Privacy Policy
Effective from 05.10.2026
We take your privacy very seriously and process your personal data in accordance with the applicable legal data protection requirements. Personal data within the meaning of this information is all information that can relate to you as a person, such as name, address, email and IP address, user behavior.
With the following privacy policy, we inform you about the processing of your personal data by us. Furthermore, we provide you with an overview of your data protection rights. Which data is processed in detail and how it is used depends primarily on the services used, requested or agreed upon.
1. Responsible Party and Data Protection Officer
1.1 Controller
The controller pursuant to Article 4 No. 7 General Data Protection Regulation (GDPR) is:
Ellyn Pirnay
Practice in Cologne-Esch
Martinusstraße 53
50765 Cologne
Practice in Cologne-Worringen
Hackhauser Weg 61
50769 Cologne
Practice in Düsseldorf
Fürstenwall 146
40217 Düsseldorf
1.2 Data Protection Officer
Practice in Cologne-Esch
The Data Protection Officer
Martinusstraße 53
50765 Cologne
E-Mail: praxis@pirnay.de
2. Source of Personal Data
We process personal data that we receive from you during your visit to our website, as part of your contact with us by email or via a contact form.
3. Categories of Personal Data Processed
3.1 Website Visit
If you visit or use our website purely for information purposes, i.e. if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security:
- Your IP address
- Date, time and duration of your visit
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred in each case
- Website from which the request originates
- Your browser
- Your operating system
This data is used exclusively for internal statistical purposes.
3.2 Cookies
In addition to the aforementioned data, transient and persistent cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive and assigned to the browser you are using and through which certain information flows to the entity that sets the cookie. Cookies cannot execute programs or transfer viruses to your computer. They serve to make the website more user-friendly and effective overall.
3.3 Cookie Settings
Most browsers are set to accept cookies. However, you can deactivate the storage of cookies in your browser at any time or set your browser so that you receive a message as soon as cookies are sent. However, we would like to point out that you may not be able to use all the functions of this website in this case.
3.4 Data Separation
This stored information is kept separate from any other data you may provide to us. In particular, the cookie data is not linked to your other data.
3.5 Hosting
Our website is provided (hosted) by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel delivers the pages via a worldwide network of servers and, on our behalf, processes the data listed in 3.1, in particular your IP address. The programs behind our website, for example for the contact form, run on servers in Frankfurt am Main.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website reliably, quickly and securely. We have concluded a data processing agreement with Vercel pursuant to Art. 28 GDPR. Vercel may also process data in the USA; the Standard Contractual Clauses of the European Commission apply to this. Further information: https://vercel.com/legal/privacy-policy
To protect against misuse, we count how often certain functions of the website are called from one IP address, for example submitting a form. For this purpose we store the IP address for no longer than 15 minutes in a database of the service Upstash (Upstash, Inc., USA). If you call up an address that does not exist on our website, we also store there this address, the referring page and your browser identifier in order to find and fix broken links; we keep no more than the last 1,000 entries. We do not store your IP address in the process. The legal basis is Art. 6(1)(f) GDPR.
4. Additional Functions and Services of Our Website
4.1 In addition to the purely informational use of our website, we offer various services that you can use if you are interested. To do so, you usually have to provide additional personal data that we use to provide the respective service.
4.2 When you contact us by email or via a contact form, the data you provide (your email address, salutation, first and last name and, if applicable, your telephone number) will be stored by us in order to answer your inquiry. We delete the resulting data after storage is no longer necessary or restrict processing if there are statutory retention obligations.
4.3 If you apply via the application form on our website, we process the data you provide (first and last name, email address, telephone number, the advertised position and the location, your answer to the question about completed training, and the origin of the application, e.g. the advertisement through which you came to us) in order to carry out the application process. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into an employment relationship). Your application reaches us by email and is forwarded to the persons involved in the selection; you receive an automatic confirmation of receipt at the email address provided. We do not pass your details on to third parties, in particular not to the operators of the platform on which you saw the advertisement. The same applies to applications that reach us by email or reached us via our former application forms. If no employment relationship is established, we delete the application data no later than six months after the application process has been completed, unless you have consented to longer storage.
5. Integration of OpenStreetMap
5.1 On our website, we show the location of our practices on maps. The map material comes from OpenStreetMap, a service of the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The maps are displayed using the open-source library Leaflet, which we deliver ourselves.
5.2 When you open a page with a map, your browser loads the map tiles directly from the OSMF servers. Your IP address, information about your browser and operating system and the address of our website (referrer) are transmitted to the OSMF. No cookies are set in the process. The map tiles are delivered via a worldwide network of cache servers; according to its own information, the OSMF stores personal data in the United Kingdom and the Netherlands. An adequacy decision of the EU Commission exists for the United Kingdom (Art. 45 GDPR).
5.3 The legal basis is our legitimate interest in presenting our services attractively and making our locations easy to find (Art. 6(1)(f) GDPR). Further information can be found in the OSMF privacy policy: https://osmfoundation.org/wiki/Privacy_Policy.
6. Google Ads
The website operator uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). In addition, targeted advertisements can be displayed on the basis of user data available to Google (e.g. location data and interests) (target group targeting).
As the website operator, we can evaluate this data quantitatively, for example by analysing which search terms led to our advertisements being displayed and how many advertisements led to corresponding clicks.
This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be revoked at any time.
The transfer of data to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.
The company is certified under the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information is available from the provider at the following link: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active.
Conversion Linker & Cookies
To attribute ad clicks correctly, Google sets first-party cookies on our domain via the so-called "Conversion Linker" (including _gcl_aw and, where applicable, _gcl_au). These cookies are used exclusively to measure ad conversions and are generally stored for up to 90 days. They are only set and read after you have given your consent via our consent banner.
Consent Mode
We use Google Consent Mode. The Google services are only loaded once you have consented to the categories "Statistics" and "Marketing" in the cookie banner (see section 7). As long as there is no consent, no measurement takes place and no data is transmitted to Google. You can change your decision at any time via the cookie settings.
Google Ads Remarketing
We also use Google Ads Remarketing to reach users later on other websites with interest-based advertising. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); consent can be revoked at any time.
Google Conversion Tracking
This website uses Google Conversion Tracking. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
With the help of Google Conversion Tracking, Google and we can recognise whether the user has performed certain actions. For example, we can evaluate which buttons on our website were clicked how often and which products were viewed or purchased particularly often. This information is used to create conversion statistics. We learn the total number of users who clicked on our ads and which actions they performed. We do not receive any information that allows us to identify the user personally. Google itself uses cookies or comparable recognition technologies for identification.
This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be revoked at any time.
More information on Google Conversion Tracking can be found in Google's privacy policy: https://policies.google.com/privacy?hl=en.
The company is certified under the "EU-US Data Privacy Framework" (DPF). Further information is available at: https://www.dataprivacyframework.gov/s/participant-search/participant-detail?contact=true&id=a2zt000000001L5AAI&status=Active.
Use of the Conversion Linker for tracking: To attribute ad clicks accurately to subsequent actions on our website, Google uses first-party cookies (e.g. _gcl_aw). These cookies are set via the Conversion Linker and help attribute conversions to a previously served ad. They are only stored after you have given your consent via the consent banner.
Enhanced Conversions
To improve measurement accuracy, in the event of a conversion we may transmit hashed online identifiers (e.g. email address, SHA-256 hash) to Google. This only happens if you have consented to marketing data (in particular ad_user_data).
7. Cookie Consent, Google Tag Manager and Google Analytics
You decide on non-essential cookies and services in the cookie banner. We only load Google Tag Manager, Google Analytics and Google Ads (section 6) once you have consented to the categories "Statistics" and "Marketing" there. Without this consent, these Google services are not loaded and no data is transmitted to Google through them.
Consent management (cookie banner)
We operate the cookie banner ourselves, without an external service. It asks for your consent, stores your decision and ensures that services requiring consent are only loaded afterwards.
Your decision is stored exclusively in your browser (local storage, entry "pirnay-consent"): the categories you allowed and the time of your decision. This information is transmitted neither to us nor to third parties. The decision is valid for twelve months; after that we ask again.
The legal basis for the storage is Section 25(2) no. 2 TDDDG: it is strictly necessary so that we can respect your decision. You can change or revoke your decision at any time via the "Cookie Settings" link at the bottom of every page.
Google Tag Manager
Google Tag Manager is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It loads and controls the Google services named below and in section 6. Tag Manager itself does not set cookies and does not create user profiles; when it loads, however, Google receives your IP address.
We only load Tag Manager after your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). If you revoke your consent, it is no longer loaded the next time a page is opened.
Google Analytics 4
With Google Analytics 4, a service of Google Ireland Limited, we evaluate how our website is used, for example which pages are visited and how visitors reach us. For this purpose Google sets cookies (including _ga and another cookie beginning with _ga_, valid for up to two years) and processes information about your device and browser, the pages visited, your approximate location and your interactions with the website. According to Google, IP addresses are not stored in Google Analytics 4.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can revoke it at any time with effect for the future via the cookie settings.
The data is stored for as long as is set in our Google Analytics account, at most 14 months. Google may also process the data in the USA; the company is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245
8. Categories of Recipients of Personal Data
8.1 We have some of the aforementioned processes and services carried out by carefully selected service providers commissioned in accordance with data protection regulations. These external service providers are bound by our instructions and are regularly monitored. They will not pass on your data to third parties.
8.2 With regard to the disclosure of data to other recipients, we only pass on information about you if statutory provisions require this, you have consented or we are authorized to pass on the information. If these conditions are met, recipients of personal data may include:
- Public authorities and institutions (e.g. tax authorities, law enforcement agencies) if there is a legal or official obligation.
- Other companies or comparable institutions to which we transmit personal data in order to carry out the business relationship with you.
9. Purposes for Which Personal Data is to be Processed and Legal Basis of Processing
We process your personal data in compliance with the applicable legal data protection regulations. Processing is lawful if the following condition is met:
Consent (Article 6 paragraph 1 a) GDPR):
The processing of personal data is lawful with consent to processing for specified purposes (e.g. processing your inquiry, use of data for marketing purposes). Consent given can be withdrawn at any time with effect for the future. This also applies to the withdrawal of declarations of consent that were given to us before the GDPR came into force, i.e. before May 25, 2018.
Legitimate interest (Article 6 paragraph 1 f) GDPR):
Processing is also lawful insofar as it is necessary to safeguard our legitimate interests and your interests do not override them – for example when embedding the OpenStreetMap maps (see section 5). You can object to such processing at any time (see section 12.3).
10. Intention to Transfer Personal Data to a Third Country or an International Organization
Active transfer of personal data to a third country only takes place if this has been expressly indicated within the framework of the aforementioned services.
11. Criteria for Determining the Duration for Which Personal Data is Stored
11.1 The data is stored in accordance with statutory provisions on data processing and in observance of statutory retention periods. We only process and use your data for the purposes for which we are authorized and as long as the data is required for these purposes.
11.2 If the data is no longer required for the purpose or to fulfill legal obligations, it will generally be deleted unless its - temporary and possibly restricted - further processing is necessary for the following purposes:
- The fulfillment of commercial and tax retention obligations: The German Commercial Code (HGB) and the German Fiscal Code (AO) should be mentioned. According to this, the retention or documentation periods are set at up to 10 years.
- The preservation of evidence within the framework of statutory limitation periods: According to Sections 195 et seq. of the German Civil Code (BGB), the regular limitation period is three years, but in special circumstances up to 30 years.
12. Your Data Protection Rights
12.1 Basic Rights
Every data subject has the right to information pursuant to Article 15 GDPR, the right to rectification pursuant to Article 16 GDPR, the right to erasure pursuant to Article 17 GDPR, the right to restriction of processing pursuant to Article 18 GDPR, the right to object pursuant to Article 21 GDPR and the right to data portability pursuant to Article 20 GDPR. The restrictions according to Sections 34 and 35 BDSG apply to the right to information and the right to erasure. In addition, there is a right to lodge a complaint with a competent data protection supervisory authority (Article 77 GDPR in conjunction with Section 19 BDSG).
12.2 Right of Revocation
You can withdraw your consent to the processing of personal data at any time with effect for the future. This also applies to the withdrawal of declarations of consent that were given to us before the General Data Protection Regulation came into force, i.e. before May 25, 2018.
12.3 Right of Objection
You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) GDPR (data processing in the public interest) and Article 6(1)(f) GDPR (data processing on the basis of a balancing of interests). If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims.
The objection can be made informally and should preferably be addressed to:
Practice in Cologne-Esch
The Data Protection Officer
Martinusstraße 53
50767 Cologne
E-Mail: praxis@pirnay.de
13. Obligation to Provide and Possible Consequences of Non-Provision of Personal Data
When using our services, you must provide the personal data that is necessary to fulfill the purpose or that we are legally obliged to collect. Without this data, we will generally not be able to provide the desired service.
14. Existence of Automated Decision-Making Including Profiling
To establish and execute the business relationship, we generally do not use fully automated decision-making in accordance with Article 22 GDPR. Should we use this procedure in individual cases, we will inform you separately about this, provided this is legally required.
15. Changes to the Privacy Policy
We continuously develop and optimize our services. It may therefore be that we add new functionalities. Should this have an impact on how your personal data is processed, we will inform you in good time in our privacy policy.