Privacy Policy

We greatly appreciate your interest in our company. At Ingold Solutions GmbH, data protection is a particularly high priority for our management team. In general, it is possible to use the Ingold Solutions GmbH website without providing any personal data. However, if an individual wishes to access specific services offered by our company via the website, the processing of personal data may become necessary. Where the processing of personal data is required and there is no legal basis for such processing, we will generally seek the explicit consent of the individual concerned.

The processing of personal data - such as the name, address, email address, or telephone number of a data subject - is always carried out in compliance with the General Data Protection Regulation (GDPR) and in accordance with the country-specific data protection laws applicable to Ingold Solutions GmbH. Through this privacy policy, we aim to inform the general public about the nature, scope, and purpose of the personal data we collect, use, and process. Moreover, this policy also serves to inform data subjects of the rights to which they are entitled.

As the data controller, Ingold Solutions GmbH has implemented a wide range of technical and organizational measures to ensure the most comprehensive protection possible for personal data processed via this website. Nevertheless, internet-based data transmissions may in principle have security gaps, meaning absolute protection cannot be guaranteed. For this reason, data subjects are free to submit their personal data to us through alternative channels, such as by telephone.

1. Definitions

This privacy policy of Ingold Solutions GmbH is based on the terminology used by the European legislator when enacting the General Data Protection Regulation (GDPR). Our intention is to make this policy easily understandable for the general public, as well as for our customers and business partners. To ensure clarity, we would like to explain the key terms used in this document in advance.

We use, among others, the following terms in this privacy policy:

a) Personal data

Personal data refers to any information relating to an identified or identifiable natural person (referred to as the “data subject”). An identifiable person is someone who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

b) Data subject

A data subject is any identified or identifiable natural person whose personal data is processed by the data controller.

c) Processing

Processing refers to any operation or set of operations performed on personal data—whether or not by automated means. This includes collecting, recording, organizing, structuring, storing, adapting, altering, retrieving, consulting, using, disclosing by transmission, disseminating, or otherwise making available, as well as aligning, combining, restricting, erasing, or destroying such data.

d) Restriction of processing

Restriction of processing involves marking stored personal data to limit its future processing.

e) Profiling

Profiling refers to any form of automated processing of personal data aimed at evaluating certain personal aspects relating to a natural person, particularly to analyze or predict aspects concerning their work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

f) Pseudonymization

Pseudonymization is the processing of personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is stored separately and subject to technical and organizational measures ensuring that the data cannot be linked to an identified or identifiable person.

g) Controller or data controller

The controller or data controller is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by such law.

h) Processor

A processor is a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.

i) Recipient

A recipient is a natural or legal person, public authority, agency, or another body to whom personal data is disclosed, whether or not they are a third party. However, public authorities that may receive personal data in the context of a particular legal inquiry under Union or Member State law shall not be considered recipients.

j) Third party

A third party is a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

k) Consent

Consent is any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, by which they, by a statement or a clear affirmative action, signify agreement to the processing of personal data relating to them.

2. Name and Address of the Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR), as well as other applicable data protection laws in the Member States of the European Union and other provisions of a data protection nature, is:

Ingold Solutions GmbH

Clayallee 175

14195 Berlin

Germany

Tel.: +49 30 863 232 940

E-Mail: contact[at]ingoldsolutions.com

Website: https://www.ingoldsolutions.com/

3. Cookies

The websites of Ingold Solutions GmbH use cookies. Cookies are small text files that are stored on a user’s device via an internet browser.

Cookies may contain a unique identifier that enables a website to recognize a particular browser during a visit or, where applicable, on subsequent visits. Depending on their purpose, cookies may be necessary for the technical operation of the website or may be used to improve website functionality, remember user preferences, or analyse how the website is used.

Ingold Solutions GmbH uses cookies to ensure the proper and user-friendly operation of its websites and to optimise the information and services provided. Where cookies are not strictly necessary for the operation of the website, they are used only in accordance with applicable data protection requirements and, where required, after obtaining the user’s consent.

Users can manage their cookie preferences through the cookie consent settings provided on the website. They may also configure their internet browser to prevent or restrict the storage of cookies and can delete cookies that have already been stored at any time.

Please note that disabling certain technically necessary cookies may affect the functionality of some parts of the website.

4. Collection of General Data and Information

Each time a data subject or an automated system accesses the website of Ingold Solutions GmbH, a range of general data and information is collected. This data and information is stored in the server’s log files. The following data may be collected:

1. the browser types and versions used,
2. the operating system used by the accessing system,
3. the date and time of access,
4. the internet protocol address (IP address),
5. the name and URL of the requested resource, and other similar technical data used to protect our IT infrastructure in the event of cyberattacks.

Ingold Solutions GmbH does not draw conclusions about the identity of the data subject from this general information. Instead, this data is required in order to:

1. correctly deliver the content of our website,
2. optimize the content and advertisements on the website,
3. ensure the long-term functionality of our IT systems and website technology, and
4. provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack.

These technical log data are evaluated only to the extent necessary to ensure the security, stability and proper operation of our website and IT systems. Server log data are generally deleted after 30 days unless a security incident, legal obligation or the establishment, exercise or defence of legal claims requires longer storage. The legal basis for this processing is Article 6(1)(f) GDPR, based on our legitimate interest in the secure and reliable operation of our website and IT infrastructure.

4.1 Website Hosting via Microsoft Azure

We use Microsoft Azure services provided by Microsoft to host and operate this website. In this context, Microsoft may process technical data, including IP addresses and server log information, on our behalf for the purpose of providing, securing and maintaining the hosting infrastructure. The legal basis for our use of the hosting service is Article 6(1)(f) GDPR, based on our legitimate interest in the secure, reliable and efficient operation of our website.

Where personal data is transferred outside the European Economic Area (EEA), such transfers are protected by an applicable adequacy decision, including the EU-U.S. Data Privacy Framework where applicable, and/or other appropriate safeguards such as the European Commission Standard Contractual Clauses. Microsoft data protection terms apply to the processing carried out on our behalf.

5. Contact Options via the Website

Due to legal requirements, the website of Ingold Solutions GmbH includes information that enables quick electronic contact with our company and direct communication with us. This includes a general email address.

If a user contacts the controller by email or via a contact form, the personal data transmitted by the user is stored for the purpose of processing the inquiry and communicating with the user. Depending on the communication channel used, service providers acting on our behalf may be involved in processing the data. Contact data is generally retained for up to 90 days after an inquiry has been completed. Where ongoing communication is reasonably expected, relevant correspondence may be retained for up to one year, unless contractual or statutory retention obligations, or the establishment, exercise or defence of legal claims, require longer storage. The legal basis is Article 6(1)(b) GDPR where the inquiry concerns a contract or pre-contractual measures and Article 6(1)(f) GDPR for other business inquiries and communications.

5.1 Contact via WhatsApp

If you choose to contact us via WhatsApp, the communication is processed using the WhatsApp service. For users in the European Region, WhatsApp Ireland Limited provides the service. Depending on how you use WhatsApp, the provider may process account, device, connection and communication metadata in accordance with its own privacy policy. Message content and calls are protected by WhatsApp's end-to-end encryption as described by WhatsApp. We use the information received only to process and respond to your inquiry. You are not required to use WhatsApp and may contact us through other channels, such as email or the website contact form.

The legal basis for our processing is Article 6(1)(b) GDPR where the communication relates to a contract or pre-contractual measures and Article 6(1)(f) GDPR for other business communications. Further information is available in WhatsApp's privacy policy.

5.2 Live Chat via Smartsupp

We use the Smartsupp live-chat service provided by Smartsupp.com, s.r.o. to enable visitors to communicate with us through the website. When the live chat is used, personal data such as the information entered in the chat, contact details supplied by the user and, depending on the technical configuration, connection or device information may be processed. Smartsupp processes such data on our behalf as a service provider.

The purpose of the processing is to answer inquiries and provide customer and business support. The legal basis is Article 6(1)(b) GDPR where the communication relates to a contract or pre-contractual measures and Article 6(1)(f) GDPR for other support and business inquiries. Where non-essential technologies used by the service require consent, the relevant processing is carried out on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG.

6. Routine Deletion and Blocking of Personal Data

The data controller processes and stores personal data only for the period necessary to achieve the purpose of storage, or as permitted by European or national legislators under applicable laws and regulations.

Personal data is deleted or restricted when the purpose for which it was collected no longer applies and no legal basis requires or permits further storage. Specific retention periods stated in this policy apply to the relevant processing activity, including the 30-day period for server logs, the contact-data periods described above and the retention period for unsuccessful job applications. Longer storage may be required in particular to comply with statutory obligations or to establish, exercise or defend legal claims.

7. Rights of the Data Subject

a) Right to Confirmation

Every data subject has the right to obtain confirmation from the controller as to whether personal data concerning them are being processed.

b) Right of Access

Data subjects may request free information at any time about the personal data stored about them, together with a copy of that information. This includes:

• the purposes of processing;
• the categories of personal data processed;
• the recipients or categories of recipients to whom the data have been or will be disclosed, especially in third countries or international organisations;
• where possible, the planned period of storage or, if not possible, the criteria used to determine that period;
• the existence of rights to rectification, erasure, restriction, or objection;
• the right to lodge a complaint with a supervisory authority;
• any available information about the data’s origin if not collected from the data subject; and
• the existence of automated decision‑making, including profiling, and meaningful details about the logic involved and the envisaged consequences.
  Data subjects also have the right to know whether data have been transferred to a third country or international organisation and, if so, what appropriate safeguards apply.

c) Right to Rectification

Data subjects can request the prompt correction of inaccurate personal data and the completion of incomplete data.

d) Right to Erasure (“Right to Be Forgotten”)

Data subjects may demand that their personal data be erased without delay where one of the following grounds applies and processing is not required:

1. The data are no longer necessary for the purposes for which they were collected.
2. Consent on which processing was based is withdrawn, and there is no other legal ground.
3. Objection is lodged pursuant to Art. 21 (1) GDPR and no overriding legitimate grounds exist, or objection is lodged under Art. 21 (2) GDPR.
4. The data were processed unlawfully.
5. Erasure is required to comply with EU or Member State law.
6. The data were collected in relation to information‑society services under Art. 8 (1) GDPR.

If Ingold Solutions GmbH has made data public and is obliged to erase them, we will take reasonable steps - considering available technology and implementation costs - to inform other controllers processing the data that the data subject has requested deletion of all links, copies, or replications.

e) Right to Restrict Processing

Data subjects may obtain restriction of processing where:

1. they contest the data’s accuracy (for a period enabling verification);
2. processing is unlawful and they oppose erasure;
3. the controller no longer needs the data, but the data subject requires them for legal claims; or
4. they have objected under Art. 21 (1) GDPR and verification of overriding legitimate grounds is pending.

f) Right to Data Portability

Data subjects have the right to receive the personal data they provided to a controller in a structured, commonly used, machine‑readable format, and to transmit those data to another controller where processing is based on consent or contract and carried out by automated means. They also have the right, where technically feasible, to have the data transmitted directly between controllers, provided this does not adversely affect others’ rights.

g) Right to Object

Data subjects may object at any time, on grounds relating to their particular situation, to processing based on Art. 6 (1)(e) or (f) GDPR, including profiling. Ingold Solutions GmbH will cease processing unless we can demonstrate compelling legitimate grounds overriding the interests, rights, and freedoms of the data subject, or processing is needed for legal claims.

Where personal data are processed for direct marketing, data subjects may object at any time; this includes profiling related to such marketing. After objection, the data will no longer be processed for these purposes.

h) Automated Individual Decision‑Making, Including Profiling

Data subjects have the right not to be subject to decisions based solely on automated processing - including profiling - that produce legal effects or similarly significant consequences, unless the decision is necessary for a contract, authorised by Union or Member‑State law with suitable safeguards, or based on explicit consent. In such cases, Ingold Solutions GmbH will implement measures to safeguard the data subject’s rights, including the right to human intervention, to express a viewpoint, and to contest the decision.

i) Right to Withdraw Consent

Data subjects may withdraw consent for processing personal data at any time.

For any of these rights, data subjects can contact any employee of Ingold Solutions GmbH.

8. Data Protection in Applications and Recruitment

The controller collects and processes applicants’ personal data for the purpose of managing the recruitment process. Processing may be carried out electronically - for example, when applications are submitted by email or via a web form. If the controller concludes an employment contract with an applicant, the transmitted data will be stored - subject to statutory provisions - for the purpose of the employment relationship. If no contract is concluded, the application documents are automatically deleted two months after notification of the rejection, unless other legitimate interests of the controller (e.g., evidence in proceedings under the German General Equal Treatment Act) require longer retention.

9. Data Protection Provisions Regarding Facebook and Meta Pixel

We maintain a presence on the social network Facebook and use the Meta Pixel on this website.

The Meta Pixel is a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta").

The Meta Pixel enables us to measure the effectiveness of our advertising campaigns, understand how visitors interact with our website, create statistical evaluations and, where applicable, display relevant advertisements to users on Facebook and other Meta services.

When the Meta Pixel is activated, information about a visitor's interaction with our website may be transmitted to Meta. Depending on the configuration of the Meta Pixel, this may include information such as:

• IP address;
• browser and device information;
• pages visited;
• date and time of the visit;
• referring URL;
• actions performed on the website; and
• identifiers and other information used for advertising and measurement purposes.

If the visitor is logged into Facebook or another Meta service, Meta may be able to associate the information received with the visitor's Meta account.

We use the Meta Pixel only after the visitor has provided the appropriate consent through our cookie consent mechanism. The legal basis for processing personal data in connection with the Meta Pixel is the user's consent pursuant to Article 6(1)(a) GDPR. Access to or storage of information on the user's device is also carried out on the basis of consent in accordance with Section 25(1) TDDDG.

Consent is voluntary and may be withdrawn at any time with effect for the future through the cookie settings available on our website.

In connection with the use of Meta services, personal data may also be processed outside the European Economic Area. Where personal data is transferred to a country for which no adequacy decision exists, appropriate safeguards for the transfer are applied in accordance with applicable data protection law.

Further information about Meta's processing of personal data and users' privacy rights is available in Meta's Privacy Policy.

Our website also contains a link to our Facebook presence. If a visitor clicks this link, the visitor leaves our website and is redirected to Facebook. Meta will then process information relating to the visitor's use of Facebook in accordance with its own privacy policies.

10. Data Protection Provisions Regarding the Use of Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand how visitors use our website and may process information such as online identifiers, device and browser information, pages visited, interactions, date and time of access and other usage data.

Google Analytics is activated only after the user has provided the relevant consent through our cookie consent mechanism. The legal basis for the processing of personal data is Article 6(1)(a) GDPR. Where information is stored on or accessed from the user's terminal device, this also takes place on the basis of consent in accordance with Section 25(1) TDDDG. Consent is voluntary and may be withdrawn at any time with effect for the future through the cookie settings available on our website.

Depending on the configuration of Google Analytics, cookies such as _ga and _ga_* may be used. Their actual duration is determined by the current configuration and is shown, where applicable, in the cookie consent settings. We do not use Google Analytics before the required consent has been obtained.

In connection with Google services, personal data may also be processed outside the EEA, including in the United States. Transfers to eligible U.S. recipients may be based on the EU-U.S. Data Privacy Framework. Where that mechanism does not apply, other appropriate safeguards, such as the European Commission Standard Contractual Clauses, are used where required.

Further information about Google's processing of personal data is available in Google's Privacy Policy and Google Analytics data-protection information.

11. Data Protection Provisions Regarding the Use of Google Remarketing

We use Google Remarketing, a function of Google Ads provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Remarketing enables us, with the user's consent, to address visitors who have previously used our website with relevant advertising on Google services and partner websites.

For this purpose, Google may process information such as IP address, device and browser information, online identifiers and information about website interactions. The service is activated only after the user has given the relevant consent. The legal basis is Article 6(1)(a) GDPR and, for storing or accessing information on the terminal device, Section 25(1) TDDDG. Consent may be withdrawn at any time through our cookie settings.

Personal data may be processed outside the EEA. Where applicable, transfers are based on the EU-U.S. Data Privacy Framework and/or other appropriate safeguards such as the European Commission Standard Contractual Clauses. Further information is available in Google's Privacy Policy and advertising settings.

12. Data Protection Provisions Regarding the Use of Google Ads and Conversion Tracking

This website uses Google Ads, an online advertising service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. In connection with Google Ads, we use conversion measurement to understand whether users who interact with our advertisements subsequently perform defined actions on our website.

Google Ads and Conversion Tracking may process online identifiers, IP address, device and browser information and information about interactions with advertisements and our website. These technologies are activated only after the user has provided the relevant consent through our cookie consent mechanism. The legal basis for the processing of personal data is Article 6(1)(a) GDPR and, for storing or accessing information on the terminal device, Section 25(1) TDDDG. Consent can be withdrawn at any time through our cookie settings.

Personal data may be processed outside the EEA, including in the United States. Where applicable, transfers are based on the EU-U.S. Data Privacy Framework and/or other appropriate safeguards such as the European Commission Standard Contractual Clauses. Further information about Google Ads and data processing is available in Google's Privacy Policy.

12.1 Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, to manage website tags and to control the activation of analytics and marketing services. Google Tag Manager is a tag-management system; the services deployed through it may themselves process personal data. Tags for non-essential analytics or marketing services are activated only after the required consent has been obtained. The legal basis for such activation is Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.

12.2 Google Ad Manager

We use Google Ad Manager, provided by Google Ireland Limited, for the management, delivery and measurement of online advertising. Depending on the configuration, the service may process IP addresses, device and browser information, online identifiers and information about advertising interactions. Where the service is not strictly necessary, it is activated only after the user has provided consent. The legal basis is Article 6(1)(a) GDPR and, where information is stored on or accessed from the terminal device, Section 25(1) TDDDG.

Where Google Ad Manager or Google Tag Manager involves processing outside the EEA, the transfer safeguards described above for Google services apply.

12.3 Google Web Fonts

This website uses Google Web Fonts hosted by Google Ireland Limited to provide consistent presentation of fonts. When fonts are loaded from Google servers, technical connection data such as the user's IP address may be transmitted to Google. Where consent is required for this connection, the legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG. Personal data may also be processed outside the EEA; where applicable, the transfer safeguards described above for Google services apply.

13. Data Protection Provisions Regarding Links to Instagram

Our website contains links to our presence on the social network Instagram. Instagram is a service provided by Meta Platforms.

The Instagram link on our website is provided solely as an external link. We do not integrate Instagram plug-ins, embedded Instagram feeds or posts, Instagram SDKs, or other Instagram-specific components that automatically establish a connection with Instagram when our website is accessed. The Meta Pixel used on this website is described separately in Section 9 above and is independent of the external Instagram link.

Therefore, simply visiting our website does not, through the Instagram link itself, result in data being transmitted to Instagram.

A connection to Instagram is established only if you actively click on the Instagram link. You will then leave our website and be redirected to Instagram. When you access Instagram, Meta may collect and process information about your visit in accordance with its own privacy policy. If you are logged into your Instagram account, Meta may also associate your visit with your Instagram account.

The nature, scope and purposes of the collection and processing of personal data by Meta are determined by Meta and are outside our control.

Further information about how Meta processes personal data and the privacy options available to users can be found in Meta's Privacy Policy at:

https://privacycenter.instagram.com/policy/

14. Data Protection Provisions Regarding Links to LinkedIn

Our website contains links to our presence on the professional social network LinkedIn.

The LinkedIn link on our website is provided solely as an external link. We do not integrate LinkedIn plug-ins, embedded LinkedIn content, the LinkedIn Insight Tag, LinkedIn SDKs, or other LinkedIn components that automatically establish a connection with LinkedIn when our website is accessed.

Therefore, simply visiting our website does not, through the LinkedIn link itself, result in data being transmitted to LinkedIn.

A connection to LinkedIn is established only if you actively click on the LinkedIn link. You will then leave our website and be redirected to LinkedIn. When you access LinkedIn, LinkedIn may collect and process information about your visit in accordance with its own privacy policy. If you are logged into your LinkedIn account, LinkedIn may also associate your visit with your LinkedIn account.

The nature, scope and purposes of the collection and processing of personal data by LinkedIn are determined by LinkedIn and are outside our control.

Further information about how LinkedIn processes personal data and the privacy options available to users can be found in LinkedIn's Privacy Policy at:

https://www.linkedin.com/legal/privacy-policy

14.1 Links to X (formerly Twitter)

Our website contains links to our presence on X (formerly Twitter). When a user actively clicks such a link, the user leaves our website and is redirected to X. The provider may then process information about the visit in accordance with its own privacy policy. If embedded X content is used on individual pages, such content is activated only in accordance with the applicable consent settings where consent is required.

14.2 Links to YouTube

Our website contains links to our YouTube presence. When a user actively clicks such a link, the user leaves our website and is redirected to YouTube, a Google service. Google may then process information about the visit in accordance with its own privacy policy. If embedded YouTube content is used on individual pages, such content is activated only in accordance with the applicable consent settings where consent is required.

15.Microsoft Clarity

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement