Privacy Policy
Preamble
With the following privacy notice, we would like to inform you about the types of your personal data (hereinafter also referred to simply as “data”) that we process, for what purposes and to what extent. This privacy notice applies to all processing of personal data carried out by us, both in the course of providing our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”).
The terms used are not gender-specific.
As at: 29 October 2026
Contents
– Preamble
– Controller
– Overview of processing activities
– Applicable legal bases
– Provision of the online offering and web hosting
– Use of cookies
– Web analysis, monitoring and optimisation
– Presence on social networks (social media)
– Plug-ins and embedded functions and content
Controller
PlasmaAir AG
Am Lindenberg 8
71263 Weil der Stadt
Email address: info@plasmaair.de
Overview of processing activities
The following overview summarises the types of data processed and the purposes for which they are processed, and identifies the data subjects.
Types of data processed
– Inventory data.
– Employee data.
– Location data.
– Contact data.
– Content data.
– Usage data.
– Meta, communication and procedural data.
– Log data.
Categories of data subjects
– Recipients of services and clients.
– Employees.
– Users.
– Third parties.
– Whistleblowers.
Purposes of processing
– Communication.
– Security measures.
– Audience measurement.
– Feedback.
– Profiles containing user-related information.
– Provision of our online offering and user-friendliness.
– Information technology infrastructure.
– Whistleblower protection.
– Public relations.
Applicable legal bases
Applicable legal bases under the GDPR: Below you will find an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply in your country or ours of residence or registered office. If more specific legal bases apply in an individual case, we will inform you of these in the privacy notice.
– Consent (Article 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
– Legal obligation (Article 6(1)(c) GDPR) – Processing is necessary to comply with a legal obligation to which the controller is subject.
– Legitimate interests (Article 6(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
National data protection provisions in Germany: In addition to the GDPR’s data protection provisions, national data protection regulations apply in Germany. These include, in particular, the Federal Data Protection Act (BDSG). The BDSG contains specific provisions concerning the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transfers, as well as automated decision-making in individual cases, including profiling. Data protection laws of the individual federal states may also apply.
Provision of the online offering and web hosting
We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to users’ browsers or devices.
– Types of data processed: Usage data (e.g. page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved). Log data (e.g. log files relating to logins, data retrieval or access times).
– Data subjects: Users (e.g. website visitors, users of online services).
– Purposes of processing and legitimate interests: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.)). Security measures.
– Retention and erasure: Erasure in accordance with the information in the section “General information on data storage and erasure”.
– Legal bases: Legitimate interests (Article 6(1)(f) GDPR).
Further information on processing activities, procedures and services:
– Provision of the online offering on rented storage space: To provide our online offering, we use storage space, computing capacity and software that we rent or otherwise obtain from a relevant server provider (also known as a “web host”); legal bases: Legitimate interests (Article 6(1)(f) GDPR).
– Collection of access data and log files: Access to our online offering is recorded in the form of so-called “server log files”. Server log files may include the address and name of the webpages and files accessed, the date and time of access, the volume of data transferred, a report of successful retrieval, browser type and version, the user’s operating system, the referrer URL (the page visited previously) and, as a rule, IP addresses and the requesting provider. Server log files may be used for security purposes, for example to prevent server overload (particularly in the event of malicious attacks, known as DDoS attacks), and to ensure server capacity and stability; legal bases: Legitimate interests (Article 6(1)(f) GDPR). Erasure of data: Log file information is stored for a maximum of 30 days and then erased or anonymised. Data that must be retained as evidence is exempt from erasure until the incident in question has been finally resolved.
– Checkdomain: Services relating to the provision of information technology infrastructure and associated services (e.g. storage space and/or computing capacity); service provider: checkdomain GmbH, a dogado group company, Große Burgstraße 27/29, 23552 Lübeck, Germany; legal bases: Legitimate interests (Article 6(1)(f) GDPR); website: https://www.checkdomain.de/; privacy notice: https://www.checkdomain.de/agb/datenschutz/. Data processing agreement: Provided by the service provider.
Use of cookies
The term “cookies” refers to functions that store information on users’ devices and read it from them. Cookies may also be used for various purposes, such as ensuring the functionality, security and convenience of online offerings, and analysing visitor traffic. We use cookies in accordance with the statutory provisions. Where required, we obtain users’ consent in advance. If consent is not necessary, we rely on our legitimate interests. This applies where storing and reading information is essential to provide expressly requested content and functions. This includes, for example, storing settings and ensuring the functionality and security of our online offering. Consent may be withdrawn at any time. We provide clear information about its scope and the cookies used.
Notes on the legal bases under data protection law: Whether we process personal data using cookies depends on consent. Where consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, as explained above in this section and in the context of the relevant services and procedures.
Storage period: The following types of cookies are distinguished in terms of storage period:
– Temporary cookies (also known as session cookies): Temporary cookies are deleted at the latest when a user leaves an online offering and closes their device (e.g. browser or mobile application).
– Persistent cookies: Persistent cookies remain stored even after the device has been closed. For example, they can store login status and display preferred content directly when the user revisits a website. User data collected using cookies may also be used for audience measurement. Unless we provide users with explicit information about the type and storage period of cookies (e.g. when obtaining consent), they should assume that these are persistent and may be stored for up to two years.
General information on withdrawal and objection (opt-out): Users may withdraw any consent they have given at any time and may also object to processing in accordance with statutory requirements, including through their browser’s privacy settings.
– Types of data processed: Meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).
– Data subjects: Users (e.g. website visitors, users of online services).
– Legal bases: Legitimate interests (Article 6(1)(f) GDPR). Consent (Article 6(1)(a) GDPR).
Further information on processing activities, procedures and services:
– Processing of cookie data on the basis of consent: We use a consent management solution to obtain users’ consent to the use of cookies or to the procedures and providers specified as part of the consent management solution. This procedure is used to obtain, record, manage and withdraw consent, particularly in relation to the use of cookies and similar technologies used to store, read and process information on users’ devices. As part of this procedure, users’ consent is obtained for the use of cookies and the associated processing of information, including the specific processing activities and providers named in the consent management procedure. Users also have the option to manage and withdraw their consent. Consent declarations are stored to avoid asking again and to provide proof of consent in accordance with legal requirements. Storage takes place server-side and/or in a cookie (a so-called opt-in cookie) or using similar technologies, so that consent can be linked to a specific user or their device. If no specific information is provided about the providers of consent management services, the following general information applies: Consent is stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, details of its scope (e.g. the cookie categories and/or service providers concerned), and information about the browser, system and device used; legal bases: Consent (Article 6(1)(a) GDPR).
Web analysis, monitoring and optimisation
Web analysis (also known as “audience measurement”) is used to evaluate visitor traffic to our online offering and may include pseudonymous values relating to visitors’ behaviour, interests or demographic information, such as age or gender. Audience analysis allows us, for example, to identify when our online offering or its functions or content are used most frequently, or to encourage their reuse. It also enables us to identify areas that need improvement.
In addition to web analysis, we may also use testing procedures to test and optimise different versions of our online offering or parts of it.
Unless stated otherwise below, profiles (i.e. data combined to reflect a particular use) may be created for these purposes, and information may be stored in and read from a browser or device. The information collected includes, in particular, websites visited and the elements used there, as well as technical information such as the browser and computer system used and information about times of use. If users have consented to the collection of their location data by us or by the providers of the services we use, location data may also be processed.
Users’ IP addresses are also stored. However, we use an IP masking procedure (i.e. pseudonymisation by truncating the IP address) to protect users. As a rule, no clear data relating to users (such as email addresses or names) are stored as part of web analysis, A/B testing and optimisation; instead, pseudonyms are used. This means that neither we nor the providers of the software used know the users’ actual identities, only the information stored in their profiles for the purposes of the relevant procedures.
Notes on legal bases: Where we ask users for their consent to the use of third-party providers, consent is the legal basis for data processing. Otherwise, user data are processed on the basis of our legitimate interests (i.e. our interest in providing efficient, economical and user-friendly services). In this connection, we also refer you to the information on the use of cookies in this privacy notice.
– Types of data processed: Usage data (e.g. page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions). Meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).
– Data subjects: Users (e.g. website visitors, users of online services).
– Purposes of processing and legitimate interests: Audience measurement (e.g. access statistics, identification of returning visitors); profiles containing user-related information (creation of user profiles). Provision of our online offering and user-friendliness.
– Retention and erasure: Erasure in accordance with the information in the section “General information on data storage and erasure”. Cookies are stored for up to 2 years (unless stated otherwise, cookies and similar storage methods may be stored on users’ devices for a period of two years).
– Security measures: IP masking (pseudonymisation of the IP address).
– Legal bases: Consent (Article 6(1)(a) GDPR). Legitimate interests (Article 6(1)(f) GDPR).
Further information on processing activities, procedures and services:
– Google Analytics: We use Google Analytics to measure and analyse the use of our online offering on the basis of a pseudonymous user identification number. This identification number does not contain unique data, such as names or email addresses. It is used to associate analytical information with a device, enabling us to identify which content users have accessed during one or more usage sessions, which search terms they have used, whether they have accessed them again, or how they have interacted with our online offering. The time and duration of use are also stored, together with the sources referring users to our online offering and technical details about their devices and browsers.
Pseudonymous user profiles are created using information from the use of different devices, and cookies may be used. Google Analytics does not record or store individual IP addresses for EU users. However, Analytics provides approximate geographical location data by deriving the following metadata from IP addresses: city (and the city’s derived latitude and longitude), continent, country, region, subcontinent (and ID-based equivalents). For EU traffic, IP address data are used solely to derive this geolocation data and are then immediately deleted. They are not logged, cannot be accessed and are not used for any other purpose. When Google Analytics collects measurement data, all IP lookups are carried out on EU-based servers before the traffic is forwarded to Analytics servers for processing; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal bases: Consent (Article 6(1)(a) GDPR); website: https://marketingplatform.google.com/intl/de/about/analytics/; security measures: IP masking (pseudonymisation of the IP address); privacy notice: https://business.safety.google/privacy/; data processing agreement: https://business.safety.google/adsprocessorterms/; basis for transfers to third countries: Data Privacy Framework (DPF), standard contractual clauses (https://business.safety.google/adsprocessorterms); opt-out option: opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertising: https://myadcenter.google.com/personalizationoff. Further information: https://business.safety.google/adsservices/ (types of processing and data processed).
Presence on social networks (social media)
We maintain online presences on social networks and process user data in this context in order to communicate with users active there or to provide information about us.
Please note that user data may be processed outside the European Union. This may give rise to risks for users, as it could, for example, make it more difficult to enforce their rights.
Furthermore, user data on social networks are generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behaviour and resulting interests. These profiles may in turn be used to place advertisements within and outside the networks that are presumed to match users’ interests. Cookies are therefore generally stored on users’ computers, recording their usage behaviour and interests. Usage profiles may also store data independently of the devices used by users (particularly if they are members of the relevant platforms and are logged in).
For a detailed description of the respective forms of processing and the options for objecting (opt-out), please refer to the privacy notices and information provided by the operators of the relevant networks.
We also note, in the case of requests for information and the exercise of data subject rights, that these can be pursued most effectively with the providers. Only they have access to the user data and can take appropriate action and provide information directly. If you nevertheless need assistance, you can contact us.
– Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts, as well as information relating to them, such as authorship details or time of creation). Usage data (e.g. page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
– Data subjects: Users (e.g. website visitors, users of online services).
– Purposes of processing and legitimate interests: Communication; feedback (e.g. collecting feedback via an online form). Public relations.
– Retention and erasure: Erasure in accordance with the information in the section “General information on data storage and erasure”.
– Legal bases: Legitimate interests (Article 6(1)(f) GDPR).
Further information on processing activities, procedures and services:
– LinkedIn: Social network – We are jointly responsible with LinkedIn Ireland Unlimited Company for the collection (but not the further processing) of data from visitors, which is used to create “Page Insights” (statistics) for our LinkedIn profiles. This data includes information about the types of content users view or interact with and the actions they take. Details of the devices used are also collected, such as IP addresses, operating system, browser type, language settings and cookie data, as well as information from user profiles, such as job function, country, industry, seniority, company size and employment status. Information about LinkedIn’s processing of user data can be found in LinkedIn’s privacy notice: https://www.linkedin.com/legal/privacy-policy.
We have entered into a specific agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum”, https://legal.linkedin.com/pages-joint-controller-addendum), which sets out, in particular, the security measures LinkedIn must observe and LinkedIn’s undertaking to fulfil data subjects’ rights (i.e. users may, for example, send requests for access or erasure directly to LinkedIn). The agreements with LinkedIn do not restrict users’ rights (in particular, the rights of access, erasure and objection, and the right to lodge a complaint with the competent supervisory authority). Joint controllership is limited to the collection and transfer of data to LinkedIn Ireland Unlimited Company, a company based in the EU. Further processing of the data is the sole responsibility of LinkedIn Ireland Unlimited Company, particularly with regard to transfers of data to its parent company LinkedIn Corporation in the USA; service provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland; legal bases: Legitimate interests (Article 6(1)(f) GDPR); website: https://www.linkedin.com; privacy notice: https://www.linkedin.com/legal/privacy-policy; basis for transfers to third countries: Data Privacy Framework (DPF), standard contractual clauses (https://www.linkedin.com/legal/privacy-policy). Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
Plug-ins and embedded functions and content
We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos or maps (hereinafter collectively referred to as “content”).
Integration always requires the third-party providers of this content to process users’ IP addresses, as they would not be able to send the content to users’ browsers without an IP address. The IP address is therefore required to display this content or these functions. We endeavour to use only content whose providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to analyse information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on users’ devices and may include technical information about the browser and operating system, referring websites, visit times and other information about the use of our online offering, as well as being combined with information from other sources.
Notes on legal bases: Where we ask users for their consent to the use of third-party providers, consent is the legal basis for data processing. Otherwise, user data are processed on the basis of our legitimate interests (i.e. our interest in providing efficient, economical and user-friendly services). In this connection, we also refer you to the information on the use of cookies in this privacy notice.
– Types of data processed: Usage data (e.g. page views and duration of visits, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); meta, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved). Location data (information about the geographical position of a device or person).
– Data subjects: Users (e.g. website visitors, users of online services).
– Purposes of processing and legitimate interests: Provision of our online offering and user-friendliness.
– Retention and erasure: Erasure in accordance with the information in the section “General information on data storage and erasure”. Cookies are stored for up to 2 years (unless stated otherwise, cookies and similar storage methods may be stored on users’ devices for a period of two years).
– Legal bases: Consent (Article 6(1)(a) GDPR). Legitimate interests (Article 6(1)(f) GDPR).
Further information on processing activities, procedures and services:
– Google Fonts (obtained from Google’s server): Obtaining fonts (and symbols) to ensure technically secure, maintenance-free and efficient use of fonts and symbols in terms of currency and loading times, their consistent presentation and compliance with any licensing restrictions. The user’s IP address is disclosed to the font provider so that the fonts can be made available in the user’s browser. Technical data (language settings, screen resolution, operating system and hardware used) that are necessary to provide the fonts according to the devices used and the technical environment are also transmitted. This data may be processed on a server belonging to the font provider in the USA. When users visit our online offering, their browsers send HTTP requests to the Google Fonts Web API (i.e. a software interface for retrieving fonts). The Google Fonts Web API provides users with Google Fonts’ Cascading Style Sheets (CSS) and then the fonts specified in the CSS. These HTTP requests include (1) the IP address used by the relevant user to access the internet, (2) the URL requested from the Google server and (3) the HTTP headers, including the user agent, which describes website visitors’ browser and operating system versions, and the referrer URL (i.e. the webpage on which the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers, and are not analysed. The Google Fonts Web API logs details of HTTP requests (requested URL, user agent and referrer URL). Access to this data is restricted and strictly controlled. The requested URL identifies the font families for which the user wishes to load fonts. This data is logged so that Google can determine how often a particular font family is requested. For the Google Fonts Web API, the user agent must adapt the font generated for the relevant browser type. The user agent is logged and used primarily for debugging and to generate aggregated usage statistics measuring the popularity of font families. These aggregated usage statistics are published on the “Analytics” page of Google Fonts. Finally, the referrer URL is logged so that the data can be used for production maintenance and an aggregated report on the top integrations can be generated based on the number of font requests. According to Google, it does not use any information collected by Google Fonts to create end-user profiles or serve targeted advertisements; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal bases: Legitimate interests (Article 6(1)(f) GDPR); website: https://fonts.google.com/; privacy notice: https://business.safety.google/privacy/; basis for transfers to third countries: Data Privacy Framework (DPF). Further information: https://fonts.google.com/faq?hl=de#privacy.
– Google Maps: We embed maps from the “Google Maps” service provided by Google. The data processed may include, in particular, users’ IP addresses and location data; service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; legal bases: Consent (Article 6(1)(a) GDPR); website: https://mapsplatform.google.com/; privacy notice: https://business.safety.google/privacy/. Basis for transfers to third countries: Data Privacy Framework (DPF)