Privacy policy

Status: 01.10.2026

oberflaeche.de is an internet service of I.G.T. Informationsgesellschaft Technik mbH. Protecting your personal data is important to us. Below you will find which data we process when you visit and use our services, for what purpose, on which legal basis and for how long.

1. Controller

I.G.T. Informationsgesellschaft Technik mbH, Jägerweg 10, D-85521 Ottobrunn, Germany
Phone: +49 89 673697-0 · Fax: +49 89 673697-19 · Email: info(at)oberflaeche.de

2. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent at any time with effect for the future (Art. 7(3)), see section 5.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.

Please contact us using the details above. You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You may also contact the supervisory authority of your place of residence.

3. Visiting the website

Server log files. Each access logs technically necessary data: IP address, date and time, requested file, amount of data transferred, success status, browser and referrer. Purpose: delivery of pages, security, error analysis. Legal basis: Art. 6(1)(f) GDPR. Retention: 7 days, then deletion or anonymisation.

Hosting. The website is operated in Germany by Mittwald CM Service GmbH & Co. KG, Espelkamp. A data processing agreement under Art. 28 GDPR is in place.

Fonts. The font used (Heebo) is loaded from our own server. No connection to Google is made.

4. Cookies and consent

On your first visit we ask in a notice which cookies and external media you allow. Technically necessary cookies are set without consent (Section 25(2) TDDDG). All others only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

5. Changing or withdrawing your choice

Via the link "Cookie settings" in the footer you can open, change or withdraw your choice at any time. Your decision is valid for 12 months, after which we ask again. If you withdraw, we delete the related cookies and stop loading external media.

6. Audience measurement with Matomo

We use the software Matomo, which runs on our own servers (analytics.oberflaeche.de). No data is passed on to third parties. Processed: IP address shortened by two bytes, page viewed, referrer, time on page and frequency of visits, coarse browser/device data.

• Without your consent we count visits anonymously, without cookies.
• With your consent (category "Statistics") Matomo sets cookies to recognise returning visitors.

Purpose: improving our services. Legal basis: without cookies Art. 6(1)(f) GDPR, with cookies Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Retention of raw data (individual visits): 24 months, so that we can compare developments over two full years; afterwards they are deleted and only aggregated reports without personal reference remain.

7. Customer account, login and protection against account misuse

Customer account. For online subscriptions and protected areas we offer a password-protected account. We process your credentials (email address or user name, password in encrypted form only) and subscription details. Legal basis: Art. 6(1)(b) GDPR. Retention: for the duration of the contract, then until statutory retention periods expire.

Login by IP address (company access). If your company has agreed access via fixed IP addresses, we recognise your entitlement by the IP address of your network, without individual login. Legal basis: Art. 6(1)(b) GDPR.

Session data for Premium and VIP accounts. Online subscriptions are personal. To detect whether an account is used by several people at the same time, we store for each session of logged-in Premium and VIP accounts: your account ID, the time of first and last activity, and a coarse browser and operating system label (e.g. “Chrome on Windows”). We do not store IP addresses, set no additional cookie for this purpose and do not analyse your reading behaviour. This does not apply to access by IP address. Legal basis: Art. 6(1)(b) GDPR (agreed single-user licence) and Art. 6(1)(f) GDPR (protection against misuse). Retention: 30 days after the last activity of the session.

8. Enquiries, registration, comments

If you write to us by email or contact form, register, order, or post a comment, we process the data you provide (at least a valid email address) to handle your request and for possible follow-up questions. Legal basis: Art. 6(1)(b) or (f) GDPR. Retention: until your request is completed; data subject to statutory retention until the period ends; comments until you request deletion.

9. Newsletter (CleverReach)

For subscription and delivery of our newsletter "Surface-News" we use CleverReach (CleverReach GmbH & Co. KG, Rastede, Germany; servers in the EU) as processor under Art. 28 GDPR. No data is transmitted to CleverReach when you open the subscription page; only when you submit the form are your entries (and, for technical reasons, your IP address) sent to CleverReach. We process your email address and the data you voluntarily provide (first name, last name, salutation, title, company, industry, position, language preference) based on your consent (Art. 6(1)(a) GDPR) using double opt-in: you receive a confirmation email and are added only after clicking the link. We analyse our newsletters: CleverReach records whether and when a newsletter is opened and which links are clicked (open and click tracking) so that we can improve our content. You can unsubscribe at any time via the link in each newsletter, which withdraws your consent. Retention: until unsubscription; proof of consent up to 3 years thereafter. The Surface-News are an editorial information service.

10. Embedded videos (Vimeo, YouTube)

Some pages embed videos from Vimeo (Vimeo Inc., USA) and YouTube (Google Ireland Limited, enhanced privacy mode). We load these videos only after you have consented in the category "External media" or released a single video by click. Only then is your IP address transmitted to the respective provider, who may set cookies. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG. Transfer to the USA: Vimeo.com, Inc. and Google LLC are certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision. For the Vimeo player we use the "Do Not Track" setting.

Job board: A widget from StepStone is embedded there and is loaded only after your consent; your IP address is then transmitted to StepStone.

11. Advertising

Banners and ads of our customers appear on our pages. We deliver the banners ourselves as images with a link and without third-party scripts; we count impressions and clicks on our own server. If you click a banner you reach the advertiser's website, who is responsible for its own data processing. Should advertisers embed their own scripts that set cookies or collect data, we load them only after your consent.

12. Recipients

We pass on your data only as necessary for contract processing or billing, where legally required, or with your consent. Recipients are in particular our service providers for hosting (Mittwald), newsletter (CleverReach) and email delivery.

13. Data security

We protect your data by technical and organisational measures, including encrypted transmission (HTTPS), encrypted password storage and access restrictions. Complete confidentiality cannot be guaranteed for email communication.

14. Changes

We update this policy when our services or the legal situation change. The current version on this page applies.