Privacy Information
Our privacy information is structured as follows:
Contents
- General Information
- Supplementary Information on Data Processing on Our Website
- Strictly Necessary Data Processing for the Provision of the Website
- Additional Data Processing on the Website Subject to Consent
- Data Processing When Contacting Us, Placing an Order, or Using Features on the Website
- Categories of Recipients of Personal Data of Our Website Visitors and Third-Country Transfers
- Supplementary Information on Data Processing on Our Social Media Company Pages
For the sake of readability, the simultaneous use of masculine and feminine language forms has been omitted. All designations apply to all genders.
A. General Information
1. Controller
The controller responsible for the processing of personal data is:
Cumdente GmbH
Paul-Ehrlich-Straße 11
72076 Tübingen
Phone: 07071 - 975 57 21
Fax: 7071 - 975 57 22
E-Mail: info@cumdente.de
2. Data Protection Officer
You can reach our Data Protection Officer at:
Cumdente GmbH
Dr. med. dent. Esther Hahn
Paul-Ehrlich-Straße 11
72076 Tübingen
Phone: 07071 - 975 57 21
Fax: 7071 - 975 57 22
E-Mail: datenschutz@cumdente.de
3. Disclosure of Data to Third Parties
Your personal data will only be disclosed to third parties to the extent permitted by data protection law, in particular if you have consented to the disclosure (Art. 6(1)(1)(a) GDPR) or the disclosure is necessary for the purpose of contract performance (Art. 6(1)(1)(b) GDPR).
The relevant recipients and categories of recipients are listed in the respective supplementary information.
4. Retention Period
Personal data processed by us will be stored for as long as necessary for the respective purpose – in particular the processing of inquiries and orders as well as the maintenance of user accounts. After that, personal data will be deleted.
Storage beyond this period is possible if you have consented to it pursuant to Art. 6(1)(1)(a) GDPR or if we are legally obliged to retain the data (e.g. pursuant to the German Commercial Code and Tax Code: ten years for tax-relevant documents or six years for other business correspondence) (Art. 6(1)(1)(c) GDPR).
5. Your Rights
5.1 Disabling and Deleting Cookies
When you visit our website, cookies may be stored on your device. You can disable the storage of cookies on your device in your browser settings. You can also delete cookies that have already been stored at any time via your browser settings. However, in this case you may not be able to use all functions of our website to their full extent.
5.2 Right of Withdrawal
Some of the processing operations described in this privacy information are carried out on the basis of your consent. You can withdraw your consent to the performance of these processing operations at any time with effect for the future. You can exercise your withdrawal from data processing by services on our website via the Consent Management Tool ("CMT"). This also allows you to consent to individual data processing operations again. You can open the CMT at any time via the "Cookie Settings" link in the footer of the website. In all other cases, you can withdraw your consent by contacting us using the contact details provided above.
5.3 Right to Object
You may object at any time to the use of personal data for direct marketing purposes; you may also object at any time, with effect for the future, to the use of personal data on the basis of Art. 6(1)(e) or (f) GDPR for reasons arising from your particular situation. The only costs incurred for the objection are the transmission costs at the basic rates.
5.4 Right to Access, Rectification, Erasure or Restriction and Portability
Subject to the conditions of Art. 15 to 20 GDPR, you have the right to obtain free information about the data stored about you, to have incorrect data corrected, and to request the erasure or restriction of processing as well as the portability of your personal data. In some cases, however, we may not be able to completely delete user data due to statutory retention obligations.
5.5 Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes data protection law.
B. Supplementary Information on Data Processing on Our Website
In addition to our General Information (please refer to section A), we inform you here about how personal data is collected on our website and for what purposes it is processed and on what legal basis.
I. Strictly Necessary Data Processing for the Provision of the Website
In some cases, data processing is strictly necessary in order to provide our service with as few technical or functional restrictions as possible and in accordance with legal requirements. Data processing takes place in these cases even if you have rejected any additional data processing via the Consent Management Tool ("CMT").
1. Accessing Our Web Pages and Server Log Files
In order to retrieve the content of our web pages and display it correctly on your device, your browser automatically sends data requests to our servers. Each data request from your browser includes, among other things, the following information: (dynamic) IP address, browser type and version, operating system and version, accessed domain, previously visited website, and the date and time of access. Your browser's data requests are automatically stored in so-called "server log files".
The described data processing is strictly necessary to ensure that our web pages can be accessed and displayed correctly on your device. In addition, log files can be used to identify cyberattacks and thereby ensure the accessibility of our web pages (Art. 6(1)(1)(b) GDPR).
2. Consent Management Tool
We have integrated a Consent Management Tool ("CMT") to obtain and document your consent to data processing by various services.
When you open our website, you can submit declarations of consent for individual data processing operations via the CMT, which are stored by the CMT.
For this purpose, the CMT stores cookies – small text files – on your device. These are the following cookies:
This allows us to track, when the website is reopened, which data processing by which services you have or have not consented to. This means you do not have to re-enter your consent preferences for individual data processing operations every time you visit. The storage of the listed cookies on your device is strictly necessary for this purpose (§ 25(2)(2) TTDSG).
Of course, you can open the CMT at any time via the "Cookie Settings" link in the footer of the website. This makes it easy to withdraw a consent that has already been granted.
3. Cookies for the Provision of the Website
When you open our website, cookies – small text files – may be stored on your device. These are the following cookies:
Storing these cookies on your device is strictly necessary for the provision of our website (§ 25(2)(2) TTDSG).
II. Additional Data Processing on the Website Subject to Consent
We have integrated the services listed below on our website for various purposes. Data processing by these services only takes place to the extent that you have consented via the Consent Management Tool ("CMT"). You can withdraw a consent you have already given at any time via the CMT. Please also refer to section A.I.5.2.
1. Google Services
Our website integrates services provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland ("Google").
1.1 General Information on Google Services, Legal Basis
To provide the services, Google accesses information stored on your device. Google may also store information and in particular cookies on your device to provide the services. Details can be found below for each respective service. The legal basis for accessing information and storing information and cookies is your consent (§ 25(1)(1) TTDSG).
Google processes the information on the one hand to provide the services. On the other hand, Google states that it processes the information to continuously improve and further develop its services. The legal basis for the processing of personal data for these purposes is your consent (Art. 6(1)(1)(a) GDPR).
It cannot be excluded that data collected by Google services is also transferred to a Google server in a third country, in particular to a server of Google's parent company, Google LLC, headquartered at 1600 Amphitheatre Parkway, Mountain View, California, USA, and stored there. To safeguard the third-country transfer, we have agreed on EU standard contractual clauses with Google. Google states that it ensures compliance with the data protection agreements. Nevertheless, a transfer of personal data to the USA is associated with particular risks for data subjects. The integration of and data processing by Google services therefore only takes place with your express consent. Further information on the third-country transfer can be found in section IV.2.
If you are logged into your Google account, Google may, depending on your account settings, add processed information to your account and treat it as personal data; see in particular https://www.google.de/policies/privacy/partners. We have no knowledge of the data collected in this way or its use.
Further information on data processing by Google can be found at:
- https://policies.google.com/privacy ("Google Privacy Policy")
- https://www.google.com/intl/de/policies/privacy/partners ("How Google uses data when you use our partners' sites or apps")
- http://www.google.com/policies/technologies/ads ("Use of data for advertising purposes")
1.2 Google Tag Manager
Our website integrates the Google Tag Manager (GTM) service to load additional services. Due to this technical implementation, Google learns when a web page is accessed that the page was visited from the IP address of your device. Google can also track which functions and tools are loaded via the GTM.
You have the option to disable the service and thus prevent the transfer of data to the provider by disabling JavaScript in your browser settings. However, please note that in this case you will not be able to use all functions of the website.
Further information on data processing by the GTM can be found at:
1.3 Google Analytics
Our website integrates the Google Analytics service. The service performs a cross-website analysis of your browsing behaviour. For this purpose, the service stores cookies – small text files – on your device. These are the following cookies:
On our behalf, Google processes the collected data in order to provide us with pseudonymous profiles of individual visitors and general statistics on the use of our website. We use this information to improve our offering and make it more interesting for you as a user.
We use the "Google Optimize" function of Google Analytics. Google Optimize analyses the use of different versions of our website (so-called "A/B tests") and thereby helps us to improve usability in line with the behaviour of our users on the website.
We use the "demographic characteristics" function of Google Analytics. By analysing your browsing behaviour, Google can make statistical statements about the demographic characteristics and interests (e.g. age, gender, affinity categories, in-market audience segments) of visitors to our website. However, we cannot assign this data to any specific person. We use the demographic information to improve our offering and make it more interesting for you as a user. Further information on data processing by "demographic characteristics" in Google Analytics can be found at: https://support.google.com/analytics/answer/2799357?hl=de.
IP anonymisation has been activated on this website, so your IP address is truncated by Google Analytics before storage. According to Google, the full IP address is only transmitted to a Google LLC server in the USA in exceptional cases and truncated there. According to Google, the truncated IP address transmitted by your browser within the scope of Google Analytics is not merged with other Google data.
You can download and install a plug-in for your browser to disable Google Analytics across websites at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
Further information on data processing by Google Analytics can be found at: https://support.google.com/analytics/answer/6004245?hl=de%20.
1.4 Google Ads and Google Ads Remarketing
Our website integrates the Google Ads and Google Ads Remarketing services in order to draw attention to our offerings in Google search results and on third-party websites.
We want to display only ads that are relevant to you. For this purpose, Google analyses in particular device information, your location, and your browsing behaviour on our website. For this purpose, the service stores cookies – small text files – on your device:
These are the following cookies:
If you click on an ad placed by Google for us in the Google search results or on a third-party website, cookies for so-called conversion tracking (visit action evaluation) are stored on your device. These cookies have a limited validity period. If you then visit certain pages of our website while the cookies have not yet expired, Google can recognise that you clicked on our ad and were redirected to our website. This allows Google to provide us with a statistical analysis of the effectiveness of our advertising measures. For this purpose, the service stores cookies – small text files – on your device:
These are the following cookies:
Google assumes joint responsibility for the described data processing and has therefore provided us with a corresponding agreement pursuant to Art. 26 GDPR in the course of the order process, which we have concluded with Google.
You can activate or deactivate personalised advertising from Google via the advertising settings at this link: https://adssettings.google.com/anonymous?sig=ACi0TCjoT_RnPbIUe8IGa85dyA_5J4bol6TV5SM7jVOJycoeZaGP6BA8RWwSWmRUP0XRoURUu0XBV15kNZzQKE4cntIuJx15vg&hl=de. These settings are saved (if you are logged in) in your Google account or (if you are not logged in) in the browser. Alternatively, you can install a plug-in for your browser at this link to disable personalised advertising: https://support.google.com/ads/answer/7395996?hl=de.
Further information on how Google Ads works and on data processing by Google Ads can be found at:
- https://ads.google.com
- https://ads.google.com/intl/de_de/home/faq/gdpr
- https://policies.google.com/technologies/ads
2. Meta Pixel
Our website integrates the Meta Pixel service (formerly: "Facebook Pixel"). The service is provided by Meta Platforms Ireland Limited (formerly: Facebook Ireland Limited), 4 Grand Canal Square, Dublin 2, Ireland ("Meta"). Data processing by the service only takes place after you have consented to it via the CMT.
When our web pages are accessed, a 1x1 pixel image file is automatically loaded from the provider's servers. The respective data request to load the image file discloses, among other things, the following information to the provider: (dynamic) IP address, browser type and version, operating system and version, accessed domain, previously visited website, and the date and time of access. The legal basis for the access to information stored on your device by the service is your consent (§ 25(1)(1) TTDSG).
We can place advertisements on Facebook to draw attention to our offerings. We want to display only ads that are relevant to you. For this purpose, the provider analyses your browsing behaviour on our website based on the collected information and provides us with the results. The legal basis for the further processing of the collected data is your consent (Art. 6(1)(1)(a) GDPR).
If an ad from us is displayed for you on Facebook and you click on it, you may be redirected to our website. In this case, a 1x1 pixel image file is again loaded from the provider's servers when our website loads. This again discloses the above-mentioned information to the provider. In this case too, the legal basis for the access to information stored on your device by the service is your consent (§ 25(1)(1) TTDSG).
Using the tracking pixel, the provider can track that you clicked on our ad and were redirected to our website. This allows the provider to give us a statistical analysis of the effectiveness of our advertising measures (so-called "conversion tracking"). The legal basis for conversion tracking is your consent (Art. 6(1)(1)(a) GDPR).
If you are logged into your profile on Facebook, Meta may add the collected data to your user profile. Meta may also use the collected data for its own advertising purposes in accordance with Meta's data use policy. The legal basis for this data processing is your consent (Art. 6(1)(1)(a) GDPR).
It cannot be excluded that data collected by the service is also transferred to a server of the provider in
a third country – in particular in the USA – and stored there. To safeguard the third-country transfer, we have agreed on EU standard contractual clauses with the provider. The provider states that it ensures compliance with the data protection agreements. Nevertheless, a transfer of personal data to the USA is associated with particular risks for data subjects. The integration of and data processing by the service therefore only takes place with your express consent. Further information on the third-country transfer can be found in section IV.2.
Users logged into Facebook can adjust their advertising preferences at: https://www.facebook.com/ads/preferences.
Further information on data processing by the service can be found at:
3. Trustpilot – Review Widget
We integrate review content from Trustpilot on our website to show you authentic customer reviews of our products and services.
If you have consented to the use of the corresponding technologies via our consent management, a connection to Trustpilot's servers is established when a page with an integrated Trustpilot widget is accessed. In particular, your IP address, browser information, and other technically necessary information may be transmitted to Trustpilot.
The legal basis for this is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via the cookie settings.
Further information can be found in Trustpilot's privacy notice:
https://de.legal.trustpilot.com/for-reviewers/end-user-privacy-terms
4. Trustami
We use a review widget provided by Trustami GmbH, Bamberger Straße 40, 10779 Berlin, Germany, on our website. The widget is used to display publicly accessible customer reviews and trust indicators from various review platforms (e.g. Amazon) in order to give you a transparent impression of other customers' experiences with our company.
The Trustami widget is only loaded after your consent via our consent management. When the widget is loaded, a connection is established to Trustami's servers. In particular, your IP address, browser information, and other technically necessary information may be transmitted to Trustami.
Processing is carried out on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via the cookie settings.
Further information on the processing of personal data by Trustami can be found at:
https://www.trustami.com/datenschutz/
III. Data Processing When Contacting Us, Placing an Order, or Using Features on the Website
Read here about what data is processed when you contact us or use features of the website.
1. Contact
We collect personal data that you enter in a contact form or transmit to us in the course of making contact. Where certain input fields are marked as "required fields", we use these fields to collect the data necessary for carrying out the requested measure. Of course, you may also provide us with additional data if you wish.
The processing of this data is based on Art. 6(1)(1)(b) GDPR, insofar as it is necessary for the performance of a measure requested by you. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Art. 6(1)(1)(f) GDPR).
2. Registration and Login
You can register a customer account with us. During registration, the data marked as "required fields" is collected. The "required fields" are used to collect the data necessary for the purpose of carrying out the user relationship established by the registration (Art. 6(1)(1)(b) GDPR). Of course, you may also provide us with additional data if you wish (Art. 6(1)(1)(a) GDPR). You can delete your personal user account at any time.
In order to technically enable access to password-protected areas, it is strictly necessary that the following cookies are stored on your device (§ 25(2)(2) TTDSG):
These are the following cookies:
3. Orders
You can place orders with us. During the ordering process, the data marked as "required fields" is collected. The "required fields" are used to collect the data required for processing the order (Art. 6(1)(1)(b) GDPR). Of course, you may also provide us with additional data if you wish (Art. 6(1)(1)(a) GDPR).
For a more convenient shopping experience in our online shop, you can also register or log in with us; please also refer to section D.2.
In order to technically enable the shopping cart function and the further ordering process, it is strictly necessary that the following cookies are stored on your device (§ 25(2)(2) TTDSG):
These are the following cookies:
4. Payment Processing
Read here about the available payment processing options and which personal data is processed in each case.
4.1 PayPal
Payments can be processed via the PayPal service. The service is provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg ("PayPal").
Payment processing via the service is only possible if you have registered with PayPal. By selecting the PayPal payment option, you will be redirected to the PayPal website. Data is transmitted to PayPal; in particular, PayPal receives information about your purchase. The data transfer is strictly necessary to provide you with the payment option you have selected (Art. 6(1)(1)(b) GDPR).
We have no influence over the data processing that subsequently takes place at PayPal. This is governed by the terms agreed between you and PayPal. PayPal alone is responsible for the protection and handling of the data collected by PayPal. Further information on data processing by PayPal can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
4.2 Further Payment Options
If you have selected the payment method credit card or direct debit and this is necessary for the processing of payments, we will pass on the data required for this purpose to the payment service provider you have selected (Art. 6(1)(1)(b) GDPR).
5. Advertising Measures
We have a legitimate interest in using your data for direct marketing purposes within the meaning of Art. 6(1)(1)(f) GDPR.
To the extent that you have consented (Art. 6(1)(1)(a) GDPR), we also use your data for sending an e-mail newsletter.
You can withdraw your consent to the sending of the newsletter at any time via the link provided for this purpose in every e-mail newsletter or by sending a message to the contact details provided above. Furthermore, you can object to the processing of your personal data for advertising purposes with effect for the future in writing, by fax, by e-mail, or by telephone. The only costs incurred for the objection are the transmission costs at the basic rates. The lawfulness of data processing operations already carried out remains unaffected.
6. Trustpilot – Review Invitations
We work with Trustpilot A/S, Pilestræde 58, 5., 1112 Copenhagen K, Denmark ("Trustpilot") to collect customer feedback on our products and service.
After completing an order, we may transmit your name, e-mail address, and order information (e.g. order or reference number) to Trustpilot. Trustpilot uses this data solely to send you, on our behalf, an invitation to submit a review of your shopping experience. If you do not respond to the first invitation, a single reminder may be sent to you.
Processing is carried out for the purpose of quality assurance, improving our offering, and obtaining authentic customer reviews.
The legal basis for processing is Art. 6(1)(f) GDPR. Our legitimate interest consists in receiving honest customer feedback and presenting the quality of our products and services in a transparent manner.
You can object at any time, with effect for the future, to the use of your e-mail address for the sending of review invitations. To do so, you may use the corresponding link in the review invitation or contact us at any time by e-mail at info@apacare.de.
Further information on the processing of personal data by Trustpilot can be found at:
https://de.legal.trustpilot.com/for-reviewers/end-user-privacy-terms
IV. Categories of Recipients of Personal Data of Our Website Visitors and Third-Country Transfers
1. Categories of Recipients of Personal Data of Our Website Visitors
Categories of non-instructed recipients of personal data are: providers of analytics services, providers for payment processing, and providers of review platforms.
Categories of instructed service providers bound by data protection requirements who may not use the data for any other purpose are: providers for the maintenance and hosting of the website.
2. Third-Country Transfers
Our website integrates services from providers headquartered in or with connections to the USA. If you consent to data processing by one of these providers, it cannot be excluded that US authorities may have unrestricted access to the data processed about you. You also have no legal recourse against this. Specifically, these are the following providers:
- Service:
- Google Tag Manager, Google Analytics, Google Ads
- Provider:
- Google Ireland Limited, Ireland
- Parent company:
- Google LLC, USA
- Service:
- Meta Pixel
- Provider:
- Meta Platforms Ireland, Ireland
- Parent company:
- Meta Platforms Inc., USA
It cannot be excluded that the companies and/or their respective parent companies and/or US authorities may access personal data processed for the provision of the services.
As the legal basis for the transfer of personal data to the USA, standard contractual clauses pursuant to Art. 46(2)(c) GDPR ("SCC") are currently regularly agreed. However, a third-country transfer on the basis of SCCs is only permissible if the agreements can actually be complied with by the providers in the third country. This would in particular require that unrestricted access by US authorities to the data can be excluded, which is currently not the case to the best of our knowledge.
Although we conclude the standard contractual clauses with the companies, we therefore only use the aforementioned services with your prior express consent (Art. 49(1)(1)(a) GDPR) and explicitly draw attention to the following risks of transferring data to one of the above-mentioned service providers:
Due to the powers of the US intelligence services and the legal situation in the USA, the state surveillance measures of the USA are disproportionate and, from the EU's perspective, there is no adequate level of state data protection for personal data. In particular, Section 702 of the US Foreign Intelligence Surveillance Act (FISA) does not provide for any restrictions on intelligence surveillance measures or any guarantees for non-US citizens. The Presidential Policy Directive 28 (PPD-28) also does not provide data subjects with effective legal remedies against measures taken by US authorities and does not provide for safeguards ensuring proportionate measures. Furthermore, US authorities may, on the basis of the US Cloud Act, require a US company to hand over all stored data, even if that data is located on servers within the EU.
C. Supplementary Information on Data Processing on Our Social Media Company Pages
We operate a so-called "company page" on the following social media platforms:
- Facebook:
- Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
- Instagram:
- Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
- YouTube:
- Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland
In addition to our General Information (please refer to section A), we inform you here about data processing when visiting one of our company pages.
1. General Information on Company Pages, Legal Basis
As the operator of an online presence on a social media platform, we process personal data when you contact us directly via a personal message or via the public comment function on the platform. The data collected depends on your details and the contact information you have provided or released. The processing of this data is based on Art. 6(1)(1)(b) GDPR insofar as it is necessary for the performance of a measure requested by you. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Art. 6(1)(1)(f) GDPR).
When visiting a company page, the respective platform operator ("provider") collects information that enables it to recognise users and comprehensively analyse user behaviour. Based on the data collected in this way, the social media platform provider can also create user profiles. If you are logged into your corresponding social media account when visiting a company page, the respective provider may also assign this visit to your account.
The respective provider only provides us with an anonymised statistical analysis of the use of our company page based on the information obtained. This allows us to make our posts even more targeted in the future. We have a legitimate interest in the collection and processing of this information. Beyond this, we have a legitimate interest in using as many communication channels as possible to personally reach as many interested parties as possible. The legal basis for the data processing associated with operating a company page is therefore Art. 6(1)(1)(f) GDPR.
We do not disclose any personal data that we collect via our company pages to third parties. However, we can neither influence nor exclude the possibility that the aforementioned providers transfer the collected data to third parties – in particular to their partner companies, which may also be headquartered outside the EU. In many third countries outside the EU, there is currently no level of data protection equivalent to that of the EU.
You can generally assert your data subject rights (see also section A.I.5.) in relation to data processing by our company pages both against us and against the respective provider. However, we draw your attention to the fact that these can be most effectively asserted against the respective provider, as only the respective provider has access to the users' data and can directly take appropriate measures and provide information.
Further information on data processing by the respective provider can be found at:
- Facebook: https://de-de.facebook.com/about/privacy
- LinkedIn: https://www.linkedin.com/legal/privacy-policy
- YouTube: https://www.google.de/intl/de/policies/privacy
2. Agreements Pursuant to Art. 26 GDPR
We have concluded an agreement with Meta (formerly: Facebook) pursuant to Art. 26 GDPR, in which the data protection obligations arising from the operation of our company page are allocated between us and the provider. Meta has assumed the majority of the data protection obligations, such as fulfilling data subjects' rights pursuant to Art. 12 et seq. GDPR, the obligation to maintain appropriate technical and organisational measures to protect the security of personal data, as well as the notification and reporting obligations in the event of a data breach. If you contact us regarding your data subject rights, we will promptly forward your request to the provider. We are obliged to do so under the agreement with the respective provider.
Further information on the agreement between us and the provider can be found at:
