Privacy policy

Consent with Borlabs Cookie

We use Borlabs Cookie consent technology from Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany, to obtain your consent to the storage of certain cookies or the use of certain technologies and to document this in accordance with data protection regulations.

When you visit our website, a Borlabs cookie is stored in your browser. This cookie stores the consents you have given or any revocations. This data is not passed on to Borlabs GmbH.

The collected data will be stored until you request its deletion, delete the Borlabs cookie yourself, or the purpose for storing it no longer applies. Statutory retention obligations remain unaffected.

This is used to obtain the legally required consent for the use of cookies. The legal basis is Art. 6 (1) (c) GDPR.

For more information, please visit: de.borlabs.io

10. Contact form 

If you send us inquiries via a contact form, we will process the personal data you enter in the form (e.g., name, email address, telephone number, content of the message) for the purpose of processing your inquiry and in case of follow-up questions.

Processing is carried out for the purpose of implementing pre-contractual measures or fulfilling contracts with (potential) customers (Art. 6 (1) (b) GDPR) and in the legitimate interest of efficient and traceable processing of incoming inquiries (Art. 6 (1) (f) GDPR); if consent is requested in the form, processing is also carried out on the basis of Art. 6 (1) (a) GDPR; consent that has been given can be revoked at any time.

The data will be deleted as soon as your request has been processed and there are no legal retention obligations (e.g. under commercial or tax law) that prevent this.

Data will only be passed on to third parties if this is necessary to process your request or if there is a corresponding legal obligation to do so.

11. Inquiry by email or phone

If you contact us by email or telephone, we will process the personal data collected in this context (e.g., name, contact details, date and time of contact, content of the inquiry) for the purpose of communicating with you and processing your request.

Email correspondence is handled via the Microsoft 365 service; your communication data is stored in Microsoft data centers in Germany or within the EU.

Processing is carried out for the purpose of initiating or executing a contract (Art. 6 (1) (b) GDPR) and in the legitimate interest of effective and secure communication with (potential) customers, business partners, and other contact persons (Art. 6 (1) (f) GDPR). Microsoft acts as a processor in this regard; a contract for processing exists in accordance with Art. 28 GDPR. If access from the US is necessary in individual cases, this is based on an adequacy decision by the European Commission for the US (EU-US Data Privacy Framework, Art. 45 GDPR).

The data will be deleted as soon as it is no longer required for processing your request and there are no legal retention periods, in particular commercial or tax law retention obligations, that prevent this.

12. YouTube with enhanced privacy settings

This website embeds videos from the YouTube platform. Personal data such as IP address, subpage accessed, and, if applicable, other technical usage data are processed by YouTube as soon as a corresponding video is loaded or played. If you are logged in to YouTube or Google, your usage behavior can be assigned to your profile. The processing is carried out for the purpose of providing embedded videos and for the attractive presentation of our online offering (Art. 6 (1) (f) GDPR); if consent is requested via the consent banner, processing is carried out on the basis of Art. 6 (1) lit. a GDPR in conjunction with § 25 (1) TDDDG; consent can be revoked at any time.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; transfer to the USA is possible on the basis of, among other things, the EU standard contractual clauses and certification under the EU-US Data Privacy Framework (Articles 45 and 46 of the GDPR). Further information can be found in Google's privacy policy here and here. 

13. Google Maps

We use the Google Maps map service to display locations and facilitate route planning. When you visit pages that incorporate Google Maps, personal data such as your IP address, the URL you visited, the date and time of access, and, if applicable, location and usage data are transmitted to Google Ireland Limited and processed on servers in the EU and the US.

The legal basis is our legitimate interest in a user-friendly and easily accessible presentation of our facilities (Art. 6 (1) (f) GDPR); if consent is requested via the consent banner, processing is carried out on the basis of Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG; consent can be revoked at any time.

Transfer to the USA cannot be ruled out; this is carried out on the basis of the EU standard contractual clauses and Google's certification under the EU-US Data Privacy Framework (Articles 45 and 46 of the GDPR).

Further information on data protection at Google can be found here, and the SCC here. 

14. CleverReach (newsletter distribution)

We use the CleverReach service to send our newsletter. The data provided during registration (e.g., email address, name if applicable, timestamp, and double opt-in confirmation data) is processed on servers belonging to CleverReach GmbH & Co. KG and used for sending the newsletter and for statistical analysis of newsletter behavior (opening and click rates).

The legal basis is your consent in accordance with Art. 6 (1) (a) GDPR; you can revoke this consent at any time with future effect, e.g., via the unsubscribe link in the newsletter.

A contract for order processing in accordance with Art. 28 GDPR has been concluded with CleverReach. The data is stored on servers within the EU/EEA. No data is transferred to third countries.

The data will be deleted after unsubscribing from the newsletter, provided that there are no legal retention obligations to the contrary. Double opt-in proofs are stored for 3 years for verification purposes.

Further information on data protection at CleverReach can be found here.

15. Google Analytics

We use the web analytics service Google Analytics from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on our website. Google Analytics uses cookies and similar technologies to evaluate the use of the website (e.g., pages accessed, click behavior, device used, approximate location data).

Processing is carried out exclusively on the basis of your consent (Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG), which you can give via our consent banner and revoke there at any time.

The collected data may be transferred to Google servers in the US; the US is considered a safe recipient country under Article 45 of the GDPR due to the EU-US Data Privacy Framework. In addition, Google uses standard contractual clauses and other security measures.

You can also prevent data collection by revoking your consent in the consent banner or by using the browser add-on available at tools.google.com. Further information can be found here and here. 

Google Tag Manager

We also use Google Tag Manager to centrally manage Google Analytics and other tracking tags; its use is also based exclusively on your consent (Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG), and the above information on Google Analytics (including possible data transfers to the USA within the framework of the EU-US Data Privacy Framework) applies.

16. Facebook/Instagram

We operate company profiles on Facebook and Instagram to provide information about our facilities and services and to communicate with interested parties, parents, and other users. Both services are provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

When you visit our Facebook or Instagram pages, Meta processes users' personal data (e.g., IP address, device information, page views, interactions with posts, comments, and messages) and provides us with aggregated statistics on the use of our pages ("Insights"). We are jointly responsible with Meta for this Insights data within the meaning of Art. 26 GDPR. The relevant agreement ("Page Insights Addendum Regarding the Controller") and further information on data processing by Meta can be found at facebook.com and in Meta's privacy policy, including here and here.

The legal basis for operating these social media accounts and analyzing the insights data is our legitimate interest in maintaining a modern public image, communicating with (potential) parents, providing insights into everyday life at our facilities, conducting public relations work, and attracting new interested parties (Art. 6 (1) (f) GDPR).

Meta may transfer personal data to third countries, in particular the USA. According to Meta, this is done on the basis of an adequacy decision by the EU Commission (EU-US Data Privacy Framework, Art. 45 GDPR) and, in addition, the EU standard contractual clauses pursuant to Art. 46 GDPR. For further details on the nature, scope, and purposes of data processing by Meta, as well as your rights as a data subject and settings options (e.g., advertising and privacy settings), please refer to Meta's privacy information.

You can assert your rights (e.g., to information, deletion, restriction, objection) both against us and directly against Meta. Insofar as the processing of data is the sole responsibility of Meta (in particular when using the platforms independently of our presence), we recommend that you contact Meta directly.

17. Accessibility plugin

We use the accessibility plugin "Ally" from Elementor Ltd., Tuval St 40, Ramat Gan, Israel, to make our website more accessible and improve usability for people with disabilities.

Depending on the configuration of the plugin, technical usage data may be processed (e.g., page views, use of individual accessibility features, browser and device data). This data may be processed on Elementor's servers; Elementor acts as our processor in this respect. The legal basis for this is our legitimate interest in designing our website to be accessible and user-friendly (Art. 6 (1) (f) GDPR).

An agreement for order processing in accordance with Art. 28 GDPR has been concluded with Elementor. For more information on data processing by Elementor, please refer to Elementor's privacy policy at elementor.com and Elementor's Data Processing Agreement.

18. Weglot (website language translation)

We use the "Weglot" service provided by Weglot SAS, 138, rue Pierre Joigneaux, 92270 Bois-Colombes, France, to make our website available in several languages. The content displayed on our website is transmitted to Weglot, where it is automatically translated and delivered back in the selected language versions. In this context, Weglot may process technical information (e.g., IP address, pages visited, language used, browser and device data). Weglot also uses cookies and local storage to save your language selection (e.g., wglang, wg-translations, wg-slugs).

The legal basis is our legitimate interest in a multilingual, user-friendly presentation of our online offering and in reaching additional target groups (Art. 6 para. 1 lit. f GDPR); insofar as Weglot cookies are not technically necessary, their use is based on your consent (Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG).

We have entered into an agreement with Weglot for order processing in accordance with Art. 28 GDPR. Further information on data processing by Weglot can be found here.

19. Zammad (helpdesk system) 

We use the Zammad ticket system to process inquiries and communicate with interested parties, parents, and other contacts in a structured manner. If you contact us by email or via the contact form, your details (e.g., name, contact details, content of the inquiry, metadata) will be stored in the Zammad GmbH system and assigned to an inquiry (ticket).

The processing is carried out for the purpose of initiating or executing a contract (Art. 6 (1) (b) GDPR) and, in addition, in the legitimate interest of efficient and traceable processing of support and service requests (Art. 6 (1) (f) GDPR).

We operate Zammad on servers in our own data center in Germany. There is no access by the provider Zammad or any transfer to third countries.

The data will be deleted as soon as it is no longer required for processing the request and there are no legal retention periods that prevent this.

20. Softgarden (applicant portal)

We use the Softgarden applicant management system to process online applications. When you use the applicant portal, the personal data you enter (e.g., master data, contact details, application documents, communication content) is processed on the servers of Softgarden e-recruiting GmbH.

The processing is carried out for the purpose of deciding on the establishment of an employment relationship (Art. 6 (1) (b) GDPR in conjunction with § 26 BDSG) and, if applicable, on the basis of your consent (Art. 6 (1) (a) GDPR), insofar as you consent, for example, to longer storage in the talent pool; Consent can be revoked at any time.

The storage period is usually (without consent) 6 months after completion of the application process. With consent to inclusion in the talent pool, up to 24 months after completion of the application process or until consent is revoked.

When an employment relationship is established, the data is transferred to the personnel file and stored in accordance with labor and social security law obligations.

A contract for order processing has been concluded with Softgarden in accordance with Art. 28 GDPR. Processing takes place exclusively on servers in certified data centers in Germany (Frankfurt am Main). No data is transferred to third countries.

For further details , please refer to the privacy policy on the Softgarden website .

As of: 03/2026