Datenschutzbestimmungen
Allgemeines
This privacy policy will explain what kind of personal data (hereinafter also referred to as “data”) we process as well as the purposes and extent of data processing. The privacy policy applies to all personal data we process, be it as part of the provision of our services and on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offering”).
The terms used apply to all genders.
Status: 8th March 2026
Contents
Person in charge
Dr. Martin Stieler
BIMOVIS GmbH
c/o BioLabs Heidelberg
Nikola-Tesla-Str. 1
69124 Heidelberg
website(at)bimovis.com
Processing overview
The following overview summarizes the types of data processed and the purposes of their processing and refers to the persons concerned.
Types of Data Processed
Categories of data subjects
Purposes of processing
Relevant legal basis
Below you will find an overview of the legal basis of GDPR, based on which we process personal data. Please note that, in addition to the provisions of GDPR, national data protection regulations may apply in your or our country of residence or domicile. If more specific legal bases are relevant in individual cases, we will inform you of them in the data protection declaration.
In Germany, national data protection regulations apply in addition to the data protection regulations of the General Data Protection Regulation. This includes in particular the law on protection against misuse of personal data in data processing (Federal Data Protection Act – BDSG). In particular, the BDSG contains special regulations on the right to information, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated decision-making in individual cases including profiling. Furthermore, it regulates data processing for the purposes of the employment relationship (§ 26 BDSG), in particular regarding the establishment, implementation or termination of employment relationships and the consent of employees.
Security measures
We take appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the implementation costs and the type, scope, circumstances and purposes of the processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons Measures to ensure a level of protection appropriate to the risk.
In particular, these measures include securing the confidentiality, integrity and availability of data by controlling physical and electronic access as well as access, input, disclosure, securing availability and their separation. Furthermore, we have set up procedures that ensure the exercise of data subject rights, the deletion of data and reactions to data threats. Furthermore, we already take the protection of personal data into account during the development or selection of hardware, software and processes in accordance with the principle of data protection, through technology design and through data protection-friendly default settings.
Transmission of personal data
In the course of processing personal data, they may be transmitted or disclosed to other bodies, companies, legally independent organizations or persons. The recipients of this data might include, for example, service providers commissioned with IT tasks or providers of website-related services and content. In such cases, we observe the legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.
Data processing in third countries
If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)) or the processing within the framework of the use of third-party services or the disclosure or transmission of data to other persons, bodies or companies takes place, this is only done in accordance with the legal requirements.
Subject to express consent or contractually or legally required transmission, we only process or have the data processed in third countries with a recognized level of data protection, contractual obligation through so-called standard protection clauses of the EU Commission, if there are certifications or binding internal data protection regulations (Art. 44 to 49 DSGVO, Information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).
Deletion of data
Data we process will be deleted in accordance with the legal requirements as soon as your consent to processing is revoked or other permissions are no longer applicable (e.g. if the purpose of processing this data no longer applies or it is not required for the purpose).
If the data is not deleted because it is required for other, legally permissible purposes, its processing will be limited to these purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be stored for commercial or tax reasons or whose storage is necessary to assert, exercise or defend legal claims or to protect the rights of another natural or legal person.
Our data protection information can also contain further information on the storage and deletion of data, which apply primarily to the respective processing.
Business services
We process data from our contractual and business partners, e.g. customers and interested parties (collectively referred to as “contractual partners”) within the framework of contractual and comparable legal relationships and related measures and within the framework of communication with the contractual partners (or pre-contractual), e.g to answer inquiries.
We process this data to fulfill our contractual obligations. This includes in particular the obligations to provide the agreed services, any updating obligations and remedy in the case of warranty and other service disruptions. In addition, we process the data to protect our rights and for the purpose of the administrative tasks associated with these obligations and the corporate organization. In addition, we process the data on the basis of our legitimate interests in proper and economical business management and in security measures to protect our contractual partners and our business operations from misuse, endangerment of their data, secrets, information and rights (e.g. to involve telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of the applicable law, we only pass on the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or to fulfill legal obligations. The contractual partners will be informed about other forms of processing, e.g. for marketing purposes, within the scope of this data protection declaration.
We inform our contractual partners which data is required for the aforementioned purposes before or during data collection, e.g. in online forms, by means of special markings (e.g. colours) or symbols (e.g. asterisks or similar), or personally.
We delete the data after statutory warranty and comparable obligations have expired, i.e. generally after 4 years, unless the data is stored in a customer account, e.g. for as long as it must be kept for legal archiving reasons (e.g. for tax purposes usually 10 years). We delete data disclosed to us by the contractual partner as part of an order in accordance with the specifications of the order, generally after the end of the order.
In cases where we use third-party providers or platforms to provide our services, the terms and conditions and data protection notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.
Technical services
We process the data of our customers and clients (hereinafter referred to as “customers”) to enable them to select, purchase or commission the selected services or works and related activities as well as their payment and provision or execution or provision to allow.
The information required is marked as such within the framework of the conclusion of the contract, order or comparable contract and includes the information required for the provision of services and billing as well as contact information to be able to hold any consultations. Insofar as we have access to information from end customers, employees or other persons, we process this in accordance with the legal and contractual requirements.
Online offering and web hosting
To be able to provide our online offer securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offer can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services, as well as security services and technical maintenance services.
The data processed as part of the provision of the hosting offer may include all information relating to the users of our online offer that arises in the context of use and communication. This regularly includes the IP address, which is necessary to be able to deliver the content of online offers to browsers, and all entries made within our online offer or on websites.
Further information on processing processes, procedures and services:
Marketing communications via e-mail, post, fax or phone
We process personal data for the purpose of marketing communications via various channels such as e-mail, phone, post or fax, in accordance with legal requirements.
Recipients have the right to revoke their consent at any time or to object to marketing communications at any time.
After revocation or objection, we can store the data required to prove consent for up to three years based on our legitimate interests before we delete them. The processing of this data is limited to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that the previous existence of consent is confirmed at the same time.
Presence in social networks (social media)
We maintain online presences within social networks and process user data in this context to communicate with the users active there or to offer information about us.
We would like to point out that user data can be processed outside of the European Union. This can result in risks for the user, because it could make it more difficult to enforce the user’s rights, for example.
Furthermore, user data is usually processed within social networks for market research and advertising purposes. For example, usage profiles can be created based on usage behavior and the resulting interests of users. The usage profiles can in turn be used, for example, to place advertisements inside and outside the networks that presumably correspond to the interests of the user. For these purposes, cookies are usually stored on the users’ computers, in which the usage behavior and the interests of the users are stored. Furthermore, data can also be stored in the usage profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).
For a detailed description of the respective forms of processing and the possibility of objection (opt-out), we refer to the data protection declarations and information provided by the operators of the respective networks.
Also, in the case of requests for information and the assertion of data subject rights, we would like to point out that these can be asserted most effectively with the providers. Only the providers have access to the data of the users and can take appropriate measures and provide information directly. If you still need help, you can contact us.
Further information on processing processes, procedures and services:
Plugins and embedded functions and content
We integrate functional and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These can be, for example, graphics, videos or city maps (hereinafter uniformly referred to as “content” ).
The integration always presupposes that the third-party providers of this content process the IP address of the user, since without the IP address they could not send the content to their browser. The IP address is therefore required for the display of this content or functions. We endeavor to only use content whose respective providers only use the IP address to deliver the content. Third-party providers can also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website.
Notes on legal basis: If we ask users for their consent to the use of third-party providers, the legal basis for processing data is consent. Otherwise, user data is processed based on our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this data protection declaration.
Further information on processing processes, procedures and services:
Modifications and update of the privacy policy
We ask you to regularly check the content of our data protection declaration. We will adapt the data protection declaration as soon as this is required by changes in our data processing. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.
If we provide addresses and contact information of companies and organizations in this data protection declaration, please note that the addresses can change over time and ask you to check the information before contacting us.
Rights of the data subject
As a data subject, you are entitled to various rights under GDPR, which result in particular from Articles 15 to 21 GDPR:
Definitions of terms
This section provides you with an overview of the terms used in this data protection declaration. Many of the terms are taken from the law and defined above all in Art. 4 GDPR. The legal definitions are binding. The following explanations, on the other hand, are intended primarily for understanding. The terms are sorted alphabetically.
