The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other applicable data protection regulations is:

3e Solutions GmbH
Lützeltaler Straße 1
63868 Großwallstadt
Germany

Tel: +49 (0) 6022 508 89 33
E-Mail: datenschutz[at]3esolutions.de
Website: https://www.3esolutions.de

Represented by the Managing Directors:
Heribert Weigand and Gerd Stabenow
The controller determines the purposes and means of the processing of personal data.

If you have any questions regarding the processing of your personal data or wish to exercise your data protection rights, you may contact our Privacy Contact:

3e Solutions GmbH
Privacy Contact
E-Mail: datenschutz[at]3esolutions.de

Personal Data
Personal data means any information relating to an identified or identifiable natural person. This includes, for example, names, email addresses, telephone numbers, IP addresses, company affiliations, as well as the content of messages and inquiries.
We process personal data only where there is a legal basis for doing so. Depending on the purpose of the processing, this is based in particular on the following legal grounds:

• Art. 6(1)(a) GDPR where you have given your consent to the processing of your personal data.
• Art. 6(1)(b) GDPR where processing is necessary for the performance of a contract or for taking steps prior to entering into a contract.
• Art. 6(1)(c) GDPR where processing is necessary for compliance with a legal obligation.
• Art. 6(1)(f) GDPR where processing is necessary for the purposes of our legitimate interests or those of a third party, provided that such interests are not overridden by the interests, fundamental rights, or freedoms of the data subject.

The information obligations under Art. 13 GDPR include, among other things, details regarding the purposes of processing, legal bases, recipients, possible transfers to third countries, retention periods, and the rights of data subjects.

Security of Processing
We implement appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access, or unauthorized disclosure. These security measures are regularly reviewed and adapted in line with technological developments, the level of risk, and the nature of the personal data processed.
Our website uses an encrypted connection. You can recognize an encrypted connection in particular by the use of “https://” and the corresponding security indicator in your browser.

Requirement to Provide Personal Data
The provision of personal data is generally neither legally nor contractually required. However, for certain services, such as responding to an inquiry, providing a whitepaper or consenting to receive marketing communications, the provision of certain information may be necessary. Without this information, we may be unable to provide the respective service.

Automated Decision-Making
No decision-making based solely on automated processing, including profiling within the meaning of Article 22 GDPR, takes place unless expressly stated otherwise in this Privacy Policy.

Hosting

Our website is hosted by the following service provider:

IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany

When you access our website, the hosting provider processes technical information required for the provision, stability, and security of the website.

Where the hosting provider processes personal data on our behalf, such processing is carried out on the basis of a Data Processing Agreement pursuant to Article 28 GDPR.

Server Log Files

When you visit our website, the following data may be processed and stored in server log files:

• IP address or an IP address anonymized by the hosting provider; in certain proxy configurations, additional information relating to the requesting IP address may be processed
• Date and time of access
• Requested page or file
• Amount of data transferred
• Referrer URL
• Browser type and browser version
• Operating system used
• Hostname of the accessing device
• HTTP status code
• Information regarding technical errors

The processing is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and efficient provision of our online services.

A Data Processing Agreement (DPA) pursuant to Article 28 GDPR has been concluded with IONOS SE.

To ensure system availability and enable data recovery in the event of a malfunction, disruption, or security incident, we create regular data backups. Any personal data contained in such backups is processed solely for backup, recovery, and restoration purposes.

The processing is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in ensuring the availability, integrity, and recoverability of our systems and data.

Backups are stored within our hosting infrastructure. Currently, backups are created on a weekly basis and up to 15 backup versions are retained, unless legal, technical, or security-related reasons require a longer retention period.

Further information on data protection at IONOS can be found here: IONOS Privacy Policy

Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small data files that can be stored on or retrieved from your device. Local Storage, Session Storage, pixels, scripts, and similar technologies may also be used in this context.

We use technically necessary technologies where their use is required to provide the website and functions expressly requested by you.

For technologies that are not strictly necessary, we obtain your consent before they are activated. Under Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), informed consent is generally required for the storage of information on a user's device or for access to information already stored on that device. Exceptions apply in particular to strictly necessary technologies and to the transmission of a communication over a public telecommunications network. [§ 25 TDDDG], [TDDDG]

Legal Basis

The following legal bases apply to the storage of information on your device or access to such information:

• Section 25 (1) TDDDG for technologies requiring consent
• Section 25 (2) TDDDG for strictly necessary technologies

The subsequent processing of personal data is carried out on the following legal grounds, depending on the service involved:

• Art. 6 (1)(a) GDPR where consent has been provided
• Art. 6 (1)(f) GDPR for processing required for technical and security-related purposes, provided the applicable legal requirements are met

Consent Management

We use the Complianz consent management platform to manage cookie consent preferences.

Complianz enables us to obtain, document, and manage the consent provided by website visitors for the use of certain cookies and external services.

The following information may be stored in particular:

• Your consent or refusal
• Date and time of your decision
• Cookie ID
• Browser information

Processing is carried out to comply with legal obligations pursuant to Art. 6 (1)(c) GDPR and on the basis of our legitimate interest in maintaining GDPR-compliant consent management pursuant to Art. 6 (1)(f) GDPR.

You can change your preferences or withdraw your consent at any time with future effect via the Cookie Settings link.

If you contact us via a contact form, email, telephone, or any other means, we process the information you provide for the purpose of handling your request. In particular, the following data may be processed:

• First and last name
• Company and job title
• Email address
• Telephone number
• Content and subject of the inquiry
• Date and time of contact
• Technical transmission and log data
• Documents and attachments provided by you

If your inquiry relates to an existing contract or is made in preparation for entering into a contract, processing is carried out on the basis of Art. 6 (1)(b) GDPR. For general business inquiries, processing is based on Art. 6 (1)(f) GDPR. Our legitimate interest lies in the efficient handling of business inquiries and communication with prospects, customers, and business partners. Where you have expressly consented to further processing, Art. 6 (1)(a) GDPR serves as the legal basis.
Mandatory fields are marked accordingly. All other information is provided voluntarily.
We delete the data once your inquiry has been fully processed and there are no contractual, legal, or legitimate reasons requiring further retention.

Our website enables users to request or download whitepapers, checklists, guides, and other informational materials. For this purpose, we may collect the following information:

If we provide protected downloads, we may use the Secure Downloads plugin for this purpose. This allows us to restrict access to certain resources and to verify authorization for downloading protected content.

In connection with the provision of protected downloads, the following data may be processed in particular:

• IP address
• Date and time of access
• Requested file or resource
• Download token or access identifier
• Technical log and connection data
• Browser and device information

The processing is carried out for the secure provision of downloads, the prevention of unauthorized access, and the protection of the integrity and security of our online services.

The legal basis for the processing is, in particular:

• Article 6(1)(b) GDPR, where the provision of a download is related to a requested service, a contract, or pre-contractual measures.
• Article 6(1)(f) GDPR, based on our legitimate interest in the secure delivery of digital content and the prevention of misuse and unauthorized access.

Data processed in connection with protected downloads will be retained only for as long as necessary to provide the download, maintain technical security, establish proof where required, or prevent misuse.

Consent
If you consent to receive our marketing communications or other recurring marketing information, we may process the following information in particular:

• Email address
• Name and company, where provided
• Date and time of consent
• Date and time of confirmation
• IP address at the time of consent and confirmation
• Consent text and consent version
• Sending and delivery information
• Date and time of withdrawal

The legal basis for the sending of marketing communications is your consent pursuant to Article 6(1)(a) GDPR.

Double Opt-In
Consent is obtained using the double opt-in procedure. After submitting the form, you will receive an email requesting confirmation of your consent. Your email address will only be added to the recipient list for marketing communications once this confirmation has been completed. The logging of the consent and confirmation process serves as proof of valid consent. The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest lies in documenting consent and defending against potential legal claims.

Withdrawal of Consent
You may withdraw your consent at any time with future effect. To do so, you may contact us at datenschutz[at]3esolutions.de. Following withdrawal of consent, your email address may be stored on a suppression list to ensure that your withdrawal of consent or objection is permanently respected and to prevent any future unsolicited communications. The storage of data in a suppression list is based on Article 6(1)(f) GDPR. Our legitimate interest lies in permanently respecting withdrawals of consent and objections to marketing communications and in preventing any further unsolicited communications.

We use Burst Statistics to analyze the use of our website for statistical purposes.

In this context, information about the use of our website is processed in order to analyze reach, visitor numbers, and the use of individual pages, and to improve our online services.
The processing is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in the statistical analysis of website usage and the continuous improvement of our online services.

Burst Statistics is currently operated in a privacy-friendly, cookieless configuration. To the best of our current knowledge, statistical data is processed exclusively within our website and hosting infrastructure. To the best of our current knowledge, no statistical data is transferred to external analytics providers.

For the provision of forms, the request of informational materials, the delivery of download links, and the management and documentation of consent, we use the Brevo service.

Service provider:

Brevo GmbH
Köpenicker Straße 126
10179 Berlin
Germany

As part of the use of our forms, the following personal data may be processed in particular:

• First and last name
• Email address
• Company name
• Information and content submitted through the form
• Date and time of registration
• IP address at the time of registration and confirmation
• Information relating to the double opt-in procedure
• Sending and delivery information for requested documents or emails

Purposes of Processing and Legal Bases

Processing is carried out for the purpose of handling your request, providing requested information or documents, and maintaining legally compliant records of granted consent.

Data processing is carried out, depending on the purpose, on the basis of:

• Article 6(1)(a) GDPR where you have provided consent, in particular as part of the double opt-in procedure
• Article 6(1)(b) GDPR for handling inquiries and providing requested information or documents
• Article 6(1)(f) GDPR for documenting consent, preventing misuse, and ensuring the technical provision and security of communications

Double Opt-In Procedure

Where consent is required, we use a double opt-in procedure. After submitting the form, you will receive an email containing a confirmation link. The email address provided will only be activated for the respective purpose after successful confirmation.

For verification purposes, the date and time of registration, the date and time of confirmation, and the IP address used during the process are stored.

Data Processing Agreement

A Data Processing Agreement pursuant to Article 28 GDPR has been concluded with Brevo. To the extent that Brevo processes personal data for the provision of the services we use, such processing is carried out on our behalf and in accordance with our instructions.

Further information on data protection at Brevo can be found in Brevo’s Privacy Policy. [brevo.com], [help.brevo.com]

Forms may be displayed within pop-up windows. The display and management of these pop-ups is carried out using the Popup Maker plugin. Popup Maker is used solely for the technical presentation of content and does not process personal data beyond what is technically necessary for the provision and functionality of the pop-up.Popup Maker is used for the technical presentation of content. To the best of our current knowledge, Popup Maker does not process personal data beyond what is technically necessary for the provision and functionality of the pop-up.

For our business communications, the handling of contact inquiries, internal collaboration, and the management of business documents, we use Microsoft 365.
Email communications sent to and received through @3esolutions.de email addresses are processed using Microsoft 365.

The service provider for customers within the European Economic Area is generally:
Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland

Depending on the type of communication and application used, the following data may be processed in particular:

• Names and contact details
• Email addresses
• Email content and attachments
• Company and job-related information
• Communication and metadata
• Calendar and scheduling information
• Documents and file content
• Technical log and diagnostic data
• Information relating to user accounts and access permissions

The processing is carried out in particular:

• on the basis of Article 6(1)(b) GDPR, where communication is necessary for the performance of a contract or for pre-contractual measures,
• on the basis of Article 6(1)(c) GDPR, where statutory documentation or retention obligations apply,
• on the basis of Article 6(1)(f) GDPR for secure and efficient business communication, document management, and collaboration.

The processing of personal data by Microsoft is governed by the data protection and security provisions of the Microsoft Products and Services Data Protection Addendum (DPA), as amended from time to time. Further information is available in Microsoft’s licensing and data protection documentation. [microsoft.com],[microsoft.com]

Microsoft describes an EU Data Boundary under which, according to Microsoft, customer data and personal data from certain Microsoft online services are intended to be stored and processed within the European Union. Microsoft also notes that there may be limited circumstances in which data continues to be processed outside this EU Data Boundary. [learn.microsoft.com],[learn.microsoft.com]

Therefore, processing outside the European Union or the European Economic Area cannot be completely excluded in all cases. Further information can be found in the section “International Data Transfers”.

Purpose and Provider

To protect our forms against automated submissions, spam, misuse, and technical attacks, we use Google reCAPTCHA.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

reCAPTCHA analyzes technical characteristics and user interactions in order to determine whether an input is made by a human user or an automated program.

Depending on the version and configuration used, the following data may be processed in particular:

• IP address
• Date and time
• Referrer URL
• Browser and device information
• Operating system
• Language settings
• Interaction and movement data
• Information related to the form request
• reCAPTCHA-related cookies and identifiers
• Result of the risk or abuse assessment

Google documents that reCAPTCHA uses cookies and similar technical identifiers for risk analysis purposes. This may include, in particular, the _GRECAPTCHA cookie. [Google reCAPTCHA FAQ]

We only load Google reCAPTCHA after you have consented to the use of the service through our consent management system.

The legal bases for processing are:

• Section 25 (1) TDDDG for accessing information stored on a user's device or storing information on a user's device
• Article 6(1)(a) GDPR for the subsequent processing of personal data

You may withdraw your consent at any time with future effect through the cookie settings.

The processing of data in third countries, particularly the United States, cannot be completely excluded. Further information can be found in the section “International Data Transfers”.

We use the Super RSS Reader plugin to display current information and security-related content on our website. For this purpose, RSS feeds, in particular from the German Federal Office for Information Security (BSI) and Heise Media, are retrieved and displayed on our website.

In connection with the technical retrieval and delivery of these feeds, the following data may be processed:

• URL of the RSS feed retrieved
• Date and time of retrieval
• Technical connection and log data
• Information required for the delivery of feed content

The processing is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in providing current information and security-related content to visitors of our website.

Where individual content items or embedded media establish a direct connection between the visitor's device and servers operated by a third party, the visitor's IP address and other technically required connection data may be transmitted to the respective provider.

Further information can be found in the privacy notices of the respective provider.

To display and play video content on our website, we use the Easy Video Player and Video PopUp plugins.

These plugins are used for the technical provision, management, and presentation of video content embedded on our website. Videos may be displayed directly on our web pages or within pop-up windows.

In connection with the use of these plugins, the following technically required data may be processed in particular:

• IP address
• Date and time of access
• Browser and device information
• Technically required connection data
• Information related to the delivery and playback of video content

The processing is carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in the user-friendly provision of information, product, and training content, as well as in the technically secure and efficient presentation of media content.

Where third-party services or third-party content are used in connection with the provision of video content, we will provide separate information about such processing in the relevant sections of this Privacy Policy.

Within 3e Solutions GmbH, only those employees who require access to personal data in order to perform their duties will have access to such data. In addition, personal data may be transferred to the following categories of recipients:

• Hosting and infrastructure providers
• IT support and security service providers
• Consent management system providers
• Form and email delivery service providers
• Brevo GmbH
• Microsoft Ireland Operations Limited and affiliated subprocessors
• Google Ireland Limited in connection with reCAPTCHA
• Tax advisors, auditors, and legal advisors
• Postal, telecommunications, and delivery service providers
• Authorities, courts, and other public bodies where required by law
• Other recipients to whom you have given your consent or whose involvement is necessary for the performance of a contract

Service providers that process personal data on our behalf are contractually bound in accordance with Article 28 GDPR. Personal data will only be disclosed for other purposes where a legal basis exists or where you have provided your consent.

Personal data may be transferred to countries outside the European Union and the European Economic Area when certain service providers are used.
Such transfers only take place where the requirements of Articles 44 et seq. GDPR are fulfilled. The legal basis for such transfers may include, in particular:

• an adequacy decision of the European Commission pursuant to Article 45 GDPR,
• appropriate safeguards pursuant to Article 46 GDPR, in particular Standard Contractual Clauses,
• binding corporate rules,
• a statutory derogation pursuant to Article 49 GDPR.

Where a provider is certified under the EU-U.S. Data Privacy Framework and the specific transfer is covered by that certification, the transfer may be based on the applicable adequacy decision. In other cases, Standard Contractual Clauses and additional protective measures may be required.

Despite contractual and technical safeguards, there may be risks associated with processing in third countries, including the possibility that public authorities may access personal data and that the rights of data subjects may not be enforceable to the same extent as within the European Union.

Data subjects may request further information regarding the specific transfer mechanisms used by contacting us at datenschutz[at]3esolutions.de.

We store personal data only for as long as necessary for the respective processing purpose or as required by applicable legal retention obligations.

The specific retention period depends in particular on:

• the purpose of the processing,
• the status of an inquiry,
• the duration of a contractual relationship,
• statutory documentation and retention requirements,
• applicable warranty and limitation periods,
• the existence of legal claims,
• any consent granted and its withdrawal,
• our legitimate interests in maintaining evidence and defending legal claims.

The following categories serve as a general guideline:

• Server log files: up to 8 weeks*
• Contact inquiries not related to a contract: 12 months after the inquiry has been fully processed
• Contractual and accounting records: generally 6 to 10 years in accordance with commercial and tax law retention requirements
• Marketing communications data: until consent is withdrawn or the purpose of processing no longer applies
• White paper requests: 24 months after the document request or the last communication related to that request
• Brevo contacts: until deletion, withdrawal of consent, or the purpose of processing no longer applies
• Microsoft 365 communications: in accordance with internal retention and deletion policies and applicable legal retention obligations
• Consent records and proof of consent: 3 years from the end of the calendar year in which the consent was withdrawn or last used
• Suppression list data: for as long as necessary to permanently respect withdrawals or objections and to prevent further unsolicited communications

* Server log files generated when our website is used are processed by our hosting provider IONOS. In accordance with the provisions applicable to our web hosting contract, log data is retained for up to eight weeks. IP addresses are generally anonymized in the log files provided. In certain proxy configurations, additional information relating to the requesting IP address may be processed. After the retention period has expired, the log data is deleted unless legal or security-related reasons require further processing.

Once the purpose of processing no longer applies, the data will be deleted or anonymized unless statutory obligations or overriding legitimate interests require continued retention. Data that must be retained due to legal retention requirements will be restricted from further processing or blocked from use for other purposes.

You have the following rights subject to the applicable legal requirements:

Right of Access

Pursuant to Article 15 GDPR, you may request information about whether and which personal data concerning you is being processed by us.

Right to Rectification

Pursuant to Article 16 GDPR, you may request the correction of inaccurate personal data and the completion of incomplete personal data.

Right to Erasure

Pursuant to Article 17 GDPR, you may request the deletion of your personal data unless legal obligations prevent such deletion.

Right to Restriction of Processing

Pursuant to Article 18 GDPR, you may request the restriction of processing under the conditions set out by law.

Right to Data Portability

Pursuant to Article 20 GDPR, you may receive the data you have provided to us in a structured, commonly used, and machine-readable format, or request that it be transferred to another controller, provided that the legal requirements are met.

Right to Object

Pursuant to Article 21 GDPR, you have the right to object to the processing of personal data where such processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR.

Right to Withdraw Consent

Pursuant to Article 7(3) GDPR, you may withdraw any consent you have given at any time with effect for the future.

Right to Lodge a Complaint

Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a supervisory data protection authority.

To exercise your rights, please contact:

We may request additional information where necessary to clearly identify the requesting individual. We generally respond to requests within the statutory deadlines.

Right to Object Based on Your Particular Situation

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right, pursuant to Article 21(1) GDPR, to object at any time to the processing of your personal data on grounds relating to your particular situation.

Following a justified objection, we will no longer process the relevant personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or where the processing serves the establishment, exercise, or defense of legal claims.

Right to Object to Direct Marketing

Where personal data is processed for direct marketing purposes, you have the right, pursuant to Article 21(2) GDPR, to object at any time to the processing of your personal data for such marketing purposes. This also applies to profiling insofar as it is related to direct marketing.

Following your objection, your personal data will no longer be used for direct marketing purposes.

The objection may be submitted in any form, for example by email to: datenschutz[at]3esolutions.de

Where processing is based on your consent pursuant to Article 6(1)(a) GDPR, you may withdraw that consent at any time with effect for the future. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

You may withdraw your consent in particular:

• via the cookie settings on our website,
• by email to datenschutz[at]3esolutions.de,
• in writing to the postal address provided above (see "Data Controller").

Upon receipt of your withdrawal, we will discontinue the relevant processing activity unless another legal basis exists for the continued processing of your personal data.

This Privacy Policy is current as of September 2026
We regularly review this Privacy Policy and update it whenever our data processing activities, the services we use, or applicable legal and regulatory requirements change.

The version published on this website at the time of your visit shall apply. We may also announce significant changes on our website or through other appropriate communication channels.