Privacy Policy

Hosting, servers and backups

This website, its database and our visitor statistics run on our own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in its Nuremberg data center. Operation and maintenance are handled by our IT service provider, hansenexus GmbH. We have concluded data processing agreements (Art. 28 GDPR) with both.

To deliver the pages to you, the server necessarily processes your IP address and the information sent by your browser. We do not store access logs containing IP addresses. If a technical error occurs, the application logs it so that it can be fixed. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR).

The database is backed up in encrypted form every night, to storage at our company and to storage at Hetzner Online GmbH in Germany. We keep backups for up to six months. Deleted data may therefore remain in older backups for that long.

Cookies and browser storage

Some features store small entries in your browser. Most of them are technically necessary for the feature you are using to work at all (Section 25(2) no. 2 TDDDG). For these we do not need your consent: the language you selected (cookie NEXT_LOCALE, until you close the browser), signing in to your customer account (cookies __convexAuthJWT and __convexAuthRefreshToken as well as entries in local storage), a random identifier for the chat (elbe_chat_session_id), your progress in the online hearing test for the current session (ea_hoertest, ea_hoertest_sid), whether you have closed the chat today or dismissed a notice, and your decision on ad measurement (ea_consent).

Only one entry requires your consent: the cookie ea_attr for ad measurement, see “Ad measurement (Google Ads)” below. You can change your decision at any time via “Cookie settings” at the bottom of every page.

Visitor statistics (Plausible)

To understand which pages are used, we count page views with Plausible Analytics. Plausible runs on our own server (analytics.elbe-akustik.de), and the data does not leave it. Plausible does not set cookies and does not store anything in your browser. An identifier that changes daily is derived from your IP address and browser information; the IP address itself is not stored. This allows visits to be counted without recognizing you.

In addition to page views and clicks on links to other websites, we count certain steps, for example whether an appointment booking was completed or which result level (green, yellow, red) an online hearing test had. These counts do not contain names or contact details. The legal basis is our legitimate interest in improving our services (Art. 6(1)(f) GDPR).

Appointment booking

When you book an appointment online, we process the branch, appointment type, date and time, your name, your email address and phone number, and your answers to the questions before the appointment, for example about your hearing, hearing aids or tinnitus. These answers are health data. We process them only with your explicit consent, which you give by ticking the box before submitting (Art. 9(2)(a) GDPR); everything else serves to carry out the appointment (Art. 6(1)(b) GDPR).

You receive a confirmation by email, and the branch receives a notification. If you came to us through one of our ads and have agreed to ad measurement, we store the ad identifier with the booking. We delete your details as soon as we no longer need them for the appointment and your further care, unless statutory retention obligations prevent this. You can withdraw your consent at any time with effect for the future.

Online hearing test

For the online hearing test, we store your answers, your age group, the measured hearing thresholds, the result and which browser you use, together with a random identifier. As long as you do not provide contact details, we do not know who took the test.

If you then request a call back, we link the result to your name, your phone number and, where applicable, your email address. Because the result says something about your health, we do this only with your explicit consent (Art. 9(2)(a) GDPR). We send the result by email only if you separately agree to this. The online hearing test does not replace an examination by a hearing care professional or at an ENT practice.

Contact form, hearing aid advisor and job applications

We send messages from the contact form by email to our mailbox; we do not store them in our database. To prevent misuse, the server keeps your IP address for ten minutes.

With the hearing aid advisor (“Which hearing aid is right for me?”), we store your answers, your name, your phone number, your email address if you wish, your preferred branch and your health insurance so that we can call you back. The branch is notified by email.

We store applications submitted via the careers form (name, contact details, position, message) and forward them by email to the people responsible for recruitment. After the application process has been completed, we delete them unless you are hired or there are legal reasons against deletion.

In each case, the legal basis is the processing of your inquiry or the steps prior to entering into a contract (Art. 6(1)(b) GDPR) and, for details about your hearing, your consent (Art. 9(2)(a) GDPR).

Chat and AI assistant

In the chat, we store your messages, the replies and a random identifier from your browser so that the conversation continues the next time you open it. An AI assistant replies first; if you wish, a staff member takes over.

For each reply, we send the most recent messages of the conversation to an AI language model. As a rule, this is a model operated by our IT service provider hansenexus GmbH itself; the connection to it runs through the network of Cloudflare, Inc. (USA). If this model is unavailable, OpenRouter, Inc. (USA) answers the request using a model from Google or Anthropic. In this process, data may be transferred to the USA; the transfer is based on the EU-US Data Privacy Framework or EU standard contractual clauses. For quality assurance, the conversations are also stored in a logging system (Langfuse) on a server of hansenexus GmbH in Germany.

Please do not enter any health data or other sensitive information in the chat. If you book an appointment or request a call back via the chat, the sections on appointment booking and on inquiries apply. The legal basis is answering your inquiry (Art. 6(1)(b) GDPR) and our legitimate interest in customer service that is quickly reachable (Art. 6(1)(f) GDPR).

Customer account

If you create a customer account, we store your name, your email address, your password (only in encrypted form) and, if you wish, your phone number and your type of health insurance. To reset your password, we send you a code by email. The legal basis is the provision of the account (Art. 6(1)(b) GDPR). You can have your account deleted at any time.

Sending emails

We send confirmations, notifications to our branches and replies to your inquiries via the mail server of our email provider. The provider processes the emails on our behalf (Art. 28 GDPR).

Reviews from Google and ProvenExpert

On this website we show public reviews that customers have left about us on Google Maps and ProvenExpert. Our server retrieves them several times a day from the Google Places API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and from the ProvenExpert interface (Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin). From Google, this includes the stars, number of reviews, texts and the name, profile picture and profile link of the authors; from ProvenExpert, only the overall rating, the number of reviews and the recommendation rate. We replace the Google data with each retrieval and display it for no more than 48 hours.

Your browser does not connect to Google or ProvenExpert in the process: we also deliver the profile pictures via our own server. Only when you click a link to Google or ProvenExpert do you leave our website; the privacy notices of the respective provider then apply.

The legal basis is our legitimate interest in showing interested visitors the public experiences of other customers (Art. 6(1)(f) GDPR). If you have written a review and do not want us to show it here, please write to us; you manage the review itself on Google or ProvenExpert.

Maps and directions

The maps of our branches come from OpenStreetMap and are only loaded when you click “Load map”. Your browser then transmits your IP address to the OpenStreetMap Foundation (United Kingdom, for which an EU adequacy decision exists). The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR).

“Get directions” is a simple link to Google Maps. Only when you click it do you open Google's website; before that, no data is transmitted to Google.

Ad measurement (Google Ads)

We place ads with Google Ads. If you reach our website through one of these ads, we ask you whether we may keep a note of which ad it was. Only if you agree do we store the ad's click ID (gclid, gbraid or wbraid), the campaign details from the web address, the first page you visited and the website you came from for 90 days in the cookie ea_attr.

If you then book an appointment or submit an inquiry, we store these details with your request. If you later buy a hearing aid from us, we transmit the click ID together with the time and value of the purchase to Google Ireland Limited so that we can see which ads are effective. We do not transmit your name or contact details. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you decline, we do not set the cookie. You can withdraw your consent at any time via “Cookie settings” at the bottom of every page; the cookie is then deleted.

Reviews widget (ProvenExpert)

A reviews widget from our partner ProvenExpert GmbH can appear in the bottom-left corner of every page. It loads customer reviews and Google star ratings directly from ProvenExpert's servers; the widget only runs once you consent.

If you consent, your browser sends its IP address to ProvenExpert, and ProvenExpert may set a cookie. The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). If you decline, we do not load the widget and show only a link to our ProvenExpert profile instead. You can withdraw your consent at any time under “Cookie settings” at the bottom of every page.

Fonts and social networks

The fonts used on this website are hosted on our own server; your browser does not load them from Google or other providers.

We only link to Facebook and Instagram. Data is only sent to these platforms when you click a link.