Privacy policy

This is a courtesy translation. Only the German version is legally binding.

1. Subject of this privacy policy

We are pleased about your interest in our website www.for-medic.de, our company and the services we offer. We are aware that protecting your privacy when using our website is important to you.

Compliance with the statutory data protection regulations is therefore a matter of course for us. It is also important to us that you, as a customer, always know when, how and which of your data is collected, stored and used.

Below we inform you about the collection and other processing of personal data, such as storage, retrieval, modification and disclosure, when using our website. By personal data we mean all data that can be related to you personally, such as your name, address, email address and user behaviour.

Where we process personal data in the course of your use of our website, or where we use commissioned service providers for individual functions, offers or services of our website involving data processing, we inform you in detail below about the respective processes. In particular, we state which data is processed, the intended storage period or at least the criteria for determining it, and the relevant legal basis for the respective processing.

2. Controller responsible for processing your data on this website

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the member states and other data protection provisions is:

Formedic GmbH

Chorbuschstraße 32 a

50765 Cologne, Germany

Phone: +49 221 999894 10

Email: info@for-medic.de

Management: Dr. Deniz Cansun-Labenski

3. Contact details of our data protection officer

You can reach the data protection officer of Formedic GmbH at info@for-medic.de or at our postal address with the addition “the data protection officer”.

4. Collection and use of your data

4.1 Visiting the website

When you use the website for information purposes only, or otherwise transmit information to us, we only collect the personal access data in so-called server log files that your browser transmits to our server. The following data is collected in the server log files:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Amount of data transferred in each case
• Website from which the request comes

This data is evaluated exclusively to ensure trouble-free operation of the website with regard to stability and security and to improve our offer, and is then discarded. The legal basis for the data processing is Art. 6(1)(1)(f) GDPR. Our legitimate interest follows from the purposes of data collection mentioned above.

The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.

Both the collection of data to provide the website and the storage of data in log files are strictly necessary for the operation of our website. Consequently, the user has no right to object.

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected to provide the website, this is the case when the respective session has ended.

In addition, we use cookies and analysis services when you visit our website. Further explanations can be found in the following sections of this privacy policy.

4.2 Contact by email or via the contact form

When you contact us via our contact form with a general enquiry or a request for an offer regarding our services, the data you voluntarily provide, such as first and last name, address, telephone number, email address and company name/address, is stored by us in order to answer your enquiry.

First and last name, email address, company and address data are required – all other information is voluntary. We reply by email or, if provided and requested, by telephone.

The legal basis for the processing is Art. 6(1)(f) GDPR; the legitimate interest lies in answering your enquiry.

We delete the data arising in this context once your enquiry has been dealt with, or restrict processing if statutory retention obligations apply.

4.3 Applying for an advertised position

If you apply for a job advertised online on our website, the personal data you voluntarily submit will be used exclusively for the purpose of filling the advertised position and reviewing and processing your application in this context.

After completion of the application process for the specific advertised position, this data is blocked for further use and deleted after expiry of any statutory retention obligations. The legal basis for the processing is Art. 88 GDPR in conjunction with § 26(1) BDSG (German Federal Data Protection Act).

4.4 Disclosure of data

Your personal data will not be transferred to third parties for purposes other than those listed below.

We only pass on your personal data to third parties if:

• you have given your express consent in accordance with Art. 6(1)(1)(a) GDPR,
• disclosure in accordance with Art. 6(1)(1)(f) GDPR is necessary to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed,
• there is a legal obligation for disclosure in accordance with Art. 6(1)(1)(c) GDPR, and
• this is legally permissible and necessary in accordance with Art. 6(1)(1)(b) GDPR for the performance of contractual relationships with you.

4.5 Use of cookies

To make visiting our website user-friendly and as effective as possible and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your device and save certain settings and data for exchange with our system via your browser.

Through cookies, certain information flows to the body that sets the cookie, in the case described here, to us. Cookies cannot run programs or transfer viruses to your computer.

Cookies do not contain any personal data and therefore cannot be directly assigned to any user. Please note that certain cookies are already set as soon as you enter our website.

This website uses the following types of cookies:

• Necessary / functional cookies: These cookies are necessary to enable the operation of our website. They include, for example, cookies that allow you to log into the customer area.
• Transient cookies: These are automatically deleted when you close the browser. They include in particular session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This allows your computer to be recognised when you return to our website. Session cookies are deleted when you log out or close the browser.

You can configure your browser settings according to your wishes and, for example, refuse to accept third-party cookies or all cookies. Your browser can also be configured to always notify you when a cookie is set. Please consult the provider of your browser for this. Please note that if you refuse cookies, you may not be able to use all functions of this website.

The legal basis for the use of cookies is Art. 6(1)(1)(f) GDPR. Our legitimate interest results from the purposes mentioned above of making our website more user-friendly and effective.

4.6 Recipients of your data

We use carefully selected service providers to operate this website and for our communication. Where they process personal data on our behalf, this is done on the basis of a data processing agreement in accordance with Art. 28 GDPR. The service providers are bound by our instructions and may not use the data for their own purposes unless otherwise stated below.

a) Hosting and technical provision

This website is hosted by Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA (hereinafter “Lovable”). On our behalf, Lovable processes all data arising when this website is visited (in particular the server log files mentioned in section 4.1), as well as the data you submit via our contact and appointment booking forms. The associated database is operated within the European Union (server location: Ireland). We have concluded a data processing agreement with Lovable in accordance with Art. 28 GDPR. Lovable in turn uses sub-processors, a current list of which is available at trust.lovable.dev. You can reach Lovable’s data protection officer at dpo@lovable.dev.

The legal basis is Art. 6(1)(1)(f) GDPR; our legitimate interest lies in the secure, reliable and efficient provision of our website. Where you arrange an appointment via the appointment booking form, the processing is also based on Art. 6(1)(1)(b) GDPR.

In addition, Lovable processes certain usage and operating data (“service data”) as an independent controller for its own purposes, for example for security, billing and the further development of its services. Lovable itself is responsible for this processing. Further information can be found in Lovable’s privacy policy at lovable.dev.

b) Domain name resolution (DNS) via Cloudflare

For domain name resolution (DNS) we use Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter “Cloudflare”) as a technical intermediary. Cloudflare exclusively handles DNS resolution, i.e. mapping our domain name to Lovable’s servers so that your browser can find our website.

Cloudflare is not operated as a proxy. The content of our website and your form entries are therefore not routed through, cached on or processed by Cloudflare servers. In the course of DNS resolution, only technical connection data may be processed, in particular the IP address of the requesting DNS server and the time and content of the DNS request.

The legal basis is Art. 6(1)(1)(f) GDPR; our legitimate interest lies in the reliable availability of our website.

c) Domain registration with STRATO

Our domain for-medic.de is registered with STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany (hereinafter “STRATO”). STRATO is solely the registrar of this domain and manages its registration. Website content, log files or form data for this domain are not stored at or processed by STRATO.

d) Email sending and communication

Automated emails in connection with appointment booking (e.g. appointment confirmations) are sent via the email function integrated in Lovable. The legal basis is Art. 6(1)(1)(b) GDPR.

Our regular email communication, including replies to your enquiries, takes place via Microsoft 365, offered by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Processing by the parent company Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA, cannot be ruled out. The legal basis is Art. 6(1)(1)(b) or (f) GDPR; our legitimate interest lies in efficient and secure communication.

e) Data transfers to third countries

Lovable, Cloudflare and Microsoft or their sub-processors are based wholly or partly in the USA. A transfer of personal data to the USA can therefore not be ruled out. Where the respective companies are certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR). Otherwise, it is based on the EU standard contractual clauses pursuant to Implementing Decision (EU) 2021/914 (Art. 46(2)(c) GDPR). You can request a copy of the respective safeguards from us using the contact details above.

4.7 Data security

We use the necessary technical and organisational security measures to protect personal data that arises or is collected, in particular against manipulation, loss or unauthorised access. In particular, as you can see from the encryption symbol in your browser bar, communication with our server is encrypted. Our security measures are continuously reviewed and, where necessary, adapted in line with technological developments.

4.8 Your rights

Provided the legal requirements are met, you have the right at any time:

• to request information about your personal data processed by us (cf. Art. 15 GDPR);
• to request without delay the correction of inaccurate or completion of your personal data stored by us (cf. Art. 16 GDPR);
• to request the erasure of your personal data stored by us, unless statutory exceptions apply (cf. Art. 17 GDPR);
• to request the restriction of processing of your personal data (blocking) if the relevant legal requirements are met (cf. Art. 18 GDPR);
• to notification in connection with the correction or erasure of personal data or the restriction of processing (cf. Art. 19 GDPR);
• to request the transfer of your personal data (cf. Art. 20 GDPR).

5. Right to object (Art. 21 GDPR)

You have a right to object on a case-by-case basis as well as a right to object to the processing of data for advertising purposes.

a) Right to withdraw consent under data protection law

You can withdraw consent to the processing of your personal data at any time vis-à-vis the controller. Please note that the withdrawal only takes effect for the future. The lawfulness of processing carried out on the basis of consent until withdrawal is not affected.

b) Right to object on a case-by-case basis

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you that is carried out on the basis of Art. 6(1)(e) GDPR or Art. 6(1)(1)(f) GDPR; this also applies to profiling based on these provisions.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

c) Right to object to the processing of data for advertising purposes

In individual cases, we process your personal data for direct advertising. You have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct advertising.

If you object to processing for direct advertising purposes, we will no longer process your personal data for these purposes.

The objection can be made informally and should be sent by email, if possible with the subject “Objection”, to:

Formedic GmbH

Chorbuschstraße 32 a

50765 Cologne, Germany

info@for-medic.de

5.1 Right to lodge a complaint with a supervisory authority

Furthermore, in accordance with Art. 77 GDPR, you have the right to complain to a supervisory authority about the processing of your personal data. As a rule, you can contact the supervisory authority of our headquarters for this purpose. This is

Die Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)

Postfach 20 04 44

40102 Düsseldorf, Germany

Phone: +49 211 38424-0

Fax: +49 211 38424-10

Email: poststelle@ldi.nrw.de

https://www.ldi.nrw.de

6. Data security

We endeavour to store your personal data using all technical and organisational means in such a way that it is not accessible to third parties. When communicating by email, we cannot guarantee complete data security, so we recommend sending confidential information by post.