Privacy Policy

1. Controller and data protection officer

The controller responsible for data processing on this website is:

Escalt GmbH
Scheyerer Str. 10, 85293 Reichertshausen, Germany
Phone: +49 8137 6292651
E-mail: info@escalt.com

A data protection officer has not been appointed, as the legal requirements for this are currently not met. For data protection matters you can reach us using the contact details above.

2. General information on data processing

As a matter of principle, we process personal data of our users only to the extent necessary to provide a functioning website and our content and services. Processing regularly takes place only with the user's consent (Art. 6 (1)(a) GDPR), or where processing is necessary for the performance of a contract or pre-contractual measures (Art. 6 (1)(b) GDPR), or where it is necessary to safeguard legitimate interests (Art. 6 (1)(f) GDPR), unless other legal bases apply.

You are neither legally nor contractually required to provide your data. However, without the details marked as required fields in the contact form, we cannot process your inquiry.

3. Hosting and server log files

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO operates its data centres in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO.

Each time our website is accessed, the server automatically records so-called server log files, which your browser transmits automatically. These are:

• browser type and browser version
• operating system used
• referrer URL
• host name of the accessing computer
• time of the server request
• IP address (truncated or anonymized where technically possible)

This data is not merged with other data sources and serves to ensure trouble-free operation and IT security. The legal basis is our legitimate interest in the secure and stable operation of the website (Art. 6 (1)(f) GDPR). The log files are deleted after 30 days at the latest, unless in exceptional cases they are needed for longer to investigate a specific security incident.

4. Contact form and e-mail contact

If you send us an inquiry via the contact form or by e-mail, your details from the inquiry form, including the contact data you provide there (name, e-mail address, phone number, company, message text), are stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not pass this data on to third parties without your consent; this does not apply to the processors named in section 7.

This data is processed on the basis of Art. 6 (1)(b) GDPR, where your inquiry is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases the processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Art. 6 (1)(f) GDPR) or on your consent (Art. 6 (1)(a) GDPR), where this has been requested.

The form contains a field invisible to you that serves to ward off automated submissions (spam protection). No additional personal data is collected in the process and no third-party services are involved.

The data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected.

5. Cookies

Our website uses cookies. Cookies are small text files that are stored on your device. Details on the cookies we use, their purpose and legal basis, and your choices can be found in our separate cookie policy.

6. Fonts (locally hosted)

This website uses the fonts “Inter” and “Source Serif 4”. Both font files are delivered exclusively from our own server and are not loaded from external providers such as Google Fonts. When you visit our website, no connection to servers of Google or other third parties is therefore established, and your IP address is not transmitted to third parties for this purpose.

7. Recipients of the data and processors

Within our company, only those persons who need access to your data to handle your request receive it.

In addition, we use carefully selected service providers who process data on our behalf and according to our instructions. Data processing agreements pursuant to Art. 28 GDPR are in place with them. These are the following categories:

• Hosting and data centre – STRATO GmbH, Berlin (see section 3): operation of the website and storage of the server log files
• E-mail and communication services – delivery and storage of the messages received via the contact form
• IT maintenance and support – technical support of the systems, in the course of which access to data cannot always be ruled out

Your data is not transferred for advertising purposes and is not sold. Data is only disclosed to government bodies within the framework of mandatory legal requirements.

8. Data transfers to third countries

Processing in the course of operating this website takes place exclusively on servers in Germany (see section 3). Data collected about you as a website visitor is not transferred to a third country.

Should personal data in future be transferred to a country outside the EU or the EEA for which no adequacy decision of the European Commission exists, this will take place exclusively on the basis of suitable safeguards pursuant to Art. 46 GDPR – in particular the standard contractual clauses adopted by the European Commission – combined with the additional measures required following a risk assessment. You can request a copy of the safeguards using the contact details given in section 1. For processing on behalf of our clients, section 9 additionally applies.

9. Processing on behalf of our clients

This section does not concern visitors to this website; for the sake of completeness, it explains how we handle personal data entrusted to us in the course of our services.

If we provide IT services for a client and process personal data on the client's behalf in doing so, the client is the controller within the meaning of the GDPR and we are the processor. Before processing begins, we conclude a data processing agreement pursuant to Art. 28 GDPR with the client. In these cases, data subjects should contact the respective client as controller to exercise their rights.

Such processing takes place as a matter of principle exclusively within the European Union or the European Economic Area. Where we use sub-processors – in particular development partners in Poland and Romania – they are based within the EU. The use of sub-processors, the client's right to object and the current list are governed by the data processing agreement.

Processing outside the EU or the EEA – for instance by development partners in Ukraine – only takes place if we have expressly agreed this with the client concerned for the individual engagement. No adequacy decision of the European Commission exists for Ukraine; such processing therefore takes place exclusively on the basis of the standard contractual clauses pursuant to Art. 46 GDPR together with supplementary technical and organizational measures.

10. Reach measurement and analytics tools

We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service helps us understand which content of this website is found and read, so that we can improve it.

Only with your consent. Google Analytics is only loaded after you have agreed in the cookie banner. If you decline or make no choice, not a single data record is transmitted to Google and no analytics cookies are set. The legal basis is your consent pursuant to Art. 6 (1)(a) GDPR and § 25 (1) of the German TDDDG.

What is processed. Pages visited and time spent, approximate location at city or region level, device type, browser and operating system, the previously visited page, and a randomly assigned identifier that recognizes your browser on subsequent visits. Your IP address is truncated by Google Analytics 4 before it is stored; it is not merged with other Google data. We have not activated advertising features or Google Signals.

Cookies and storage period. The cookies _ga and _ga_<ID> are set with a lifetime of two years. The event data in Google Analytics is deleted after 14 months.

Transfers to the USA. Processing by Google LLC in the United States cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; an adequacy decision of the European Commission pursuant to Art. 45 GDPR therefore exists for this transfer. In addition, the standard contractual clauses pursuant to Art. 46 GDPR apply. A data processing agreement pursuant to Art. 28 GDPR is in place with Google.

Withdrawal. You can withdraw your consent at any time with effect for the future — via the Cookie settings item in the page footer. Upon withdrawal, we delete the analytics cookies that have been set. The lawfulness of the processing carried out until then remains unaffected.

11. Data security

Pursuant to Art. 32 GDPR, we take appropriate technical and organizational measures to protect your data against accidental or intentional manipulation, loss, destruction and access by unauthorized persons. The transmission between your browser and our server is encrypted via TLS (recognizable by the lock symbol and https:// in the address bar). Our measures are continuously adapted in line with technological developments.

12. Your rights as a data subject

With regard to the personal data concerning you, you have in principle the following rights:

• right of access (Art. 15 GDPR)
• right to rectification or erasure (Art. 16, 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to object to processing (Art. 21 GDPR)
• right to data portability (Art. 20 GDPR)
• right to withdraw consent given, with effect for the future (Art. 7 (3) GDPR)
• right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise these rights, please contact info@escalt.com.

Right to object

Where we process your data on the basis of legitimate interests pursuant to Art. 6 (1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Competent supervisory authority

For us as a non-public body based in Bavaria, the competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA) in Ansbach. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies and can also be exercised with the supervisory authority of your place of residence.

No automated decision-making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place on this website.

13. Storage period

Unless a more specific storage period has been stated in this privacy policy, your personal data remains with us until the purpose for the data processing no longer applies. Statutory retention and documentation obligations (e.g. under commercial or tax law) remain unaffected and may require longer storage.

14. Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements, or to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.