Privacy policy

The controller responsible for processing personal data on this website is:

The authorised Managing Director is Jochen Schmid. You can also use these contact details for all privacy enquiries.

We process personal data only to the extent necessary for a specific function, to handle your enquiry, to take steps before entering into a contract, or to meet legal obligations.

Depending on the processing involved, we rely in particular on:

• Article 6(1)(a) GDPR, where you give consent, for example for the newsletter;
• Article 6(1)(b) GDPR, where processing is necessary to respond to a contract-related enquiry or to take steps before entering into a contract;
• Article 6(1)(c) GDPR, where we must meet legal obligations;
• Article 6(1)(f) GDPR, where our legitimate interests in a secure, reliable website, efficient communication and preventing misuse prevail.

Where information is stored on or accessed from your device, section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies. Strictly necessary technical functions are covered by section 25(2) TDDDG. Functions requiring consent would only be activated after you have consented under section 25(1) TDDDG.

This website is hosted on servers operated by Timme Hosting GmbH & Co. KG, Ovelgönner Weg 43, 21335 Lüneburg, Germany. We have a data processing agreement with the hosting provider.

Technically necessary server log data is processed whenever a page is accessed. This may include the IP address, date and time, requested resource, referrer URL, browser type and version, operating system, volume of data transferred and status code. Processing serves website delivery, stability, error analysis and attack detection. The legal basis is Article 6(1)(f) GDPR.

Log data is regularly deleted once it is no longer needed for operation and security. In a security incident, relevant log data may be retained until the matter has been resolved and for longer where required by statutory time limits.

Transmission between your browser and our website is encrypted using TLS. An encrypted connection is indicated, in particular, by “https://” in the address bar.

The website has no audience measurement or advertising profiles integrated into the project. For security-related and functional processes, Kirby sets a strictly necessary session cookie named sjmedia_session. It stores, for example, form state, security information to prevent abusive requests and short-lived status messages.

Your separate choices for YouTube videos, OpenFreeMap maps and Zoho Bookings are stored in your browser’s local storage under sjmedia_consent_v3. Your choice is valid for 180 days, after which we ask again. The storage entry remains until it is overwritten or you delete the website data in your browser. You can change or withdraw your choice at any time under “For you → Cookie settings”. External content remains blocked without permission. Expandable details in the cookie settings explain the providers, purposes, cookie names and retention periods. You can delete storage already set by external providers in your browser settings.

We store your explicitly selected light or dark appearance in local storage under sjmedia_theme. This setting contains no visitor identifier and remains until you change it or delete the website data. An old preview value, sjmedia_theme_preview, may still be read; new writes use only sjmedia_theme.

The session cookie is not intended for advertising or cross-site tracking. The legal basis for access to the device is section 25(2) TDDDG; subsequent processing relies on Article 6(1)(f) GDPR and, for contract-related forms, additionally on Article 6(1)(b) GDPR. Session data is deleted when the configured session expires or its purpose no longer applies.

When you contact us by form, email, telephone or another communication channel you choose, we process the information you provide. Depending on the form, this may include your name, company, email address, telephone number, project and budget information, selected topics, free text, technical form data and submission time.

We process this information to handle your enquiry and any necessary follow-up questions under Article 6(1)(b) GDPR where the enquiry concerns a contract, or otherwise under Article 6(1)(f) GDPR. Our legitimate interest is traceable and efficient communication. Information processed solely on the basis of separate consent is covered by Article 6(1)(a) GDPR.

Providing your information is generally voluntary. However, without the information marked as required, the relevant form cannot be submitted and we cannot handle your enquiry through that channel. Optional information is not necessary for processing.

We process job applications to decide whether to establish an employment relationship under section 26 of the German Federal Data Protection Act (BDSG). If you are not hired, we generally delete your application no later than six months after the application process ends, unless you have consented to longer retention or legal claims require it.

WhatsApp: If you use the WhatsApp chat link on the website, you leave our website and communicate with us through WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp processes data under its own responsibility and may process data outside the EU or EEA. For confidential information, please preferably use email or our contact form. Further information is available in the WhatsApp privacy policy.

To handle contact, project and calculator enquiries in a structured way, our server transfers the data you enter in the relevant form to Zoho CRM. The provider for the European data centre is Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands.

The transfer uses Zoho’s European interfaces. The data is used to assign, process, document and follow up your enquiry. The legal bases are Articles 6(1)(b) and 6(1)(f) GDPR. We have a data processing agreement with Zoho.

Zoho generally stores European service data in EU data centres. Limited access from third countries, particularly by technical support teams in India, may occur in individual cases. Zoho uses the European Commission’s standard contractual clauses and supplementary safeguards for this purpose. See the Zoho privacy policy.

We use Zoho Campaigns to send our ecommerce updates. The provider for European customers is Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands. Registration through the website form is first emailed to our team. We receive your email address, registration time, registration page and confirmed consent. Our team processes the registration and then adds your email address to Zoho Campaigns manually. The website form does not currently transfer it automatically. Zoho Campaigns processes the data needed to send the newsletter and manage your subscription.

The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw it at any time with effect for the future using the unsubscribe link in each newsletter email or by contacting us. Withdrawal does not affect the lawfulness of processing before that point.

We do not use tracking pixels to measure opens or personal click tracking for our ecommerce updates.

Zoho generally processes European customers’ service data in European data centres. Limited access from third countries, particularly for technical support, may occur in individual cases. Zoho cites safeguards including the European Commission’s standard contractual clauses and supplementary measures. See the Zoho privacy policy.

We use Zoho Bookings on the appointment booking page. Before loading the external booking service, the website displays a privacy notice. A connection to Zoho is established only after you consent to Zoho Bookings in the cookie settings. You can withdraw your choice at any time under “For you → Cookie settings”.

Data processed may include your IP address, browser and device information, the page accessed, and the appointment and contact details you subsequently enter in the booking form. The purpose is the online appointment booking you request. The legal basis is Article 6(1)(a) GDPR; where Zoho stores or accesses information on your device, section 25(1) TDDDG also applies. The safeguards described in the Zoho CRM section apply to processing by Zoho and possible access from third countries.

We use Zoho SalesIQ, provided by Zoho Corporation B.V., the Netherlands, for customer chat. The integration loads only when you click “Chat” under “For you”, independently of your general cookie choice. Data processed may include your IP address, device and browser information, visited pages, and the chat and contact details you enter. SalesIQ’s separate visitor analytics are disabled on this website through its tracking interface. For the requested chat function, Zoho may use siq_embed in local storage and session storage, along with technical session and security cookies. Zoho’s loader script also reads utsdb from session storage. The storage information in the cookie details distinguishes verified script access from possible provider cookies.

Loading and the associated storage access rely on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Reloading the page or saving your choices under “For you → Cookie settings” ends the integration. The chat loads again only when you click “Chat” under “For you” again. The Zoho CRM section also applies to processing your enquiry and possible access from third countries. Cookie and retention details are available in the cookie details and from Zoho SalesIQ.

The button at the bottom right lets you request the supplementary accessibility tool provided by digi·access GmbH. When you click “Accessibility” under “For you”, we connect to download.digiaccess.org and api.digiaccess.org. The provider receives technically necessary connection data, particularly your IP address, browser information and domain. The tool may store your display and language preferences in your browser’s local storage.

Activation is voluntary and independent of permission for customer chat. The requested loading relies on your consent under Article 6(1)(a) GDPR. Reloading the page ends the integration; we do not automatically reload the tool. You can reset preferences in the tool or remove them by deleting website data in your browser. Further information: DigiAccess privacy policy.

Some demo pages contain YouTube videos. The responsible provider in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the embedding domain youtube-nocookie.com, which enables privacy-enhanced mode. The website displays a privacy notice before loading the player. The YouTube player is embedded and a connection to Google established only after you allow YouTube in the cookie settings and explicitly start the video.

Loading the embedded player transfers technically necessary connection data to Google, such as your IP address, browser and device information, and the page accessed. When you play a video, YouTube may process additional usage data and associate the activity with a signed-in Google account. The player loads on the basis of your consent under Article 6(1)(a) GDPR; where information is stored on or accessed from your device, section 25(1) TDDDG also applies. Consent is voluntary and can be withdrawn for the future.

Data may also be processed in the USA. Google LLC is certified under the EU–US Data Privacy Framework. Further information is available in Google’s privacy policy.

Without permission, the contact page displays only locally stored map images. If you allow OpenFreeMap in the cookie settings, we load map data from OpenFreeMap. In particular, your IP address is transferred to the map service. You can withdraw permission at any time under “For you → Cookie settings”; the local map is then shown again.

Further information is available from OpenFreeMap. The separate directions link opens Google Maps only when you click it.

The webfonts used on this website are served locally from our server. Loading a page therefore does not establish a connection to Google Fonts or another font provider.

External links, for example to partners, social networks, map or review services, establish a connection to the respective provider only when you actively open the link. The external provider’s privacy policy applies from that point.

Within sjmedia GmbH, only people who need personal data for their work have access to it. We also use carefully selected technical service providers, particularly for hosting, CRM, appointments and newsletters. Where they act as processors, we enter into the agreements required by Article 28 GDPR.

Data is transferred to other recipients only where necessary to fulfil a contract, required by law, authorised by your consent, or justified by an overriding legitimate interest.

For transfers outside the EU or EEA, we use an adequacy decision, in particular the EU–US Data Privacy Framework for certified US providers, or appropriate safeguards such as the European Commission’s standard contractual clauses. Despite these measures, a level of data protection differing from the EU standard cannot be entirely ruled out when processing takes place in third countries.

We retain personal data only for as long as necessary for its purpose. We then delete or anonymise it unless statutory retention periods or legitimate interests in retaining evidence prevent this.

In particular, the following criteria apply:

• Contact and project enquiries are deleted after processing unless they lead to a business relationship or are needed to establish, exercise or defend legal claims.
• Documents relevant to contracts and accounting may need to be retained for six, eight or ten years under commercial and tax law.
• Newsletter data is retained until consent is withdrawn; evidence of consent may subsequently be retained for the duration of statutory limitation periods.
• Application data is deleted within the periods stated in “Contact, forms, project enquiries and job applications”.
• Data deleted in Zoho may remain in encrypted backups for a limited period; the provider generally specifies up to three months.

Subject to the applicable legal conditions, you have in particular the right to:

• access your processed data under Article 15 GDPR;
• rectification of inaccurate data under Article 16 GDPR;
• erasure under Article 17 GDPR;
• restriction of processing under Article 18 GDPR;
• data portability under Article 20 GDPR;
• object to processing under Article 21 GDPR;
• withdraw consent with effect for the future under Article 7(3) GDPR.

Right to object under Article 21 GDPR: Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. Where data is processed for direct marketing, you may object at any time without giving a specific reason.

To exercise your rights, simply contact info@sjmedia-consulting.de. We may request suitable proof of identity to prevent unauthorised disclosure.

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. For companies based in Baden-Württemberg, the relevant authority is in particular the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg. You may also contact the supervisory authority at your usual place of residence or work.

We take appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access. This website does not carry out solely automated decision-making, including profiling, within the meaning of Article 22 GDPR.

We update this privacy policy when functions, service providers or the legal situation change. The version published on this page applies.