We ♡ your Privacy

We are happy to provide you with the privacy policy here in English. The German language version, which you can find here, is authoritative.

Information on data protection
With this data protection information, we inform you about our handling of your personal data and about your rights according to the European Data Protection Regulation (DSGVO) and the German Federal Data Protection Act (BDSG). Responsible for data processing is urbyo GmbH (hereinafter referred to as "we" or "us"). 

Contents
I. General information
1. Contact
2. Legal basis
3. Duration of storage
4. Categories of recipients of the data
5. Data transfer to third countries
6. Processing when exercising your rights
7. Your rights
8. Right to object
9. Data protection officer

II. Data processing on our website
1. Processing of server log files
2. Cookies
3. Consent management tool
4. Sentry
5. Urbyo platform
6. Newsletter
a. Subscription and unsubscription
b. Analysis
c. Service provider
7. Google tag manager
8. Analysis of our website
a. Google Analytics
b. Hubspot Analytics
c. Hotjar
d. Launch Darkly
9. Tracking & retargeting
a. Google Ads
b. Microsoft Advertising
c. Facebook Pixel
10. External media
a. YouTube
b. Google Maps

III. Data processing on our social media pages
1. Visit of a social media page
a. Facebook and Instagram page
b. LinkedIn company page
c. YouTube
2. comments and direct messages

IV. Further data processing
1. Contact by e-mail
2. Customer and prospective customer data
3. Use of your e-mail address for marketing purposes
4. Applications
5. Heyflow

I. General data

1. Contact

If you have any questions or suggestions about this information, or if you would like to contact us about asserting your rights, please send your request to 

Herting Oberbeck Rechtsanwälte Partnerschaft
Hallerstraße 76
20146 Hamburg

E-Mail: data-protection@urbyo.com

2. Legal basis

The term "personal data" under data protection law refers to all information relating to an identified or identifiable individual. We process personal data in compliance with the relevant data protection regulations, in particular the DSGVO and the BDSG. Data processing by us only takes place on the basis of a legal permission. We process personal data only with your consent (Art. 6 para. 1 letter a DSGVO), for the performance of a contract to which you are a party, or at your request for the performance of pre-contractual measures (Art. 6 para. 1 letter b DSGVO), for the performance of a legal obligation (Art. 6 para. 1 letter c DSGVO) or if the processing is necessary to protect our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms which require the protection of personal data override (Art. 6 (1) letter f DSGVO). 

If you apply for a vacant position in our company, we will also process your personal data for the purpose of deciding whether to establish an employment relationship (Section 26 (1) sentence 1 BDSG).

3. Duration of storage

Unless otherwise stated in the following notes, we store the data only for as long as is necessary to achieve the processing purpose or to fulfill our contractual or legal obligations. Such statutory retention obligations may arise in particular from commercial or tax law regulations. From the end of the calendar year in which the data was collected, we will retain such personal data contained in our accounting records for ten years and retain personal data contained in commercial letters and contracts for six years. In addition, we will retain data in connection with consents requiring proof as well as with complaints and claims for the duration of the statutory limitation periods. We will delete data stored for advertising purposes if you object to processing for this purpose.

4. Categories of recipients of the data

We use processors as part of the processing of your data. Processing operations carried out by such processors include, for example, hosting, maintenance and support of IT systems, customer and order management, order processing, accounting and billing, marketing measures or file and data carrier destruction. A processor is a natural or legal person, authority, institution or other body that processes personal data on behalf of the data controller. Processors do not use the data for their own purposes, but carry out data processing exclusively for the data controller and are contractually obligated to ensure appropriate technical and organizational measures for data protection. In addition, we may transmit your personal data to bodies such as postal and delivery services, house bank, tax advisor/auditor or the financial administration. For the purpose of infection control, data may be transferred to the responsible public health department. Further recipients may result from the following information. 

5. Data transfer to third countries

Visiting our website may involve the transfer of certain personal data to third countries, i.e. countries in which the GDPR is not applicable law. Such a transfer takes place in a permissible manner if the European Commission has determined that an adequate level of data protection is required in such a third country. If such an adequacy decision by the European Commission does not exist, a transfer of personal data to a third country will only take place if appropriate safeguards are in place in accordance with Article 46 of the GDPR or if one of the conditions of Article 49 of the GDPR is met.

Unless otherwise stated below, we use the EU standard contractual clauses for the transfer of personal data to processors in third countries as suitable safeguards: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32010D0087.

If you consent to the transfer of personal data to third countries, the transfer will take place on the legal basis of Art. 49(1)(a) DSGVO.

6. Processing in the exercise of your rights

If you exercise your rights in accordance with Articles 15 to 22 of the GDPR, we will process the personal data provided for the purpose of implementing these rights by us and to be able to provide evidence thereof. We will only process data stored for the purpose of providing information and preparing it for this purpose and for data protection control purposes and otherwise restrict processing in accordance with Art. 18 DSGVO. 

These processing operations are based on the legal basis of Art. 6 para. 1 lit. c DSGVO in conjunction with. Art. 15 to 22 DSGVO and Section 34 (2) BDSG.

7. Your rights

As a data subject, you have the right to assert your data subject rights against us. In particular, you have the following rights:

  • In accordance with Art. 15 DSGVO and § 34 BDSG, you have the right to request information about whether and, if so, to what extent we are processing personal data relating to you or not.

  • You have the right to demand that we correct your data in accordance with Art 16 DSGVO.

  • You have the right to demand that we delete your personal data in accordance with Art 17 DSGVO and § 35 BDSG.

  • You have the right to have the processing of your personal data restricted in accordance with Art. 18 DSGVO.

  • You have the right, in accordance with Art. 20 DSGVO, to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format and to transfer this data to another controller.

  • If you have given us separate consent to data processing, you may revoke this consent at any time in accordance with Art. 7 (3) DSGVO. Such a revocation does not affect the lawfulness of the processing that was carried out on the basis of the consent until the revocation.

  • If you believe that a processing of personal data concerning you violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.

8. Right of objection

In accordance with Art. 21 (1) DSGVO, you have the right to object to processing based on the legal basis of Art. 6 (1) (e) or (f) DSGVO on grounds relating to your particular situation. If we process personal data about you for the purpose of direct marketing, you may object to such processing pursuant to Article 21 (2) and (3) of the GDPR.

9. Data Protection Officer

You can reach our data protection officer at the following contact details:

E-Mail: datenschutz@urbyo.com

Herting Oberbeck Datenschutz GmbH
Hallerstr. 76, 20146 Hamburg
https://www.datenschutzkanzlei.de    

II. Data processing on our website

When you use the website, we collect information that you provide yourself. In addition, during your visit to the website, certain information about your use of the website is automatically collected by us. In data protection law, the IP address is also generally considered to be a personal data. An IP address is assigned to every device connected to the Internet by the Internet provider so that it can send and receive data.

1. Server log files processing

During the purely informative use of our website, general information that your browser transmits to our server is initially stored automatically (i.e. not via registration). This includes by default: browser type/version, operating system used, requested page, the previously visited page (referrer URL), IP address, date and time of the server request and HTTP status code. The processing is carried out to protect our legitimate interests and is based on the legal basis of Art. 6 (1) f DSGVO. This processing serves the technical administration and security of the website. The stored data is deleted after seven days, unless there is a justified suspicion of unlawful use based on concrete indications and further examination and processing of the information is necessary for this reason. We are not able to identify you as a data subject on the basis of the stored information. Articles 15 to 22 of the GDPR therefore do not apply pursuant to Article 11 (2) of the GDPR, unless you provide additional information that enables us to identify you in order to exercise your rights set out in these articles.

2. Cookies

We use cookies and similar technologies ("cookies") on our website. Cookies are small data sets that are stored by your browser when you visit a website. This identifies the browser used and can be recognized by web servers. You have full control over the use of cookies through your browser. You can delete the cookies in the security settings of your browser at any time. You can object to the use of cookies through your browser settings in principle or for specific cases. 

The use of cookies is partly technically necessary for the operation of our website and thus permissible without the consent of the user. In addition, we may use cookies to offer special features and content and for analysis and marketing purposes. These may also include cookies from third-party providers (so-called third party cookies). We only use such technically unnecessary cookies with your consent pursuant to Art. 6 (1) a DSGVO. You can find information about the purposes, providers, technologies used, stored data and the storage period of individual cookies in the cookie settings of our Consent Management Tool. 

3. Consent Management Tool

We use the Usercentrics consent management platform on our website. Usercentrics is a product of the company Usercentrics GmbH (Germany). It enables users of our website to give consent to certain data processing processes or to revoke consent they have given. In addition, Usercentrics helps us to provide proof of the declaration of consent. For this purpose, Usercentrics processes information about the declaration of consent and further log data about this declaration. Cookies are also used to collect this data. The collected IP address is only processed in anonymized form. So that we can meet our obligation to provide proof, the certificate of revocation of a previously given consent is kept for three years. The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis arises from our legal obligation to document your consent (Art. 6 para. 1 lit. c) in conjunction with. Art. 7 para. 1 DSGVO).

4. Sentry

Our website uses the Sentry service of Functional Software Inc. (USA). Sentry is used to monitor system stability and detect code errors in order to improve the website. Information about the device or the time of the error is collected pseudonymously and then deleted. There is no evaluation for advertising purposes. Further information on Sentry's data protection can be found on the following website: https://sentry.io/privacy/. The legal basis for data processing in connection with the use of this service is Art. 6 (1) f DSGVO and the processing serves our legitimate interest in optimizing our website.
 
In the case of Sentry, a transfer of data to the USA cannot be ruled out. Please note the information in the section "Data transfer to third countries". 

5. Urbyo-Platform

If you want to use our platform to buy, market and manage real estate, you must first register on our website. To activate your customer account, we need your email address for verification. We will then send you an opt-in email to the email address provided to us, which will contain a link for confirmation. For more information, please refer to the Terms of Use.

The data you provide on our platform is processed for the purpose of service provision. Service provision includes, among other things, the publication of real estate offers, the provision of communication services, the obtaining of financing offers and the handling of purchase processes. The processing is based on the legal basis of Art. 6 para. 1 letter b DSGVO.

6. Newsletter

a. Registration and deregistration

We offer on our website the possibility to register for our newsletter. After registration we will inform you regularly about the latest news on our offers. A valid e-mail address is required to register for the newsletter. To verify the e-mail address, you will first receive a registration e-mail, which you must confirm via a link (double opt-in). If you subscribe to the newsletter on our website, we process personal data such as your e-mail address and name based on the consent you have given. The processing is based on the legal basis of Art. 6 (1) a DSGVO. You can revoke the consent given at any time with effect for the future, for example via the "unsubscribe" link in the newsletter or by contacting us via the channels mentioned above. The legality of the data processing operations already carried out remains unaffected by the revocation. When registering for the newsletter, we also store the IP address and the date and time of registration. The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis results from our legal obligation to document your consent (Art. 6 para. 1 letter c in conjunction with Art. 7 para. 1 DSGVO).

b. Analyse

We also analyze the reading behavior and opening rates of our newsletter. For this purpose, we collect and process pseudonymized usage data that we do not merge with your email address or your IP address. The legal basis for the analysis of our newsletter is Art. 6 para. 1 lit. f DSGVO and the processing serves our legitimate interest in optimizing our newsletter. You can object to this at any time by contacting one of the above mentioned contact channels.

c. Service provider

For the management of subscribers, the dispatch of the newsletter and the analysis, we use the service "HubSpot" of HubSpot Germany GmbH (Germany). Your email address is therefore transmitted by us to HubSpot. The processing is carried out on our behalf and is based on the legal basis of Art. 6 lit. f DSGVO and serves our legitimate interest in optimizing and economically sending our newsletter. The newsletter service offers statistical analysis options of usage data. This includes, among other things, information on whether an email has reached the recipient or whether it was rejected by the server.

In the case of HubSpot services, the transmission of data to HubSpot Inc. in the USA cannot be ruled out. Please note the information in the section "Data transfer to third countries".

7. Google Tag Manager

We use the Google Tag Manager of Google Ireland Limited (Ireland/EU). The Google Tag Manager is used to manage our website tags via an interface. The Google Tag Manager is a cookie-less domain that does not collect or store any personal data. The Google Tag Manager merely triggers other tags, which in turn may collect data without accessing that data themselves. If a deactivation has been made at the domain or cookie level (e.g. via the Consent Management Tool), this remains in place for all tracking tags implemented with the Google Tag Manager.

8. Analysis of our website

a. Google Analytics

We use the Google Analytics service of the provider Google Ireland Limited (Google Ireland/EU) on our website.

Google Analytics is a web analytics service that allows us to collect and analyze data about the behavior of visitors to our website. Google Analytics uses cookies for this purpose, which enable an analysis of the use of our website. This involves processing personal data in the form of online identifiers (including cookie identifiers), IP addresses, device identifiers and information about interaction with our website.

In part, this data is information stored in the terminal device you are using. In addition, further information is also stored on your used end device via the cookies used. Such storage of information by Google Analytics or access to information already stored in your end device will only take place with your consent.

Google Ireland will process the data thus collected on our behalf in order to evaluate the use of our website by the users, to compile reports on the activities within our website and to provide us with further services related to the use of our website and the Internet. In doing so, pseudonymous usage profiles of the users can be created from the processed data.

The setting of cookies and the further processing of personal data described here takes place with your consent. The legal basis for the data processing in connection with the Google Analytics service is therefore Art. 6 (1) a DSGVO. You can revoke this consent at any time with effect for the future.

The personal data processed on our behalf to provide Google Analytics may be transferred to any country in which Google Ireland or Google Ireland's sub-processors maintain facilities. The legal basis for this transfer is the standard contractual clauses for the transfer of personal data to processors in third countries pursuant to Art. 46 para. 2 lit. c DSGVO.

We only use Google Analytics with IP anonymization enabled. This means that the IP address of the user is shortened by Google Ireland within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. The IP address transmitted by the user's browser is not merged with other data. 

We use the Google Analytics 4 variant, which allows us to track interaction data from different devices and from different sessions. This allows us to put individual user actions in context and analyze long-term relationships.

Data about user actions is stored for a period of 14 months and then automatically deleted. All other event data is stored for 2 months and then automatically deleted. In this regard, the deletion of data whose storage period has expired takes place automatically once a month.

We also use the Google Analytics advertising functions (remarketing). This function enables us, in conjunction with Google's cross-device functions, to display advertisements in a more targeted manner and to present users with ads that are tailored to their interests. Via remarketing, users are shown ads and products for which interest has been identified on other websites in the Google network. The function allows us to link advertising target groups created via Google Analytics Remarketing with the cross-device functions of Google Ads. In this way, interest-based, personalized advertising messages that have been adapted to a user depending on previous usage and surfing behavior on one end device (e.g. cell phone) can also be displayed on another end device of the user (e.g. tablet or PC). 

If you have given your consent, Google will link your web and app browsing history with your Google Account for this purpose. In this way, the same personalized advertising messages can be served on every end device on which you log in with your Google account. The aggregation of the collected data in your Google account is based solely on your consent, which you can give or revoke at Google. For these linked services, data is then collected via Google Analytics for advertising purposes. To support the remarketing function, Google Analytics collects users' google-authenticated IDs, which are temporarily linked to our Google Analytics data. This is used to define and create target groups for cross-device ad advertising.

You can also prevent the collection of information generated by the cookie by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout. If you visit our website via a mobile device, you can deactivate Google Analytics by clicking on this link.
 
You can permanently object to cross-device remarketing/targeting by deactivating personalized advertising in your Google account; follow this link: https://www.google.com/settings/ads/onweb/ 

For further information on the use of data for advertising purposes, please refer to Google's privacy policy at: www.google.com/policies/technologies/ads/

b. Hubspot Analytics

To analyze visits to our website, we use HubSpot, a service provided by HubSpot Germany GmbH (Germany). HubSpot uses cookies and similar technologies that enable an analysis of your use of our website. In the process, personal data in the form of online identifiers (including cookie identifiers), IP addresses and device identifiers are processed. HubSpot will use this information on our behalf to evaluate the use of our online offer by users and to compile reports for us on the activities within our website. In doing so, usage profiles of the users can be created from the processed data.

Further information on this processing activity, the technologies used, stored data and the storage period can be found in the settings of our Consent Management Tool.
The setting of cookies and the further processing of personal data described here only takes place with your consent. The legal basis for data processing in connection with the HubSpot service is therefore Art. 6 (1) a DSGVO.
 
In the case of HubSpot services, a transfer of data to HubSpot Inc. in the USA cannot be ruled out. Please note the information in the section "Data transfer to third countries".

c. Hotjar

We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behavior and their devices. This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf.

For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.

d. Launch Darkly

As part of website operations, we use a tool called Launch Darkly, by Catamorphic Co, 405 14th Street Oakland, CA 94612, USA. Launch Darkly performs crash reporting in relation to website features created by Urbyo. Regarding the categories of personal data, it is about usage data. This concerns website users, interested parties or visitors to this website. The tracker "insitez.blob.core.windows.net" belongs to Launch Darkly. This tracker is used by Launch Darkly for quality assurance and troubleshooting purposes. The legal basis of the data processing is based on Art. 6 para. 1 lit. f DSGVO and the interest of maintaining, quality assurance and troubleshooting of the website.

For more information, please see Catamorphic (Launch Darkly) privacy policy.

9. Tracking & Retargeting

a. Google Ads

We use the online advertising program Google Ads of Google Ireland Limited (Ireland/EU), through which we place advertisements on the Google search engine. When you access our website via a Google ad, Google sets a cookie on your end device ("conversion cookie"). In the process, a different conversion cookie is assigned to each Google Ads customer, so that the cookies are not tracked across the websites of different Ads customers. The information obtained with the help of the cookie is used to create conversion statistics. Thus, we learn the total number of users who clicked on one of our Google ads. However, we do not receive any information with which users can be personally identified.
 
For more information about these processing activities, the technologies used, stored data and the storage period, please refer to the settings of our Consent Management Tool. Processing is only carried out with your consent pursuant to Art. 6 (1) a DSGVO. You can revoke your consent via our Consent Management Tool. 

b. Microsoft Advertising

We use the Microsoft Advertising service of the provider Microsoft Ireland Operations Limited (Ireland/EU) (formerly Bing Ads) on our website. Microsoft Advertising is an online marketing service that uses the Universal Event Tracking (UET) tool to help us display targeted advertisements via the Microsoft Bing search engines. Microsoft Advertising uses cookies for this purpose. This involves processing personal data in the form of online identifiers (including cookie identifiers), IP addresses, device identifiers, and information about device and browser settings. 

Microsoft Advertising collects data via UET that allows us to track target groups thanks to remarketing lists. For this purpose, a cookie is stored on the end device used when visiting our website. Microsoft Advertising can thus recognize that our website has been visited and play an ad when Microsoft Bing or Yahoo is used at a later time. 

The information is also used to create conversion statistics, i.e. to record how many users have reached our website after clicking on an advertisement. We thereby learn the total number of users who clicked on our ad and were redirected to our website. However, we do not receive any information that personally identifies users.

Microsoft Advertising is used for the purpose of optimizing the placement of advertisements. For more information about these processing activities, the technologies used, data stored and the storage period, please refer to the settings of our Consent Management Tool. Processing is only carried out with your consent pursuant to Art. 6 (1) a DSGVO. You can revoke your consent via our Consent Management Tool. 

In the case of Microsoft services, a transfer of data to Microsoft Corp. in the USA cannot be ruled out. Please note the information in the section "Data transfer to third countries". For more information on data protection at Microsoft, please refer to Microsoft's privacy policy at https://privacy.microsoft.com/de-de/privacystatement.

c. Facebook-Pixel

We use the Facebook Pixel on our website, a Facebook business tool from Meta Platforms Ireland Limited (Ireland, EU). For information on Meta Platforms Ireland's contact details and the contact details of Meta Platforms Ireland's data protection officer, please see Meta Platforms Ireland's data policy at https://www.facebook.com/about/privacy. 

The Facebook pixel is a JavaScript code snippet that allows us to track visitors' activity on our website. This tracking is called conversion tracking. The Facebook pixel collects and processes the following information (so-called event data) for this purpose:

  • Information about actions and activities of visitors to our website, such as searching for and viewing a product or purchasing a product;

  • Specific pixel information such as the pixel ID and the Facebook cookie;

  • Information about buttons clicked by visitors to the website;

  • Information present in HTTP headers, such as IP addresses, web browser information, page location, and referrer;

  • Information about the status of disabling/restricting ad tracking.

Some of this event data is information that is stored in the device you are using. In addition, cookies are also used via the Facebook pixel, via which information is stored on your end device used. Such storage of information by the Facebook pixel or access to information that is already stored in your end device only takes place with your consent.

Tracked conversions appear in the dashboard of our Facebook Ads Manager and Facebook Analytics. We can use the tracked conversions there to measure the effectiveness of our ads, set Custom Audiences for ad targeting, Dynamic Ads campaigns, and analyze the effectiveness of our website's conversion funnels. The features we use via the Facebook Pixel are described in more detail below.

Processing of event data for advertising purposes

The event data collected via the Facebook pixel is used for targeting our ads and improving ad delivery, personalizing features and content, and improving and securing Facebook products.

For this purpose, event data is collected on our website by means of the Facebook pixel and transmitted to Meta Platforms Ireland. This only takes place if you have previously given your consent to this. The legal basis for the collection and transmission of personal data by us to Facebook Ireland is therefore Art. 6 (1) a DSGVO.

This collection and transmission of event data is carried out by us and Facebook Ireland as joint controllers. We have entered into a joint controller processing agreement with Facebook Ireland, which sets out the distribution of data protection obligations between us and Facebook Ireland. In this agreement, we and Facebook Ireland have agreed, among other things, that we are responsible for providing you with all information pursuant to Art. 13, 14 DSGVO about the joint processing of personal data;
that Facebook Ireland is responsible for enabling data subjects' rights under Art. 15 to 20 of the GDPR with respect to personal data stored by Facebook Ireland after the joint processing.

You can access the agreement concluded between us and Facebook Ireland at https://www.facebook.com/legal/controller_addendum.

Meta Platforms Ireland is the sole controller for the subsequent processing of the transmitted event data. For more information about how Meta Platforms Ireland processes personal data, including the legal basis on which Meta Platforms Ireland relies and how you can exercise your rights against Meta Platforms Ireland, please see Meta Platforms Ireland's Data Policy at https://www.facebook.com/about/privacy. 

We have also commissioned Meta Platforms Ireland to prepare reports on the impact of our advertising campaigns and other online content based on the Event Data collected via the Facebook Pixel (Campaign Reports) and to create analyses and insights about users and their use of our website, products and services (Analytics). We transfer personal data contained in the Event Data to Meta Platforms Ireland for this purpose. The submitted personal data is processed by Meta Platforms Ireland as our processor to provide us with the campaign reports and analytics.

Personal data will only be processed to provide analytics and campaign reports if you have given your prior consent to do so. The legal basis for this processing of personal data is therefore Art. 6 (1) a DSGVO.

A transfer of data to Meta Platforms Inc. in the USA cannot be excluded. The legal basis for this transfer is the standard contractual clauses for the transfer of personal data to processors in third countries. Please note the information in the section "Data transfer to third countries". 

10. External media

a. YouTube

We use the YouTube service of Google Ireland Limited (Ireland/EU) on our website to integrate videos. For such an integration, a processing of your IP address is technically necessary so that the content can be sent to your browser. Your IP address is therefore transmitted to Google and Google may set its own cookies. We use YouTube in "extended data protection mode" so that no cookies are set by YouTube to analyze user behavior. 

Further information on these processing activities, the technologies used, stored data and the storage period can be found in the settings of our Consent Management Tool. YouTube is only used with your consent pursuant to Art. 6 (1) a DSGVO. 

With YouTube, a transmission of data to Google Inc. and YouTube LLC in the USA cannot be excluded. Please note the information in the section "Data transfer to third countries". Users can find further information on data protection at Google in Google's privacy policy at https://www.google.com/policies/privacy.

b. Google Maps

We use Google Maps of Google Ireland Limited (Ireland/EU) on our website to display maps and for virtual tours. For such an integration, a processing of your IP address is technically necessary so that the content can be sent to your browser. Your IP address is therefore transmitted to Google and Google may set its own cookies. 

You can find more information about these processing activities, the technologies used, stored data and the storage period in the settings of our Consent Management Tool. Google Maps is only used with your consent pursuant to Art. 6 (1) a DSGVO.

In the case of Google services, the transmission of data to Google Inc. in the USA cannot be ruled out. Please also note the information in the section "Data transfer to third countries". Further information on data protection at Google can be found in Google's privacy policy at https://www.google.com/policies/privacy.

III. Datenverarbeitungen auf unseren Social-Media-Seiten

We are represented on several social media platforms with a company page. Through this, we would like to offer further opportunities for information about our company and for exchange. Our company has company pages on the following social media platforms:

  • Facebook

  • Instagram

  • LinkedIn

  • YouTube

When you visit or interact with a profile on a social media platform, personal data about you may be processed. The information associated with a social media profile used also regularly constitutes personal data. This also covers messages and statements made while using the profile. In addition, during your visit to a social media profile, certain information about it is often automatically collected, which may also constitute personal data.

1. Visit a social media page

a. Facebook and Instagram page

When you visit our Facebook or Instagram page, through which we present our company or individual products from our range, certain information about you is processed. The sole controller of this processing of personal data is Meta Platforms Ireland Ltd (Ireland/EU - "Meta" or "Facebook"). For more information about the processing of personal data by Facebook, please visit https://www.facebook.com/privacy/explanation. Facebook offers the option to object to certain data processing; information and opt-out options in this regard can be found at https://www.facebook.com/settings?tab=ads. 

Meta provides us with anonymized statistics and insights for our Facebook and Instagram pages that help us gain insights about the types of actions people take on our page (called "Page Insights"). These page insights are created based on certain information about individuals who have visited our page. This processing of personal data is carried out by Facebook and us as joint controllers. The processing serves our legitimate interest in evaluating the types of actions taken on our site and improving our site based on these insights. The legal basis for this processing is Art. 6 (1) (f) DSGVO. We cannot associate the information obtained via Page Insights with individual user profiles interacting with our Facebook and Instagram page. We have entered into a joint controller agreement with Meta, which sets out the distribution of data protection obligations between us and Meta. For details about the processing of personal data to create Page Insights and the agreement entered into between us and Meta, please visit https://www.facebook.com/legal/terms/information_about_page_insights_data. In relation to these data processing operations, you have the option of asserting your data subject rights (see "Your rights" in this regard) against Meta as well. Further information on this can be found in Meta's privacy policy at https://www.facebook.com/privacy/explanation.

Please note that according to the Meta Privacy Policy, user data is also processed in the USA or other third countries. Meta only transfers user data to countries for which an adequacy decision has been issued by the European Commission in accordance with Art. 45 of the GDPR or on the basis of appropriate safeguards in accordance with Art. 46 of the GDPR.

b. LinkedIn Company Page

LinkedIn Ireland Unlimited Company (Ireland/EU - "LinkedIn") is the sole responsible party for the processing of personal data when you visit our LinkedIn page. Further information about the processing of personal data by LinkedIn can be found at https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy.

When you visit, follow or engage with our LinkedIn company page, LinkedIn processes personal data to provide us with anonymized statistics and insights. This provides us with insights into the types of actions that people take on our page (so-called page insights). For this purpose, LinkedIn processes in particular such data that you have already provided to LinkedIn via the information in your profile, such as data on function, country, industry, seniority, company size and employment status. In addition, LinkedIn will process information about how you interact with our LinkedIn company page, such as whether you are a follower of our LinkedIn company page. With the page insights, LinkedIn does not provide us with any personal data about you. We only have access to the aggregated Page Insights. It is also not possible for us to draw conclusions about individual members via the information in the Page Insights. This processing of personal data in the context of the Page Insights is carried out by LinkedIn and us as joint controllers. The processing serves our legitimate interest to evaluate the types of actions taken on our LinkedIn company page and to improve our company page based on these insights. The legal basis for this processing is Article 6(1)(f) DSGVO. We have entered into a joint controller agreement with LinkedIn, which sets out the distribution of data protection obligations between us and LinkedIn. The agreement is available at: https://legal.linkedin.com/pages-joint-controller-addendum. Accordingly, the following applies:

LinkedIn and we have agreed that LinkedIn is responsible for enabling you to exercise your rights under the GDPR. You can contact LinkedIn to do so online via the following link (https://www.linkedin.com/help/linkedin/ask/PPQ?lang=de) or reach LinkedIn via the contact details in the Privacy Policy. You can contact the Data Protection Officer at LinkedIn Ireland via the following link: https://www.linkedin.com/help/linkedin/ask/TSO-DPO. You may contact us at our provided contact details about exercising your
rights in connection with the processing of personal data within the framework of the
Page Insights, you may also contact us. In such a case, we will forward your
forward your request to LinkedIn.

  • LinkedIn and we have agreed that the Irish Data Protection Commission is the lead supervisory authority overseeing processing for Page Insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see at www.dataprotection.ie) or any other supervisory authority.

    Please note that according to the LinkedIn Privacy Policy, personal data is also processed by LinkedIn in the US or other third countries. LinkedIn transfers personal data only to countries for which an adequacy decision has been issued by the European Commission according to Article 45 of the GDPR or on the basis of appropriate safeguards according to Article 46 of the GDPR. 

c. YouTube

Google Ireland Limited (Ireland/EU) is the sole responsible party for the processing of personal data when visiting our YouTube channel. Further information about the processing of personal data by YouTube and Google Ireland Limited can be found at https://policies.google.com/privacy.
 
2. Comments and direct messages

We also process information that you have provided to us via our company page on the respective social media platform. Such information may be the username used, contact details or a message to us. These processing operations by us are carried out as the sole responsible party. We process this data on the basis of our legitimate interest in contacting inquiring persons. The legal basis for the data processing is Art. 6 para. 1 letter f DSGVO. Further data processing may take place if you have consented (Art. 6 para. 1 letter a DSGVO) or if this is necessary for the fulfillment of a legal obligation (Art. 6 para. 1 letter c DSGVO).

IV. Other data processing

1. Contact via E-Mail

If you send us a message via the contact email provided, we will process the transmitted data for the purpose of responding to your inquiry. We process this data based on our legitimate interest to get in touch with inquiring persons. The legal basis for the data processing is Art. 6 para. 1 letter f DSGVO.

2. Customer and prospect data

If you contact our company as a customer or interested party, we process your data to the extent necessary to establish or implement the contractual relationship. This regularly includes the processing of personal master, contract and payment data provided to us as well as contact and communication data of our contact persons at commercial customers and business partners. The legal basis for this processing is Art. 6 (1) (b) DSGVO if you contact us as an end customer and Art. 6 (1) (f) if you contact us as the contact person of a commercial customer. We also process customer and prospective customer data for evaluation and marketing purposes. These processing operations are carried out on the legal basis of Art. 6 (1) (f) DSGVO and serve our interest to further develop our offer and to inform you specifically about our offers. Further data processing may take place if you have consented (Art. 6 para. 1 letter a DSGVO) or if this is necessary for the fulfillment of a legal obligation (Art. 6 para. 1 letter c DSGVO).

3. Use of your e-mail address for marketing purposes

We may use the email address you provided during registration to inform you about our own similar products and services offered by us. The legal basis is Art. 6 para. 1 lit. f DSGVO in conjunction with. § Section 7 (3) UWG. You can object to this at any time without incurring any costs other than the transmission costs according to the prime rates. To do so, you can unsubscribe by clicking on the unsubscribe link contained in each mailing or by sending an e-mail to support@urbyo.com.

4. Applications

If you apply to our company, we process your application data exclusively for purposes related to your interest in current or future employment with us and the processing of your application. Your application will only be processed and noted by the relevant contacts at our company. All employees entrusted with data processing are obliged to maintain the confidentiality of your data. If we are unable to offer you employment, we will retain the data you have provided for up to six months after any rejection for the purpose of answering questions relating to your application and rejection. This does not apply if legal provisions prevent deletion, if further storage is necessary for the purpose of providing evidence, or if you have expressly consented to longer storage. The legal basis for data processing is Section 26 (1) sentence 1 BDSG. If we store your applicant data beyond a period of six months and you have expressly consented to this, we would like to point out that this consent can be freely revoked at any time in accordance with Article 7 (3) DSGVO. Such revocation shall not affect the lawfulness of the processing that was carried out on the basis of the consent until the revocation.

5. Heyflow

We use forms from Heyflow in various places. The provider is Heyflow GmbH, Jungfernstieg 49, 20354 Hamburg (hereinafter referred to as HeyFlow). All requests are processed in HeyFlow's systems on our behalf. We have concluded an order processing contract with HeyFlow. This contract ensures that HeyFlow processes the data in a DSGVO-compliant manner and exclusively based on our instructions. For further details, please refer to HeyFlow's privacy policy at https://heyflow.app/de/datenschutz.
The processing of this data with the help of HeyFlow is based on our legitimate interest in a most interactive and user-friendly communication with users (Art. 6 para. 1 lit. f DSGVO).
The data you enter will remain with us until you request us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies. Mandatory legal provisions - in particular retention periods - remain unaffected.

6. Data processing when using WhatsApp

When registering, you can indicate that we may contact you via WhatsApp to provide further information about our services. In this case, we will process the phone number you use and the other information you provide in order to answer questions or make an appointment with you. This data processing is based on Art. 6 para. 1 letter b DSGVO.

We use the WhatsApp Business service, which is offered by WhatsApp Ireland Limited based in Ireland. WhatsApp acts as our order processor. You can view the associated agreement here: https://www.whatsapp.com/legal/business-data-processing-terms. When using WhatsApp Business, data may be transferred to WhatsApp LLC in the USA and to any other sub-processors of WhatsApp Ireland Limited. Please note the information in the section "Data processing in third countries".