Three different profile systems

Privacy Policy

This privacy policy explains which personal data we process when you visit our website, for what purposes and on what legal basis.

1. Controller
IsoProfil GmbH & Co. KG
Derken 12
42327 Wuppertal
Germany
Phone: +49 202 730043-0
E-mail: info@isoprofil.com

2. Hosting
Our website is hosted by loswebos.de GmbH, Maximilianallee 2, 04129 Leipzig, Germany. The host processes the data generated when you visit the website (in particular the server log files described in section 3) on our behalf. We have concluded a data processing agreement with the host in accordance with Art. 28 GDPR. The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR).

The video in the header of our home page is delivered via the video hosting service Videolyser (provider: Christian Eckardt, Brandstraße 62, 37441 Bad Sachsa, Germany). Videolyser’s servers are located in Germany. When you open the home page, your browser loads the video player and the video directly from Videolyser’s servers; in the process, technically necessary data are transmitted, in particular your IP address, the date and time of the request, information about your browser and the address of our website. The player does not set any cookies and does not store any information on your device. The legal basis is our legitimate interest in delivering the video quickly, economically and with as little data as possible (Art. 6(1)(f) GDPR).

3. Server log files
When you access our website, your browser automatically sends information to our server, which is stored in so-called log files:

  • IP address of the requesting computer,
  • date and time of access,
  • name and URL of the file accessed,
  • website from which the access was made (referrer URL),
  • browser used and, where applicable, the operating system.

We process this data to establish the connection, to operate the website in a stable and secure manner and to detect misuse. The legal basis is Art. 6(1)(f) GDPR. The log files, including the full IP address, are stored for 12 months and then deleted automatically. We do not use this data to draw any conclusions about you personally.

4. Enquiry and contact form
You can use our form to send us an enquiry and attach files (e.g. drawings or sketches). Your name and e-mail address are mandatory; all other details are voluntary. By ticking the box for the privacy information, you confirm that you have read this information. We use the data exclusively to process your enquiry and to prepare a quotation for you.

The form is processed on our own server. Your details and files are transmitted there in encrypted form, checked and delivered to us by e-mail; they are not stored permanently on the web server. Uploaded photos are re-saved in the process, and embedded metadata such as the location (GPS) is removed. Together with your enquiry, we also receive the time of receipt, the language and the address of the page from which you sent the form. We send an automatic confirmation of receipt with your reference number to the e-mail address you provided.

To protect the form against spam and misuse, we use ALTCHA, a check that your browser carries out itself. It runs entirely on our own server, sets no cookies and does not transmit any data to third parties. To limit repeated or automated enquiries, we do not process your IP address in plain text, only as a pseudonymous key value (HMAC with a secret key). These values are deleted about 24 hours after your last enquiry. So that an address receives no more than one confirmation of receipt per day, we store your e-mail address in the same way and for the same period. The technical logs of the form contain neither content nor IP or e-mail addresses and are deleted after 14 days.

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is aimed at concluding a contract, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The legal basis for the protection against misuse is our legitimate interest in operating the form securely (Art. 6(1)(f) GDPR). We delete the data once your enquiry has been dealt with, unless statutory retention obligations (in particular under commercial and tax law) require us to keep it.

5. Contact by e-mail or phone
If you contact us by e-mail or phone, we process your details in order to deal with your request. The legal basis and deletion are as described in section 4.

6. Job applications
We process applications that you send us by e-mail or post – for example in response to a vacancy on our careers page – in order to carry out the application procedure (Section 26 of the German Federal Data Protection Act (BDSG), Art. 6(1)(b) GDPR). If no employment relationship results, we delete your documents six months after the end of the procedure, unless you have consented to longer storage.

7. Newsletter (Brevo)
If you subscribe to our newsletter, we use your e-mail address and any details you provide voluntarily (e.g. name, company) to send you information about IsoProfil and our products and services. We use the double opt-in procedure: after signing up, you receive an e-mail in which you confirm your subscription. To be able to prove your subscription, we store the time of sign-up and of confirmation as well as your IP address. The legal basis for sending the newsletter is your consent (Art. 6(1)(a) GDPR); for the proof of subscription, it is our legitimate interest (Art. 6(1)(f) GDPR).

For sign-up and dispatch we use the Brevo service of Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France. Brevo processes the data on our behalf; a data processing agreement in accordance with Art. 28 GDPR is in place. With your consent, we analyse whether a newsletter was opened and which links were clicked (tracking pixel and redirect links) in order to improve our content.

You can unsubscribe from the newsletter at any time via the unsubscribe link in every e-mail or by e-mail to info@isoprofil.com. We will then remove your address from the mailing list. So that we do not send you any further newsletters after you unsubscribe and can prove earlier consents, your address may remain on a block list (Art. 6(1)(f) GDPR).

8. Disclosure of data
Your personal data will not be transferred to third parties for purposes other than those set out in this privacy policy. We only disclose your personal data to third parties if

  • you have given your express consent in accordance with Art. 6(1)(a) GDPR,
  • disclosure is necessary under Art. 6(1)(f) GDPR to establish, exercise or defend legal claims and there is no reason to assume that you have an overriding interest worthy of protection in your data not being disclosed,
  • there is a legal obligation to disclose the data under Art. 6(1)(c) GDPR, or
  • this is necessary under Art. 6(1)(b) GDPR to perform contracts with you.

Service providers that process data on our behalf (e.g. hosting) are contractually bound in accordance with Art. 28 GDPR.

9. Cookies and consent (Complianz)
We only store information on your device or read it from your device (e.g. cookies) where this is strictly necessary to operate the website (Section 25(2) of the German Telecommunications Digital Services Data Protection Act, TDDDG) or where you have given your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

We obtain your consent using the consent tool Complianz, which runs as a plugin on our own server. Complianz stores your choice in a cookie so that we can respect it on your next visit (legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). Google Analytics, Google Ads, Microsoft Clarity and embedded YouTube videos are only loaded after you have accepted the “Marketing” category in the cookie banner. You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link at the bottom of every page. Details of the individual cookies used can be found in our Cookie Policy.

10. Fonts
The fonts used on this website are hosted locally on our server. No connection to servers of Google or other font providers is established when you visit the website.

11. Web analytics with Matomo (without cookies)
We use the open-source software Matomo to analyse the use of our website statistically and to improve it. Among other things, it records the pages accessed, date and time, the length of the visit, the website you came from and details of your browser, operating system and screen size. Matomo is operated for us by the agency x mind, Boris Hanuschke, Freibühlstraße 19, 78224 Singen, Germany, on its server (xmtrack.de). x mind processes the data exclusively on our behalf; we have concluded a data processing agreement with x mind in accordance with Art. 28 GDPR. The data is not passed on to third parties.

Matomo is configured so that no cookies are set and your IP address is shortened before it is stored; visitors are not recognised across several days and the data is not combined with other data. The legal basis is our legitimate interest in analysing and optimising our website (Art. 6(1)(f) GDPR). You can object to this at any time: if you activate the “Do Not Track” setting in your browser, Matomo does not record your visits.

12. Google Tag Manager
We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). With this tool we integrate Google Analytics (section 13) and Google Ads (section 14). The Tag Manager itself does not set any cookies and does not analyse any data, but it does process your IP address. It is only loaded if you have accepted the “Marketing” category in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Data may also be transferred to the USA in the process (see section 18).

13. Google Analytics 4
With your consent, we use Google Analytics 4, a web analytics service from Google, to analyse the use of our website. Cookies are set and information such as the pages visited, length of visit, device and browser used, approximate location (derived from the shortened IP address) and the source of the visit is processed. Google Analytics 4 does not store full IP addresses. The data may also be transferred to servers of Google LLC in the USA (see section 18).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via the cookie settings. The data is deleted automatically at the end of the retention period we have set, after 14 months at the latest. Further information: policies.google.com/privacy.

14. Google Ads (conversion tracking, remarketing, call tracking)
We place advertisements via Google Ads. With your consent, we measure whether a visitor carries out a certain action after clicking on an ad, such as sending an enquiry (conversion tracking), and whether a call results from an ad. For call tracking, Google may replace our phone number on the website with a forwarding number. We may also show visitors to our website relevant ads in the Google advertising network later on (remarketing). Google sets cookies for this purpose; we only receive aggregated statistics, not data that would allow us to identify you personally. The data may also be transferred to the USA (see section 18).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via the cookie settings. You can also deactivate personalised advertising at adssettings.google.com. Further information: policies.google.com/technologies/ads.

15. Microsoft Clarity
With your consent, we use Microsoft Clarity, an analytics service from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Clarity shows us how visitors use our website: the service records page views, mouse movements, clicks and scrolling and uses them to create heatmaps and recordings of individual sessions. Clarity sets cookies and processes information about your device and browser as well as your IP address. The data may also be transferred to Microsoft Corporation in the USA (see section 18).

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via the cookie settings. Further information: privacy.microsoft.com/en-gb/privacystatement and clarity.microsoft.com/terms.

16. YouTube videos
On some pages we embed videos from the YouTube platform (Google Ireland Limited) in privacy-enhanced mode (youtube-nocookie.com). The videos are only loaded once you have accepted the “Marketing” category in the cookie banner; until then you see a placeholder. Once a video has loaded, YouTube receives your IP address and the information which page you visited; when the video is played, cookies may be set and data may also be transferred to the USA (see section 18). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Further information: policies.google.com/privacy.

17. Social networks: LinkedIn, Facebook, Instagram, Xing and YouTube
Links on our website. We link to our company profiles on social networks. You can also share posts via links to LinkedIn and Xing and plan a route via Google Maps. These are simple links, not embedded content or plugins. No data is therefore transferred to these providers when you visit our website. Only when you click on a link are you taken to the respective provider, which then processes your data in accordance with its own privacy policy.

Our profiles on the networks. When you visit our profiles, the operators process your data, even if you do not have an account there or are not logged in. Among other things, they use it for statistics on the use of our profiles (so-called Insights), which we receive in aggregated, non-personal form. For LinkedIn, Facebook and Instagram, we are jointly responsible with the respective operator for these statistics (Art. 26 GDPR); the operators provide the essence of the corresponding agreements at the addresses below. For Xing and YouTube, processing is governed by the operators’ privacy policies, which are also linked below. We process your data there in order to present our company and to communicate with you; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). You can assert your rights (section 19) against us or against the operator; as only the operator has full access to the data, it is best to contact the operator directly.

18. Transfers to third countries
In the case of Google (sections 12 to 14 and 16, and YouTube in section 17), data may be transferred to Google LLC, in the case of Microsoft Clarity (section 15) to Microsoft Corporation, in the case of LinkedIn to LinkedIn Corporation and in the case of Facebook and Instagram to Meta Platforms, Inc., each in the USA. These companies are certified under the EU-US Data Privacy Framework, for which the EU Commission has adopted an adequacy decision (Art. 45 GDPR); in addition, the EU Commission’s standard contractual clauses apply.

19. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR); you can object to direct marketing without giving reasons. An e-mail to info@isoprofil.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

20. Data security
Our website is only transmitted in encrypted form (TLS, recognisable by “https://” and the padlock symbol in the address bar). In addition, we protect your data against loss, manipulation and unauthorised access by means of appropriate technical and organisational measures, which we continuously adapt to the state of the art.

21. Current version and changes to this privacy policy
This privacy policy was last updated in October 2026. We adapt it when we develop our website further or when legal requirements change. The current version can be found on this page at any time.