determines which party fulfills which legal obligations. This particularly includes ensuring the rights of data subjects and complying with the information obligations under Articles 13 and 14 of the GDPR. The respective data protection responsibilities are generally distributed as follows:

• We are responsible for creating the data protection requirements, in particular obtaining your as the legal basis for this data processing and integrating the Utiq code on our websites to enable access to users’ IP addresses.

• Utiq is responsible for using the IP address to activate the Utiq technology.

• iqd is responsible for creating, maintaining and analyzing user profiles based on the existing and provided data.

You will generally receive information from the entity where you have exercised your rights, as long as the data processing falls within the scope of joint responsibility. In all other cases, we will provide the information.

Through the Utiq Privacy Portal ("hub”) , you can review and revoke any s you have given for the use of Utiq technology across all digital properties using the technology. You may also withdraw your Utiq specifically for this digital property on hub , or alternatively, via the "Manage Utiq”  page. More information about the Utiq technology can be found in Utiq’s privacy statement .

Google Ads Conversion Tracking

Our websites use the conversion tracking Google Ads of our advertising partner "Google” (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Ads sets a cookie on your device that is valid for 30 days and is not used for personal identification. If you now visit certain websites and the cookie is still active, we and Google can recognize that you clicked on the ad and were redirected to this page. Each Google AdWords customer receives a different cookie. This means that there is no way that cookies can be tracked across the websites of AdWords customers. The information obtained using the conversion cookie is used to generate conversion statistics for Google Ads customers who have opted for conversion tracking. Google Ads customers can see the total number of users who have clicked on their ads and been redirected to a page with a conversion tracking tag. However, they do not receive any information that could be used to identify users. Google's information on conversion tracking can be found here. The legal basis is your in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR and § 25 Para. 1 TDDDG. When Google processes data in third countries, your rights are protected by both adequacy decisions, certifications and standard contractual clauses (Art. 45 ff. GDPR); you can find details in our Privacy Center and here.

If you wish to exclude Google Ads Conversion Tracking, you can also refuse the setting of a cookie that is required for this or disable cookies for conversion tracking in your browser settings.

Google Display & Video 360

We would like to place targeted advertising on our websites and analyse the effectiveness of our marketing measures. We process cookies (cookie IDs and browser and device information) to collect information about your interactions with our advertisements in order to display relevant advertisements and measure and optimise campaign performance. The legal basis is your in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, § 25 para. 1 TDDDG. We use the online marketing service Display & Video 360 (DV360) from Google for the analyses and data processing described above.

In addition to the general revocation options, you can prevent Google from collecting personalised advertising in the future in your Google Account settings here: https://adssettings.google.com/u/0/authenticated?hl=de. 

AdDefend

If you visit one of our websites while an ad blocker is installed on your device, we process personal data for the purpose of detecting/preventing ad blocking and subsequently displaying advertisements. For this purpose, we place a cookie in your device's browser and process the cookie ID that identifies your device or browser. The legal basis for this is your , Art. 6 para. 1 sentence 1 lit. a GDPR, § 25 para. 1 TDDDG.

For these purposes, we use AdDefend technology (AdDefend GmbH, Borselstraße 3, 22765 Hamburg, Germany, https://www.addefend.com/de/datenschutzerklarung/ ) in such a way that we and AdDefend are jointly responsible for certain areas of data processing within the meaning of Art. 26 GDPR. In this context, we and AdDefend have entered into a joint agreement to regulate our respective responsibilities and determine which of us fulfils which legal obligations. This applies in particular to the exercise of the rights of data subjects and the fulfilment of the information obligations under Articles 13 and 14 GDPR. The data protection obligations are generally distributed as follows:

· We are responsible for creating the data protection requirements, in particular obtaining your as the legal basis for this data processing and integrating AdDefend technology on our websites.

· AdDefend is responsible for detecting/preventing ad blocking and transmitting the collected usage data to monetisation platforms and advertisers for the purpose of displaying advertising, as well as for the associated billing within the scope of our partnership.

You will generally receive information from the entity to which you have asserted your rights, as long as the data processing is carried out within the scope of joint responsibility. In all other cases, you will of course receive the information from us.

B) Personalized advertising offers from the publisher (self-promotion)

We display personalised advertising on our websites for our own products and those identified as such (publisher offers). In addition to simply presenting our product range, we strive to continuously improve the relevance of the selection of publishing offers so that we can present our offers to you based on our publisher-specific offer profile for the device you are using or your SPIEGEL login account. To do this, we use usage profiles created on the basis of Adobe-based advertising tracking. By setting cookies, we process information for these purposes regarding your device and the browser you use, your IP address, your interactions with our websites and – provided you are navigating our websites as a registered and logged-in user – also a unique identifier assigned to you, which links your usage behaviour to your account information. The legal basis is your , Article 6(1)(a) of the GDPR.

C) Political advertising

For the purpose of displaying personalised political advertising, we process the information relating to you obtained from Adobe-based advertising tracking (see section 3) and use it for advertising tracking purposes (see section 6(A)). This processing is based on your voluntary in accordance with Article 18(1)(b) of the Regulation on the Transparency and Targeting of Political Advertising (TTPW-VO) in conjunction with Article 6(1)(a) and Article 7 of the GDPR.

D) Marketing (Affiliate Marketing and Remarketing)

Affiliate Programs

Affiliate marketing is a type of online advertising in which companies work with partners, known as affiliates, to promote their products or services. These affiliates place links or banners on their own websites or platforms that refer to our companies. When a user clicks on such a link and makes a purchase or performs a certain action, the affiliate partner receives a commission. This method allows companies to increase their reach and only pay for actual results, while affiliates earn revenue by successfully referring customers. Affiliate marketing is often combined with re-marketing methods (also known as re-targeting), which focuses on the practice of retargeting users who have already interacted with a website or product without completing a product purchase. This is often done by placing ads on other websites or platforms that a user visits.

We process personal data in connection with affiliate marketing campaigns. As part of this, we analyze the performance of our advertising measures in order to continuously improve them and to be able to present you with relevant offers (optimization of our affiliate marketing offer). The data collected enables us to reward our affiliate partners fairly and transparently for successful referrals (performance-based remuneration). In addition, we want to optimize our website and its functions by analyzing user behavior in order to offer you a better user experience (improvement of user-friendliness). We use personal data to track our users' paths between the advertisers and our websites and to be able to correctly assign transactions (traceability of transactions) and we improve our product portfolio and our services based on the paths of movement (further development of the offer). As part of affiliate marketing, we process tracking domain cookies, pseudonymized user profiles, click data (time, type of advertising medium, website), device information (browser, screen resolution), the IP address (anonymized) and, if applicable, the order ID.

The processing is based on your voluntarily granted , Art. 6 para. 1 sentence 1 lit. a GDPR, § 25 para. 1 TDDDG. In the context of affiliate marketing, we work together with the agencies listed below, which act as an interface between us and the respective publishers:

AWIN

AWIN AG, Landsberger Allee 104 BC, 10249 Berlin, Germany

Information on data protection by AWIN can be found at the following link: https://www.awin.com/de/datenschutzerklarung 

The Reach Group

The Reach Group GmbH, Am Karlsbad 16, 10785 Berlin, Germany

Information on data protection at The Reach Group GmbH can be found at https://trg.de/datenschutzerklarung/.  You can prevent the storage of cookies that are processed in connection with this provider by adjusting your browser software accordingly. In addition, you can prevent the collection of personal data generated by the cookie and related to your use of the website by activating the opt-out function under the following link:

https://hal9000.redintelligence.net/privacy/8lcfmzhxc8d6/ 

This objection applies as long as the associated opt-out cookie is not deleted. This cookie is set for the domain, per browser and user of a computer. If you access our websites from multiple devices and browsers, you must therefore object to data collection separately on each of these devices and in each browser.

Targeting360

targeting360 GmbH, Gredinger Str. 28, 90453 Nuremberg, Germany

targeting360 uses the NEORY ad serving technology (NEORY GmbH, Brandschachtstr. 2, 44149 Dortmund, Germany), which includes a portfolio of websites that can be used to assign the content offered and visitor interests to a specific end device.

You can prevent the cookie from being set by selecting the appropriate settings, following this link: https://ad.ad-srv.net/privacy/kdb0xdq3ls8m/. 

Remarketing/Retargeting Direct Partnerships

We use direct partnerships to try to address users again after they have visited one of our websites but not taken the desired action (e.g. taken out a subscription) as part of retargeting and remarketing campaigns. For this purpose, we process personal data such as cookies and tracking data, IP addresses, device information and user behavior. The processing is all based on your voluntarily declared (Art. 6 para. 1 sentence 1 lit. a GDPR, § 25 para. 1 TDDDG). Possible third-country transfers in this context are justified by the legal requirements of Art. 44 ff GDPR. We work together with the following partners for this purpose:

Google Remarketing

We use the remarketing function of "Google” (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). When you visit certain of our websites, we have integrated a program code provided by Google there. This transmits a code that Google has previously stored in a cookie in your browser to Google. Google thus records that you have accessed certain of our websites. If you later enter search terms on Google or see ads from the Google network on other websites, we have the option of presenting you with our ads there (so-called "remarketing”). If you have a Google account, Google may link this data to your Google account. Information on data protection at Google and how remarketing works can be found in the Google data protection information and the explanations on Google remarketing. You can object to remarketing by configuring your browser so that it does not accept any cookies. However, this may mean that you are only able to use our website to a limited extent. You can also deactivate interest-based ads from Google in the Google ad settings here .

Meta remarketing/retargeting

Where appropriate, we have integrated remarketing tags from Meta (Meta Platforms Inc, 1601 Willow Road, Menlo Park, CA 94025, USA) and associated social networks (e.g., Facebook) into our offerings. If you are logged in to one of these networks, the platform receives information via cookies set in your web browser or in the app that you have visited our site, which allows us to target you with advertising on Meta-affiliated networks. The transmission of your data as a user is governed by Meta's own privacy policy. You can manage the privacy settings for your profile here. If you also have a customer account with us and authenticate yourself by logging in, we can use a unique identifier to link your profile/inventory data across devices with your usage data. Based on these enriched profiles, we can send you personalized publishing offers via our advertising network.

Bing Ads

The service of the US company "Microsoft” (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA) sets a cookie when you access one of our offer pages via a Bing ad so that we can find out the total number of clicks from the ad to our offers. Your user profile is only recorded under a pseudonym. No data transfer takes place. You can prevent this here .

Sovendus

The German service provider "Sovendus” (Sovendus GmbH, c/o Design Offices Karlsruhe Bahnhofplatz, Bahnhofplatz 12, 76137 Karlsruhe, Germany) offers some of our products for sale on the internet as an advertising partner. To ensure correct billing, a pixel of the service is set when the purchase is made in order to transmit the ordered offer, including a timestamp and IP address, in pseudonymized and encrypted form. The latter is used only for data security purposes and is usually anonymized after seven days. Details on data protection at Sovendus can be found here .

TikTok Retargeting

We have integrated retargeting pixels from the social network TikTok into our services. This means that TikTok will collect information about your use of our website via cookies and transmit this information to them. If you are logged in to TikTok when you visit our website, TikTok receives this information, enabling us to show you interest-based advertising on TikTok and measure the effectiveness of our advertising campaigns. The following data is processed for this purpose: usage and event data, technical data, online identifiers, website metadata and time- and campaign-related data. This data processing is based on your voluntary (Article 6(1), first sentence, point (a) of the GDPR). Further information can be found in TikTok’s privacy policy .

As part of our own product and sales development, we continuously work to improve our offerings and adapt them to the needs of our readers. This includes analyzing market trends, optimizing our product range, and further developing our sales strategies. The goal is to always be able to offer you, the reader, high-quality and needs-based solutions. To support this process, certain data may be used for specified purposes as described below.

Optimising monetisation strategies based on real-time behavioural data

Our aim is to monetise our products and offers as effectively as possible. To this end, we collect and aggregate usage and event data. Analysing this data enables us to deliver the best possible offers to you on a segment-by-segment basis. To this end, we process the following data: user, login or visitor ID; data relating to the use of registration and payment barriers; technical device and browser data; page view and visit history; interaction with content details; number of visits; visitor type information; and the 'Engagement Score' (see Section 7 of the Privacy Policy). The legal basis for this processing is your , given voluntarily in accordance with Article 6(1), first sentence, point (a) of the GDPR. We use the service provider 'Mather' (Mather Economics LLC, 1215 Hightower Trail, Building A, Suite 100, Atlanta, Georgia, USA). Mather processes the data on our behalf. We have entered into a data processing agreement with Mather Economics in accordance with Article 28(3) of the GDPR. Where personal data is transferred to third countries in the course of processing, we ensure that the requirements of Articles 44 et seq. of the GDPR are met.

On-site campaigns and testing

To continuously improve our website and services, we regularly run on-site campaigns, including A/B/n testing, editorial offers, and other product development methods. As part of this process, we show various versions of our website or individual elements to a limited number of users in order to test their effectiveness. We use the test results to optimise the user-friendliness of our website, improve our products and services, and analyse user behaviour to further develop our user-centred offering. To achieve this, we process the data summarised under the heading 'Adobe-based advertising tracking' (see section 3 of this privacy policy), as well as the order ID where necessary, using AI systems on a case-by-case basis. This processing is carried out on the basis of your , which you have given voluntarily, in accordance with Article 6(1), first sentence, point (a) of the GDPR.

Profile-based approach

On the basis of the basic tracking, we process your personal data for general evaluations regarding our products and offers. We use the analyses to assign you to a segment according to the profile information determined, possibly supplemented by profile information provided by you, and then to address you with on-site campaigns and personalizations.

These characteristics for the profile-based approach arise from the context (the content of the displayed website), from your profile characteristics, and from analyses and tests of product development. The resulting profile-based approach is essentially based on the "engagement score” (labeling your profile with a calculated usage intensity of our offers), the "propensity score” (labeling your profile with a calculated subscription probability) and the "churn score” (labeling your profile with a calculated cancellation probability). These assignments help us to create segments for the delivery of customized and relevant on-site campaigns, including suitable surveys, and for the delivery of e-mail campaigns. The legal basis is our legitimate interest, Art. 6 para. 1 sentence 1 lit. f GDPR. You can object to the processing at any time.

User feedback

If you use our contact form (section 4. G), we process the reason for your contact, channel and/or feature, the subject, and the content of your message in order to find out how satisfied our users are with our product and thus in our legitimate interest to record your feedback directly and implement it if necessary. The processing is necessary for product and sales development. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. We use the provider Zendesk already named under 4. G. to collect the information from the contact form, which is why the system-side data processing by Zendesk is also required for the processing of your feedback for the purpose stated here. In addition, we use the AI application "Langdock" (Langdock GmbH, Fehrbelliner Straße 4, 10119 Berlin, https://www.langdock.com/de ) for structuring and summarising the feedback via the form, with which we have concluded an order processing contract in accordance with Art. 28 para. 3 GDPR.

App analytics, attribution and analysis of user behaviour

We would like to analyse how you use our app. To this end, we collect data on how users interact with the app, particularly which events are triggered and how usage patterns develop. This evaluation helps us to analyse usage patterns, determine attribution and further develop and optimise our app offering. For this purpose, we process pseudonymous device, app and installation identifiers, as well as usage and interaction data, event data and technical information on app usage, sessions, app versions, the operating system used and user-defined characteristics such as language preferences, approximate location information and user identifiers. This processing is carried out on the basis of your , in accordance with Article 6(1), first sentence, point (a) of the GDPR, and Section 25(1) of the TDDDG. To this end, we use the 'Firebase Analytics' service provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; www.firebase.google.com/products/analytics). We have entered into a data processing agreement with Google for this purpose, which complies with the requirements of Article 28(3) of the GDPR.

Information about the app's new features and updates.

We would like to inform you within the app about new functional features and how to use them ('in-app messages'). These messages are displayed in context while you are using the app. In order to provide these messages, we process the Firebase installation ID in order to identify the app installation and deliver the message to the relevant device, as well as the technical information required for allocating and displaying the messages. The legal basis for this processing is your (Article 6(1)(a) GDPR, Section 25(1) TDDDG). To this end, we collaborate with 'Google' (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; www.firebase.google.com/products/in-app-messaging.de). We have a data processing agreement with Google in accordance with Article 28(3) of the GDPR.

A) Editorial cooperation offers (calculator)

We repeatedly use the services of cooperation partners in our articles. These can be for a variety of offers; one example is the integration of the "gross-net calculator”. If you wish to use such a third-party offer, at least your IP address is usually processed in connection with the call. Although we consider such services to be part of our journalistic offering, from a data protection perspective they are provided under the responsibility of the respective provider. The legal basis for forwarding to the third-party offering is your in accordance with Art. 6 (1) 1 lit. a GDPR, which we have generally made mandatory for use via a so-called pop-up window. Please visit the website of the respective provider to find out about data processing in connection with its use.

B) Social media

platforms – social networks in detail

We integrate postings and recommendation functions from Facebook, YouTube, X, Instagram, Giphy, Imgur, Spotify, TikTok, Vimeo, Reddit, Bluesky (abbreviated: Bsky) or the map service Mapbox on our site. These services are disabled by default, but you can enable them in whole or in part. We also maintain profiles on social networks for communication and public relations purposes.

If you have an account with a social media provider and are logged in when you activate the respective service on one of our websites, your visit can be assigned to your user account and your usage behavior can generally be analyzed comprehensively. Your personal data may also be collected even if you are not logged in or do not have an account with the respective social media provider. In this case, data collection is carried out, for example, by means of cookies that are stored on your end device or by collecting metadata, such as your IP address. This is another way in which social network operators can create user profiles that are displayed as the basis for interest-based advertising both within and outside the respective social media platform. We have no influence over the data collected by the provider and the processing operations, nor are we aware of the processing purposes and the respective scope of the processing. For details, please refer to the terms of use and data protection provisions of the respective social media portals. Please adjust your privacy settings on the respective service.

We would like to point out that, due to the location of the vast majority of providers, your data collected on a social media site may also be processed outside the European Union in so-called third countries. If you offer your services within the EU / EEA (European Economic Area), providers are still obliged to comply with European data protection laws. Please check the websites of the individual providers to ensure that they comply with legal requirements when transferring data to third countries.

The legal basis for the processing that occurs when these social networks are activated is your voluntarily given (Art. 6 para. 1 sentence 1 lit. a GDPR). The processes initiated by the social media providers, which you trigger by giving us your and thus activating the respective service, may be based on different or the same legal bases, which must be specified by the operators (e.g. within the meaning of Art. 6 (1) sentence 1 lit. a GDPR or § 25 (1) TDDDG).

The data collected directly by us via the respective social media platform will be deleted from our systems as soon as the purpose for its storage ceases to apply, you ask us to delete it or you revoke your to its storage. Retention periods due to mandatory legal provisions remain unaffected. We have no influence on the storage period of your data, which is stored by the operators of the social media presence for their own purposes. As you already know, the respective providers' own data protection regulations apply here, even if we distribute information and maintain presences there with our brands.

You can find out about the data protection regulations of the individual social media providers at the following links:

• Bluesky: The Bluesky "Embed” function allows the integration of text-focused content. To the Bluesky data protection information: https://bsky.social/about/support/privacy-policy 

• Facebook: We use the Facebook plug-in to integrate Facebook content into the website. To the Facebook data protection information: https://www.facebook.com/privacy/explanation 

• Giphy: The Giphy "Embed” function allows us to integrate GIFs into our web pages. For Giphy's privacy policy, see: https://giphy.com/privacy 

• Imgur: Imgur allows us to integrate Imgur content such as images. For Imgur's privacy policy, see: https://imgur.com/privacy 

• Instagram: The Instagram "Embed” function allows us to integrate images and videos from Instagram into our service. For the Instagram privacy policy, see: https://www.instagram.com/legal/privacy/ 

• Mapbox: We use Mapbox to integrate maps. For the privacy policy, see: https://www.mapbox.com/legal/privacy/ 

• Reddit: The Reddit "Embed” function allows us to integrate texts, images and videos from Reddit into our offering. Reddit's privacy policy: https://www.reddit.com/policies/privacy-policy 

• Spotify: We use Spotify to integrate songs, albums and playlists into our websites. To the Spotify data protection information: https://www.spotify.com/de/legal/privacy-policy/ 

• TikTok: We use the TikTok plug-in to integrate videos from TikTok. To the TikTok data protection information: https://www.tiktok.com/legal/privacy-policy?lang=de 

• Vimeo: We use the Vimeo player to integrate videos or videos from other providers into our website. For Vimeo's privacy policy, see: https://vimeo.com/privacy 

• X: We use the Tweet plugin to integrate X content into our website. For X's privacy policy, see: https://twitter.com/de/privacy 

• YouTube: With the YouTube player, we integrate videos from its YouTube channels or videos from other providers into our online offering. Google's privacy policy: https://support.google.com/youtube/answer/2801895?hl=de 

Moderation of posts on Facebook, Instagram and YouTube

As part of the moderation of comments and posts on Facebook, Instagram and YouTube, we process your user ID, the respective comment text, as well as the date and time of the comment on a random basis. The processing serves to check compliance with predefined rules for comment content, the interaction with other users, the detection of potentially criminally relevant statements and thus also the protection of our rights. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. We use the tool "Conversario” (ferret go GmbH, Brauerstraße 14, 16321 Bernau near Berlin) for these purposes on the basis of a data processing agreement in accordance with Art. 28 para. 3 GDPR.

The data will be deleted immediately if no violations are detected. Otherwise, it will be passed on to the appropriate authorities (to the law enforcement authorities or to the respective social media provider).

Provision of a 'Link in Bio' landing page

We process personal data in connection with the provision of a ‘Link-in-Bio’ page. This is a landing page that we link to on social media platforms (e.g. in the profile or bio), which redirects users to the content mentioned in posts or Reels.

For technical reasons, each time this 'Link-in-Bio' page is accessed, we process your anonymised IP address, as well as your browser and device information, usage and log data (e.g. pages/URLs visited, date and time of visit, and visit duration), technical identifiers (e.g. device identifiers), diagnostic and error data, and general location information (limited to city and country). This processing is necessary in order to deliver and display the 'Link-in-Bio' page, ensure security and stability, and analyse errors. The legal basis for this processing is Article 6(1), first sentence, point (f) of the GDPR.

To achieve these purposes, we use the 'Link in Bio' service provided by Mavrck LLC dba Later, 60 State Street, 8th Floor, Suite 810, Boston, MA 02109, USA. This is done on the basis of a data processing agreement in accordance with Article 28(3) of the GDPR. As Later also processes personal data in the USA or transfers it there, a transfer to a third country takes place. This is carried out on the basis of the EU Commission’s Standard Contractual Clauses (Article 46(2)(c) of the GDPR). Personal data will be erased as soon as it is no longer required for the aforementioned purposes.

A) spiegel.de

SPIEGEL Debate

If you have registered for a user account on spiegel.de and taken out a SPIEGEL subscription (except for a starter subscription), you can participate in our debate formats. For this purpose, we process your name, your e-mail address, your subscription data and your user ID for SPIEGEL Debatte (profile data), as well as a first and last name of your choice, which may be a pseudonym and does not have to correspond to your actual name, so that your identity does not have to be revealed when posts are published. We also process the number of your posts, votes received, suggestions and interests determined on the basis of your participation in your debate profile. The legal basis is Art. 6 para. 1 sentence 1 lit. b DSGVO, § 25 para. 2 no. 2 TDDDG in conjunction with the Special Terms of Use. You can optionally choose an avatar and describe your profile in more detail. This information is based on your voluntarily declared ; the legal basis is Art. 6 Para. 1 S. 1 lit. a DSGVO, § 25 Abs. 2 Nr. 2 TDDDG. We use the Logora tool (Société Logora, 31 Avenue Théophile Gautier, 75016 Paris, France, https://www.logora.com/de ) to moderate and manage your posts. We have concluded an order processing contract with Logora for these purposes in accordance with Art. 28 (3) GDPR.

In addition, we may analyze your posts in order to verify compliance with our Community Guidelines, Special Terms of Use and relevant legal requirements. We also process your profile data and your posts for this purpose. The review is usually carried out on the basis of formal criteria (e.g. using filter functions and keywords on hate speech, explicit content). The legal basis is our legitimate interest in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. We use the moderation tool "Perspective” for this post analysis.

Daily quiz

As a registered user, you have the opportunity to participate in our daily quiz. For this purpose, we process the assignment of clicks to you as a user by setting a cookie and its ID (associated processing of metadata). This gives you access to an evaluation of which quizzes you have participated in, as well as which and how many questions you answered correctly or incorrectly. In addition, we aggregate the data from all quiz participations of our users and process it anonymously to enable you to compare your quiz results with those of other participants. The legal basis is our legitimate interest in providing you with the widest possible range of services, and thus Art. 6(1)(f) GDPR, Section 25(2)(2) TDDDG.

Gaming

On our website, we offer you a wide range of games, including word search, four-in-a-row, pair search, honeycomb puzzles, Wordle, crossword puzzles, solitaire, mini Sudoku and Sudoku. In order to provide you with a wide range of editorial content, we process metadata and a hashed (pseudonymised) ID for displaying game scores by setting a cookie, which allows you to return to a game at any time and continue playing from where you left off. The legal basis for this is our legitimate interest in providing you with the most user-friendly gaming experience possible (Art. 6(1)(f) GDPR, Section 25(2)(2) TDDDG). The cookie is deleted three months after your last activity in the games section. To provide the games, we work with "Heine" (presse service Stefan Heine, Basselweg 103, 22527 Hamburg, Germany), with whom we have concluded a data processing agreement in accordance with Art. 28(2) GDPR for this purpose.

Price comparison

We use widgets on our website, e.g. with price information, tables or images. When you visit one of our websites with a widget, your IP address, user agent string and standard headers are transmitted to Heise Medien. This is necessary for technical reasons so that we can respond to queries. Among other things, the widgets are used to provide an overview of prices from different providers. At the same time, it is possible to access the offer directly via an affiliate link. This data is stored for a maximum of 7 days and then deleted or anonymized so that it can no longer be assigned to the accessing client. The processing of the data required from you is carried out on the basis of Art. 6 Para. 1 lit. f) GDPR exclusively to safeguard our legitimate interests, in particular for technical reasons, for IT security purposes, to fulfill user interests and to ensure the economic operation of our online services. The widgets are provided by Heise Medien (Heise Medien GmbH & Co. KG, Karl-Wiechert-Allee 10, 30625 Hannover, Germany). We have concluded a data processing agreement with Heise Medien in accordance with the requirements of Art. 28 (3) GDPR.

B) manager-magazin.de

podcasts

We process IP addresses and device information to enable you to download and play podcasts and to determine statistical data, such as the number of downloads. The legal basis is our legitimate interest in the secure and efficient provision of podcasts, as well as the analysis and optimisation of our offer in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. We use the podcast hosting service of the provider "Podigee" (Podigee GmbH, Schlesische Straße 20, 10997 Berlin, Germany) for loading and transmitting the podcasts, with whom we have concluded an order processing contract for this purpose in accordance with Art. 28 para. 2 GDPR. Furthermore, the podcasts are played out under joint data protection responsibility with OMR (Ramp 106 GmbH, Lagerstr. 36, 20357 Hamburg, Germany), with whom we are jointly responsible for data processing within the meaning of Art. 26 GDPR as part of the FFWD cooperation. In this context, we and OMR have regulated the respective responsibilities in a joint agreement and determined which of us fulfils which legal obligations. This relates in particular to the exercise of the rights of data subjects and the fulfilment of information obligations in accordance with Articles 13 and 14 GDPR. The data protection obligations are distributed as follows:

- OMR is responsible for the technical processing, including the provision of the podcast tool

- We are responsible for the fulfilment of the data protection information obligations and the playout of the podcasts on www.manager-magazin.de

You will generally receive information from the body to which you have asserted your rights as long as the data processing takes place within the scope of joint responsibility. In all other cases, you will of course receive the information from us.

LinkedIn Retargeting

In addition to the direct partnerships described in section 5. C. in the area of remarketing/retargeting, we explicitly use the retargeting function of LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland) at www.manager-magazin.de to display personalised advertising to you. This feature allows us to present targeted ads on LinkedIn to users who have visited our website. For more information about processing, please visit https://de.linkedin.com/legal/privacy/eu.  You can adjust your LinkedIn settings for personalised ads at any time at https://www.linkedin.com/mypreferences/d/categories/ads. 

A) 11Freunde

Sovendus

We offer some of our products for sale via advertising partners on the Internet. For this purpose, we process advertising partner-specific IDs, the time stamp of the order and your IP address to ensure correct billing. The legal basis is your , Art. 6 (1) (a) GDPR. For this purpose, we work with the service provider 'Sovendus’ (Sovendus GmbH, c/o Design Offices Karlsruhe Bahnhofplatz, Bahnhofplatz 12, 76137 Karlsruhe, Germany).

Games

We process your IP address for the provision of our games (online game: 'Box to Box’) and the temporary saving of game scores. This data processing is necessary for accessing and using the game. The legal basis is our legitimate interest in providing you with the most user-friendly gaming experience possible (Art. 6(1)(f) GDPR, Section 25(2)(2) TDDDG). To provide the game, we work with 'Spotever’ (Spotever UG, Am Ruhrstein 45, 45133 Essen, Germany), with whom we have concluded a data processing agreement in accordance with Art. 28 (2) GDPR for this purpose.

Right of access (Art. 15 GDPR)

You have the right to request information from us about which of your personal data we process.

Right to rectification (Art. 16 GDPR)

If the data concerning you is incorrect or incomplete, you can request the correction of incorrect or incomplete information.

Right to erasure (Art. 17 GDPR)

Under the conditions set out in Art. 17 of the GDPR, you have the right to request the erasure of your personal data. Whether or not you have the right to erasure depends, among other things, on whether we still need the data concerning you in order to fulfil our legal or contractual obligations.

Right to restriction of processing (Art. 18 of the GDPR)

Under the conditions set out in Art. 18 of the GDPR, you have the right to request the restriction of the processing of personal data concerning you.

Right to object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you.

Right to withdraw (Art. 7 (3) GDPR)

You have the right to withdraw to the processing of your personal data at any time. The withdrawal of shall not affect the lawfulness of processing based on before its withdrawal.

You can contact the Group's data protection officer at any time at: SPIEGEL Group, Attn: Data Protection Officer, Ericusspitze 1, 20457 Hamburg, Germany, or by email at dsb@spiegelgruppe.de .

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority of your choice. The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) is directly responsible for the SPIEGEL Group.

Contact:

Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Ehrhard-Str. 22, 7th floor
20459 Hamburg

Tel.: 040/428544040
E-Mail: mailbox@datenschutz.hamburg.de 

When you use our products and services, certain data is automatically generated by the website you are using. This so-called machine-generated data may contain information about the functionality and use of our products and is subject to the provisions of the Data Act (Regulation 2022/868). With this information, we want to demonstrate transparency to you as a user and give you the control over this data that is required by law.

A. Type and use of the data collected

We collect and process machine-generated data that is generated through the use of our products. This includes the following types of data:

Usage data: personally identifiable characteristics (Adobe 'Data Feed’, which contains browser-related [the Experience Cloud Visitor ID (EC ID), comparable to a cookie ID, which can be used to identify the browser of your end device] and user account-related (SSO ID) identification characteristics that can be used to track surfing behaviour and navigation on our site).

This machine-generated data is used exclusively for the following purposes:

- To determine statistical indicators about the use of our digital offering in order to determine the number of visits to our website, the number of website visitors and their surfing behaviour – based on a uniform standard procedure – and thus obtain market-wide comparable values. We process the usage data to ensure operation, to evaluate the relevance of content in editorial work, to examine the use of our websites and offerings, to continuously optimise individual functions and offerings as well as the user experience, and to identify faulty usage paths.

- For analysing the use of our offerings and the targeted display of editorial content in selected places based on your personal reading behaviour

- For personal access security, misuse prevention and clarification

- For profile-based addressing (scores)

Detailed information on the processing purposes can also be found in our data protection information under the respective heading.

B. User rights

In accordance with the provisions of the Data Act, you have the following rights with regard to the machine-generated data that arises from the use of our products:

- Right of access: You can request a copy of the data.

- Portability: You have the right to receive this data in a structured, commonly used and machine-readable format in order to share it with other services or providers.

- Data transfer: You can request that we share your data directly with a third-party provider, provided this is technically possible.

If you have any questions about the processing of your usage data or exercising your rights, you can contact us at any time at the following email address:

datenschutz@spiegelgruppe.de