Privacy Policy
1. Controller and Data Protection Officer
Represented by the Managing Directors: Philipp Grimm, Christian Grimm
Our Data Protection Officer can be contacted with any questions concerning the processing of personal data, data protection requests, objections, and requests regarding your data subject rights.
2. General Information
Personal data means any information relating to an identified or identifiable natural person. In the following, we inform you about the processing of personal data in connection with the use of this website in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws, including the German Telecommunications-Telemedia Data Protection Act (TDDDG).
We process personal data only where necessary to provide a functional and secure website and for the specific purposes described below. Where processing is based on legitimate interests, the nature of the interest is explained.
We do not intentionally process special categories of personal data, such as health data or biometric data, and we do not use automated decision-making or profiling in connection with this website.
This website is primarily informational. We collect personal data only when you actively provide it to us, for example when contacting us by email, or when technical access data is generated automatically when visiting the website.
3. Contacting Us by Email and Use of Microsoft 365
If you contact us by email, the personal data that you voluntarily provide — for example your name, email address, company or professional role, contact details, and the content of your message — is processed solely to handle your inquiry and respond to it.
We use Microsoft 365 for receiving, sending, storing, and managing business email. Microsoft processes email data on our behalf as a data processor under a data processing agreement pursuant to Article 28 GDPR. This may include email content, attachments, sender and recipient data, timestamps, subject lines, message headers, and mailbox metadata.
Legal basis: Article 6(1)(b) GDPR, where the contact is for the performance of a contract or for pre-contractual measures. Otherwise, processing is based on Article 6(1)(f) GDPR, based on our legitimate interest in processing and answering your inquiry efficiently and securely.
If the data is no longer needed for any further purpose, it is deleted. For email inquiries without an ongoing contractual relationship, we normally store the data for up to 12 months after the final communication, unless statutory retention obligations require longer storage, for example under commercial or tax law, or unless a longer retention period is necessary for the defense of legal claims.
Microsoft may use subprocessors for the operation of Microsoft 365 in accordance with Article 28(4) GDPR. Depending on your Microsoft 365 configuration and data residency settings, Microsoft data may be stored in EU/EEA data centers or, where applicable, in other locations. Any transfer outside the EU/EEA is based on appropriate safeguards, such as the EU Standard Contractual Clauses and supplementary measures.
4. Website Access and Hosting by Strato
We host this website at Strato. When you visit this website, our hosting provider may automatically process technical access data, also referred to as server log files. This data may include:
- IP address,
- date and time of access,
- requested file or resource,
- HTTP status code,
- browser type and version,
- operating system,
- referrer URL,
- transmission protocol/version.
Strato processes this data on our behalf as a data processor under a data processing agreement pursuant to Article 28 GDPR. The data is used to ensure the smooth operation, stability, and security of the website, and to detect, defend against, or document attacks and abuse.
Legal basis: Article 6(1)(f) GDPR, based on our legitimate interest in secure, stable, and legally compliant website operation.
Log data is normally deleted after a short period, typically up to 14 days. Longer retention may occur only if and as long as the data is necessary to clarify or document a concrete security incident or abuse.
5. Cookies and Tracking
In the version of the website provided here, the site does not embed analytics tools, advertising technologies, tracking pixels, social media plugins, embedded videos, or third-party fonts, and it does not set cookies for marketing or analysis purposes by default.
If cookies or similar technologies that are not strictly necessary for the technical transmission or delivery of requested information are introduced later, their use will be clearly disclosed. For such non-essential technologies, consent will be requested before activation in accordance with § 25(1) TDDDG and Article 6(1)(a) GDPR.
For technically necessary technologies, the legal basis is § 25(2) TDDDG in conjunction with Article 6(1)(f) GDPR. These are only allowed without consent if strictly necessary to provide the requested information society service or to ensure the transmission of a communication.
This website does not load fonts from third-party providers. Fonts are used either locally or as system fonts. Therefore, no user information is transmitted to external font providers merely through loading this website.
6. Service Providers and Data Transfers
We do not sell personal data. Personal data is passed to third parties only where necessary for the purposes described in this privacy policy, where required by law, or where you have consented to the transfer.
The following service providers are used in connection with this website:
- Hosting / Web Presence: Strato. Strato processes website data and technical access data on our behalf, including server log files and operational data.
- Email / Communication: Microsoft 365. Microsoft processes email communications and related metadata on our behalf.
These providers act as data processors and are contractually bound to process personal data only on our instructions and in accordance with Article 28 GDPR. Where appropriate, subprocessors may be used by these providers in compliance with legal requirements.
If personal data is transferred outside the EU or the European Economic Area, appropriate safeguards such as the EU Standard Contractual Clauses are used where applicable, together with any additional measures required to ensure an adequate level of protection.
7. Retention Periods
We store personal data only as long as necessary for the purposes for which it was collected, unless a longer retention period is required by law.
Website log files processed by our hosting provider Strato are normally deleted after a short period, typically up to 14 days, unless longer retention is required to document or investigate a concrete security incident.
Contact emails and correspondence processed within Microsoft 365 are normally deleted after up to 12 months following the final communication, unless longer storage is necessary to defend legal claims or unless statutory retention obligations apply.
Business documents subject to commercial or tax law may be retained for the legally required retention periods, which can range from six to ten years.
8. Your Data Subject Rights
Subject to applicable law, you have the following rights regarding your personal data:
- Right of access: You may request confirmation as to whether personal data relating to you is being processed and request access to that data, in accordance with Article 15 GDPR.
- Right to rectification: You may request correction of inaccurate personal data and/or completion of incomplete personal data, in accordance with Article 16 GDPR.
- Right to erasure: You may request deletion of stored personal data under the conditions of Article 17 GDPR, subject to legal retention obligations and applicable exceptions.
- Right to restriction of processing: You may request that processing be restricted under the conditions of Article 18 GDPR.
- Right to object: You may object to processing based on Article 6(1)(e) or 6(1)(f) GDPR, in particular on grounds relating to your particular situation. You may also object to direct marketing and profiling related to direct marketing in accordance with Article 21 GDPR.
- Right to data portability: You may receive data provided by you in a structured, commonly used, and machine-readable format and transmit it to another controller, in accordance with Article 20 GDPR, where the processing is based on consent or performance of a contract and is carried out by automated means.
- Right to withdraw consent: If processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal, in accordance with Article 7(3) GDPR.
To exercise your rights, please contact us at the email address listed in section 1: privacy@igi-systems.com. We may ask for additional information necessary to verify your identity.
9. Supervisory Authority
In addition to your other rights, you have the right to lodge a complaint with a competent supervisory authority, in accordance with Article 77 GDPR.
For our company located in Germany, the competent authority is likely the:
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Website: https://www.ldi.nrw.de
You may also lodge a complaint with the supervisory authority of the EU Member State where you reside or where the alleged infringement occurred.
10. Changes and Questions
We may update this privacy policy if the legal framework changes, our data processing activities change, or new technical functions are introduced. The updated version will be published on this website.
If you have questions about this privacy policy or about the processing of personal data, please contact our Data Protection Officer at: