Privacy Policy

1. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:

Ambylon GmbH
Am Walzwerk 21
45527 Hattingen
Germany
+49 2324 68 35 119
ambylon@ambylon.com
https://ambylon.com

2. General information on data processing

1. Scope of processing personal data

We only process personal data of our users insofar as this is necessary to provide a functional website as well as our content and services. The processing of personal data of our users generally takes place only with the user’s consent. An exception applies in cases in which obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by legal provisions.

2. Legal basis for processing personal data

If we obtain the consent of the data subject for processing personal data, Art. 6 para. 1 sentence 1 lit. a GDPR serves as the legal basis.

When processing personal data is necessary for the performance of a contract to which the data subject is party, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations required to carry out pre-contractual measures.

If processing personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis.

If processing is necessary to protect vital interests of the data subject or another natural person, Art. 6 para. 1 sentence 1 lit. d GDPR serves as the legal basis.

If processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for processing.

3. Deletion of data and storage duration

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless further storage of the data is necessary for concluding or performing a contract.

3. Rights of the data subject

If your personal data are processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

1. Right of access (Art. 15 GDPR)

You have the right to ask us to confirm whether personal data concerning you are being processed.

If this is the case, you have a right of access to these data and the following information:

• Processing purposes
• Categories of personal data
• Recipients or categories of recipients
• Planned duration of storage or the criteria for determining this duration
• The existence of rights to rectification, erasure, restriction or objection
• Right to lodge a complaint with the competent supervisory authority
• Where applicable, origin of the data (if collected from a third party)
• Where applicable, existence of automated decision-making including profiling with meaningful information about the logic involved, as well as the significance and the envisaged consequences
• Where applicable, transfer of personal data to a third country or international organization

2. Right to rectification (Art. 16 GDPR)

If your personal data are inaccurate or incomplete, you have the right to request prompt correction or completion of the personal data.

3. Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of processing of your personal data if one of the following conditions is met:

• You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data.
• In the context of unlawful processing, you refuse the erasure of the personal data and request the restriction of the use of the personal data instead.
• We no longer need your personal data for the purposes of the processing, but you require the data for the establishment, exercise or defense of legal claims, or
• after you have objected to the processing, for the duration of the examination of whether our legitimate grounds override your grounds.

4. Right to erasure ("right to be forgotten") (Art. 17 GDPR)

You have the right to request the immediate erasure of your personal data if one of the following reasons applies:

• Your data are no longer necessary for the purposes for which they were originally collected.
• You have withdrawn your consent and there is no other legal basis for the processing.
• You object to the processing and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR.
• Your personal data have been processed unlawfully.
• Erasure is required to fulfil a legal obligation under Union law or the law of the member state to which we are subject.
• The personal data were collected in relation to the offer of information society services pursuant to Article 8 para. 1 GDPR.

Please note that the aforementioned reasons do not apply insofar as processing is necessary:

• For exercising the right to freedom of expression and information.
• For compliance with a legal obligation or for the performance of a task carried out in the public interest to which we are subject.
• For reasons of public interest in the area of public health.
• For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
• For the establishment, exercise or defense of legal claims.

5. Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format or to request the transmission to another controller.

6. Right to object to certain data processing (Art. 21 GDPR)

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 para. 1 sentence 1 lit. e or f GDPR. This also applies to profiling based on these provisions.

If your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is connected with such direct marketing.

7. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR. A list of the locally competent supervisory authorities in Germany can be found on the website of the Federal Commissioner for Data Protection at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

4. Provision of the website and creation of log files

1. Description and scope of data processing

Every time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.

The following data are collected:

• Information about the browser type and the version used
• The user's operating system
• The user's internet service provider
• Date and time of access
• Websites from which the user's system reaches our website
• IP address

These data are stored in the log files of our system. The user's IP addresses or other data that enable the data to be assigned to a user are not affected by this. No storage of these data together with other personal data of the user takes place.

2. Purpose of data processing

Storage in log files is carried out to ensure the functionality of the website. In addition, the data serve us to optimize the website and to ensure the security of our information technology systems. No evaluation of the data for marketing purposes is carried out in this context.

In these purposes also lies our legitimate interest in data processing pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.

3. Legal basis for data processing

The temporary storage of data is based on Art. 6 para. 1 sentence 1 lit. f GDPR.

4. Duration of storage

The data are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. In the case of data collection for provision of the website, this is the case when the respective session is terminated.

5. Possibility of objection

The collection of data for provision of the website and the storage of data in log files is absolutely necessary for operating the website. The user can object to this. Whether the objection is successful is to be determined within the framework of a balancing of interests.

5. Use of cookies

1. Description and scope of data processing

When you visit our website, we use technical tools for various functions, in particular cookies that may be stored on your end device. When you call up our website and at any later time, you can choose whether to allow the setting of cookies in general or which individual additional functions you would like to select. You can make changes in your browser settings or via our consent manager. Cookies are text files or information in a database that are stored on your hard drive and assigned to the browser you are using so that the entity setting the cookie can receive certain information. Below we describe the types of cookies we use:

We use technically necessary cookies that are required for the technical structure of the website. Without these cookies, our website cannot be displayed (completely correctly) or the support functions are not possible.

The following data are stored and transmitted by technically necessary cookies:

• Language settings
• Log-in information
• Entered search terms
• Use of website functions
• IP address

2. Purpose of data processing

The purpose of using technically necessary cookies is to ensure the functionality of our website. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized again even after a page change.

We need technically necessary cookies for the following applications:

• Adoption of language settings
• Remembering search terms
• Functionality of the website

3. Legal basis for data processing

The provisions of the Telecommunications Telemedia Data Protection Act (TTDSG) apply to the storage of information in the end user’s device and/or access to information already stored in the end user’s device. If the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, the storage of and access to cookies on your end device is carried out on the basis of Section 25 para. 2 no. 2 TTDSG. This storage and access to information on your end device serves to make it easier for you to use our website and to provide you with our services as requested. Some functions of our website also do not work without the use of these cookies and therefore could not be offered. As a rule, the cookies are deleted after the session ends (e.g. when logging out or closing the browser) or after a predetermined period has expired. You can find information on deviating storage periods for cookies in the following sections of this privacy policy.

6. Newsletter

1. Description and scope of data processing

Our website offers the option to subscribe to a free newsletter. When registering for the newsletter, the data from the input mask are transmitted to us.

• E-mail address
• Last name
• First name
• Date and time of registration
• Date and time of the double opt-in for the newsletter registration

No data are passed on to third parties in connection with data processing for the dispatch of newsletters. The data are used exclusively for sending the newsletter.

2. Purpose of data processing

The collection of the user's e-mail address serves to deliver the newsletter.

The collection of other personal data during the registration process serves to prevent misuse of the services or of the e-mail address used.

3. Legal basis for data processing

The legal basis for processing the data after registration for the newsletter by the user is, if consent is given, Art. 6 para. 1 sentence 1 lit. a GDPR.

4. Duration of storage

The data are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. The user's e-mail address is therefore stored as long as the newsletter subscription is active.

The other personal data collected during the registration process are generally deleted after a period of seven days.

5. Possibility of revocation

The newsletter subscription can be terminated at any time by the affected user. For this purpose, there is a corresponding link in every newsletter.

This also enables revocation of consent to the storage of the personal data collected during the registration process.

7. E-mail contact

1. Description and scope of data processing

It is possible to contact us via the e-mail address provided on our website. In this case, the personal data transmitted with the e-mail are stored.

The data are used exclusively for processing the conversation.

2. Purpose of data processing

In the event of contact via e-mail, the necessary legitimate interest in processing the data also lies therein.

3. Legal basis for data processing

The legal basis for processing the data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to answer your inquiry, which you send to us by e-mail, in the best possible way.

If the e-mail contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.

4. Duration of storage

The data are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. For the personal data sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the relevant facts have been conclusively clarified.

The personal data additionally collected during the sending process are deleted at the latest after a period of seven days.

5. Possibility of objection

If the user contacts us by post or e-mail, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

All personal data stored in the course of contacting us will be deleted in this case.

8. Contact form

1. Description and scope of data processing

A contact form is available on our website which can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask are transmitted to us and stored.

At the time the message is sent, the following data are stored:

• E-mail address
• Last name
• First name
• Date and time of contact
• Company name
• Your request

2. Purpose of data processing

The processing of personal data from the input mask of the contact form or via the e-mail address provided serves us solely to process the contact.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

3. Legal basis for data processing

The legal basis for processing data transmitted in the course of sending an e-mail is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest is to answer your inquiry, which you send to us via the contact form, in the best possible way. If the e-mail contact aims at the conclusion of a contract, the additional legal basis for processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

4. Duration of storage

The data are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. For the personal data from the input mask of the contact form and those that were sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is deemed to have ended when it can be inferred from the circumstances that the relevant facts have been conclusively clarified.

The personal data additionally collected during the sending process are deleted at the latest after a period of seven days.

5. Possibility of objection

If the user contacts us via the input mask in the contact form, they may object to the storage of their personal data at any time by post or e-mail.

by post or by e-mail

All personal data stored in the course of contacting us will be deleted in this case.

9. Company presences

Use of company presences in social networks

Instagram:

Instagram, Part of Meta Platforms Ireland Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2 Ireland

On our company page we provide information and offer Instagram users the opportunity to communicate. If you perform an action on our Instagram company presence (e.g. comments, posts, likes etc.), it is possible that you make personal data (e.g. real name or photo of your user profile) public. However, as we generally or to a large extent have no influence on the processing of your personal data by the company Instagram, which is jointly responsible for the Ambylon GmbH company presence, we cannot make binding statements about the purpose and scope of the processing of your data.

We use our company presence in social networks for communication and the exchange of information with (potential) customers. In particular, we use the company presence for:

IT training and marketing of the product Ambylon

The publications on the company presence can contain the following content:

• Information about products
• Information about services
• Advertising
• Customer contact

Each user is free to publish personal data through activities.

Insofar as we process your personal data in order to analyze your online behavior, offer you competitions or carry out lead campaigns, this is based on your explicit declaration of consent, Art. 6 para. 1 sentence 1 lit. a, Art. 7 GDPR. The legal basis for processing personal data for the purpose of communication with customers and interested parties is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest here is to answer your inquiry optimally and to be able to provide the information requested. If the contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.

The data generated by the company presence are not stored in our own systems.

For the processing of your personal data in third countries, we have provided suitable safeguards in the form of standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR. A copy of the standard contractual clauses can be requested from us.

You can object at any time to the processing of your personal data that we collect in the course of your use of our Instagram company presence and assert your data subject rights mentioned under IV. of this privacy policy. To do so, send us an informal e-mail to datenschutz@ambylon.com.
You can find more information on the processing of your personal data by Instagram and the corresponding objection options here:

Instagram: https://help.instagram.com/519522125107875

X (Twitter):

Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland

On our company page we provide information and offer X (Twitter) users the opportunity to communicate. If you perform an action on our X (Twitter) company presence (e.g. comments, posts, likes etc.), it is possible that you make personal data (e.g. real name or photo of your user profile) public. However, as we generally or to a large extent have no influence on the processing of your personal data by the company Instagram, which is jointly responsible for the Ambylon GmbH company presence, we cannot make binding statements about the purpose and scope of the processing of your data.

We use our company presence in social networks for communication and the exchange of information with (potential) customers. In particular, we use the company presence for:

IT training and marketing of the product Ambylon

The publications on the company presence can contain the following content:

• Information about products
• Information about services
• Advertising
• Customer contact

Each user is free to publish personal data through activities.

Insofar as we process your personal data in order to analyze your online behavior, offer you competitions or carry out lead campaigns, this is based on your explicit declaration of consent, Art. 6 para. 1 sentence 1 lit. a, Art. 7 GDPR. The legal basis for processing personal data for the purpose of communication with customers and interested parties is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest here is to answer your inquiry optimally and to be able to provide the information requested. If the contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.

The data generated by the company presence are not stored in our own systems.

For the processing of your personal data in third countries, we have provided suitable safeguards in the form of standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR. A copy of the standard contractual clauses can be requested from us.

You can object at any time to the processing of your personal data that we collect in the course of your use of our X (Twitter) company presence and assert your data subject rights mentioned under IV. of this privacy policy. To do so, send us an informal e-mail to datenschutz@ambylon.com.
You can find further information on the processing of your personal data by Twitter and the corresponding objection options here:

X (Twitter): : https://twitter.com/de/privacy

YouTube:

YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, United States

On our company page we provide information and offer YouTube users the opportunity to communicate. If you perform an action on our YouTube company presence (e.g. comments, posts, likes etc.), it is possible that you make personal data (e.g. real name or photo of your user profile) public. However, as we generally or to a large extent have no influence on the processing of your personal data by the company YouTube, which is jointly responsible for the Ambylon GmbH company presence, we cannot make binding statements about the purpose and scope of the processing of your data.

We use our company presence in social networks for communication and the exchange of information with (potential) customers. In particular, we use the company presence for:

IT training and marketing of the product Ambylon

The publications on the company presence can contain the following content:

• Information about products
• Information about services
• Advertising
• Customer contact

Each user is free to publish personal data through activities.

Insofar as we process your personal data in order to analyze your online behavior, offer you competitions or carry out lead campaigns, this is based on your explicit declaration of consent, Art. 6 para. 1 sentence 1 lit. a, Art. 7 GDPR. The legal basis for processing personal data for the purpose of communication with customers and interested parties is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest here is to answer your inquiry optimally and to be able to provide the information requested. If the contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.

The data generated by the company presence are not stored in our own systems.

For the processing of your personal data in third countries, we have provided suitable safeguards in the form of standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR. A copy of the standard contractual clauses can be requested from us.

You can object at any time to the processing of your personal data that we collect in the course of your use of our YouTube company presence and assert your data subject rights mentioned under IV. of this privacy policy. To do so, send us an informal e-mail to datenschutz@ambylon.com. You can find further information on the processing of your personal data by YouTube and the corresponding objection options here:

YouTube: https://policies.google.com/privacy?gl=DE&hl=de

10. Use of company presences in career-oriented networks

1. Scope of data processing

We use the option of company presences in career-oriented networks. We maintain a company presence on the following career-oriented networks:

LinkedIn:

LinkedIn, Unlimited Company Wilton Place, Dublin 2, Ireland

On our page we provide information and offer users the opportunity to communicate.

The company presence is used for applications, information/PR and active sourcing.

We have no information about the processing of your personal data by the companies jointly responsible for the company presence. You can find more information on this in the privacy policy of:

LinkedIn: https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

If you perform an action on our company presence (e.g. comments, posts, likes etc.), it is possible that you make personal data (e.g. real name or photo of your user profile) public.

2. Legal basis for data processing

The legal basis for processing personal data for the purpose of communication with customers and interested parties is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest is to answer your inquiry optimally and to be able to provide the information requested. If the contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.

3. Purpose of data processing

Our company presence serves to inform users about our services. Each user is free to publish personal data through activities.

4. Duration of storage

We store your activities and personal data published via our company presence until the consent is revoked. In addition, we comply with statutory retention periods.

5. Possibility of objection

You can object at any time to the processing of your personal data that we collect in the course of your use of our company presence and assert your data subject rights mentioned under IV. of this privacy policy. To do so, send us an informal e-mail to the e-mail address stated in this privacy policy.

You can find more information on exercising your rights here:

LinkedIn: https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv

11. Hosting

The website is hosted on servers by a service provider commissioned by us.

Our service provider is:

Klauke Enterprises GmbH & Co. KG
Am Kindergarten 16
59872 Meschede

The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The stored information is:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Date and time of the server request
• IP address

These data are not combined with other data sources. The collection of these data is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest in processing these data is to display our website without errors and to optimize its functions.

The location of the website's server is geographically in Germany.

12. Geotargeting

We use the IP address and other information provided by the user (in particular postal code as part of registration or order) for regional targeting (so-called "geotargeting").

Regional targeting serves, for example, to automatically show you regional offers or advertising that are often of greater relevance to users. The legal basis for using the IP address and, if applicable, other information provided by the user (in particular postal code) is Art. 6 para. 1 lit. f GDPR, based on our interest in ensuring more precise targeting and thus providing offers and advertising with higher relevance for users.

Part of the IP address and the additionally provided information (in particular postal code) are merely read and not stored separately.

You can prevent geotargeting by using, for example, a VPN or proxy server that prevents precise localization. In addition, depending on the browser used, you can also deactivate location determination in the corresponding browser settings (if supported by the browser).

We use geotargeting on our website for the following purposes:

• Language settings

13. Registration/Billing

1. Description and scope of data processing

Our website offers users the opportunity to register by providing personal data. The data are entered in an input mask and transmitted to us and stored. The data are not passed on to third parties. The following data are collected during the registration process:

• E-mail address
• Last name
• First name
• Pseudonym
• Address
• Date and time of registration
• Company name

As part of the registration process, the user's consent to the processing of these data is obtained.

2. Purpose of data processing

User registration is required to fulfil a contract with the user or to carry out pre-contractual measures - for the general technical feasibility of the offers, to store course progress, to create course certificates and as a basis for carrying out fee billing.

3. Legal basis for data processing

The legal basis for processing the data is Art. 6 para. 1 sentence 1 lit. a GDPR if the user has given consent.

If registration serves to fulfil a contract to which the user is party or to carry out pre-contractual measures, the additional legal basis for processing the data is Art. 6 para. 1 sentence 1 lit. b GDPR.

4. Duration of storage

The data are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected.

This is the case for data collected during the registration process to fulfil a contract or to carry out pre-contractual measures when the data are no longer required for the performance of the contract. Even after termination of the contract, it may be necessary to store personal data of the contractual partner in order to comply with contractual or legal obligations.

5. Possibility of withdrawal in the event of consent

As a user, you can cancel the registration at any time. You can have the data stored about you changed at any time.

Account cancellation or changes to data are made within the user account.

If the data are necessary to fulfil a contract or to carry out pre-contractual measures, premature deletion of the data is only possible insofar as contractual or legal obligations do not oppose deletion.

6. Payment service / billing

To fulfil the contractual costs of the respective account, we provide the payment service provider Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands outside our environment.

14. Google AdSense (Activated for Lite users only, Pro users are not affected)

This website uses the Google AdSense service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google AdSense is used to integrate advertisements and enables remuneration through their display or clicks.

Type of data processed

Depending on the user's consent, the following information can be processed:

• Device information (browser, operating system, IP address - possibly shortened/anonymized)
• Time and frequency of page views
• If applicable, cookies and similar technologies for recognition (e.g. "IDE", "ANID")
• Interactions with ads
• Pseudonymous usage profiles (only with consent for personalized advertising)

Legal basis

Processing takes place - depending on the type of ads - on the following bases:

• Art. 6 para. 1 lit. a GDPR - Consent (for personalized ads or when setting non-essential cookies)
• Art. 6 para. 1 lit. f GDPR - Legitimate interest (for non-personalized ads without tracking)

Personalization only occurs if the user expressly consents.

Consent management

A cookie banner is displayed when the website is first accessed.

Only after consent are:

• Advertising cookies set
• Tracking functions activated
• Personalized ads loaded

Without consent, only non-personalized ads are delivered that do not allow the creation of individual user profiles.

Data transfer to third countries

A transfer to the USA cannot be ruled out. Google uses standard contractual clauses in accordance with Art. 46 GDPR to ensure an adequate level of protection.

Storage duration

Google stores data for different lengths of time, depending on the type of cookie and its own internal policies.

IP addresses are usually stored in a shortened/anonymized form.

Deactivation of personalized ads

Users can deactivate personalized advertising at any time at:

https://adssettings.google.com

Further information

Google's privacy policy:

https://policies.google.com/privacy

Information on advertising technologies:

https://policies.google.com/technologies/ads