Privacy Policy

of SoulAr GmbH & Co. KG (“SoulAr”) for the use of the SoulAr online shop

Date: June 2026

1. Data controller

The data controller is SoulAr GmbH & Co. KG, Alfred-Nobel-Str. 6, 97080 Würzburg, Germany.

2. Contact details of the Data Protection Officer

The external company data protection officer is Dr Carlo Piltz, Piltz Legal, Piltz Rechtsanwälte PartGmbB, Südwestkorso 3, 12161 Berlin, Tel: +49 (0)30 814 53 50 00.

3. Purpose, duration and legal basis of data processing

The processing of your personal data is based on your consent (Article 6(1)(a) of the GDPR) for the purpose of subscribing to the newsletter. If you provide us with your personal data when contacting us by email, we process your personal data to handle your enquiries, to contact you and, where applicable, to carry out pre-contractual measures or to fulfil the contract (Article 6(1), first sentence, point (b) of the GDPR) . Where necessary, we process your data beyond the actual performance of the contract to safeguard the following legitimate interests of ours or of third parties: reviewing and optimising procedures for needs analysis and direct marketing, advertising or market and opinion research, provided you have not objected to the use of your data; asserting legal claims and defending against legal disputes; ensuring IT security and IT operations, to enable various payment methods for your online orders, to ensure the operation of our website, to use social media functions, and to implement measures for business management and the further development of services and products (Article 6(1), first sentence, point (f) of the GDPR).

Furthermore, we are subject to various retention and documentation obligations and may also be legally obliged to disclose personal data to public authorities (Article 6(1), first sentence, point (c) of the GDPR). The table below provides an overview of the most important retention periods:

Data will only be transferred to third countries (countries outside the EU and the European Economic Area – EEA) insofar as this is necessary for the performance of the contracts concluded with you, is required by law, or you have given us your consent. We will inform you separately of the details, where required by law.

4. Processing of customer data

4.1 Orders

SoulAr processes the following customer data: the customer’s name, address, telephone number and email address, details of the order’s contents, IP address, details of a different delivery address where applicable, and details of the preferred payment method. The data is processed in Germany and may, in this context, be transferred to third-party service providers, such as the data processor shopware AG, as recipients. The aforementioned personal data is processed, on the one hand, for the purpose of fulfilling the relevant contractual relationship. The legal basis for data processing is Article 6(1), first sentence, point (b) of the GDPR.

The recipient of the data is our data processor responsible for handling and optimising the ordering process. If you place your order with us via Amazon Marketplace, Amazon (Amazon EU S.à.r.l., Société à responsabilité limitée, 38 avenue John F. Kennedy, L-1855 Luxembourg) is both the source and recipient of the data. Recipients of the data in connection with order processing also include our data processors Microsoft (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Dublin D18 P521, Ireland), Capsule (Zestia Ltd., 20 Dale St, Manchester M1 1EZ, United Kingdom) and ZenDesk (Zendesk GmbH c/o TaylorWessing, Neue Schönhauser Str. 3–5, 10178 Berlin) . Please note that, in the case of our data processor Capsule, transfers to third countries are carried out on the basis of the European Commission’s adequacy decision for the United Kingdom (Commission Implementing Regulation (EU) 2021/1772 of 28 June 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequacy of the protection of personal data by the United Kingdom).

Finally, we reserve the right to send you postal advertising at reasonable intervals to your address, promoting offers in our online shop. You may, however, object at any time to the use of your name and address for the purpose of sending postal advertising (see above). Simply send an email to datenschutz@soular.de.

4.2 Registration as a specialist retailer (new customer registration)

You have the option to register as a specialist retailer with SoulAr, so that SoulAr can subsequently create a customer account for you in our online shop on the website. This is done

• so that you can make use of our services;
• to manage your user data and settings; and
• to view invoices and outstanding balances.

The specific minimum data processed in this context is specified on the page containing the new customer registration form. In addition, we process your IP addresses and the times of registration and confirmation. The purpose of this procedure is to verify your registration and, where necessary, to investigate any potential misuse of your personal data.

The legal basis for data processing is Article 6(1), first sentence, point (b) of the GDPR.

As we are obliged, pursuant to Sections 1(9), 11(1), first sentence, of the Money Laundering Act (GwG), we are obliged to identify our contractual partner prior to establishing a business relationship or carrying out a transaction; therefore, as part of the new customer registration process and for the purposes of combating money laundering (Section 58 of the GwG), we process a copy of the new customer’s identity document. The copy is not processed for any other purpose. In accordance with Section 8(4), sentences 1 and 3 of the Money Laundering Act (GwG), this copy of the identity document is generally retained for five years following the termination of our business relationship and is subsequently destroyed, unless we are obliged to retain it for a longer period due to other statutory retention obligations, Section 8(4), sentence 2 of the Money Laundering Act (GwG).

The legal basis for this data processing is, in this respect, Article 6(1), first sentence, point (c) of the GDPR in conjunction with Sections 1(9) and 11(1), first sentence, of the GwG.

4.3 Use of email addresses for marketing purposes (Newsletter distribution)

4.3.1 Newsletter distribution in general

You may have the option to subscribe to the SoulAr email newsletter via a double-opt- -in procedure. This means that, following your registration, we will send an email to the email address you have provided, asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration, your information will be blocked and subsequently deleted. In addition, we process the IP addresses you provide and the times of registration and confirmation. The purpose of this procedure is to verify your registration and, if necessary, to investigate any potential misuse of your personal data.

Subscribing implies your consent to receive the regular newsletter, which, in addition to up-to-date information on SoulAr’s website and details of special product offers, may also contain advertising for other services and offerings from SoulAr. Your email address will therefore be used by SoulAr for its own advertising purposes following registration. You may unsubscribe at any time using the function provided for this purpose in the newsletter, by sending an email to datenschutz@soular.de or – where available – via a corresponding option in your user account settings. Your email address is stored to enable the newsletter to be sent. The legal basis for data processing is Article 6(1)(a) of the GDPR. To send the newsletter, we use the services of Mailchimp, provided by The Rocket Science Group, LLC, 675 Ponce de Leon Ave, NE Suite 5000, Atlanta, GA 30308, USA.

4.3.2 Sending newsletters to existing customers

If you have already purchased goods or services from us, SoulAr will use your email address and, for personalisation purposes, the first name and surname of the contact person on file, in order to send you our newsletter for the direct marketing of our own similar goods or services, provided you have not objected to this use of the aforementioned data. You may, of course, object to receiving our newsletter at any time with future effect, by clicking on ‘Unsubscribe’ at the bottom of the newsletter you have received or by contacting our Data Protection Officer at datenschutz@soular.de. You will not incur any costs other than the standard transmission charges.

The legal basis for this data processing is Article 6(1)(a) f) of the GDPR. Our legitimate interest lies in being able to inform you about our latest product offers through direct marketing.

4.4 Processing of personal data in connection with payment

Payment methods: ‘Prepayment (by bank transfer)’, ‘Invoice’

If you are offered one of the payment methods ‘Prepayment (by bank transfer)’ or ‘Invoice’ when placing your order, SoulAr will process solely the personal data you provide when placing the order in order to fulfil the contractual relationship with you.

The legal basis for the data processing is Article 6(1)(b) of the GDPR.

SoulAr is co-insured under a goods insurance contract. Under this contract, specialist services provided by the insurer (credit insurance, factoring, risk assessment and debt collection) are utilised. Where SoulAr makes use of the services described, personal data relating to the unfulfilled contract is also transferred to Coface. The legal basis for this data processing is Article 6(1), first sentence, point (f) of the GDPR. Our legitimate interest lies in protecting ourselves against payment defaults and in asserting the rights to which we are entitled and enforcing claims.

5. Processing of usage data

5.1 Log files

When the SoulAr website is accessed, the following information is automatically logged by the web server:

• IP address of the requesting computer;
• Date and time of the request;
• Access method/function requested by the requesting computer;
• Input values transmitted by the requesting computer (e.g. file name);
• Access status of the web server (file transferred, file not found, command not executed, etc.);
• Name of the requested file; and
• URL from which the file was requested or the desired function initiated.

This information is used exclusively for the purposes of identifying and tracing unauthorised access to the web server and other criminal offences. The legal basis for data processing is Article 6(1), first sentence, point (f) of the GDPR. Our legitimate interests are to ensure IT security and to ensure the operation of our website.

5.2 Cookies

When using our website, technical tools are used to support various functions, in particular so-called cookies, which may be stored on your device; . A cookie is a piece of text information that can be stored in the web browser of your device each time you visit a website. The cookie is either sent from the web server to the web browser or generated in the web browser by a script as a sequence of repetitive programme instructions.

Below you will find an overview of the cookies and other technologies we use when you visit the website.

5.3 Contact form

There is a contact form on the SoulAr website. The data you enter there is stored for the purpose of individual communication with you, and the processing of this data is justified on the basis of our legitimate interest pursuant to Article 6( 1(1)(f) of the GDPR, as we wish to offer you a simple way to get in touch. Your data is also processed for the purpose of responding to your enquiry and for any follow-up questions. If you contact us to request a quote or to enter into a contract, the legal basis for data processing is Article 6(1), first sentence, point (b) of the GDPR.

5.4 Facebook Fan Page

SoulAr operates a so-called fan page on Facebook. These are websites hosted on the Facebook platform to present SoulAr as a company and, for example, to engage with customers and prospective clients. Facebook is part of Meta.

5.4.1 Joint controllership with Meta

Together with Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (hereinafter ‘Meta’), we are responsible for the processing of so-called Insights data when you visit our fan page. With the information provided below, we fulfil, within the framework of joint controllership, our duty to provide information under Article 13 of the GDPR. When you visit our fan page, personal data is processed by Meta, including, amongst other things, your IP address and other information stored on your computer in the form of cookies. This applies both to visitors who have a Facebook account and to those who are not registered with Facebook. This information is used to provide SoulAr, as the operator of the Facebook fan page, with statistical information about the usage of the Facebook page. You can find out exactly which data is processed in the ‘Information on Page Insights Data’ provided by Facebook:  https://www.facebook.com/legal/terms/information_about_page_insights_data.

Please also refer to Facebook’s Privacy Policy for general information on how Facebook handles data:  https://de-de.facebook.com/about/privacy.

The results of this processing are then made available to us, as the operator of the fan page, by Meta in an aggregated, statistical and anonymised form as user statistics. We do not have access to the data processed by Meta. Meta provides further information on Insights via the following link:  https://de-de.facebook.com/help/pages/insights.

Meta describes the data it processes for its own purposes in its Data Use Policy, available via the following link:  https://de-de.facebook.com/about/privacy.

There you will also find information on how to contact Facebook and on the options for managing ad settings.

Please note that data collected during the data collection phase may also be transferred to locations in the USA and thus outside the European Union. Insofar as personal data is transferred to Facebook’s servers in the USA, where it is stored and further processed, Facebook is certified under the European Commission’s adequacy decision for data transfers to the USA, the Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023) , which permits such data transfers in accordance with this adequacy decision.

In the agreement entered into with SoulAr (available at:  https://www.facebook.com/legal/terms/page_controller_addendum), Facebook agrees to assume primary responsibility under the GDPR for the processing of so-called Insights data and to fulfil all obligations under the GDPR with regard to the processing of this Insights data. The key points of the agreement can be found here:  https://www.facebook.com/legal/terms/information_about_page_insights_data.

Should you wish to exercise any data subject rights to which you are entitled (see point 6 below for details) under the GDPR, please note that, in case of doubt, we may not be able to fully fulfil these rights on our own. It would therefore certainly be more effective for you to contact Facebook directly. Information on your rights regarding Page Insights is provided by Facebook here: https://www.facebook.com/legal/terms/information_about_page_insights_data.

With regard to Page Insights and joint controllership with Facebook, you have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you. Guidance on how to exercise your right to object can be found here: https://www.facebook.com/legal/terms/information_about_page_insights_data.

Should you nevertheless require assistance, please feel free to contact us. We will then forward your enquiry to Meta, insofar as it relates to Insights data.

The processing of visitors’ personal data serves to provide the fan page and to carry out statistical analysis of the use of our fan page. This analysis is carried out anonymously for us. The legal basis for data processing is Article 6(1), first sentence, point (f) of the GDPR. Our legitimate interests regarding the collection of personal data when visiting the fan page and the creation of statistical analyses are: communication and interaction with prospective and existing customers; dissemination of information about our company; and the anonymised analysis and presentation of the fan page’s usage.

5.4.2 Sole responsibility of SoulAr

SoulAr also processes data from your use of the fan page that you provide voluntarily (for example, in a comment) for the purpose of responding to your enquiries, communicating with you, and publishing information relating to the content offered on the fan page or by SoulAr. The legal bases for this processing are Article 6(1), first sentence, points (b) and (f) of the GDPR. The legitimate interest lies in effectively informing users, customers and prospective clients, and in communicating with these individuals.

You are welcome to contact us regarding data processed under our own responsibility and to exercise your rights as a data subject. However, where this relates to processing that falls solely within Facebook’s sphere of responsibility, we would like to point out in advance that our ability to assist you in exercising your rights is limited to referring you to the relevant departments at Facebook.

5.4.3. Sole responsibility of Meta

Meta remains solely responsible for the processing of such personal data in connection with visits to fan pages that do not fall under joint responsibility.

If you, as a user, are currently logged in to Facebook, there is a cookie on your device containing your Facebook ID. This enables Meta to track that you have visited our fan page and how you have used it. This also applies to all other Facebook pages. If you wish to avoid this, you should log out of Facebook or deactivate the ‘stay logged in’ function, delete the cookies stored on your device, and close and restart your browser.

5.5 Instagram profile

SoulAr utilises the technical platform and services of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”) for the information service offered here. Instagram is part of Meta.

Please note that you use this Instagram profile and its features at your own risk. This applies in particular to the use of interactive features (e.g. commenting, sharing, rating). Alternatively, you can also access the information provided via this page on our website at https://www.soular.de/. When you visit our Instagram profile, Meta collects, amongst other things, your IP address and other information stored on your computer in the form of cookies.

5.5.1 Joint responsibility with Meta

This information is used to provide us, as the operator of the Instagram profile, with statistical data on the usage of the Instagram profile. Meta provides further details on this via the following link: https://help.instagram.com/1533933820244654.

The data collected about you in this context is processed by Meta and may, where applicable, be transferred to countries outside the European Union. Meta describes in general terms, in its Data Use Policy, what information Meta receives and how it is used. There you will also find information on how to contact Meta and on the options for managing ad settings. The Data Use Policy is available via the following link:  https://help.instagram.com/519522125107875.

The manner in which Meta uses data from visits to Instagram profiles for its own purposes, the extent to which activity on an Instagram profile is attributed to individual users, how long Meta stores this data, and whether data from a visit to the Meta website is passed on to third parties, is not clearly and exhaustively specified by Meta and is not known to us. When accessing an Instagram profile, the IP address assigned to your device is transmitted to Meta. According to Meta, this IP address is anonymised (in the case of ‘German’ IP addresses). Meta also stores information about its users’ devices (e.g. as part of the ‘login notification’ feature); where applicable, this may enable Meta to associate IP addresses with individual users. If you, as a user, are currently logged in to Instagram, there is a cookie on your device containing your Instagram ID. This enables Meta to track that you have visited this page and how you have used it. This also applies to all other Meta pages. Through Meta buttons embedded in websites, Meta is able to record your visits to these websites and associate them with your Instagram profile. This data can be used to offer you personalised content or adverts.

If you wish to avoid this, you should log out of Meta or disable the ‘stay logged in’ function, delete the cookies stored on your device, and close and restart your browser. This will delete any Meta information that could be used to directly identify you. This allows you to use our Instagram profile without your Instagram ID being revealed. When you access interactive features on the site (such as ‘Like’, ‘Comment’, Share, Messages, etc.), an Instagram login screen will appear. Once you have logged in, Meta will once again be able to recognise you as a specific user. You can find information on how to manage or delete the information Meta holds about you on the following Instagram Support page: https://help.instagram.com/1533933820244654.

5.5.2 Sole responsibility of SoulAr

In addition, SoulAr is also solely responsible for certain data processing activities. In order to provide our information service, we process the following data for the purpose of communicating with Instagram users:

• User interactions (posts, likes, etc.);
• Profile name and data provided by the user in the conversation history, e.g. for processing service enquiries;
• Statistical surveys for targeted advertising;
• Statistical data on user interactions in aggregated form, i.e. without any personal reference for SoulAr (e.g. page activity, page views, page previews, likes, recommendations, posts, videos, page subscriptions including origin and times of day);
• Target-group-based adverts based on aggregated demographic data that cannot be linked to specific individuals (e.g. age, place of residence, language or gender)

You can find the current version of this privacy policy under the ‘Info’ section on our Facebook page. If you have any questions regarding the information we provide, you can contact us at  datenschutz@soular.de.

Data processing is carried out for the purpose of responding to your enquiries (if you have submitted an enquiry) or communicating with you, and to publish information about events, products and services offered by SoulAr. The legal basis for processing for the purpose of responding to enquiries initiated by you and aimed at the conclusion of a future contract is Article 6(1), first sentence, point (b) of the GDPR, and in all other cases Article 6(1), first sentence, point (f) of the GDPR.

Insofar as personal data is transferred to Meta’s servers in the USA and stored and further processed there, Meta is certified under the EU Commission’s adequacy decision for data transfers to the USA, the Data Privacy Framework (Implementing Decision (EU) 2023/ 1795 of 10 July 2023), which permits such data transfers in accordance with this adequacy decision.

Where the legal basis is Article 6(1), first sentence, point (f) of the GDPR (legitimate interests), in the effective provision of information to users, customers and prospective clients, in communicating with these individuals, and in promoting SoulAr’s public image.

Once your enquiry has been dealt with, the personal data you have provided will be deleted from our systems. Should you interact with us publicly, for example by leaving a comment or ‘liking’ a post, this data will remain publicly accessible on the site until it is deleted by us or by you. Where statutory retention obligations require longer storage, your data will be stored solely for this purpose and blocked for other purposes.

To exercise your right to object, please contact either datenschutz@soular.de or the above-mentioned address by post or telephone. We will then process your request without delay.

5.5.3. Meta’s sole responsibility

Meta remains solely responsible for the processing of such personal data in connection with visits to Instagram pages that do not fall under joint responsibility.

If you, as a user, are currently logged in to Instagram, there is a cookie on your device containing your Instagram ID. This enables Meta to track that you have visited our page and how you have used it. This also applies to all other Instagram pages. If you wish to avoid this, you should log out of Instagram or deactivate the ‘stay logged in’ function, delete the cookies stored on your device, and close and restart your browser.

5.6 LinkedIn

SoulAr uses the technical platform and services of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter “LinkedIn”) for the information service offered here. Please note that you use this LinkedIn page of SoulAr and its features at your own risk. This applies in particular to the use of interactive features (e.g. commenting, sharing, rating).

5.6.1. Joint controllership with LinkedIn

SoulAr is jointly responsible with LinkedIn solely for the processing of so-called ‘Insights data’, insofar as this data is used to generate so-called ‘Page Insights’.

SoulAr and LinkedIn have entered into an agreement within the framework of their joint responsibility, which you can access here: https://legal.linkedin.com/pages-joint-controller-addendum (the ‘Page Insights Joint Controller Addendum’). The agreement relates to data processing carried out in connection with a visit to or interaction with our LinkedIn profile, but only insofar as this data is also (subsequently) processed for ‘Page Insights’. ‘Page Insights’ comprise analytics services that help the operator of a LinkedIn profile to better understand interactions with their pages. The purpose of the data processing is to generate aggregated statistics for LinkedIn profile operators.

This involves the processing of data in connection with a visit to or interaction with a LinkedIn profile, but only insofar as the purpose is its use for ‘Page Insights’. LinkedIn provides further information on this at the following link: https://www.linkedin.com/help/linkedin/answer/4499/linkedin-page-analytics-overview?lang=en. The ‘Information on Data for “Page Insights”’ (https://legal.linkedin.com/pages-joint-controller-addendum), which is available to data subjects, explains how and when ‘Insights data’ is collected and used to generate ‘Page Insights’:

• When a LinkedIn member visits, follows or engages with the page, LinkedIn processes personal data to provide the page administrator with insights into usage;
• In particular, LinkedIn processes data that the member has provided to LinkedIn, such as data on role, country, sector, length of service, company size and employment status from a member’s profile; and
• Furthermore, LinkedIn processes information about how a member has interacted with your company page, e.g. whether a member is a follower.

When you visit our LinkedIn page, LinkedIn collects, amongst other things, your IP address and other information stored on your computer in the form of cookies. This information is used to provide us, as the operator of the LinkedIn page, with statistical information about the use of the LinkedIn page. We do not receive any personal data from LinkedIn in this context.

The data collected about you in this context is processed by LinkedIn and may be transferred to countries outside the European Union. LinkedIn describes, in general terms, what information it receives and how it is used in its User Agreement and Privacy Policy. There you will also find information on how to contact LinkedIn and on the options for managing advertisements. LinkedIn’s Privacy Policy is available via the following link: https://www.linkedin.com/legal/privacy-policy.

Should you wish to exercise any of your rights as a data subject under the GDPR, please note that we cannot fully comply with all these rights without LinkedIn’s cooperation. It would therefore certainly be more effective for you to contact LinkedIn directly. Should you nevertheless require assistance, please do not hesitate to contact us.

The respective responsibilities, in particular with regard to safeguarding the rights of data subjects, between SoulAr and LinkedIn can be found in the Page Insights Addendum (https://legal.linkedin.com/pages-joint-controller-addendum).

LinkedIn bears primary responsibility for fulfilling the GDPR obligations relating to the joint processing of ‘Insights data’. This includes fulfilling the following data subject rights:

• The right of access (Art. 15 GDPR);
• The right to erasure (Art. 17 GDPR);
• The right to restriction of processing (Article 18 of the GDPR);
• The right to data portability (Article 20 of the GDPR); and
• The right to object (Article 21 of the GDPR).

Further details on exercising these rights are provided by LinkedIn in section 4 of its Privacy Policy: https://www.linkedin.com/legal/privacy-policy.

LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA; http://www.linkedin.com/legal/privacy-policy

5.6.2. SoulAr’s responsibility

In addition, SoulAr is also solely responsible for certain data processing activities. In order to provide our information service, we process the following data for the purpose of communicating with LinkedIn users:

• User interactions (posts, likes, etc.);
• Profile name and data provided by the user in the conversation history, e.g. for processing service enquiries;
• Statistical surveys for targeted advertising;
• Statistical data on user interactions in aggregated form, i.e. without any personal reference for SoulAr (e.g. page activities, page views, page previews, likes, recommendations, posts, videos, page subscriptions including origin and times of day); and
• Targeted advertising based on aggregated demographic data that cannot be linked to specific individuals (e.g. age, place of residence, language or gender).

Processing is carried out for the purpose of responding to your enquiries (if you have submitted an enquiry to us) or communicating with you, and to publish information about SoulAr’s events, products and services. The legal basis for processing for the purpose of responding to enquiries that serve to conclude a future contract and are initiated by you is Article 6(1), first sentence, point (b) of the GDPR and, in all other cases, Article 6(1), first sentence, point (f) of the GDPR.

Insofar as personal data is transferred to LinkedIn’s servers in the USA, where it is stored and further processed, LinkedIn is certified under the European Commission’s adequacy decision for data transfers to the USA, the Data Privacy Framework, which permits such data transfers in accordance with this adequacy decision.

The legitimate interest lies in the effective provision of information to users, customers and prospective clients, in communicating with these individuals, and in promoting SoulAr’s public image.

You can find the current version of this privacy policy on the ‘About Us’ page under the heading ‘Privacy Policy’ on our LinkedIn page.

Once your enquiry has been dealt with, the personal data you have provided will be deleted from our systems. Should you interact with us publicly, for example by leaving a comment or ‘liking’ a post, this data will remain publicly accessible on the page until it is deleted by us or by you. Where statutory retention obligations require data to be stored for a longer period, your data will be stored solely for this purpose and blocked from use for any other purposes.

To exercise your right to object, please contact either datenschutz@soular.de or the address given above by post or telephone. We will then process your request without delay.

The provision of your data is voluntary. However, it is not possible to visit our profile without us processing personal data jointly with LinkedIn, or with SoulAr and LinkedIn each acting as separate data controllers.

5.7 Stepstone

We have an account with the Stepstone job portal (The Stepstone Group GmbH, Völklinger Straße 1, 40219 Düsseldorf, telephone: +49 211 93493-0, email: info@stepstone.de, ‘Stepstone’), on which we provide information about vacancies available with us and where interested individuals can apply.

The legal basis is Article 6(1), first sentence, points (b) and (f) of the GDPR. Our legitimate interest lies in advertising vacancies at SoulAr as effectively as possible, as well as in facilitating straightforward communication with applicants via Stepstone.

The recipient and source of the data is Stepstone.

Data which we receive in connection with applications via Stepstone and/or through our interactions with Stepstone will be retained for six months from the date the applicant receives notification of rejection, or, in the event of an offer of employment, for up to three years from the end of the employment relationship.

The provision of your data is voluntary. Please note that it is not possible to carry out a recruitment process without you providing the relevant data.

Further information on the purpose and scope of data processing by Stepstone can be found in their privacy policy at: https://www.stepstone.de/e-recruiting/rechtliches/datenschutz-bewerber/.

5.8 Embedded YouTube videos

We have embedded YouTube videos into our online service which are stored at https://www.YouTube.com and can be played directly from our website. The operator of the video platform is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (‘YouTube’). YouTube is part of Google.

YouTube videos are embedded on our website in ‘enhanced privacy mode’, meaning that, according to YouTube, user information is not stored until the video is played. However, the enhanced privacy mode cannot prevent data being shared with YouTube partners. Consequently, a connection to the Google DoubleClick network is established regardless of whether a video is opened.

When you open a YouTube video embedded on our website, a connection is established with YouTube’s servers and data is transmitted. We have no control over the scope or content of the data transmitted to YouTube when the plug-in is activated. Among other things, the YouTube server is informed which of our pages you have visited. According to YouTube, this information is used, amongst other things, to compile video statistics, to improve user-friendliness and to prevent misuse. YouTube uses cookies to collect information about user behaviour. These cookies remain on your device until you delete them. You can prevent YouTube from using cookies by adjusting the settings in your browser software.

If you are logged into your YouTube account, YouTube can link your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account before clicking the play button.

The use of YouTube is in the interests of presenting our online services in an appealing manner. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR.

Further information on the purpose and scope of data collection and its processing by YouTube can be found in their privacy policy at: https://www.google.de/intl/de/policies/privacy. Please note that data collected during the data collection phase may also be transferred to locations in the USA and thus outside the European Union. Where personal data is transferred to Google’s servers in the USA and stored and further processed there, Google is certified under the European Commission’s adequacy decision for data transfers to the USA, the Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023), which permits such data transfers in accordance with this adequacy decision.

5.9 Embedded videos via Vimeo

We have also embedded videos on our website which are stored on https://vimeo.com and can be played directly via our website. The operator of the video platform is Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. When you access a subpage that has a Vimeo video embedded, your browser establishes a direct connection to the provider’s servers to load the plugin. In doing so, certain information, including your IP address, is transmitted to the provider.

If playback of embedded videos is started via the plugin, Vimeo.com, Inc. also uses cookies to collect information about user behaviour, compile playback statistics and prevent misuse. If you are logged into a user account with Vimeo.com, Inc. whilst visiting the site, your data will be directly associated with your account when you click on a video. If you do not wish your data to be associated with your account, you must log out before clicking the play button.

All the aforementioned processing activities, in particular the setting of cookies to read information from the device you are using, will only take place if you have given us your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You may withdraw your consent at any time with future effect by deactivating this service via the ‘Cookie Consent Tool’ provided on the website.

For data transfers to the USA, Vimeo.com, Inc. has joined the EU-US Data Privacy Framework, which, on the basis of an adequacy decision by the European Commission, ensures compliance with European data protection standards.

5.10 Google reCAPTCHA

On this website, we also use the reCAPTCHA feature provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (‘Google’). This feature is primarily used to distinguish whether an input is made by a natural person or, in an abusive manner, through machine-based and automated processing. The service involves the processing of the IP address, all cookies set by Google over the last 6 months, browser language settings, browser plug-ins, JavaScript, time spent on the website, mouse or touchpad movements, and the cookie ID, as well as any other data required by Google for the reCAPTCHA service. The legal basis for data processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in establishing individual responsibility on the internet and in preventing abuse and spam on our website. When using Google reCAPTCHA, personal data may also be transfer of personal data to the servers of Google LLC in the USA.

We would like to point out that data collected during the collection phase may also be transferred to locations in the USA and thus outside the European Union. Insofar as personal data is transferred to Google’s servers in the USA and stored and further processed there, Google is certified under the EU Commission’s adequacy decision for data transfers to the USA, the Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023), which permits such data transfers in accordance with this adequacy decision.

Further information on Google reCAPTCHA and Google’s privacy policy can be found at: https://www.google.com/intl/de/policies/privacy/.

5.11 Data-Exchange-Portal

SoulAr uses its own web client solution for internal and external file transfers. When the web client is used, SoulAr processes the user’s IP address for up to seven days. The legal basis for data processing is Article 6(1), first sentence, point (c) of the GDPR in conjunction with Section 12 of the TDDDG, as well as Article 6(1), first sentence, point (f) of the GDPR. SoulAr’s legitimate interest lies, in particular, in safeguarding against the misuse of the web client and in ensuring network and information security.

5.12 Cookie-Consent-Tool

SoulAr uses a cookie consent tool to obtain valid user consent for cookies requiring consent and cookie-based applications. When you visit the website, you can use the cookie consent tool to decide which cookies requiring consent should be used. To this end, the tool uses technically necessary cookies to store your cookie preferences. The legal basis for the associated data processing is our legitimate interest under Article 6(1), first sentence, point (f) of the GDPR in ensuring legally compliant and user-friendly consent management for cookies and in providing evidence thereof.

5.13 etracker

We use the web analytics service etracker Analytics provided by etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg (“etracker”). etracker is a piece of software that collects and analyses data about your activities on our website in order to continuously improve and optimise our online offering. The categories of data processed in this context include technical connection data relating to server access (IP address, date, time, page accessed, browser information) as well as data on website usage, such as pages visited, duration of visit, origin, device type and interactions such as clicks or downloaded files.

The legal basis for data processing is your consent pursuant to Article 6(1), first sentence, point (a) of the GDPR and your consent pursuant to Section 25(1), first sentence of the TDDDG for the setting of and access to cookies stored on your device.

You may withdraw your consent to the data processing described above at any time with future effect by selecting the ‘Cookie settings’ option in the footer of this website and opting out of the relevant cookie there. You may also disable the storage of cookies from the outset by adjusting the settings in your browser software accordingly. Please note that certain functions of our website may not work if you have disabled the use of cookies.

Further information on etracker and etracker’s privacy policy can be found at:  https://www.etracker.com/datenschutz/.

5.14 Newsletter tracking

We use Mailchimp, provided by The Rocket Science Group, LLC, 675 Ponce de Leon Ave, NE Suite 5000, Atlanta, GA 30308, USA, to track how recipients interact with our newsletter. This involves recording recipient actions (opening an email, clicks on text and image links, downloading of images using an email programme) are recorded and stored for statistical purposes. The legal basis for this data processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing better and more tailored information to newsletter recipients.

6. User rights

6.1 Withdrawal of consent, objection

If you have given SoulAr your consent to the processing of personal data in connection with your use of SoulAr’s services, you may withdraw this consent at any time in accordance with Article 7(3) of the GDPR. The withdrawal may be sent by email to datenschutz@soular.de or in writing to the address given below. The effects of the withdrawal are limited to the storage and use of personal data which may not already be stored and used without your consent on the basis of statutory grounds for processing. Such a withdrawal affects the lawfulness of the processing of your personal data from the point at which you notify us of it. Please note, however, that in this case it may no longer be possible to process the data in question in the future. 

Where we base the processing of your personal data on a balancing of interests, you may object to the processing in accordance with Article 21 of the GDPR. This is the case, in particular, where the processing is not necessary for the performance of a contract with you. When exercising such a right to object, we ask that you state the reasons why we should not process your personal data in the manner we have been doing. In the event of a justified objection, we will review the circumstances and either cease or adapt the data processing, or explain to you our compelling legitimate grounds on the basis of which we will continue the processing. Should you exercise your right to object, the data controller will no longer process your personal data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms as the data subject, or the processing serves to establish, exercise or defend legal claims.

You may, of course, object at any time to the processing of your personal data for the purposes of marketing and data analysis. You can inform us of your objection to marketing using the following contact details: datenschutz@soular.de or at the address given below.

6.2 Your other rights

Upon request, SoulAr will, in accordance with Article 15 of the GDPR, provide you at any time with information regarding which personal data relating to you is stored by SoulAr. Furthermore, you have the right at any time to have your personal data rectified by SoulAr in accordance with Article 16 of the GDPR, erased in accordance with Article 17 of the GDPR, or to have the processing of your data restricted in accordance with Article 18 of the GDPR. Under Article 20 of the GDPR, you have the right to have data which we process automatically on the basis of your consent or in fulfilment of a contract transferred to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another data controller, this will only take place to the extent that it is technically feasible. The only data exempt from erasure is that which SoulAr requires to carry out outstanding tasks or to enforce existing rights and claims, as well as data that SoulAr is required to retain by law. Such data will, however, be blocked. 

You also have the right, under Article 77 of the GDPR, to lodge a complaint with a data protection supervisory authority.

We are happy to assist you.

Adress:

SoulAr GmbH & Co. KG
Alfred-Nobel-Str. 6
97080 Würzburg
Germany

E-Mail: datenschutz@soular.de
Telefon: 0931 9708 444