Privacy Policy

In this Privacy Policy, we inform you about what personal data we process when you visit our websites semper-fidus.de and unterweisungonline.net and in connection with our services, for what purposes and on what legal basis this is done, and what rights you have.

1. Data Controller

Semper Fidus GmbH
August-Mohl-Straße 13
95030 Hof
Represented by Managing Directors Philipp Schwarz and Natalie Degelmann
Phone: +49 9191 351939-0
Email: info@semper-fidus.de

2. Data Protection Officer

You can contact our Data Protection Officer at:
Semper Fidus GmbH
Data Protection Officer
Email: info@semper-fidus.de

3. General Information on Data Processing

3.1 Legal Basis

We process personal data based on the following legal grounds set forth in the General Data Protection Regulation (GDPR):

  • Art. 6(1)(a) of the GDPR – Consent
  • Art. 6(1)(b) of the GDPR – Performance of a contract or implementation of precontractual measures
  • Art. 6(1)(c) of the GDPR – Compliance with a legal obligation (e.g., retention requirements under commercial and tax law)
  • Art. 6(1)(f) of the GDPR —Protection of our legitimate interests or the legitimate interests of third parties, unless your interests take precedence

To the extent that we store information on your device or access information stored there (e.g., cookies), we do so on the basis of Section 25(1) of the TDDDG (consent) or, if this is absolutely necessary for the provision of a service you have expressly requested, on the basis of Section 25(2)(2) of the TDDDG.

3.2 Retention Period

We delete personal data as soon as the purpose of the processing no longer applies, provided there are no legal retention requirements to the contrary. We retain documents relevant under commercial and tax law for up to ten years in accordance with legal requirements (in particular Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)). We specify the specific retention periods for each individual processing activity.

3.3 Recipients

We use carefully selected service providers (data processors under Article 28 of the GDPR), for example, for hosting, email, and IT services. We have entered into data processing agreements with these providers. In addition, we only disclose data if it is necessary to fulfill a contract (e.g., to tax advisors, payment service providers, or event venue partners), if you have given your consent, or if we are legally required to do so.

3.4 Transfer to Third Countries

Some of the services used may transfer data to countries outside the European Economic Area (particularly the United States). A transfer will only take place if the European Commission has issued an adequacy decision for the third country (for the U.S.: the EU-U.S. Data Privacy Framework, provided the recipient is certified) or if appropriate safeguards are in place, in particular EU Standard Contractual Clauses (Art. 46(2)(c) of the GDPR).

4. Hosting and Server Log Files

Our website is hosted by Neue Medien Münnich | Hauptstraße 68 | D-02742 Friedersdorf. When you visit our website, information transmitted by your browser is automatically collected (server log files):

  • IP address
  • Date and time of access
  • page or file accessed
  • Referrer URL (previously visited page)
  • Browser and operating system used
  • Amount of data transferred and HTTP status code

This processing is necessary to provide the website and to ensure its security and stability. The legal basis is Article 6(1)(f) of the GDPR. The log files are deleted after 7 days , unless they are needed for a longer period to investigate a security incident. A contract for data processing has been entered into with the hosting provider.

5. SSL/TLS Encryption

For security reasons, our website uses SSL/TLS encryption. You can recognize an encrypted connection by the "https://" and the padlock icon in your browser's address bar.

6. Cookies and Consent Management

6.1 Cookies

We use cookies and similar technologies (e.g., local storage). We use technically necessary cookies in accordance with Section 25(2)(2) of the TDDDG and Article 6(1)(f) of the GDPR. We use all other cookies (e.g., for statistics and marketing) only with your consent (Section 25(1) of the TDDDG, Article 6(1)(a) of the GDPR). You may revoke or modify your consent at any time with future effect by clicking on the cookie icon in the lower-left corner of the website.

6.2 CookieYes

To manage your consent, we use the CookieYes consent management platform provided by CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. In doing so, your consent decision, an anonymized identifier, the date and time, as well as browser and device information are processed and stored in the “cookieyes-consent” cookie (retention period: 1 year). In addition, the WordPress plugin “WP Consent API” stores your selections in cookies with the prefix “wp_consent_” (retention period: 1 month). The legal basis is Art. 6(1)(c) of the GDPR in conjunction with Art. 7(1) of the GDPR (duty to provide evidence) as well as § 25(2)(2) of the TDDDG. An adequacy decision by the European Commission is in effect for the United Kingdom. A data processing agreement is in place with CookieYes.

7. Making Contact

7.1 Contact Form

When you use our contact form, we process your name, email address, and message—as well as any additional voluntary information you provide—to respond to your inquiry. The form is powered by the WordPress plugin “Gravity Forms.” The information you enter is stored on our web server and sent to us via email.

The legal basis is Article 6(1)(b) of the GDPR if your inquiry is aimed at entering into a contract, and otherwise Article 6(1)(f) of the GDPR (our legitimate interest in responding to inquiries). We will delete the data as soon as your inquiry has been fully processed, but no later than [6 months] after it is received, provided that no contractual relationship is established and there are no retention obligations.

7.2 Inquiries by Email or Phone

If you contact us by email or phone, we will process the data you provide to handle your inquiry. The legal basis and retention period are as described in Section 7.1. Our email account is hosted by [e.g., Microsoft Ireland Operations Ltd. / IONOS SE / hosting provider].

8. Registration for Seminars and Training Courses

To register for our in-person courses, we use a registration form based on the “The Events Calendar” plugin on our web server. In doing so, we process the company name and legal form, billing address, name, email address, and phone number of the contact person, the number of participants, and the participant data required to conduct the course (e.g., name, date of birth).

We use the data to check availability, conduct the course, issue certificates of participation and other certificates, and for billing purposes. The legal basis is Article 6(1)(b) of the GDPR; if data is transmitted by a client’s employees, the legal basis is Article 6(1)(f) of the GDPR (performance of the contract concluded with the client). To the extent that legal requirements or requirements of accident insurance providers mandate proof of training, we additionally process the data on the basis of Article 6(1)(c) of the GDPR.

We retain data relevant to invoicing for up to ten years, in accordance with commercial and tax law requirements. We store proof of participation and issued certificates for [10 years] so that we can issue you a duplicate if necessary.

9. Contract Processing, Consulting Services, and Customer Portal

As part of our consulting and support services (e.g., safety engineering support, risk assessments, inspections), we process contact and contract information for our clients and their points of contact, as well as the operational information necessary for the provision of services. The legal basis is Article 6(1)(b) of the GDPR; with regard to points of contact, the legal basis is Article 6(1)(f) of the GDPR.

For the exchange of documents, we provide a password-protected customer portal at cloud.semper-fidus.de. This portal is powered by [software, e.g., Nextcloud] and hosted by [hosting provider / our own server]. In doing so, we process your login credentials, uploaded files, and log data (IP address, time of login). The data is stored for the duration of the business relationship and deleted thereafter, provided there are no retention requirements.

10. Online Training

Through our “UnterweisungOnline” service (unterweisungonline.net), we conduct digital safety training sessions. In doing so, we process [name, email address, company, participation and results data, and time of the training session] in order to provide the training and enable the employer to provide proof in accordance with Section 12 of the Occupational Safety and Health Act (ArbSchG) and DGUV Regulation 1.

To the extent that we conduct the training on behalf of your employer, we process the data as a processor pursuant to Article 28 of the GDPR. In such cases, your employer is the controller. The platform is hosted by [provider/host]. The records are stored for [X years / as directed by the employer].

11. Applications

If you apply for a position with us (including unsolicited applications), we will process the data you provide—in particular, contact information, your resume, certificates, and proof of qualifications—for the purpose of conducting the application process. The legal basis is Article 6(1)(b) of the GDPR (initiation of an employment relationship) in conjunction with Section 26 of the German Federal Data Protection Act (BDSG). To the extent that you voluntarily provide us with special categories of personal data (e.g., information regarding your health or severe disability), we process this data in accordance with Article 9(2)(b) of the GDPR.

If an employment relationship is not established, we will delete your documents six months after the conclusion of the application process. This is to protect against potential claims under the General Equal Treatment Act (Art. 6(1)(f) of the GDPR). Your data will only be retained for a longer period for future job openings with your consent. If an employment relationship is established, the data will be transferred to your personnel file.

12. Newsletter (Mailchimp)

When you subscribe to our newsletter, we process your email address and, if applicable, your name, in order to send you regular information about occupational safety, training dates, and our services. Subscription is handled via a double opt-in process: You will receive an email asking you to confirm your subscription. We log the time and IP address of both the sign-up and the confirmation to be able to verify your consent.

We use Mailchimp, a service provided by The Rocket Science Group LLC (Intuit Inc.), 405 N Angier Ave NE, Atlanta, GA 30308, USA, to send our newsletters. Mailchimp tracks whether newsletters are opened and which links are clicked. The legal basis for this is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time by clicking the unsubscribe link in every email. After you unsubscribe, we may store your email address in a block list to prevent you from receiving further emails (Art. 6(1)(f) GDPR). The provider is certified under the EU-U.S. Data Privacy Framework; in addition, we have entered into a data processing agreement containing standard contractual clauses.

13. Analytics and Marketing Services

We use the following services only if you have given your consent via our cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can revoke your consent at any time by clicking the cookie icon.

13.1 Google Analytics and Google Tag (via Google Site Kit)

We use Google Analytics 4 and the Google Tag, integrated via the WordPress plugin “Site Kit by Google.” The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics analyzes the use of our website, such as pages visited, time spent on the site, device used, approximate location, and interactions such as form submissions. Cookies (e.g., “_ga,” “_ga_*,” with a storage period of up to 2 years) are set for this purpose. IP addresses are truncated within the EU and are not stored.

We use Google Consent Mode: No Analytics cookies will be set until you have given your consent. [If technically implemented: The Google tag is loaded only after you have given your consent.] Data may be transferred to the U.S. Google LLC is certified under the EU-U.S. Data Privacy Framework. We have entered into a data processing agreement with Google. The data will be deleted after [14 months]. For more information: https://policies.google.com/privacy

13.2 Meta Pixel

We use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. This allows us to measure the effectiveness of our ads on Facebook and Instagram and to serve targeted ads to visitors to our website. In doing so, your IP address, browser and device information, pages visited, and interactions are processed, and cookies (e.g., “_fbp,” which are stored for up to 3 months) are set. If you are logged into Facebook or Instagram, Meta may associate this data with your account.

We are jointly responsible with Meta for the collection and transfer of data to Meta (Art. 26 GDPR). The agreement regarding this is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for further processing. Data may be transferred to the United States; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. For more information: https://www.facebook.com/privacy/policy

14. Other Integrated Services

14.1 Trustindex (Review Widget)

To display our Google reviews, we use a widget from Trustindex, a service provided by Trustindex Kft., [address], Hungary. When the widget loads, scripts and graphics are retrieved from Trustindex’s servers. In the process, your IP address is transmitted to Trustindex. The widget is loaded only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The reviews displayed come from Google. Trustindex does not verify whether the reviewers have actually used our services.

14.2 Weglot (Translation)

For the English-language version of our website, we use the Weglot translation service provided by Weglot SAS, [address], Paris, France. When you access the translated pages, content and graphics (e.g., language flags) are loaded from Weglot’s servers. In doing so, your IP address is transmitted to Weglot. The legal basis for this is our legitimate interest in maintaining a multilingual website (Art. 6(1)(f) GDPR). We have a data processing agreement in place with Weglot.

14.3 Fonts

The fonts used on our website are stored locally on our server. No connection is established to servers operated by Google or other third parties for this purpose.

15. Your Rights

You have the following rights:

  • Information About the Data We Process (Art. 15 of the GDPR)
  • Rectification of Inaccurate Data (Art. 16 of the GDPR)
  • Erasure (Art. 17 of the GDPR)
  • Restriction of Processing (Art. 18 of the GDPR)
  • Data Portability (Art. 20 of the GDPR)
  • Consent may be withdrawn at any time with future effect (Art. 7(3) of the GDPR). The lawfulness of the processing carried out prior to the withdrawal remains unaffected.

To exercise your rights, simply send a message to info@semper-fidus.de or datenschutz@semper-fidus.de.

Right to Object under Art. 21 GDPR
To the extent that we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to such processing at any time for reasons arising from your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

If we process your data for direct marketing purposes, you may object to this processing at any time without providing a reason.

Right to File a Complaint with a Supervisory Authority

You have the right to file a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach
https://www.lda.bayern.de

16. Obligation to Provide Information and Automated Decision-Making

Providing your data is generally voluntary. However, without the information marked as required on the form, we cannot process your request or registration. No automated decision-making, including profiling, within the meaning of Article 22 of the GDPR takes place.

17. Changes to This Privacy Policy

We will update this Privacy Policy if our data processing practices or the legal landscape change. The version currently published here is the one that applies.

As of September 2026