Privacy

Privacy Statement

We manage our websites pursuant to the principles detailed in the following:
We undertake to comply with the statutory regulations for data protection and do our best to avoid the collection of data and to minimize the data volume at all times.

1. Name and address of the Controller and the Data Security Officer

a) The Controller

The Controller in the sense of the General Data Protection Regulation and other national privacy acts of the Member States of the European Union and of other privacy laws is:

HMI Project GmbH
Frankfurter Str. 92
97082 Würzburg

E-Mail: datenschutz@hmi-project.com
Phone: 0931 / 45 32 97 70

www.hmi-project.com

b) The Data Security Officer

The address of the Controller’s Data Security Officer is:
SiDIT GmbH, www.sidit.de, E-Mail: info@sidit.de

2. Terms

We designed our Privacy Statement in keeping with the principles of clarity and transparency. If you are uncertain regarding the use of specific terms, please refer to the respective definitions here.

3. Legal basis for processing of personal data

We process your personal data, such as your name and first name, email address and IP address etc., only if there is a legal basis for such processing. According to the General Data Protection Regulation, processing primarily takes place pursuant to the following regulations:

• Point (a) of Article 6(1) S. 1 GDPR: The data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• Point (b) of Article 6(1) S. 1 GDPR: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Point (c) of Article 6(1) S. 1 GDPR: Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Point (d) of Article 6(1) S. 1 GDPR: Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
• Point (e) of Article 6(1) S. 1 GDPR: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
• Point (f) of Article 6(1) S. 1 GDPR: Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

In the respective places of this Privacy Statement, we will point out to you once more the legal basis on which your personal data will be processed.

b) Consent of the legal guardian pursuant to Art. 8 para. 1 sentence 2 alt. 2 GDPR

A legal guardian must consent to all data processing within the scope of this website for which the consent of a minor who has not yet reached the age of 16 is required.
Information on the individual data processing operations, their purposes and the categories of data concerned for which the consent of the data subject is required can be found in the privacy policy.

You can revoke your consent at any time by sending a declaration of revocation in text form to the contact details of the controller. The processing remains lawful until revocation.

c) Processing of information in accordance with §25 (1) TDDDG

We also process information in accordance with §25 (1) TDDDG by storing information on your terminal equipment or accessing information that is already stored on your terminal equipment. This may involve both personal information and non-personal data, e.g. cookies, browser fingerprints, advertising IDs, MAC addresses and IMEI numbers. Terminal equipment is any equipment directly or indirectly connected to the interface of a public telecommunications network for sending, processing or receiving messages, Section 2 (2) No. 6 TDDDG.

As a rule, we process this information on the basis of your consent, §25 (1) TDDDG.

Insofar as an exception according to §25 para. 2 no. 1 and no. 2 TDDDG is given, we do not require consent. Such an exception is given if we only access or store the information in order to transmit a message via a public telecommunications network or if this is absolutely necessary so that we can provide a telemedia service expressly requested by you. You can withdraw your consent at any time.

We inform you that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4. Forwarding of personal data

The disclosure of personal data is also considered processing in the sense of the above paragraph 3. However, at this point we would like to give you specific information on the subject of disclosure to third parties. The protection of your personal data is a top priority for us. For this reason, we are particularly cautious when it comes to disclosing your data to third party.

Thus, we will only allow third parties access to your data if there is a legal basis for processing. For example, we disclose personal data to persons or companies commissioned to process data on our behalf as processors pursuant to Article 28 GDPR. A processor is a party commissioned to process personal data on our behalf, i.e. subject to our instructions and supervision.

In accordance with the requirements of the GDPR, we conclude a contract with each of our processors to oblige them to comply with data protection regulations and thus comprehensively protect your data.

5. Period of retention and erasure

We will erase your personal data as soon as they are no longer required for the purposes for which they were collected or otherwise processed, and if processing is not required for exercising the right to freedom of expression and information, for meeting a statutory obligation, for reasons of public interest, or for asserting, exercising or defending legal claims.

6. SSL or TLS encryption

This website uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as the requests you send to us as the website operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.
If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

7. Use of AI Systems (Artificial Intelligence)

To optimize our processes and improve your personalized visitor experience on our website, your personal data may be processed using artificial intelligence (AI) technologies. AI is used in particular to:

• perform data analysis,
• make predictions,
• address security vulnerabilities,
• and streamline routine processes.

The AI we use operates in accordance with the principles of the GDPR. Any decisions that have legal or similar implications for you are not made solely by AI but are supplemented by human intervention.

8. Cookies

We use cookies on our website. Cookies are small data packets that your browser automatically creates and that are stored on your end device when you visit our website. These cookies are used to store information in connection with the end device used.
When cookies are used, a distinction is made between technically necessary cookies and “other” cookies. Technically necessary cookies are those that are absolutely necessary in order to provide an information society service that you have expressly requested.

a) Technically necessary cookies

In order to make the use of our website more convenient for you, we use technically necessary cookies, which may be so-called session cookies (e.g. language and font selection, shopping cart, etc.), consent cookies, cookies to ensure server stability and security or similar. The legal basis for the cookies results from Art. 6 para. 1 sentence 1 lit. f) GDPR, our legitimate interest in the error-free operation of the website and the interest in providing you with our services in an optimized manner.

b) Other cookies

Other cookies include cookies for statistical, analytical, marketing and retargeting purposes.
We use these cookies for you on the basis of your consent in accordance with Art. 6 para. 1 sentence 1 lit. a) GDPR.

You may revoke your consent to the use of cookies at any time.

Please be advised that revoking your consent does not affect the lawfulness of the processing carried out on the basis of your consent prior to revocation.

To do so, you can either edit your cookie settings on our website, disable the use of cookies in your browser settings (though this may also limit the functionality of the online service), or opt out of the relevant service on a case-by-case basis.

For each service, we specify in the Privacy Policy the legal basis on which this data is processed.

9. Consent Banner / Consent Management

To obtain consent for the cookies we use, we employ the “Cookiebot” consent banner provided by the service provider Usercentrics A/S (Cybot), Havnegade 39, 1058 Copenhagen, Denmark. This service sets a so-called consent cookie to query and process the respective consent status. This consent cookie is technically necessary and is therefore used based on our legitimate interest pursuant to Art. 6(1)(f) GDPR and § 25(1) TDDDG.

For the use of certain services provided by the Google/Alphabet Group, we use what is known as Google Consent Mode V2 in Basic Mode. Details about this consent mode can be found on Google’s website at developers.google.com/tag-platform/security/guides/consent.
The use of Consent Mode is technically necessary and is therefore implemented based on our legitimate interest pursuant to Article 6(1), sentence 1, letter f of the GDPR.

10. Collection and storage of personal data and the nature and purpose of its use

10. Collection and Storage of Personal Data, as well as the Nature and Purpose of Its Use

a) External Hosting

Our website is hosted by Host Europe GmbH, c/o Spaces, Gertrudenstraße 30-36, 50667 Cologne, Germany. For this reason, all personal data collected on our website is stored on our host’s servers, unless a third-party service is integrated. This may include your IP address, email address, communication data, or similar information. You can find out exactly what personal data is involved below in the descriptions of the individual functions and services we provide. If we use an external third-party service, this will be clearly indicated in the description of the respective service or tool.
The hosting provider processes your data only on our instructions and to the extent necessary to fulfill the services on the website. The hosting provider does not process the data for its own purposes. We have entered into a data processing agreement with the hosting provider.

b) When Visiting the Website

When you visit our website, the browser on your device automatically sends information to our website’s server. This information is temporarily stored in a so-called log file. The following information is collected without any action on your part and stored until it is automatically deleted:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the file accessed
• Website from which the access originated (referrer URL)
• Browser used and, if applicable, your computer’s operating system, as well as the name of your Internet service provider

We process the aforementioned data for the following purposes:

• To ensure a smooth connection to the website
• To analyze errors

Data that could be used to identify you, such as your IP address, will be deleted no later than 7 days after collection. If we store the data beyond this period, it will be pseudonymized so that it can no longer be linked to you.

The legal basis for data processing is Article 6(1)(f) of the GDPR. Our legitimate interest stems from the purposes of data collection listed above. Under no circumstances do we use the collected data for the purpose of identifying you personally.

c) Cloudflare

On our website, we use a so-called Content Delivery Network (“CDN”) as well as a web firewall to defend against DDoS attacks provided by the technology service provider Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”).
For this purpose, Cloudflare may process IP addresses, information regarding the routing of data traffic and system configuration, as well as other information about traffic destined for or originating from websites.
For the CDN, the transfer of information between the browser and our server is technically routed through Cloudflare’s network, allowing us to optimize the loading speeds of our website. The web firewall is designed to prevent fraudulent transactions, unauthorized access to our services, and other illegal activities.
Processing is carried out in accordance with Article 6(1)(f) of the GDPR based on our legitimate interest in the secure and efficient provision of our website, as well as in improving its stability and functionality.
We have entered into the Standard Contractual Clauses (Data Processing Addendum) with Cloudflare.
For more information, please see Cloudflare’s Privacy Policy at: cloudflare.com/privacypolicy

d) Google Tag Manager

We use Google Tag Manager from Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on our website. Google Tag Manager is an administration and management tool that allows other tracking and/or analytics tools to be centrally managed and deployed.
When you visit our website, Google Tag Manager collects and processes your IP address, which may also be transferred to the United States. However, Google Tag Manager itself does not create user profiles or perform analyses.
The use of Google Tag Manager is based on your consent pursuant to Article 6(1)(a) of the GDPR.
We have entered into a data processing agreement with Google.
You can find Google’s Privacy Policy here: google.com/policies/privacy

e) Contact Form

We provide a form on our website so that you can contact us at any time. To use the contact form, you must provide a name so we can address you personally and a valid email address so we can contact you; this allows us to identify the sender of the inquiry and process it.

When you submit inquiries to us via the contact form, the information you provide in the form—including the contact details you enter there and your IP address—will be processed in accordance with Article 6(1)(b) and (f) of the GDPR to carry out pre-contractual measures in response to your inquiry or to pursue our legitimate interest, namely the conduct of our business activities.

The inquiries and the associated data will be deleted no later than 3 months after receipt, unless they are required for a subsequent contractual relationship.

We use the HubSpot service, provided by HubSpot Germany GmbH, Kopernikusstraße 1, 85737 Unterföhring (“HubSpot”), to manage contact forms and process inquiries.

In connection with the use of HubSpot Forms, we use—with your consent—cookies and similar technologies from HubSpot to analyze the use of our forms and websites, optimize our marketing activities, and recognize returning visitors. The following data, among others, may be processed in this context: IP address, timestamps, pages visited, form submissions, device and browser information, and a user ID assigned by HubSpot.


HubSpot Germany GmbH uses its affiliate HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA, to provide these services. It therefore cannot be ruled out that your data may be accessed from the United States in connection with the use of HubSpot.
The United States is a third country within the meaning of the GDPR. An adequacy decision by the European Commission exists for HubSpot based on the EU-US Data Privacy Framework (Art. 45 GDPR), provided that HubSpot, Inc. is certified accordingly. In addition, we enter into the Standard Contractual Clauses issued by the European Commission with HubSpot and agree on supplementary safeguards as necessary.

We have entered into a data processing agreement with HubSpot. HubSpot does not have the right to disclose your data.

f) Newsletter

Newsletter Content and Registration Information

We will only send you our newsletter, conduct statistical surveys and analyses, and log the registration process if you subscribe to the newsletter and have provided your consent in accordance with Article 6(1), sentence 1, letter a of the GDPR and Section 25(1) of the TDDDG.

The contents of the newsletter are specifically described when you subscribe. To subscribe to the newsletter, simply provide your email address. If you provide additional voluntary information, such as your name and/or gender, this information will be used exclusively to personalize the newsletter sent to you.

Withdrawal

If you no longer wish to receive our newsletter, you may withdraw your consent at any time with future effect. To do so, you can click the link to unsubscribe from the newsletter at the bottom of each newsletter or send us an email to the following email address: datenschutz@hmi-project.com

Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

Double Opt-In and Logging

For security reasons—to prevent anyone from subscribing using someone else’s email address—we use the so-called double opt-in procedure for newsletter subscriptions. Therefore, after you subscribe to our newsletter, you will first receive an email asking you to confirm your subscription. Your subscription becomes effective only upon confirmation.

Furthermore, your newsletter subscription is logged. This logging includes the storage of the time of registration and confirmation, the data you provided, and your IP address. If you make changes to your data, these changes are also logged.

Use of “HubSpot”

Registration is handled through the “HubSpot” newsletter service, which is provided by HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin.

The email addresses of our prospective customers, as well as their other data described in this notice, are stored on HubSpot’s servers in Europe; however, it cannot be ruled out that, in certain cases—such as for support purposes or through subcontractors—access may occur from the United States.

HubSpot uses this information to send and analyze the participation links on our behalf. Furthermore, according to HubSpot’s own information, HubSpot may use this data to optimize or improve its own services—for example, to technically optimize the delivery and display of the invitation, or for business purposes to determine which countries the recipients are from. However, HubSpot does not use the data of our prospective customers to contact them directly or to disclose it to third parties.
We have entered into a data processing agreement with HubSpot. HubSpot has no right to disclose your data.

You can find HubSpot’s privacy policy here legal.hubspot.com/de/privacy-policy.

11. Analytics and Tracking Tools

a) Google Analytics

We use Google Analytics on our website, a web analytics service provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; hereinafter “Google”).

In this context, Google Analytics uses cookies (see Section 7). The information generated by the cookie regarding your use of this website, such as

• the name and version of the browser used
• your computer’s operating system
• the website from which access is made (referrer URL)
• the IP address of the requesting computer
• the time of the server request
  is generally transmitted to a Google server in the United States and stored there.
  Your IP address is automatically anonymized by Google before it is recorded via EU domains and servers. Therefore, your IP address is neither logged nor stored.

On our behalf, Google will use this information to evaluate your use of our website, to compile reports on website activity, and to provide us with other services related to website and internet usage. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. We have entered into a data processing agreement with Google. Please click here to view an overview of Google’s privacy policy.

The legal basis for the use of Google Analytics is your consent pursuant to Art. 6(1)(a) of the GDPR and § 25(1) of the TDDDG. You may revoke your consent at any time by changing the cookie settings on our website.

b) HubSpot

We use HubSpot’s CRM software, provided by HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, which allows us to manage our customer data and conduct online marketing. Among other things, this involves analyzing landing pages and generating reports. In doing so, we use so-called “web beacons” and cookies. In this context, the following personal data may be processed:

• IP address,
• geographic location,
• browser type,
• duration of the visit,
• pages visited,
• visitor sources via UTM parameters.

The IP address is processed on HubSpot’s European servers and stored only in a truncated form.
We use the information collected to continuously optimize and improve our website and make it more user-friendly for you. In addition, we use this information to analyze which of our company’s services are of interest to customers, users, and newsletter subscribers in order to contact them for promotional purposes.
We have entered into a data processing agreement with HubSpot. HubSpot has no right to disclose your data.
You can find HubSpot’s privacy policy here.

c) Matomo (formerly “Piwik”)

We use the analytics service Matomo (InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand), which uses cookies. These are stored on your computer and enable us to analyze how our website is used.
The cookies contain usage information and transmit it to our server, where it is stored for the purpose of analyzing usage and helping us optimize our website. The usage information also includes your IP address; however, it is truncated so that it is anonymized and you remain anonymous as a user.

We have entered into a data processing agreement with Matomo.

For more information on data protection at Matomo, please visit: matomo.org/privacy-policy
We do not share the information generated by the cookie with third parties.
The legal basis for the use of Matomo is your consent pursuant to Art. 6(1)(a) GDPR, § 25(1) TDDDG. You may revoke your consent at any time by changing the cookie settings on our website.

12. Image, sound and video integration

a) Vimeo

We embed videos from Vimeo.com, Inc. (330 West 34th Street, 5th Floor, New York 10001, USA) on our website using iFrames and/or plug-ins.

When you play a Vimeo video during your visit, a connection is established with Vimeo’s servers, and the Vimeo server is informed which of our pages you have visited. This allows Vimeo to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your user account before visiting our website. In addition, when the service is launched, Vimeo sets various cookies to, according to its own statements, improve the services it offers and prevent misuse.
Further information on data processing and privacy policy details from Vimeo can be found at vimeo.com/privacy.
The legal basis for this is the consent you have provided in accordance with Art. 6(1)(a) of the GDPR. You may revoke your consent at any time by changing the cookie settings on our website.

b) YouTube

We embed videos from YouTube, which is operated by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), into our website using iFrame and/or a plug-in. We have activated YouTube's extended data protection mode when embedding the videos.

If you play a YouTube video during your visit, a connection is established with YouTube’s servers, and the YouTube server is notified of which of our pages you have visited. This allows YouTube to link your browsing behavior directly to your personal profile. You can prevent this by logging out of your account before visiting our website. In addition, when the service is launched, YouTube sets various cookies to, according to its own statements, improve the services it offers and prevent misuse.
For more information on how user data is handled and the cookies set, please see YouTube’s Privacy Policy at: google.de/intl/de/policies/privacy

By integrating YouTube, Google Fonts are also dynamically reloaded without the website operator or visitor actively determining this. These web fonts are integrated via a server call, usually a Google server in the USA. This may result in the following information being transmitted to the server and stored by Google:

• Name and version of the browser used
• Website from which the request was triggered (referrer URL)
• Operating system of your computer
• Screen resolution of your computer
• IP address of the requesting computer
• Language settings of the browser or operating system used by the user

For more information, please refer to Google's privacy policy, which you can access here: www.google.com/policies/privacy/

The legal basis is your consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time by changing the cookie settings on our website.

13. Data subject’s rights

You have the following rights:
a) Information to be provided

According to Article 15 GDPR, you have the right to obtain information concerning your personal data processed by us. This right comprises information on

• the purposes of processing
• the categories of personal data
• the recipients or categories of recipients to whom your data have been or will be disclosed
• the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period
• the existence of the right to rectification, erasure, restriction of or objection to processing
• the right to lodge a complaint with a supervisory authority
• where the personal data are not collected from the data subject, any available information as to their source
• the existence of automated decision-making, including profiling, and if applicable meaningful information about the details

b) Rectification

According to Article 16 GDPR, you have the right to obtain rectification without undue delay of inaccurately or incompletely stored personal data concerning you.

c) Erasure

According to Article 17 GDPR, you have the right to obtain from us the erasure of personal data concerning you without undue delay unless further processing is required for one of the following grounds:

• the personal data are still needed in relation to the purposes for which they were collected or otherwise processed
• to execute the right to freedom of opinion and information
• to meet a legal obligation requiring processing in compliance with a legal obligation in European Union or Member State law to which the controller is subject, or requiring processing to fulfill a task which is in the public interest or is carried out in the execution of the public authority vested in the controller
• for reasons of public interest in the field of public health pursuant to points (h) and (i) of Article 9(2) and Article 9(3) GDPR
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing
• for assertion, execution or defense of legal claims

d) Restriction of processing

Pursuant to Article 18 GDPR, you can request the restriction of processing of your personal data for one of the following reasons:

• you contest the accuracy of your personal data;
• the processing is unlawful and you oppose the erasure of the personal data;
• we no longer need the personal data for the purposes of processing, but you require them for the establishment, exercise or defense of legal claims;* you have objected to processing pursuant to Article 21(1) GDPR.

e) Information

If you have requested the rectification or erasure of your personal data or a restriction of processing pursuant to Article 16, Article 17(1) and Article 18 GDPR, we will notify all recipients to whom your personal data has been disclosed unless this proves impossible or involves a disproportionate effort. You have the right to obtain from us the names of these recipients.

f) Data portability

You have the right to receive your personal data provided to us in a structured, commonly used and machine-readable format.
You also have the right to obtain transmission of those data to a third party provided the processing was carried out by automated processes and is based on consent pursuant to point (a) of Article 6(1) S. 1 or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1) S. 1 GDPR.

g) Withdrawal of consent

According to Article 7(3) GDPR, you have the right to withdraw the consent given to us at any time. Withdrawing your consent will not affect the lawfulness of the processing carried out based on your consent until withdrawn. In future, we will not be allowed to continue data processing based on your consent which has been withdrawn.

h) Complaint

According to Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes this Regulation.

i) Objection

If your personal data are processed based on legitimate interests pursuant to point (f) of Article 6(1) S. 1 GDPR, you have the right to object to processing of your personal data pursuant to Article 21 GDPR if there are grounds relating to your particular situation or if the objection is related to direct marketing. In the latter case, you have a general right to object which we will comply with without you having to demonstrate your particular situation. To exercise your right to revoke or object, just send an email to datenschutz@hmi-project.com

j) Automated decision in the individual case including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision

i. is required for the conclusion or execution of a contract between you and us
ii. is permitted by legislation of the European Union or the Member States to which we are subject and that legislation contains appropriate measures to safeguard your rights and freedoms and your legitimate interests
iii. is made with your express consent

However, these decisions must not be based on specific categories of personal data pursuant to Article 9(1) GDPR, unless point (a) or (g) of Article 9(2) GDPR applies and suitable and specific measures have been taken to safeguard your fundamental rights and freedoms and interests.
Regarding the cases i) and iii), we shall take appropriate measures to safeguard your rights and freedoms and your legitimate interests, as a minimum including the right to obtain the intervention of a person from our side, to explain your own point of view and to object against the decision.

14. Amendment of the Privacy Statement

Any amendment of our Privacy Statement will be made known by a respective note on our website.
As of: 25.08.2026