Legal

Privacy policy

This is a translation of the German original. In case of doubt, the German version applies: Privacy policy (German)

1. Privacy at a glance

General information

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. For detailed information on data protection, please see the privacy policy set out below this text.

Data collection on this website

Who is responsible for the data collection on this website?

The data processing on this website is carried out by the website operator. You can find their contact details in the section “Information on the controller” in this privacy policy.

How do we collect your data?

Your data is collected firstly by you providing it to us. This may, for example, be data you enter into a contact form.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This is above all technical data (e.g. internet browser, operating system or the time of the page view). This data is collected automatically as soon as you enter this website.

What do we use your data for?

The data is collected in order to provide the website free of errors and to answer your inquiries. Beyond that, we measure the reach of our pages only with your consent (category “Statistics”, see section 3). If you decline or do not decide, your behavior is not analyzed.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have a right to request the rectification or erasure of this data. If you have given consent to data processing, you can revoke that consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this and about any further questions on the subject of data protection.

Analytics tools and third-party content

This website uses one analytics tool: Google Analytics 4, and only after your express consent. If you do not agree, it is not loaded and no cookie is set. There are no ad networks, no cross-site profiling and no sale of data. Details in section 5.

In two places we embed content that is hosted on third-party servers: the background films from Vimeo and two interactive demos in the Showroom. This content is only loaded after you have expressly agreed. Until then you see a still image, and no request goes to the provider concerned. Details are given under “Cookies, local storage and your consent” and “Embedded third-party content”.

2. General information and mandatory information

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection provisions and this privacy policy.

When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

We point out that data transmission over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

Information on the controller

The controller for the data processing on this website is:

SALESYSTEMS Impact Solutions GmbH
Große Reichenstraße 27
20457 Hamburg
Phone: +49 (0) 172 7562314
Email: contact@salesystems.com

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of the processing of personal data (e.g. names, email addresses or similar).

Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data remains with us until the purpose for the data processing ceases to apply. If you assert a justified request for erasure or revoke your consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once those grounds cease to apply.

General information on the legal bases for the data processing on this website

Insofar as you have consented to the data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, where special categories of data under Art. 9 (1) GDPR are processed. In the case of express consent to the transfer of personal data to third countries, the data processing additionally takes place on the basis of Art. 49 (1) (a) GDPR. Insofar as you have consented to the storage of cookies or to access to information on your end device (e.g. via device fingerprinting), the data processing additionally takes place on the basis of § 25 (1) TDDDG. Consent can be revoked at any time. If your data is required for the performance of a contract or for pre-contractual measures, we process your data on the basis of Art. 6 (1) (b) GDPR. Furthermore, we process your data where this is required to fulfill a legal obligation, on the basis of Art. 6 (1) (c) GDPR. The data processing may also take place on the basis of our legitimate interest under Art. 6 (1) (f) GDPR. The legal bases relevant in each individual case are set out in the following paragraphs of this privacy policy.

Recipients of personal data

In the course of our business activities we work with various external parties. In some cases this also requires personal data to be transferred to these external parties. We only pass personal data on to external parties where this is necessary for the performance of a contract, where we are legally obliged to do so (e.g. passing data on to tax authorities), where we have a legitimate interest in passing it on under Art. 6 (1) (f) GDPR, or where another legal basis permits the transfer. Where we use processors, we only pass on our customers’ personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Revoking your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The lawfulness of the data processing carried out up to the revocation remains unaffected by it.

You revoke your consent to the loading of Vimeo films and the Showroom demos in the footer of every page via “Cookie settings”. Revoking is therefore just as easy as agreeing, and it takes effect immediately. Details are given in section 3.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6 (1) (E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT, ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNING YOU, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21 (1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS CONNECTED WITH SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION UNDER ART. 21 (2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged infringement. This right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only take place where it is technically feasible.

Access, rectification and erasure

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to rectification or erasure of this data. You can contact us at any time about this and about any further questions on the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of processing of your personal data. You can contact us at any time about this. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of the personal data we store about you, we usually need time to check this. For the duration of the check, you have the right to request the restriction of processing of your personal data.

If the processing of your personal data was or is unlawful, you can request the restriction of the data processing instead of erasure.

If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of processing of your personal data instead of erasure.

If you have lodged an objection under Art. 21 (1) GDPR, your interests and ours must be weighed against each other. As long as it has not been determined whose interests prevail, you have the right to request the restriction of processing of your personal data.

If you have restricted the processing of your personal data, this data may, apart from being stored, only be processed with your consent or for the establishment, exercise or defense of legal claims or to protect the rights of another natural or legal person or for reasons of an important public interest of the European Union or a member state.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the address line of the browser changing from “http://” to “https://” and by the padlock symbol in your browser line.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

3. Cookies, local storage and your consent

What this website does of its own accord

This website sets no cookies of its own. Nor does it load anything from external servers when you open it: fonts, images, scripts and styles are on our own server. Anyone who visits this page and allows nothing leaves no trace with any third party.

What we are asking about at all

In two places the content is hosted by third parties: the background films (Vimeo) and two interactive demos in the Showroom. They are only loaded once you allow it. As long as you do not, you see a still image there. The page stays fully usable, no text and no function depends on it. Which providers are behind them is set out in section 5.

How the request works

On your first visit, a dialogue opens with the categories. You select or deselect each category individually. The three buttons “Reject all”, “Save selection” and “Accept all” stand next to each other as equals: same level, same size, same color, same weight. The Esc key rejects everything; it never agrees. Before your decision, nothing is stored and nothing is loaded.

One exception on pre-selection: the box “Videos from Vimeo” is ticked when the dialogue first opens, so that the background film plays. It stays a pre-selection, not a permission: the film is only loaded once you press “Save selection” or “Accept all”. “Reject all” and Esc reject it along with everything else. All other categories start empty.

These are the categories:

Necessary (cannot be deselected): records what you have decided. No tracking pixel, no advertising.
Statistics: reach measurement with Google Analytics 4. Not loaded without your agreement. Data may go to the USA.
Videos from Vimeo: the background films on the home page and on “How we build”. Data goes to the USA.
Interactive demos in the Showroom: the 3D website “addmic” and the market analysis. Some of the providers deliver from the USA.

What is stored

Your decision is held in your browser’s local storage (localStorage) under the key salesystems.einwilligung. It contains: the time of the decision, the categories chosen and a version number of the service list. This information stays in your browser. It is transmitted neither to us nor to third parties. No cookie is set for it.

Storing your decision is technically required (§ 25 (2) no. 2 TDDDG): without it we would have to ask you again on every page. It remains until you revoke it or delete your browser data. If the list of embedded services changes, the version number changes, and we ask you again.

The same applies to the switch between dark and light design in the navigation: without your choice, the site follows your device setting (light or dark), and nothing is stored for that. If you use the switch, your browser keeps that choice in local storage under the key salesystems.design. It is stored only when you click, and nothing is transmitted. Without it, every page change would bring back the device setting (§ 25 (2) no. 2 TDDDG).

Language: the start page appears in your browser’s language (German or English; everyone else sees German). When you click the language switch, the site sets the cookie salesystems.sprache with the value “de” or “en”, valid for one year and only for this address. It holds nothing else and is read only to show you the chosen language on your next visit instead of the browser language. This cookie is also technically required (§ 25 (2) no. 2 TDDDG) and is set only by your click.

Revocation: at any time and just as easy as agreeing

In the footer of every page, under “Legal”, there is the entry “Cookie settings”. One click opens the same dialogue. There you can deselect individual categories or revoke everything with “Reject all”. The revocation takes effect immediately: blocked content is no longer loaded. The lawfulness of the processing carried out up to the revocation remains unaffected.

Cookies that a third party has already set (Vimeo, for example) are that party’s responsibility. You delete these in your browser settings.

Legal bases

For the non-necessary categories, the storage of information on your end device and the access to it take place exclusively on the basis of your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Insofar as data is transferred to a third country in the process, that transfer is based on your express consent under Art. 49 (1) (a) GDPR. Storing your decision itself does not require consent under § 25 (2) no. 2 TDDDG; the associated processing is based on Art. 6 (1) (f) GDPR; our legitimate interest is to respect your decision and to be able to prove it.

4. Data collection on this website

Hosting and server log files

This website is hosted by an external service provider. When the pages are called up, that provider automatically collects and stores information in so-called server log files, which your browser transmits: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and the IP address. This data is not merged with other data sources and is not used to analyze your behavior.

The collection is technically imperative for the provision of the website. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a technically error-free and secure presentation). A data processing agreement under Art. 28 GDPR is in place with the hosting provider.

The hosting provider is Railway Corp., 548 Market St PMB 68956, San Francisco, California 94104, USA. Its representative in the EU under Art. 27 GDPR is DP-Dock GmbH, Attn.: Railway Corp., Ballindamm 39, 20095 Hamburg, Germany.

Railway keeps the server log files for a limited period depending on the plan in use and deletes them automatically afterwards; for the plan we use this is 30 days. The data is not combined with other sources.

The transfer to the USA is based on the standard contractual clauses concluded with the provider under Art. 46 (2) (c) GDPR. The USA is a third country without a level of data protection equivalent to the European one: US authorities may under certain circumstances access the data without an effective legal remedy being available to you.

Redirect of the address without “www” (Cloudflare)

This website is located at www.salesystems.com. Anyone who calls up the address without “www” (salesystems.com) is automatically redirected there. This redirect is handled by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, which also operates the name resolution (DNS) of the domain for us. If you call up www.salesystems.com directly, Cloudflare is not involved in delivering the pages.

During the redirect, Cloudflare processes the information that every page request carries: IP address, requested address, time of the request, and browser and operating system. Cloudflare uses it to forward the request and to protect the network against attacks. No cookies are set during the redirect.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is that the website can be reached reliably and securely under both spellings of its address. A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Cloudflare is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is based on the adequacy decision of the European Commission under Art. 45 GDPR, supplemented by standard contractual clauses under Art. 46 (2) (c) GDPR. Details can be found in Cloudflare’s privacy policy at https://www.cloudflare.com/privacypolicy/.

Contact form

The form at Contact currently transmits nothing to our server: when you submit it, your email program opens with a prepared message that you send yourself. Your details therefore reach us as an ordinary email. The following notes apply to the data that reaches us this way.

If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you give there, are stored by us for the purpose of handling the inquiry and in case of follow-up questions. We do not pass this data on without your consent.

This data is processed on the basis of Art. 6 (1) (b) GDPR, insofar as your inquiry is connected with the performance of a contract or is necessary for pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the inquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) insofar as this was requested; consent can be revoked at any time.

The data you enter in the contact form remains with us until you ask us to delete it, revoke your consent to its storage, or the purpose for storing the data ceases to apply (e.g. once your inquiry has been dealt with). Mandatory statutory provisions, in particular retention periods, remain unaffected.

Inquiry by email, telephone or fax

If you contact us by email, telephone or fax, your inquiry including all personal data arising from it (name, inquiry) is stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent.

The data you send us with contact inquiries remains with us until you ask us to delete it, revoke your consent to its storage, or the purpose for storing the data ceases to apply (e.g. once your request has been dealt with). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

5. Embedded third-party content

Everything in this section is blocked until you agree in the consent dialogue. Without consent, your browser does not open a connection to any of these providers.

Google Analytics 4: the reach measurement

We use Google Analytics 4 to measure how often which page is read. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The measurement script is only loaded after you have agreed to the “Statistics” category. Before that, your browser makes no connection to Google and no cookie is set. We deliberately do not use “Consent Mode”, which would load the script before your decision. The loading itself is already a connection.

After your consent, Google processes among other things: the pages you open and how long you stay, an approximate location based on the shortened IP address, the referring page, your browser, operating system and device type. Google shortens your IP address before storing it; we do not combine it with other data sources. Advertising features and cross-device profiles are not enabled.

Google sets the cookies _ga and _ga_<id> with a lifetime of up to two years. The event data is kept at Google for 14 months. If you revoke your consent, we delete these cookies immediately and no further data is sent; data already stored at Google is not affected by this.

Use takes place on the basis of your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Google also processes data in the USA. The transfer is based on your express consent under Art. 49 (1) (a) GDPR and on the standard contractual clauses we have concluded with Google. The USA is a third country without a level of data protection equivalent to the European one: US authorities may under certain circumstances access the data without an effective legal remedy being available to you. Details are set out in Google’s privacy policy at https://policies.google.com/privacy. Consent can be revoked at any time.

Vimeo: the background films

On the home page and on “How we build”, a film hosted by Vimeo runs in the background. The provider is Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA.

After your consent, your browser connects to Vimeo servers and in doing so transmits your IP address as well as technical details about your browser and device. Delivery servers from vimeocdn.com and Cloudflare’s bot protection (challenges.cloudflare.com) are loaded with it. Vimeo sets its own cookies, among them “__cf_bm” for protection against automated access with a lifetime of around 30 minutes; which further cookies Vimeo sets and how long they last is determined by Vimeo.

We call the player with the parameter “Do Not Track” (dnt=1). This limits the analysis by Vimeo, but it does not prevent the connection. What Vimeo bases the data on and how long it stores it is beyond our influence; details are set out in Vimeo’s privacy policy at https://vimeo.com/privacy.

Use takes place on the basis of your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. The transfer to the USA is based on your express consent under Art. 49 (1) (a) GDPR. The USA is a third country without a level of data protection equivalent to the European one: US authorities may under certain circumstances access the data without an effective legal remedy being available to you. Consent can be revoked at any time.

Interactive demos in the Showroom

In the Showroom tour, two screens show real work: the 3D website “addmic” (station 01, 3D web design) and a market analysis (station 02, Market research). Both pages are on our server, but on start-up they fetch code libraries, fonts and images from external providers:

jsDelivr and cdnjs (delivered via Cloudflare, Inc., USA) as well as unpkg and esm.sh: the 3D and charting libraries
Google Fonts, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: fonts inside the demos
Unsplash, Unsplash Inc., Canada, and Poly Haven: photos and environment textures
Railway, Railway Corp., USA: the original analysis page that individual references point to is hosted there

These providers thereby receive your IP address and technical details about your browser and device. We set no cookies in this context; whether the providers set their own cookies and how long these last is beyond our knowledge and our influence.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, and for the transfer to the USA additionally Art. 49 (1) (a) GDPR. The same limitations apply as for Vimeo. Consent can be revoked at any time.

Without consent, these two screens stay a still image. The tour itself and all the other stations work in full. Their content is exclusively on our server.

Links to our Suite

Some buttons link to suite.salesystems.com. A link alone transmits no data. Only when you click it do you call up that page; the notices that apply there then apply.

6. Fonts

The fonts of this website (Darker Grotesque and Inter) are installed locally on our server and delivered from there. When the page is called up, no connection is made to Google servers, and no IP address is transmitted there.

The two interactive demos in the Showroom (section 5) are an exception. These embedded pages load their fonts from Google Fonts, but only after you have agreed. General information on Google Fonts: https://developers.google.com/fonts/faq, Google’s privacy policy: https://policies.google.com/privacy.

7. Audio and video conferences

Data processing

Among other things, we use online conference tools to communicate with our customers. The tools we use in detail are listed below. If you communicate with us by video or audio conference over the internet, your personal data is collected and processed by us and by the provider of the respective conference tool.

The conference tools collect all data that you provide/use in order to use the tools (email address and/or your telephone number). The conference tools also process the duration of the conference, the start and end (time) of participation in the conference, the number of participants and other “context information” in connection with the communication process (metadata).

Furthermore, the provider of the tool processes all technical data required to handle the online communication. This includes in particular IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or loudspeaker as well as the type of connection.

Insofar as content is exchanged, uploaded or otherwise made available within the tool, it is also stored on the servers of the tool providers. Such content includes in particular cloud recordings, chat/instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared during use of the service.

Please note that we do not have full influence over the data processing operations of the tools used. Our options are largely determined by the corporate policy of the respective provider. Further information on the data processing by the conference tools can be found in the privacy policies of the tools used in each case, which we have listed below this text.

Purpose and legal bases

The conference tools are used to communicate with prospective or existing contractual partners or to offer certain services to our customers (Art. 6 (1) (b) GDPR). The use of the tools also serves to simplify and speed up communication with us or with our company in general (legitimate interest within the meaning of Art. 6 (1) (f) GDPR). Insofar as consent was requested, the tools concerned are used on the basis of that consent; consent can be revoked at any time with effect for the future.

Storage period

The data collected directly by us via the video and conference tools is deleted from our systems as soon as you ask us to delete it, revoke your consent to its storage, or the purpose for storing the data ceases to apply. Stored cookies remain on your end device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no influence on the storage period of your data that is stored by the operators of the conference tools for their own purposes. For details, please inquire directly with the operators of the conference tools.

Conference tools used

We use the following conference tools:

Google Meet

We use Google Meet. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details on the data processing can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=en.

The company holds a certification under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA which is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can obtain further information on this from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.