Privacy Audit Extension for the Chrome Web Store, Edge Web Store, and Firefox Web Store

This section provides a complete description of the data collected by the Eye-Able® Audit for WCAG browser extension, as well as how that data is processed, stored, and shared. Web Inclusion GmbH is the data controller; you can find the contact information in the section titled “Name and Contact Information of the Data Controller.”

The extension is a tool for automatically testing websites for digital accessibility. It serves this purpose exclusively. We do not use any analytics, tracking, or advertising services in the extension, and we do not transmit any data to advertising networks or data brokers.

1. Website Testing — Processing in the Browser

When you start a scan, the extension analyzes the structure of the open page (the DOM) directly in your browser. This analysis takes place entirely locally on your device. The page content is not transmitted to us or to any third parties.

Data is transferred to our servers only in connection with the functions described in sections 4 through 7, which you actively trigger in each case.

2. Data stored locally on your device

To provide these features, the extension stores data in the browser's local storage (chrome.storage.local). This data does not leave your device, is not visible to us, and is deleted as soon as you uninstall the extension or reset the extension's data in your browser.

The following are stored:

• Your settings for the extension (language, verification options, display options)
• Your license key or API key, as well as the session token issued after you log in, including its expiration date
• Your email address, as well as your user ID and organization ID from your Eye-Able® account
• the results of your most recent tests, as well as the findings you have hidden
• Information about the most recently viewed tab (page address and title)
• a local cache of responses from the AI assistant “Ally,” so that the same question does not have to be sent to our server again
• When you log in with your email address and password, the extension will save these login credentials so that it can automatically refresh your session after the token expires, without requiring you to log in again. You can remove these login credentials at any time by logging out of the extension or uninstalling it.

3. Permissions for the extension and their purpose

The Chrome Web Store grants the extension the following permissions upon installation. We use them exclusively for the purposes listed:

• Access to all websites (<all_urls>): This is necessary because you should be able to check any page. The check is performed locally (item 1).
• Memory (storage): Local storage of the data referred to in paragraph 2.
• Tabs and Windows (tabs, windows): Identify the page to be tested and display the test results.
• Context menu (contextMenus): Launch a scan from the right-click menu.
• Cookies (cookies): The extension reads exclusively the session cookie named token on our own domain dashboard.eye-able.com. This allows you to use the extension without having to log in again if you are already logged in to the Eye-Able® Dashboard. Cookies from other websites are not read or transmitted.
• Identity (identity): exclusively for optional sign-in with a Microsoft account (Section 4c).

4. License Activation and Registration

You must log in to use the paid features. There are three ways to do this. In all cases, our server will issue you a temporary session token, which is stored locally.

a) Login with a license key or email address and password
Your email address and password are transmitted to our server in the European Union using TLS encryption and are used there solely to verify your access authorization. We then retrieve the user ID, email address, API key, and associated organization for your account.
Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).

b) Logging in via an existing Dashboard session
If you are already logged into the Eye-Able® Dashboard, the extension reads the session cookie from our own domain that is stored there and uses it to log you in. No additional data is collected in this process.
Legal basis: Art. 6(1)(b) GDPR.

c) Sign in with a Microsoft account (optional)
When you click the "Sign in with Microsoft" button, the extension opens via the Chrome interface chrome.identity a Microsoft login window (login.microsoftonline.com). You register directly with Microsoft; your password is never shared with us and we cannot view it. Microsoft Corporation's Privacy Statement applies to this process.
After successful sign-in, the Microsoft extension receives an access token with the permission User.Read. This token is sent to our server, which uses it to verify your identity and assign your license. The data processed includes your name, email address, and Microsoft user ID.
Signing in with a Microsoft account is optional. Even without it, you can use the extension without any restrictions by following method (a) or (b).
Legal basis: Article 6(1)(b) of the GDPR.

5. "Ally" AI Assistant (optional)

The AI assistant suggests corrections for any accessibility issues it finds. It only takes action when you prompt it to address a specific issue.

The following information is transmitted to our server:

• the HTML source code of the element in question and, if applicable, its parent element
• a description of the error found and, depending on the test rule, additional technical information
• For image checks, the address (URL) of the image in question on the page being checked
• the selected interface language and your API key for assigning your license
• When using the chat feature, the text you enter and the chat history to date

To generate the response, we use Microsoft Azure as a data processor in accordance with Article 28 of the GDPR; processing takes place in data centers in Germany and Sweden. The content submitted is not used to train AI models. Once answered, the requests are not stored on our servers.

Please note: The source code of the element in question will be transmitted. If this element contains personal data from your website, that data will also be transmitted. Therefore, do not use the wizard on pages with content that requires special protection.

Legal basis: Art. 6(1)(b) of the GDPR or Art. 6(1)(f) of the GDPR (provision of the feature you requested).

6. Generating the PDF report (optional)

When you generate a test report as a PDF, the test results are transmitted to a server service in France to create the document. The following data is transmitted:

• the address (URL) of the page that was tested, as well as the date, time, and screen width at the time of the test
• the violations found, including the HTML source code, the text content, the link targets, and the color values determined for the affected elements

Screenshots are not taken or transmitted. The service is operated on our behalf by Scaleway SAS, France, as a data processor pursuant to Article 28 of the GDPR; processing takes place at the Paris data center within the European Union. The data transmitted is used there exclusively to generate the PDF document and is subsequently deleted.

Legal basis: Article 6(1)(b) of the GDPR.

7. Page Actions (optional)

The "Page Actions" feature allows you to record a sequence of steps that the extension automatically performs before a test—such as closing a cookie banner or opening a menu. The recording only starts when you explicitly enable it.

The following information is stored and transmitted to our server:

• the address (URL) of the page to which the expiration applies
• the sequence of recorded steps, each showing the CSS selector and the element type of the element that was clicked or described
• For text entries, the text you enter, so that the sequence can be repeated. If you record a sequence that includes a login, this also includes the login credentials you entered, including the password—without them, the saved sequence would not be able to perform the login. This information is used exclusively to replay the sequence you recorded and is not analyzed for any other purposes. We recommend using a separate test account for this purpose.
• a title you have chosen for the process

You can view and delete recorded processes in the add-on at any time.

When searching for an existing report, the search term you enter or the hostname of the currently open page is also transmitted to our server in order to match it with the appropriate report.

Legal basis: Article 6(1)(b) of the GDPR.

8. Recipients and Disclosure

Your data will be transferred to the following recipients:

9. Retention Period

• Locally stored data (item 2): until the extension is uninstalled or until you delete it in your browser.
• Session token: until the token expires, up to 5 days.
• Account information (Section 4): for the duration of your contractual relationship; thereafter, it will be deleted unless required to be retained under applicable laws.
• Requests to the AI assistant (Section 5): stored locally until the extension is uninstalled or until you delete it from your browser.
• Data related to PDF generation (Section 6): No data is stored locally or on our servers
• Page Actions (Item 7): until you delete the respective process or the associated report.
• Log files from our API servers: 90 days.

10. No Use for Other Purposes

We use the data collected through the extension exclusively for the extension's primary purpose as described—the automated testing of websites for accessibility. In particular:

• We do not sell user data or share it with data brokers or advertising networks.
• We do not use the data for advertising, personalization, profiling, or credit checks.
• We do not use any analytics, tracking, or telemetry services in the extension.
• The extension does not download any program code from the Internet; all features are included in the installed package.

In doing so, we also comply with the requirements of the Chrome Web Store’s “Limited Use” policy.

11. Your Rights

You have the rights described in the section “Your Rights,” including, in particular, the rights to access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right to lodge a complaint with a supervisory authority.

To delete the data processed by the extension, simply send an informal message to datenschutz@eye-able.com. You can delete locally stored data yourself at any time by uninstalling the extension.

Date of this section: August 25, 2026

Privacy Policy for the Eye-Able® Website

In general, you can use the Eye-Able® website at www.eye-able.com without providing any personal information.

However, if a data subject wishes to use specific services offered by our company through our website, the processing of personal data may be necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the data subject’s consent.

The processing of personal data is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the country-specific data protection regulations applicable to Eye-Able®.

As the data controller, Eye-Able has implemented numerous technical and organizational measures to ensure the most comprehensive protection possible for the personal data processed through this website.

Our Privacy Policy provides information about the nature, scope, and purpose of the personal data we collect, process, and use, as well as your rights regarding our processing of your personal data.

1. Name and contact information of the data controller

The website www.eye-able.com is operated by the

Web Inclusion, LLC

1 Florian-Geyer Street

97076 Würzburg

info@eye-able.com

Managing Directors: ChristianSchmidt, Eric Braun, Inge Schardt

 

We are responsible for the collection, processing, and use of your personal data that may be collected from you during your visit to our websites. If you have any questions regarding this, please feel free to contact us using the contact information provided.

2. Your Rights

If we process your personal data, you have the right to access, rectify, erase, restrict the processing of, and transfer your data. In addition, you have the right to object and the right to file a complaint.

To exercise your rights, please contact us or our Data Protection Officer using the contact information provided above.

Specifically, you have the following rights:

2.1. The Right to Confirmation and Access, Article 15 of the GDPR

You may request confirmation as to whether we process your personal data. If we process your personal data, you have the right to obtain information regarding the following:

• the purposes of processing
• the categories of personal data that are processed,
• the recipients or categories of recipients to whom the personal data is disclosed, in particular recipients in third countries or international organizations,
• if possible, the planned period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period,
• the existence of a right to have personal data concerning you rectified or erased, or to have the processing restricted by the controller, or a right to object to such processing,
• the existence of a right to file a complaint with a supervisory authority,
• if the personal data is not collected from the data subject, all available information regarding the origin of the data,
• the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the GDPR, and—at least in such cases—meaningful information about the logic involved, as well as the scope and intended effects of such processing on the data subject.

2.2. The Right to Rectification, Article 16 of the GDPR

You have the right to request that we correct any inaccurate personal data concerning you without delay.

In addition, taking into account the purposes of the processing, you have the right to request that incomplete personal data be completed—including by means of a supplementary statement.

2.3. The Right to Erasure, Article 17 of the GDPR

You may request that we delete your personal data without delay. In this case, we are required to delete your personal data without delay if any of the following reasons apply:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• You withdraw your consent, on which the processing was based, and there is no other legal basis for the processing;
• You object to the processing and there are no overriding legitimate grounds for the processing, or you object to the processing;
• the personal data was processed unlawfully;
• the erasure of personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which we are subject;
• The personal data was collected in connection with information society services offered in accordance with Article 8(1) of the GDPR.

As an exception, the right to erasure does not apply if the processing

• to exercise the right to freedom of expression and information;
• to comply with a legal obligation that requires processing under Union or Member State law to which we are subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in us;
• for reasons of public interest in the area of public health;
• for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GDPR, to the extent that the right to erasure is likely to render impossible or seriously impair the achievement of the purposes of the processing, or
• to assert, exercise, or defend legal claims.

If we are obligated to delete the data in accordance with the aforementioned principles, and if we have made your personal data public, we will take appropriate measures—including technical measures—taking into account the available technology and the costs of implementation, to inform other data controllers who process the personal data that you have requested them to delete all links to such personal data or any copies or replicas of such personal data.

2.4. The Right to Restriction of Processing, Article 18 of the GDPR

Under the following conditions, you have the right to request that we restrict the processing of your personal data, namely if:

• the accuracy of your personal data is disputed, for a period that allows us to verify the accuracy of the personal data;
• the processing is unlawful, and you object to the erasure of the personal data and instead request that the use of the personal data be restricted;
• we no longer need the personal data for the purposes of processing, but you need it to assert, exercise, or defend legal claims, or
• You have objected to the processing, as long as it has not yet been determined whether our legitimate grounds outweigh yours.

2.5. The Right to Data Portability, Article 20 of the GDPR

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format.

In addition, you have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

• the processing is based on consent or a contract, and
• the processing is carried out using automated means.

When exercising your right to data portability, you have the right to have your personal data transferred directly from one data controller to another, provided that this is technically feasible.

2.6. Right to Object to Data Processing, Article 21 of the GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on your consent or our legitimate interest; this also applies to profiling.

Once you have objected, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

 

Direct Marketing

If personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for those purposes.

You have the right to object, on grounds relating to your particular situation, to the processing of your personal data carried out for scientific or historical research purposes or for statistical purposes, unless the processing is necessary for the performance of a task carried out in the public interest.

2.7. Right to Withdraw Consent

If you have given us your consent to process your personal data (e.g., to send you a newsletter), you also have the right to withdraw that consent at any time, effective for the future. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal.

You may cancel the agreement informally.

2.8. Right to File a Complaint with a Supervisory Authority, Article 77 of the GDPR

In addition, you also have the right to file a complaint against us with a data protection supervisory authority—in particular, in the Member State of your habitual residence, your workplace, or the location of the alleged violation—if you believe that our processing of your personal data violates applicable data protection law.

The regulatory authority responsible for us is the

[Adjust according to the state] Bavarian State Office for Data Protection Supervision, Promenade 27 (Schloss), 91522 Ansbach, Phone: +49 (0) 981 53 1300, Fax: +49 (0) 981 53 98 1300, Email: poststelle@lda.bayern.de.

3. Data Processing When Visiting Our Websites

In general, it is possible to use our website without actively providing personal data. However, every time you visit our website—even if it is solely for informational purposes—various data and information are collected by us for technical reasons and stored in our server’s log files. This data consists solely of personal data or data that can be linked to an individual that your browser transmits to our server.

The following information is collected and stored:

• the IP address (Internet Protocol address),
• the date and time of access to our website,
• the browser software/browser types used to access our website (computer programs for displaying web pages), as well as their versions and language,
• the operating system accessing our system and its version,
• the Internet service provider (ISP) of the accessing system,
• Content of the request (content of the specific pages accessed),
• Access status/HTTP status code (the response returned by the server for each HTTP request, indicating the status of the request),
• the website from which our website is accessed,
• Time zone difference from Greenwich Mean Time (GMT).

Storing the IP address—even if only for a short time—is technically necessary due to the way the Internet works. However, before we process and store your IP address, it is truncated and used only in this unrecognizable (anonymous) form. The full IP address is not stored. Once truncated, it is no longer possible to link it to you.

We also do not use the other information and data mentioned above to draw conclusions about you and/or identify you. Data that could be used to identify you is anonymized as soon as possible.

We collect the data and information listed above solely to display our websites to you, to ensure their stability and security, and to optimize our websites in this regard. The collection of this data therefore serves the purpose of improving the data security of the programs and systems we use. In addition, we use the data for anonymous, statistical analysis of your activity on our websites.

The log files are stored separately from any other personal data you may have provided to us during your visit to our website and are not combined with that data. The log files are deleted after 7 days.

The legal basis for collecting the aforementioned data is our legitimate interest (Article 6(1)(f) of the GDPR) in ensuring the functionality and security of our websites. In addition, we have a legitimate interest in using anonymous or anonymized data to analyze user behavior on our websites in order to evaluate the effectiveness of our website design and structure.

4. Cookies

We use cookies on our website. Cookies are small text files that our server sends to your browser along with the webpage you are viewing the first time you visit our website. Your browser stores the cookie(s) on the hard drive of your device.

Cookies cannot be used to transfer malware or viruses to your device, run programs, or open pop-up windows. Nor are they used to send spam. Rather, cookies are used to obtain certain information.

We distinguish between technically necessary cookies, which are essential for the websites to function at all, and optional cookies. Optional cookies are set only with your consent. Please note that if you allow only the technically necessary cookies, some features of the websites may be limited or unavailable.

4.1. Technically Necessary Cookies

We use this data and the technically necessary cookies we employ to make our website more effective, secure, and user-friendly overall, and, for example, to determine which items are already in your shopping cart or whether a pop-up window has already been displayed to you.

4.1.1. Method of Use

We use the following technically necessary cookies:

Cookie Name	Purpose	Cookie Expiration
Viewed _cookie_policy	Storing user settings; used solely to ensure the proper functioning of the website	12 months
cookielawinfo-checkbox-necessary	Storing user settings; used solely to ensure the proper functioning of the website	1 hour
cookielawinfo-checkbox-non-necessary	Storing user settings; used solely to ensure the proper functioning of the website	12 months
PHPSESSID	Storing user settings; used solely to ensure the proper functioning of the website	End of the meeting
allowCookie:	Storing user settings; used solely to ensure the proper functioning of the website	6 months
__csrf_token-1	Safety mechanism	End of the meeting
Session 1	Storing user settings; used solely to ensure the proper functioning of the website	End of the meeting

4.1.2. Legal Basis for Use

We have a legitimate interest (Article 5(1)(f) of the GDPR) in the use of cookies. This applies to cookies that are necessary for the use of our websites’ features (e.g., the shopping cart feature), as these are required for the functionality and optimal delivery of our services.

4.2. Optional Cookies

4.2.1. Legal Basis

Voluntary cookies are set only with your consent (Article 6(1)(a) of the GDPR). Please note that if you allow only technically necessary cookies, some features of the websites may be limited or unavailable.

4.3. Additional Ways to Control the Use of Cookies Through Your Browser Settings

If you do not wish to have cookies stored on your device—either in general or specific cookies—you can adjust your browser settings via the appropriate menu option to suit your preferences.

At this point, we would like to point out that this may result in not all features of our websites being available or usable.

You can not only block cookies that are stored on your device beyond the current session, but you can also delete them from your device, regardless of whether their use is time-limited or unlimited.

To do this, you can access the relevant features in your browser and clear your history.

Flash cookies can be prevented by installing an appropriate “add-on,” such as “Better Privacy” for Mozilla Firefox or the Adobe Flash Killer Cookie for Google Chrome.

By selecting incognito mode in your browser, you can prevent HTML5 Storage Objects from being set or used.

In general, we recommend that you clear your browser history and cookies regularly.

5. Data Processing When Using the Contact Form You have the option to send us an inquiry via our contact form.

5.1. Use of the Contact Form

If you take advantage of this option, we will collect only the personal data that you provide as part of your inquiry. Please note that your email address is required; without it, we unfortunately cannot send your inquiry to us. You are also welcome to provide us with your first name, last name, or title (Ms./Mr.) so that we can address you correctly in our response.

5.2. Data Processing

The processing of the data you provide as part of your inquiry via our contact form is based on the consent to processing (Article 6(1)(a) of the GDPR) that you grant us by submitting your inquiry, or on our legitimate interest (Article 6(1)(f) of the GDPR) in being able to respond to inquiries addressed to us.

If a contractual relationship is established between us as a result of your initial contact, data processing will be carried out for the purpose of taking steps prior to entering into a contract (Article 6(1)(b) of the GDPR).

5.3. Retention Period

We store the data we receive from you via the contact form until your inquiry has been fully processed. Subject to your consent to store your data for other purposes (e.g., sending newsletters), we will delete your data after your inquiry has been processed, unless a contractual relationship between us has been established as a result of your contact. In that case, we will store the data, to the extent necessary, until the expiration of the retention periods required by commercial and tax law.

5.4. Right to Withdraw Consent

You may revoke this consent at any time, effective for the future. Your revocation does not affect the lawfulness of the processing of your personal data that took place prior to your revocation.

In the event that a contract is concluded between us and you as a result of our initial contact, the storage of your data is based on the contract or on necessary pre-contractual measures.

To exercise your right of withdrawal, simply send us a brief email or choose another way to contact us. You can find our contact information in our legal notice or at the beginning of this statement.

 

6. Data Processing for Inquiries Submitted via Email, Phone, or Fax If you contact us via email, phone, or fax, we will collect and process the personal data you provide to us in this context (name, inquiry, phone number, email address, fax number, and, if applicable and provided as part of the inquiry, e.g., email signature, your address). We use your personal data exclusively to process your inquiry. We will not disclose this data to third parties without your consent.

6.1. Data Processing

The processing of the data you provide as part of your inquiry via our contact form is based on your consent to such processing (Article 6(1)(a) of the GDPR), which you grant by submitting your inquiry, or on our legitimate interest (Article 6(1)(f) of the GDPR) in being able to respond to inquiries directed to us.

If a contractual relationship (membership) is established as a result of your contact with us, data processing will be carried out for the purpose of taking steps prior to entering into a contract (Article 6(1)(b) of the GDPR).

6.2. Retention Period

We store the data we receive from you via the contact form until your request has been fully processed. Subject to your consent to the storage of your data for other purposes (e.g., sending newsletters), we will delete your data once your inquiry has been processed, unless a contractual relationship between us has been established as a result of your contact. In this case, we will store the data, to the extent necessary, until the expiration of the retention periods required by commercial and tax law.

6.3. Right to Withdraw Consent

You may revoke your consent to data processing at any time, effective for the future. Your revocation does not affect the lawfulness of the processing of your personal data that took place prior to your revocation.

To exercise your right of withdrawal, simply send us a brief email or choose another way to contact us. You can find our contact information in our legal notice or at the beginning of this statement.

7. SSL or TLS Encryption

On our websites where personal data can be entered (in particular during the ordering process, when logging into your customer account, or when subscribing to our newsletter), we use TLS (Transport Layer Security) encryption technology. This is a protocol for encrypting data transmissions to prevent unauthorized third-party access to your personal data, particularly your banking or financial information. You can recognize the encryption by the label “https://.”

8. Google Web Fonts and Google Material Icons

We use so-called web fonts and Material Icons on our websites to ensure that the content is displayed in an appealing, accurate, and consistent manner across all browsers. The appealing and accurate display of our content constitutes a legitimate interest.

The web fonts and Material icons we use are provided by Google LLC (Google), Amphitheatre Parkway, Mountain View, CA 94043, USA.

Web fonts and Material Icons make it possible to use fonts and icons that are not installed on the visitor's computer or the device used to access our site.

The fonts and icons used on the web page you have accessed are loaded into your browser cache by your browser when you visit this page, so that the content (text, characters, and icons) is displayed correctly. In doing so, the browser you are using establishes a connection with Google’s servers. As part of this connection between your browser and Google, Google becomes aware that your IP address has accessed our website. However, according to Google, there is no linking of otherwise known personal data (e.g., if you are logged into your Google account at the time you visit our website) to the fact that your IP address is transmitted to Google when you visit a website.

According to Google, CSS (Cascading Style Sheets—a programming or stylesheet language used to determine the appearance of content on our site, such as the color of individual words or paragraphs) is stored in the cache for 24 hours.

According to Google, the font files and icons themselves are cached for one year. For more information on data storage and Google Web Fonts, please visit the following link: https://developers.google.com/fonts/faq.

For more information about Google's use of data, please visit: https://policies.google.com/privacy?hl=de.

If your browser does not support Google Web Fonts or if access is blocked, the content will be displayed using a standard font installed on the device you are using.

9. Definition of Terms

The definitions provided below are based on the European Union’s General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679 of the European Parliament and of the Council).

9.1. “Data Controller”

The controller is the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be provided for by Union law or the law of the Member States.

Thus, the controller is, in principle, the natural person or entity that, alone or jointly with others, determines the purposes and means of the processing of personal data.

9.2. “Personal Data”

Personal data is any information relating to an identified or identifiable natural person (“data subject”); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier, or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. In addition to first and last names, address, phone number, email address, date of birth, etc., personal data also includes the IP address used, information about the devices you use, voice recordings, your loyalty card number, your account information, your credit card numbers, as well as, for example, physical characteristics such as your gait or appearance.

9.3. “Processing”

Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, distribution, or any other form of disclosure, the comparison or interlinking, the restriction, erasure, or destruction. For example, your data is also processed when you present your loyalty card as part of the payment process at the register or make a payment with your debit card.

9.4. “Third Party”

A “third party” is a natural or legal person, public authority, agency, or other entity, other than the data subject, the controller, the processor, and the persons authorized to process the personal data under the direct responsibility of the controller or the processor.

9.5. “Restriction of Processing”

Restriction of processing refers to the marking of stored personal data for the purpose of limiting its future processing.

9.6. “Pseudonymization”

The processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information is referred to as pseudonymization. This additional information is required. In addition, technical and organizational measures must be taken to ensure that the personal data cannot be attributed to an identified or identifiable natural person.

9.7. “Consent”

Consent is defined as any freely given, specific, informed, and unambiguous indication of the data subject’s wishes, expressed in the form of a statement or other unequivocal affirmative action, by which the data subject indicates that he or she consents to the processing of personal data relating to him or her.