Privacy Policy

Controller

Hosting and server log files

This website is delivered via the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you access it, information is automatically stored in server log files (IP address, date and time, page accessed, browser type). This data ensures secure and trouble-free operation (Art. 6 (1) (f) GDPR), is not combined with other data sources and is deleted after a short time. A data processing agreement with Cloudflare is in place. Transfers to the USA are based on the EU-U.S. Data Privacy Framework.

Cookies and consent

This website uses technically necessary cookies and – only with your consent – cookies and similar technologies for statistics and marketing. On your first visit you make your choice in the cookie banner. Via the “Cookie settings” link in the footer you can change your choice or withdraw your consent with effect for the future at any time.

The legal basis for necessary cookies is Section 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR. For all other categories, your consent under Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR is the legal basis.

• Necessary: storing your cookie choice and spam protection of the contact form.
• Statistics: audience measurement with Google Analytics (via Google Tag Manager) and PostHog to improve the content. PostHog is only loaded with your consent; Google Analytics only sets cookies with your consent (see the sections on Google and PostHog).
• Marketing: measuring and personalising Google ads – only with your consent.
• Cookies “_ga” and “_ga_*” – provider: Google – purpose: distinguishing visitors for Google Analytics – duration: up to 2 years – only with consent to “Statistics”.
• Cookie “onna_consent” – provider: ONNA GmbH – purpose: stores your consent decision – duration: 6 months.
• Browser storage “onna-chat” (sessionStorage) – provider: ONNA GmbH – purpose: remembers that you started the live chat so it stays loaded on further pages – duration: until the browser tab is closed. Once started, Zendesk sets its own identifiers (see “Live chat”).
• Browser storage “onna:cloud-check” (localStorage) – provider: ONNA GmbH – purpose: stores your Cloud Check answers and result so you can resume it and attach the result to an enquiry – duration: 30 days, can be deleted via “Start again” or “Delete saved result”.

Web analytics with PostHog

With your consent to the “Statistics” category, we use PostHog, an analytics service of PostHog Inc., USA. The data is processed in PostHog's EU cloud on servers in Frankfurt am Main. Without consent, PostHog is not loaded.

We record pages viewed, time on page, clicks on links and buttons, referring page, device type, browser, screen size and approximate location (country/region), as well as whether an enquiry was submitted or the Cloud Check was completed. Form contents, names and email addresses are not transmitted to PostHog. To recognise you within a session and on later visits, PostHog stores a random identifier in a cookie and in your browser's local storage (prefix “ph_”, duration up to 12 months).

The legal basis is your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time via “Cookie settings” in the footer; the PostHog data in your browser is then deleted. We have concluded a data processing agreement with PostHog. Where access from the USA cannot be ruled out, it takes place on the basis of the EU standard contractual clauses. More information: https://posthog.com/privacy

Google Tag Manager and Google Analytics

We use Google Analytics 4 and Google Tag Manager, services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), with Google's consent mode. Both are loaded on every page view; for technical reasons Google receives your IP address and information about your browser and device.

Without your consent, Google sets no cookies and reads no information from your device. Google Analytics then only sends messages without an identifier (e.g. “page viewed”) that cannot be attributed to a person or device; Google uses them to estimate visitor numbers statistically. No advertising data is transmitted. The legal basis is our legitimate interest in data-minimising audience measurement (Art. 6 (1) (f) GDPR). You can object at any time, e.g. by emailing us or by blocking scripts from googletagmanager.com in your browser.

Google Analytics records how the website is used: pages viewed, time on page, referring page, device, browser, approximate location and events such as a submitted enquiry (without form contents). IP addresses are truncated by Google in the EU and not stored. To recognise you, Google sets cookies (_ga, _ga_*, duration up to 2 years). Google Tag Manager itself does not process usage data but loads the approved services; we use Google's consent mode so that services only operate within your choice.

With your consent to the “Marketing” category, we additionally allow Google to measure and personalise ads.

With your consent to “Statistics”, Google Analytics sets cookies and records usage as described above. The legal basis for this is your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can withdraw at any time via “Cookie settings” in the footer; the Google Analytics cookies are then deleted. We have concluded a data processing agreement with Google. A transfer to the USA is possible; it takes place on the basis of the EU-U.S. Data Privacy Framework, to which Google has certified. More information: https://policies.google.com/privacy

Cloudflare Turnstile (spam protection)

To protect the contact form against automated submissions we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile checks whether a submission originates from a human and processes technical data such as IP address, browser and device information and interaction data. Transfers to Cloudflare in the USA are based on the EU-U.S. Data Privacy Framework, to which Cloudflare has certified.

The legal basis is our legitimate interest in a secure operation of the contact form free from abuse (Art. 6 (1) (f) GDPR). Further information: https://www.cloudflare.com/privacypolicy/

Contacting us

If you contact us by email, phone or via the contact form, your details are stored to process the enquiry and in case of follow-up questions. The contact form is processed on Cloudflare's servers and transmitted as a ticket to our ticket system Zendesk (see “Callback requests and confirmation”). If Zendesk is temporarily unavailable, the enquiry is stored temporarily at Cloudflare, submitted automatically later and deleted immediately afterwards, at the latest after 30 days. Emails to us are processed in our mailbox at Microsoft 365 (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland); a data processing agreement with Microsoft is in place. The legal basis is Art. 6 (1) (b) GDPR (initiation or performance of a contract) or Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). We do not pass this data on without your consent and delete it as soon as it is no longer required for the purpose and no statutory retention obligations apply.

Callback requests and confirmation

If you request a callback via the form, we process your name, phone number and the optional details (company, time slot, topic) in order to call you. The legal basis is Art. 6 (1) (b) GDPR.

We handle enquiries submitted via the form in our ticket system Zendesk (Zendesk, Inc., USA; see “Live chat (Zendesk)” for data processing and transfers to the USA). There, every enquiry receives a ticket number. If you provide an email address, you receive an automatic confirmation with this number so that you know your enquiry has arrived and can refer to it (Art. 6 (1) (b) GDPR); it contains no advertising.

Cloud Check

The Cloud Check is evaluated entirely in your browser. We store your answers and the result for 30 days in your browser's local storage (localStorage) so that you can resume the check and attach the result to a later enquiry. This data does not leave your device unless you submit a form. The legal basis is Section 25 (2) no. 2 TDDDG, as the storage is necessary for the function you are using.

If you submit an enquiry with the box “Attach my Cloud Check result” ticked, we transmit your answers and the result together with the enquiry to prepare the first consultation (Art. 6 (1) (b) GDPR). You can untick the box or delete the saved result at any time.

Live chat (Zendesk)

For the live chat we use Zendesk, a service of Zendesk, Inc., USA. The chat is only loaded when you click “Start chat”; before that, no data is transmitted to Zendesk.

Once started, Zendesk processes your IP address, browser and device information, the page you are on, the content of the chat and any details you provide there. To keep the conversation when you change pages, Zendesk stores identifiers in your browser's local storage or cookies; our website also remembers for the current session that you started the chat.

The legal basis is Art. 6 (1) (b) GDPR (answering your request) or Art. 6 (1) (f) GDPR (legitimate interest in a direct contact channel); storage in your browser is necessary for the chat you explicitly requested (Section 25 (2) no. 2 TDDDG). We have concluded a data processing agreement with Zendesk; transfers to the USA are based on the EU-U.S. Data Privacy Framework or the EU standard contractual clauses. We delete chat histories once they are no longer needed. More information: https://www.zendesk.com/company/agreements-and-terms/privacy-notice/

Use of artificial intelligence (AI)

In the live chat, answers may come from an AI assistant provided by Zendesk. Such answers are labelled as AI-generated in the chat so that you know you are not writing to a human (Art. 50 (1) of the AI Act, Regulation (EU) 2024/1689). AI answers may be incomplete or wrong. Binding offers, prices, appointments and other commitments are given exclusively by our team in text form.

If you do not want to write to an AI assistant, you can reach us at any time by phone or email (see legal notice).

For the AI assistant, Zendesk processes the content of your chat messages under the data processing agreement concluded with us (see “Live chat (Zendesk)”). Please do not enter passwords, access credentials or particularly sensitive data in the chat.

We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing (Art. 22 GDPR). The cloud check works with fixed rules and weightings defined by us and is not an AI system.

Applications

If you apply to us (by email to the address stated on the job pages), we process your details and documents to carry out the application procedure (Section 26 BDSG, Art. 6 (1) (b) GDPR). Only the persons involved in the procedure have access.

If no employment relationship results, we delete the documents six months after the end of the procedure unless you have consented to longer storage for future positions.

Online shop

For orders in the online shop at shop.onna.de, the privacy policy published there applies in addition.

Storage period and obligation to provide data

We only store personal data for as long as necessary for the respective purpose or required by statutory retention obligations (e.g. six or eight years for business letters and accounting records under Section 257 HGB, Section 147 AO). You are not obliged to provide data; without the details marked as mandatory, however, we cannot process an enquiry. No automated decision-making including profiling takes place.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can withdraw any consent given at any time with effect for the future, for example via “Cookie settings” in the footer.

An informal message to info@onna.de is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany (www.ldi.nrw.de).