Legal
Data protection provisions
With this data protection notice, we inform you about our handling of your personal data and about your rights under the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). Responsible for data processing is the isento GmbH (hereinafter referred to as "we" or "us").
I. General information
1. Our contact details
If you have questions or suggestions about this information or would like to contact us about asserting your rights, please contact us at
isento GmbH
Ostendstraße 242
DE-90482 Nuremberg
Phone: +49 (0) 911 – 21 77 38 70
E-mail: info@isento.de
Web: www.isento.de
2. Duration of storage
Unless otherwise stated in the following notes, we store the data only as long as it is necessary to achieve the processing purpose or to fulfill our contractual or legal obligations. In addition, we will keep data in connection with proven consents as well as claims for claims and claims for the duration of the statutory limitation periods. We will delete data stored for advertising purposes if you object to the processing for this purpose.
3. Categories of recipients of data
We use processors in the context of the processing of your data. The processing operations carried out by such processors include, for example, hosting, e-mail sending, maintenance and support of IT systems, customer and order management, order processing, accounting and billing or marketing measures. In addition, we may transfer your personal data to offices such as postal and delivery services, house bank, tax consulting / auditing company or the financial administration. Further recipients may result from the following instructions.
4. Transmission of data to third countries
Our data processing may involve the transfer of certain personal data to third countries, i.e. countries where the GDPR is not applicable law. Such a transfer shall be permitted if the European Commission has determined that an adequate level of data protection is required in such a third country. If such an adequacy decision of the European Commission does not exist, a transfer of personal data to a third country will only take place if suitable guarantees acc. Art. 46 GDPR or if one of the requirements of art. 49 GDPR is given.
Unless otherwise stated below, we use the EU standard data protection clauses as suitable guarantees for the transfer of personal data in third countries.
5. Processing in the exercise of your rights
If you have your rights according to art. 15 to 22 GDPR, we process the transmitted personal data for the purpose of the implementation of these rights by us and to be able to provide proof of this. Data stored for the purpose of providing information and preparing it will only be processed for this purpose as well as for purposes of data protection control and otherwise the processing in accordance with the art. 18 GDPR restrictions.
These processing operations are based on the legal basis of the art. 6 para 1 letter c GDPR i.V.m. Art. 15 to 22 GDPR and § 34 para. 2 BDSG.
6. Your rights
As a data subject, you have the right to assert your rights against us. In particular, you have the following rights:
• They shall, in accordance with the nature of the 15 GDPR and § 34 BDSG the right to request information about whether and, if so, to what extent we process personal data about you or not.
• You have the right, in accordance with art. 16 GDPR require us to correct your data.
• You have the right, in accordance with art. 17 DSGVO and § 35 BDSG require us to delete your personal data.
• You have the right, in accordance with art. 18 DSGVO to restrict the processing of your personal data.
• You have the right, in accordance with art. 20 GDPR to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format and to transmit this data to another controller.
• If you have given us a separate consent to the data processing, you can give this consent in accordance with the art. 7 para 3 DSGVO revoked at any time. Such revocation shall not affect the lawfulness of the processing carried out until the revocation based on the consent.
• If you believe that the processing of personal data concerning you violates the provisions of the GDPR, you have, in accordance with the art. 77 GDPR the right to complain to a supervisory authority.
7. Right of appeal
They shall, in accordance with the nature of the 21, par. 1 GDPR the right against processing based on the legal basis of art. 6 par. 1 letter e or f GDPR, for reasons arising from your particular situation, object. If we process personal data about you for the purpose of direct marketing, you can oppose this processing acc. Art. 21 para 2 and para 3 GDPR.
8. Data Protection Officer
You can reach our data protection officer at the following contact details:
Cortina Consult GmbH
Data processing on our website
When using the website, we collect information that you provide yourself. In addition, during your visit to the Website, certain information about your use of the Website by us is automatically collected. In data protection law, the IP address also applies as a personal date. An IP address is assigned to each device connected to the Internet by the Internet provider so that it can send and receive data.
1. Processing of server log files
In the purely informative use of our website, general information is initially stored automatically (i.e. not via registration) which your browser transmits to our server. By default, this includes: browser type/version, operating system used, accessed page, previously visited page (referrer URL), IP address, date and time of server request and HTTP status code (so-called logfiles).
The processing takes place in order to protect our legitimate interests and is based on the legal basis of the art. 6 para 1 letter f GDPR. This processing serves the technical management and security of the website. The stored data will be deleted after seven days, unless there is a legitimate suspicion of unlawful use on the basis of concrete indications and further examination and processing of the information is necessary for this reason. We are unable to identify you as a data subject based on the information stored. Art. 15 to 22 GDPR can therefore be found acc. Article 11, par. 2 GDPR does not apply, unless you provide additional information to enable your identification in order to exercise your rights set out in these articles.
2. Contact possibilities and requests
Our website contains contact forms through which you can send us messages. The transfer of your data is encrypted. All data fields marked as mandatory fields are necessary to process your request. Failure to provide means that we cannot process your request. The provision of further data is voluntary. Alternatively, you can also send us a message via the contact e-mail. We process the data for the purpose of answering your request.
If your request is directed to the conclusion or execution of a contract with us, art. 6 par. 1 point. b GDPR legal basis for data processing. Otherwise, we process the data based on our legitimate interest in contacting requesting persons. The legal basis for data processing is then art. 6 para 1 letter f GDPR.
3. Registration
In order to place orders and use other functions of the website, registration via the website or, if offered, a check-out via the PayPal direct purchase is required. The required information for registration can be seen from the input mask. The provision of information marked as mandatory information is mandatory in order for registration to be completed. The data provided will be processed for the purpose of providing the service.
The processing is based on the legal basis of the art. 6 para 1 letter b GDPR.
4. Orders
If you order a product via our website, we process personal data exclusively for contract processing or in order to be able to provide you with the ordered product. As part of the booking or ordering process, we only process the data that you yourself have specified in the input mask and, if applicable, payment information. The legal basis for the processing is art. 6 para 1 letter b GDPR. All data fields marked as mandatory fields are necessary to process your booking or order. Failure to provide means that we cannot process your booking or order.
5. Payment service providers
a Stripe
If we offer you the payment service provider Stripe Payments Europe, Ltd. (Ireland, EU) to pay for the ordered products in our online shop, the payment data provided by you in the context of the ordering process will be transmitted to Stripe to the extent necessary to carry out the payment transaction. The legal basis for this data processing is art. 6 para 1 letter b GDPR. In addition, Stripe, as a payment institution under the Money Laundering Act, is obliged to process and retain certain personal data for identity verification and fraud and money laundering prevention. The legal basis for this is Art. 6 para 1 letter c GDPR in connection with the relevant legal obligations.
For more information about Stripe’s data processing, click at: https://stripe.com/en/privacy
Please note that the respective payment information is processed by Stripe on its own responsibility.
b PayPal
If we offer you the payment service provider PayPal of PayPal Europe S.a.r.l. et Cie s.c.a. (Luxembourg, EU) to pay for ordered products in our online shop, the payment data provided by you in the context of the ordering process will be transmitted by us to the payment service provider insofar as this transmission is necessary to carry out the payment transaction. PayPal may transmit to us. Your address data stored with PayPal, which we process exclusively for contract processing. The legal basis for this transmission is art. 6 para 1 letter b GDPR.
For more information on privacy at PayPal click at: https://www.paypal.com/en/webapps/mpp/ua/privacy-full?locale.x=en_EN#r5
Please note that the respective payment information is also processed by payment service providers on their own responsibility.
6. Cookies
We use cookies and comparable technologies ("cookies") on our website. Cookies are small records that are stored by your browser when you visit a website. This marks the browser used and can be recognized by web servers. Through your browser, you have full control over the use of cookies. You can delete the cookies in the security settings of your browser at any time. You can object to the use of cookies by your browser settings in principle or for certain cases.
The use of cookies is partly technically necessary for the operation of our website and thus permitted without the consent of the user. We may also use cookies to provide special features and content, as well as for analytics and marketing purposes. This may also include third-party cookies. We use such technically unnecessary cookies only with your consent in accordance with § 25 Abs. 1 TTDSG and, if applicable, Art. 6 para 1 letter a GDPR. Information on the purposes, providers, technologies used, stored data and the storage duration of individual cookies can be found in the cookie settings of our Consent Management Tool.
7. Consent Management Tool
This website uses the Consent Management Tool Borlabs Cookie of Borlabs GmbH (Germany) to control cookies and the processing of personal data.
The Consent banner enables users of our website to give consent to certain data processing processes or to revoke a given consent. By confirming the "Accept All" button or by storing individual cookie settings, you consent to the use of the associated cookies.
The legal basis for data protection is your consent in the sense of Art. 6 para 1 a GDPR.
In addition, the banner helps us to provide proof of the declaration of consent. For this purpose, we process information about the declaration of consent and further protocol data for this declaration. Cookies are also used to collect this data. The processing of this data is necessary in order to be able to prove a given consent. The legal basis arises from our legal obligation to document your consent (Art. 6 para). 1 lit. c i.V.m. Art. 7 para 1 GDPR.
III. Data processing on our social media pages
We are represented on several social media platforms with a company page. In this way, we would like to offer further opportunities for information about our company and for exchange. Our company has company pages on the following social media platforms:
- Instagram
- LinkedIn
When you visit or interact with a profile on a social media platform, personal data about you may be processed. The information associated with a social media profile used also regularly constitutes personal data. This also captures messages and statements made using the profile. In addition, during your visit to a social media profile, certain information about this is often automatically collected, which can also represent personal data.
1. Visit to a social media site
a Instagram
When we visit our Instagram page, through which we present our company or individual products from our offer, certain information about you is processed. The sole controller for this processing of personal data is Meta Platforms Ireland Limited (Ireland, EU). For more information about Meta’s processing of personal data, click at https://www.facebook.com/privacy/explanation. Meta offers the possibility to object to certain data processing; Information and opt-out options can be found at https://www.facebook.com/settings?tab=ads.
Meta provides us with anonymous statistics and insights for our Instagram page, which help us to gain insights about the types of actions that people take on our site (so-called "page insights"). These page insights are created based on certain information about people who have visited our site. This processing of personal data is carried out by Meta and us as joint controllers. The processing serves our legitimate interest to evaluate the types of actions performed on our site and to improve our site based on these findings. The legal basis for this processing is art. 6 para 1 letter f GDPR.
We cannot assign the information received through the Page Insights to individual user profiles that interact with our Instagram page. We have entered into an agreement with Meta on the processing as joint controller, in which the distribution of data protection obligations between us and Meta is specified. Details about the processing of personal data for the creation of page insights and the agreement between us and Meta can be found at https://www.facebook.com/legal/terms/information_about_page_insights_data. With regard to these data processing processes, you have the opportunity to assert your data subject rights (see "Your rights") against Meta. For more information, see Meta’s privacy policy at https://www.facebook.com/privacy/explanation.
Please note that according to the meta data protection regulations, user data is also processed in the USA or other third countries. Meta transfers user data only to countries for which an adequacy decision of the European Commission according to art. 45 GDPR or on the basis of suitable guarantees according to Art. 46 GDPR.
b LinkedIn
For the processing of personal data when visiting our LinkedIn page, LinkedIn Ireland Unlimited Company (Ireland, EU) is in principle the sole controller. For further information on the processing of personal data by LinkedIn, click at https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy.
When you visit, follow or engage with our LinkedIn company page, LinkedIn processes personal data to provide us with statistics and insights in an anonymized form. This gives us insights into the types of actions that people on our site take (so-called page insights). For this purpose, LinkedIn processes in particular such data that you have already provided to LinkedIn via the information in your profile, such as data on function, country, industry, seniority, company size and employment status. In addition, LinkedIn will process information about how you interact with our LinkedIn company page, such as whether you are a follower on our LinkedIn company page. With the Page Insights, LinkedIn does not provide us with any personal data about you. We only have access to the summarized page insights. It is also not possible for us to draw conclusions about individual members via the information of the page insights. This processing of personal data within the framework of the page insights is carried out by LinkedIn and us as joint controllers. The processing serves our legitimate interest to evaluate the types of actions taken on our LinkedIn company page and to improve our company page based on this knowledge. The legal basis for this processing is art. 6 para 1 letter f GDPR.
We have entered into an agreement with LinkedIn on the processing as a joint controller, in which the distribution of data protection obligations between us and LinkedIn is specified. The agreement is available at: https://legal.linkedin.com/pages-joint-controller-addendum.
Please note that according to the LinkedIn Privacy Policy, personal data is also processed by LinkedIn in the USA or other third countries. LinkedIn only transfers personal data to countries for which an adequacy decision of the European Commission according to art. 45 GDPR or on the basis of suitable guarantees according to Art. 46 GDPR.
c) YouTube
When visiting our YouTube page, through which we present our company in or with videos, certain information about you is processed. The sole controller for this processing of personal data is the operating company of YouTube, namely Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Every access to one of the individual pages of this website, which is operated by the service provider for us and on which a YouTube component (YouTube video) has been integrated, the Internet browser on the data subject's information technology system is automatically prompted by the respective YouTube component to download a representation of the corresponding YouTube component from YouTube. More information on YouTube can be found at https://www.youtube.com/yt/about/en/ As part of this technical process, YouTube and Google are informed about which specific subpage of our website is visited by the person concerned.
If the affected person is logged into YouTube at the same time, YouTube recognizes by calling up a subpage containing a YouTube video which specific subpage of our website the affected person visits. This information is collected by YouTube and Google and assigned to the respective YouTube account of the person concerned. YouTube and Google receive information via the YouTube component that the data subject has visited our website whenever the data subject is simultaneously logged into YouTube at the time of accessing our website, regardless of whether the data subject clicks on a YouTube video or not. If such a transmission of this information to YouTube and Google is not desired by the data subject, he can prevent the transmission by logging out of his YouTube account before calling up our website.
The privacy policy published by YouTube, available at https://policies.google.com/privacy?hl=en&gl=en, provides information on the collection, processing and use of personal data by YouTube and Google.
On smartphones and tablets, the aforementioned services are often not implemented by plugins, but by a device-internal "sharing" function. According to its settings, information can also be given to other social media service providers. Please see details of this in your device information.
2. Comments and direct messages
We also process information that you have provided to us via our company page on the respective social media platform. Such information can be the user name used, contact data or a message to us. These processing operations are carried out by us as the sole controller. We process this data based on our legitimate interest in contacting requesting persons. The legal basis for data processing is art. 6 para 1 letter f GDPR. Further data processing can take place if you have consented (Art. 6 para). 1 letter a GDPR) or if this is necessary to fulfill a legal obligation (Art. 6 para. 1 letter c GDPR.
IV. Further data processing on our
1. Contact by email
If you send us a message via the contact e-mail provided, we will process the transmitted data for the purpose of answering your request. We process this data based on our legitimate interest in contacting requesting persons.
The legal basis for data processing is art. 6 para 1 letter f GDPR.
2. Customer: Interior and Interested Data
If you, as a customer or interested party, contact our company, we will process your data to establish or carry out the contractual relationship to the extent necessary for this purpose. This regularly includes the processing of the personal master, contract and payment data provided to us as well as contact and communication data of our contact persons:in the case of commercial customers:inside and business partners:in. The legal basis for these processing operations is art. 6 para 1 letter b GDPR.
We also process customer and interested data for evaluation and marketing purposes. These processing operations are carried out on the legal basis of the art. 6 para 1 letter f GDPR and serve our interest to further develop our offer and to inform you specifically about our offers.
Further data processing can take place if you have consented (Art. 6 para 1 letter). a GDPR) or if this is necessary to fulfil a legal obligation (Art. 6 para. 1 letter c GDPR.
3. Use of e-mail address for marketing purposes
We may use your email address provided when registering or ordering to inform you of our own similar products and services we offer.
The legal basis is Art. 6 par. 1 point. f DSGVO i.V.m. § 7 Abs. 3 UWG. You can object to this at any time without incurring transmission costs other than the basic tariffs. For this purpose, you can unsubscribe by clicking on the unsubscription link contained in each mailing or by e-mail to info@isento.de.
Standing the Data protection declaration: 01. October 2025