Privacy Policy

Our website is hosted by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (AWS), using the AWS Amplify Hosting service in the Frankfurt region (eu-central-1). It is delivered via the Amazon CloudFront content delivery network, which usually answers a request from a server location near you. The website is a static site: there are no user accounts, no server-side sessions and no database in which your visit is recorded.

When you access the website, AWS processes technically necessary access data: your IP address, date and time, the address requested, the amount of data transferred, the status code, the previously visited page (referrer) as well as browser and operating system. Without this processing, the website cannot be delivered to your browser. The legal basis is our legitimate interest in providing the website securely, stably and quickly (Art. 6(1)(f) GDPR). Where access logs are stored, we use them only for troubleshooting and for defending against attacks, and we do not draw any conclusions about you as a person from them.

AWS acts as our processor; a data processing agreement pursuant to Art. 28 GDPR is in place. For transfers to third countries, see the section “Data processing in third countries”.

We deliver the Roboto font and, for the Arabic and Hindi versions, Noto Sans Arabic and Noto Sans Devanagari from our own server. When you visit our website, no connection to Google Fonts is established and no data is transmitted to Google.

On your first visit, a notice asks which categories you consent to: Necessary (always on), Statistics and Marketing. We operate this notice ourselves, without an external provider. We store your choice and the time at which you made it in your browser’s local storage under “cadt-cookie-consent”, so that we do not have to ask you again on every visit and so that we can demonstrate your consent. In addition, the browser remembers the display mode you selected (light or dark, “theme”) and – until you close the browser – whether you have closed a notice at the top of the page. These entries remain on your device.

These storage operations are strictly necessary for the operation of the website and take place without consent (Section 165(3) TKG 2021, Section 25(2) TDDDG). The legal basis is our legitimate interest in a functioning website and the obligation to be able to demonstrate consent (Art. 6(1)(c) and (f) in conjunction with Art. 7(1) GDPR). The entries remain until you change your choice or clear your browser’s storage.

We use Google’s consent mode (Consent Mode v2) in “Basic” mode: as long as you have not given your consent, the website does not load any Google service and does not send any data to Google – not even cookieless signals. Once you have given your consent, we inform the Google services of the purposes you have consented to (Statistics: analytics_storage; Marketing: ad_storage, ad_user_data, ad_personalization), and the services act accordingly.

If you have consented to the Statistics category, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google) (measurement ID G-SZY6KMJFV3). Google Analytics is loaded directly via the gtag.js script and shows us how the website is used, so that we can improve content and usability.

The data processed includes in particular: pages visited and time spent on them, the page you came from, campaign parameters in the link (UTM parameters), information about your device, browser, operating system and screen, your approximate location (country, region, city) as well as events such as clicks on buttons, your choice in the cookie notice, the submission of the contact form or a newsletter sign-up – without the content of your entries. According to Google, your IP address is used only to determine your approximate location and is not stored. Google Signals (linking with Google accounts) is switched off.

Google Analytics sets the cookies _ga and _ga_SZY6KMJFV3, which contain a random identifier and expire after 2 years. Event data is automatically deleted after 14 months. Google processes the data on our behalf as a processor.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023.

We load Google Tag Manager from Google (container GTM-N4WRDVV) if you have consented to the Statistics or Marketing category. We use it to manage and load Google’s measurement and advertising services, in particular Google Ads. Tag Manager itself does not set any cookies and does not analyse any usage data; when it is loaded, however, Google receives your IP address and information about your browser for technical reasons. The services loaded via Tag Manager act in accordance with your consent (Consent Mode).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). For a possible transfer to the USA, the information given on Google Analytics applies.

If you have consented to the Marketing category, we integrate Google Ads from Google via Google Tag Manager (account AW-11070226186). This allows us to measure whether a visit came about via one of our ads and led to an enquiry or a newsletter sign-up (conversion tracking). In addition, we can later show our ads to visitors to our website on other websites and in Google services (remarketing).

For this purpose, Google sets the cookies _gcl_au and _gcl_aw (lifetime 90 days), which contain an identifier and – if you arrive via an ad – the click ID. Google may additionally set its own cookies on Google domains, for example doubleclick.net. The data processed includes, among other things, your IP address, the pages visited, information about your browser and device as well as the fact that a conversion has taken place.

Enhanced conversions: If you submit the contact form or the newsletter sign-up with this consent, your browser converts your email address and, if provided, your phone number into a hash value using the SHA-256 method. Only this hash value is sent to Google, not the address or number itself. Google matches it against signed-in Google accounts so that the enquiry can be attributed to an ad even when no cookies are present. We receive no data about your Google account, only aggregated conversion figures. We do not transmit the other form contents, such as name, company and message, to Google.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021). Google processes some of this data as a controller in its own right. A transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework, see Google Analytics). You can also manage personalised advertising in your Google account at myadcenter.google.com.

If you have consented to the Marketing category, we use Leadinfo provided by Leadinfo B.V., Rotterdam, the Netherlands (tracker LI-6405E75317FBB). For this purpose, your browser loads a script from cdn.leadinfo.net. Using the IP address, Leadinfo determines from which company the website is being accessed and matches this with publicly available company data such as company name, registered office and industry, as well as the pages visited. This enables us to identify business interest in our products (B2B). We do not use it to create profiles of individual natural persons.

Leadinfo sets the cookies _li_id (lifetime 2 years) and _li_ses (for the duration of the visit) in order to recognise returning visits. The analysis takes place within the European Union; Leadinfo acts as our processor.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 165(3) TKG 2021).

The contact form and the newsletter sign-up send your details in encrypted form to our own form service at forms.cadt365.com. It runs on AWS (Amazon API Gateway and AWS Lambda) in the Frankfurt region and forwards the details to Zoho (see below). Its logs contain neither form content nor your IP address, but only an identifier of the request, the path called and the processing status. We delete the processing logs after 3 months and the access logs after 1 month. To protect against mass submissions, the service stores a pseudonymised hash of your IP address and e-mail address (not the addresses themselves) for each submission and deletes it after 25 hours at the latest. The legal basis is our legitimate interest in secure operation free of abuse (Art. 6(1)(f) GDPR).

If you write to us via the contact form, we process your name, your e-mail address and your company (mandatory information), and, if you wish, your telephone number and your message as well as the subject you selected. In addition, the form transmits the language of the page, the page on which you submitted it, campaign parameters from the link via which you arrived (UTM parameters, if any), and whether you have consented to receiving information.

From this, the form service creates an entry (lead) in our customer relationship management system Zoho CRM. The provider is Zoho Corporation B.V., Utrecht, the Netherlands; the data is stored in Zoho’s European data centre (zoho.eu). Zoho acts as our processor.

We use the details to answer your enquiry and – for example in the case of a request for a demo or a quotation – to prepare a possible contract (Art. 6(1)(b) GDPR). Where your enquiry is not aimed at a contract, and for attributing the enquiry to our campaigns, we rely on our legitimate interest in handling enquiries and in measuring the success of our advertising (Art. 6(1)(f) GDPR). We delete the data as soon as it is no longer required for these purposes and no statutory retention obligation prevents deletion.

If you tick the box in the contact form for information on products and events, we additionally add your e-mail address to our newsletter list. You will first receive an e-mail in which you confirm the sign-up (double opt-in); only after that will we send you information. The legal basis is your consent (Art. 6(1)(a) GDPR). The handling of your enquiry does not depend on this consent. You can withdraw it at any time via the unsubscribe link in every e-mail or by sending a message to eu-gdpr@cadt-solutions.com.

If you send us an e-mail or call us, we process your details in order to deal with your request (Art. 6(1)(b) or (f) GDPR). The details may be stored in Zoho CRM; the information given on the contact form applies to their deletion.

On some pages we embed videos that are hosted on YouTube (Google Ireland Limited). Before playback, you see only a preview image that comes from our own server – there is no connection to Google. Only when you start a video is it loaded via youtube-nocookie.com, YouTube’s privacy-enhanced mode. In the process, your IP address and information about your device are transmitted to Google; YouTube may use cookies or similar technologies, and if you are logged in to Google, the use may be associated with your account.

The legal basis is the consent you give by starting the video (Art. 6(1)(a) GDPR). If you wish to prevent the association with your account, log out of Google before playback.

On our careers page, your browser loads the current list of open positions directly from Zoho Recruit (cadt-solutions.zohorecruit.eu, provider Zoho Corporation B.V.). In the process, Zoho receives your IP address and information about your browser for technical reasons; our page does not set any cookies in doing so. The legal basis is our legitimate interest in always showing the current vacancies (Art. 6(1)(f) GDPR).

If you click on a vacancy or on “Apply”, you are taken to our careers portal at Zoho Recruit. The data collected there depends on the respective application form; the processing of applications is not covered by this policy.

For trade fairs, webinars and training courses, we use Zoho Backstage provided by Zoho Corporation B.V. If you click on a registration link, you leave our website; the provider’s privacy policy then applies. The data collected there depends on the respective registration form.

For licence overviews, ticket management and protected downloads, we operate a customer portal with its own login (support.cadt-solutions.com). It is not part of this website; if you follow the link, you leave this site. Mandatory information comprises user ID, e-mail address, password, company name, first name and surname as well as telephone number; further information is voluntary. We process these data pursuant to Art. 6(1)(b) and (f) GDPR in order to create your account, to recognise you when you log in and to provide the services of the protected area. If you delete your account, we delete the data as soon as the purpose ceases to apply.

Google Search Console shows us how our website appears in Google Search. We receive only aggregated information from Google, for example search terms as well as click and impression figures by country and device type. No script is embedded on our website for this purpose, and no data about your visit is collected.