Privacy notice

1. Controller

The controller is Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau, Germany, represented by managing director Mathieu Tarnus. You can contact us at this postal address or by email:

2. Hosting and access data

The website is hosted on a virtual server in Germany. Opening a page involves processing the connection data needed to deliver it. This includes IP address, time, requested page or file, data volume, response status and any browser, operating system or referring-page information transmitted by your browser.

The data is used to deliver content, resolve faults and prevent attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a reliable and secure website. The hosting provider processes the data needed to operate, maintain and protect it.

3. Cloudflare

We use Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, for domain resolution. This involves technical DNS query data so that the domain name can be matched to the appropriate server.

When proxying is enabled, website traffic also passes through Cloudflare’s network. Cloudflare then processes information including IP addresses, request metadata and security information to deliver and cache content and protect against attacks. With DNS-only use, the web server delivers the website directly.

Necessary delivery and security processing rely on Article 6(1)(f) GDPR. Our legitimate interest is an available, stable service protected against misuse. See the Cloudflare privacy notice and Cloudflare data processing terms for further details. Section 8 covers international transfers.

4. Cookies, content and language

The website itself uses no analytics or advertising cookies and creates no visitor profiles. It stores no data in local storage or session storage. Changing language opens the relevant version without saving a preference. Graphics, stylesheets and scripts load through this domain, and fonts are system fonts. There are no embedded maps, videos, newsletter signup or payment functions.

Enabled Cloudflare protection features may use technical cookies, such as __cf_bm to detect automated traffic or cf_clearance to remember a security check result. Their use and duration depend on the feature involved; details are available in the Cloudflare cookie information.

Storing or accessing information on your device is governed by section 25 TDDDG. Without consent, this is permitted only where section 25(2) applies, for example where it is strictly necessary to provide the service you expressly request. Any personal data processing also requires a data protection basis; necessary security processing relies on Article 6(1)(f) GDPR.

5. Your enquiry

If you contact us by email or post, we process the details you provide to handle and answer your enquiry. These may include your name, contact details, business context and message. You send email through your own email service to the address shown. Email providers may handle its technical transmission and delivery.

Article 6(1)(b) GDPR applies where the enquiry concerns a contract with you personally. For business contact persons and other enquiries, we rely on Article 6(1)(f) GDPR and our legitimate interest in handling and answering the enquiry. Please send health data, other particularly sensitive information and confidential documents only after prior agreement.

6. Quotations and working together

We process contact, order and accounting data needed for quotations, engagements and invoices. Depending on the purpose, Article 6(1)(b) GDPR applies to a contract with the individual, Article 6(1)(c) to legal obligations and Article 6(1)(f) to communication with business contact persons. Our legitimate interest is organising the agreed work.

Where we process personal data on a customer’s behalf within a project, an Article 28 GDPR agreement defines the tasks and safeguards. Recipient lists cannot be uploaded through this website. Visiting the website or making an enquiry does not automatically add you to a marketing list.

7. Email advertising and unsubscribing

Advertising emails generally require your prior express consent. Article 6(1)(a) GDPR then provides the basis for the related data processing. The existing-customer exception for the sender’s own similar offerings requires every condition of section 7(3) of the German Act Against Unfair Competition to be met. Where it applies, Article 6(1)(f) GDPR may provide the processing basis; our interest is maintaining existing customer relationships. Both competition law and data protection requirements must be satisfied.

Consent records demonstrate permission to contact recipients. Necessary suppression entries ensure that unsubscribe requests are respected. This data is processed only to the extent needed for those purposes. Our Anti-Spam Policy sets out the other sending rules.

You can unsubscribe using the option stated in the message or by contacting this address:

8. Recipients and international transfers

Data is accessible to responsible employees and, as needed for their tasks, hosting, IT security and communications providers. Public authorities or professional advisers may receive data where required by law or necessary to exercise legitimate rights.

Cloudflare may process data in the United States and other countries. Cloudflare identifies the EU-U.S. Data Privacy Framework for covered US transfers and standard contractual clauses for further or alternative safeguards. The applicable mechanism depends on the transfer and relevant agreements. The linked Cloudflare documents explain these arrangements. You can use our contact address to request further information or a copy of the safeguards applicable to your processing. A server in Germany does not mean that all processing takes place there.

9. Retention

We delete personal data when it is no longer needed for its purpose, unless a statutory retention duty or another legal basis requires continued storage. Retention of access data depends on delivery, fault diagnosis and the prevention or investigation of specific security incidents. Longer storage may be needed to investigate an incident or establish or defend legal claims.

Enquiry data is deleted after the matter is concluded unless a business relationship follows or another retention basis applies. Contract and accounting records may be subject to statutory retention periods. Consent evidence and suppression entries are kept only as long as, and to the extent, needed to demonstrate permission or respect an unsubscribe request.

10. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability under Articles 15 to 20 GDPR. You can withdraw consent at any time for the future. This does not affect processing before the withdrawal.

Right to object: Where processing relies on Article 6(1)(f) GDPR, you can object on grounds relating to your particular situation. You can object to direct marketing at any time without giving a reason; your data will then no longer be processed for that marketing. Contact:

You may complain to a data protection supervisory authority, particularly where you live or work or where the alleged infringement occurred. For the company’s registered location, you may contact the Baden-Württemberg State Commissioner for Data Protection and Freedom of Information.

11. Voluntary details and automated decisions

Technical data needed for transmission arises when a page is accessed. You provide further enquiry details voluntarily. Without the information needed to answer, we may be unable to help with your enquiry.

We do not use this website to make automated decisions producing legal or similarly significant effects under Article 22 GDPR. Technical security checks may restrict access where attack or misuse patterns are detected.