Personal data means any information relating to an identified or identifiable natural person. Unless stated otherwise below, providing your personal data is neither legally nor contractually required, nor necessary to conclude a contract; you are not obliged to provide it, and non-provision has no consequences in these cases.

You can visit our website without providing any personal details. However, with every access your browser transmits usage data to us or our web hosting provider, which is stored in server log files – e.g. the name of the page accessed, date and time of access, IP address, amount of data transferred and the requesting provider. This processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in ensuring smooth operation and improving our website.

The controller responsible for data processing is André Weinert, Beim Wendentor 1, 18055 Rostock, Germany, phone +49 381 81 70 822, email dsb@karls.de.

Our data protection officer can be reached at the same address: André Weinert, Wirtschaftskontor Weinert, Beim Wendentor 1, 18055 Rostock, phone +49 381 817082-0, email dsb@karls.de.

If you contact us proactively by email or via our contact form, we collect the data you provide (e.g. name, email address, message text) only to the extent you supply it, in order to process and respond to your enquiry. Where the contact relates to pre-contractual measures or an existing contract, the legal basis is Art. 6(1)(b) GDPR; in all other cases it is our legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR) – you may object to this at any time for reasons arising from your particular situation. Your data is deleted after processing, subject to statutory retention periods, unless you have consented to further use.

When you use our application form, we collect your contact details, information on your professional qualifications, education and further training, and performance-related references, only to the extent you provide them. Processing serves to carry out the recruitment process under Art. 6(1)(b) GDPR in conjunction with § 26(1) of the German Federal Data Protection Act (BDSG). If you consent to being added to our applicant pool, the legal basis is Art. 6(1)(a) GDPR; you may withdraw this consent at any time. Where special categories of personal data are requested (e.g. degree of severe disability), this is based on Art. 9(2)(b) GDPR. Your data is deleted once no longer required for the hiring decision, at the latest after six months, unless you have consented to further use; if an employment relationship results, the data is further processed for that purpose and transferred to your personnel file.

We also offer an upload function for image files, for example to create personalised products. Submitted images are used solely to perform the contract (Art. 6(1)(b) GDPR) and may be passed to service providers engaged by us, but not to other third parties.

You can register on our website by providing personal data in order to write comments and posts; the legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time. If your comment is published, the name and email address you provided will be published alongside it.

With your explicit consent we use your email address to send newsletters (Art. 6(1)(a) GDPR); we may also use an email address obtained in connection with a purchase to advertise similar products or services of our own, unless you have objected (Art. 6(1)(f) GDPR). You can withdraw or object to either at any time via the unsubscribe link or by contacting us.

For newsletter distribution we use Klaviyo Inc., 125 Summer St Floor 7, Boston, MA 02111, USA, as a processor. This involves transmitting your email address and, where applicable, first and last name; tracking pixels or tracking links in newsletters let us evaluate campaigns statistically (e.g. IP address, browser type, device, timestamp). Your data is transferred to the USA in this process; as there is no adequacy decision for the USA, the transfer relies among other things on EU Standard Contractual Clauses.

Our website uses cookies – small text files stored on your device that allow your browser to be recognised. You can control cookie placement through your browser settings, delete cookies already stored, and object to their storage; some website functions may then no longer be fully available. We use technically necessary cookies on the basis of § 25(2) of the German Telecommunications and Telemedia Data Protection Act (TTDSG) and/or our legitimate interest (Art. 6(1)(f) GDPR) in a secure, user-friendly website.

To obtain and manage cookie consent we use the consent management platform Usercentrics by Usercentrics GmbH, Rosenthal 4, 80331 Munich. This involves processing data such as the time of your visit, browser and device information, an anonymised IP address, and your opt-in/opt-out choices, partly using the Google Cloud Platform with data transferred to the USA (Standard Contractual Clauses). The legal basis is our statutory obligation to document consent (Art. 6(1)(c) GDPR); records of consents given or withdrawn are retained for three years.

Where the following services use cookies or similar technologies, this is based on your consent under § 25(1) TTDSG in conjunction with Art. 6(1)(a) GDPR; you may withdraw your consent at any time with effect for the future.

Google Analytics / Google Analytics 4 (Google Ireland Limited, Dublin) analyses website usage and visitors based on data such as IP address, access time, click path, device and browser information, and pages visited; IP anonymisation is enabled.

Matomo (InnoCraft Ltd., Wellington, New Zealand) evaluates website usage on a pseudonymised basis.

Hotjar (Hotjar Ltd., Malta) records mouse movements, scrolling behaviour and clicks on a sample basis (heatmaps) and creates pseudonymised user profiles.

Facebook Pixel by Meta Platforms Ireland Limited is used for retargeting on Facebook; Karls and Meta Platforms Ireland are joint controllers under a published agreement.

Google Ads Conversion Tracking, Google AdSense and Remarketing/"Similar Audiences" by Google Ireland Limited evaluate ad clicks and user behaviour to enable campaigns and personalised advertising.

Pinterest Tag (Pinterest Europe Limited, Dublin) and TikTok Pixel (TikTok Technology Limited, Dublin, and TikTok Information Technologies UK Limited, London) enable interest-based advertising on their respective platforms.

For all services listed: transfer to the USA is possible and, in the absence of an adequacy decision, relies on EU Standard Contractual Clauses; further details are available in each provider's linked privacy notice.

Google Tag Manager (Google Ireland Limited) manages the integration of our tracking and analytics tools but does not itself store cookies or process personal data.

Social plugins from Facebook, Instagram and Pinterest establish a connection to the respective provider's servers when a page loads and transmit your IP address and the page visited, regardless of login status; for Facebook/Instagram we are joint controllers together with Meta Platforms Ireland Limited.

Google reCAPTCHA protects forms against automated abuse. Google Maps embeds interactive maps. YouTube displays videos in privacy-enhanced mode, so that data is only sent to YouTube once you actively play a video. Google Fonts and Adobe Fonts (Adobe Systems Software Ireland Limited) load typefaces from the respective provider's servers, transmitting IP address and browser information; for Adobe Fonts this may also involve transfer to India. Algolia (Algolia SAS, Paris) powers our search function and stores access data for 90 days. Google Translate enables automated translation of the website into other languages.

For all services listed, data may be transferred to the USA or, for Adobe Fonts, additionally to India; in the absence of an adequacy decision, these transfers rely on EU Standard Contractual Clauses. Depending on the service, the legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG) or our legitimate interest in a functional, appealing website (Art. 6(1)(f) GDPR).

As described above, several of the services we use transfer personal data to third countries, in particular the USA. Where no adequacy decision by the European Commission exists, we base these transfers on appropriate safeguards, generally EU Standard Contractual Clauses.

Note: this text was rebuilt in full based on the privacy policy published on karls.de, but written in our own words rather than copied verbatim. Please review it once more against the current version on karls.de before publishing, especially if the tools or service providers in use change.

Your data is stored in compliance with statutory retention periods and deleted afterwards, unless you have consented to further processing.

Where the legal requirements are met, you have the rights of access, rectification, erasure, restriction of processing and data portability under Art. 15 to 20 GDPR. You may object at any time (Art. 21 GDPR) to processing based on our legitimate interest (Art. 6(1)(f) GDPR) and to processing for direct marketing purposes; following an objection we will stop the relevant processing unless we can demonstrate compelling legitimate grounds, or the processing serves to establish, exercise or defend legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us:

Landesbeauftragter für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern (State Commissioner for Data Protection and Freedom of Information Mecklenburg-Western Pomerania)
Werderstraße 74a
19055 Schwerin, Germany
Phone: +49 385 594940
Fax: +49 385 5949458
Email: info@datenschutz-mv.de

The AI chatbot integrated on our website helps you with enquiries and communication with us. In doing so we collect contact details (first name, last name, email address, phone number), the chat history and your text input, timestamps of interactions and, where applicable, your order number.

To operate the chatbot we use the following service providers: Voiceflow Inc., 125 Summer St Floor 7, Boston, MA 02111, USA (chatbot infrastructure), OpenAI, USA (language processing via the OpenAI Business API; your input is not used to train models), and Make.com (automated forwarding of name, email address and order number to our internal systems).

Processing serves to answer your questions, route them to the relevant department, and improve and ensure the functionality of the chatbot, based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time. Data is shared only internally to process your enquiry. Chat data is automatically deleted after 90 days. Because Voiceflow and OpenAI process data in the USA, transfers rely on EU Standard Contractual Clauses in the absence of an adequacy decision.

You may request information about your chatbot data, its deletion or correction, and withdraw your consent at any time by contacting chatbot@aiworx.ai. This section was last updated, per the original source, on 10 October 2025.

Separate terms of participation apply to any prize draws or competitions we run; the data processing described there supplements this privacy policy.

Note: on karls.de this section links to the currently applicable terms of participation – please add the corresponding link here once that page exists in this project.