Privacy Policy

Hosting, servers and backups

This website, its database and our visitor statistics run on our own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in its Nuremberg data center. Operation and maintenance are handled by our IT service provider, hansenexus GmbH. We have concluded data processing agreements (Art. 28 GDPR) with both.

To deliver the pages to you, the server necessarily processes your IP address and the information sent by your browser. We do not store access logs containing IP addresses. If a technical error occurs, the application logs it so that it can be fixed. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR).

The database is backed up in encrypted form every night, to storage at our company and to storage at Hetzner Online GmbH in Germany. We keep backups for up to six months. Deleted data may therefore remain in older backups for that long.

Cookies and browser storage

Some features store small entries in your browser. Most of them are technically necessary for the feature you are using to work at all (Section 25(2) no. 2 TDDDG). For these we do not need your consent: the language you selected (cookie NEXT_LOCALE, until you close the browser), signing in to your customer account (cookies __convexAuthJWT and __convexAuthRefreshToken as well as entries in local storage), a random identifier for the chat (elbe_chat_session_id), your progress in the online hearing test for the current session (ea_hoertest, ea_hoertest_sid), whether you have closed the chat today or dismissed a notice, and your decision on ad measurement (ea_consent).

Only the entries for ad measurement require your consent: the cookie ea_attr and the Google tag's cookies (_gcl_…), see “Ad measurement (Google Ads)” below. You can change your decision at any time via “Cookie settings” at the bottom of every page.

Visitor statistics (Plausible)

To understand which pages are used, we count page views with Plausible Analytics. Plausible runs on our own server (analytics.elbe-akustik.de), and the data does not leave it. Plausible does not set cookies and does not store anything in your browser. An identifier that changes daily is derived from your IP address and browser information; the IP address itself is not stored. This allows visits to be counted without recognizing you.

In addition to page views and clicks on links to other websites, we count certain steps, for example whether an appointment booking was completed or which result level (green, yellow, red) an online hearing test had. These counts do not contain names or contact details. The legal basis is our legitimate interest in improving our services (Art. 6(1)(f) GDPR).

Appointment booking

When you book an appointment online, we process the branch, appointment type, date and time, your name, your email address and phone number, and your answers to the questions before the appointment, for example about your hearing, hearing aids or tinnitus. These answers are health data. We process them only with your explicit consent, which you give by ticking the box before submitting (Art. 9(2)(a) GDPR); everything else serves to carry out the appointment (Art. 6(1)(b) GDPR).

Independently of this, we store a coarse note of where the booking came from: whether you came through a Google ad, which campaign and ad group it belongs to, and which of our pages you booked through. These details are part of the address of the page you came from; we store nothing on your device for this and no click ID. You can also tell us voluntarily how you heard about us. Only our staff see both. The legal basis is our legitimate interest in knowing which advertising works (Art. 6(1)(f) GDPR).

You receive a confirmation by email, and the branch receives a notification. If you came to us through one of our ads and have agreed to ad measurement, we store the ad identifier with the booking. We delete your details as soon as we no longer need them for the appointment and your further care, unless statutory retention obligations prevent this. You can withdraw your consent at any time with effect for the future.

If you find no suitable time and request a callback, we store your name, your phone number or email address, your preferred time of day, branch and concern, and the source information described above; the branch is notified by email so that it can get in touch with you. The legal basis is handling your request (Art. 6(1)(b) GDPR). We delete these details, as with a booking, once we no longer need them.

Consultation preparation questionnaire

After booking a hearing aid appointment you can voluntarily fill in a more detailed questionnaire via the link on the confirmation page or in your confirmation e-mail. It asks about your hearing, your experience with hearing aids, your everyday life and what you would like from your hearing aids. Only if you give separate consent does it also ask about your health, such as your health insurance, allergies, ear surgery, blood pressure, eyesight and manual dexterity.

Its only purpose is to prepare your consultation at the branch. Information about your hearing and your health is health data. We process it only with your explicit consent (Art. 9(2)(a) GDPR), which you give in two steps. For the questionnaire as a whole with a separate tick before the first section. For the health section additionally with its own tick; without it we store nothing from that section. All questions are optional, and your appointment does not depend on answering them.

The answers are seen only by the staff of the branch where your appointment takes place and by the management. At your appointment the team carries what matters for your care into your customer file. We delete the questionnaire itself automatically 90 days after the appointment day, also if the appointment was cancelled.

You can withdraw both consents at any time with effect for the future, directly in the questionnaire via the link in your appointment confirmation. Untick the box before the first section and save, and we delete all your answers from the questionnaire. Untick only the box in the health section, and saving deletes your health answers. A short message to us or a call to the branch works too.

Online hearing test

For the online hearing test, we store your answers, your age group, the measured hearing thresholds, the result and which browser you use, together with a random identifier. As long as you do not provide contact details, we do not know who took the test.

If you then request a call back, we link the result to your name, your phone number and, where applicable, your email address. Because the result says something about your health, we do this only with your explicit consent (Art. 9(2)(a) GDPR). We send the result by email only if you separately agree to this. The online hearing test does not replace an examination by a hearing care professional or at an ENT practice.

Contact form, hearing aid advisor and job applications

We send messages from the contact form by email to our mailbox; we do not store them in our database. To prevent misuse, the server keeps your IP address for ten minutes.

With the hearing aid advisor (“Which hearing aid is right for me?”), we store your answers, your name, your phone number, your email address if you wish, your preferred branch and your health insurance so that we can call you back. The branch is notified by email.

We store applications submitted via the careers form (name, contact details, position, message) and forward them by email to the people responsible for recruitment. After the application process has been completed, we delete them unless you are hired or there are legal reasons against deletion.

In each case, the legal basis is the processing of your inquiry or the steps prior to entering into a contract (Art. 6(1)(b) GDPR) and, for details about your hearing, your consent (Art. 9(2)(a) GDPR).

Chat and AI assistant

In the chat, we store your messages, the replies and a random identifier from your browser so that the conversation continues the next time you open it. An AI assistant replies first; if you wish, a staff member takes over.

For each reply, we send the most recent messages of the conversation to an AI language model. As a rule, this is a model operated by our IT service provider hansenexus GmbH itself; the connection to it runs through the network of Cloudflare, Inc. (USA). If this model is unavailable, OpenRouter, Inc. (USA) answers the request using a model from Google or Anthropic. In this process, data may be transferred to the USA; the transfer is based on the EU-US Data Privacy Framework or EU standard contractual clauses. For quality assurance, the conversations are also stored in a logging system (Langfuse) on a server of hansenexus GmbH in Germany.

Please do not enter any health data or other sensitive information in the chat. If you book an appointment or request a call back via the chat, the sections on appointment booking and on inquiries apply. The legal basis is answering your inquiry (Art. 6(1)(b) GDPR) and our legitimate interest in customer service that is quickly reachable (Art. 6(1)(f) GDPR).

Customer account

If you create a customer account, we store your name, your email address, your password (only in encrypted form) and, if you wish, your phone number and your type of health insurance. To reset your password, we send you a code by email. The legal basis is the provision of the account (Art. 6(1)(b) GDPR). You can have your account deleted at any time.

Sending emails

We send confirmations, notifications to our branches and replies to your inquiries via the mail server of our email provider. The provider processes the emails on our behalf (Art. 28 GDPR).

Reviews from Google and ProvenExpert

On this website we show public reviews that customers have left about us on Google Maps and ProvenExpert. Our server retrieves them several times a day from the Google Places API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and from the ProvenExpert interface (Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin). From Google, this includes the stars, number of reviews, texts and the name, profile picture and profile link of the authors; from ProvenExpert, only the overall rating, the number of reviews and the recommendation rate. We replace the Google data with each retrieval and display it for no more than 48 hours.

Your browser does not connect to Google or ProvenExpert in the process: we also deliver the profile pictures via our own server. Only when you click a link to Google or ProvenExpert do you leave our website; the privacy notices of the respective provider then apply.

The legal basis is our legitimate interest in showing interested visitors the public experiences of other customers (Art. 6(1)(f) GDPR). If you have written a review and do not want us to show it here, please write to us; you manage the review itself on Google or ProvenExpert.

Maps and directions

The maps of our branches come from OpenStreetMap and are only loaded when you click “Load map”. Your browser then transmits your IP address to the OpenStreetMap Foundation (United Kingdom, for which an EU adequacy decision exists). The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR).

“Get directions” is a simple link to Google Maps. Only when you click it do you open Google's website; before that, no data is transmitted to Google.

Ad measurement (Google Ads)

We place ads with Google Ads. If you reach our website through one of these ads, we ask you whether we may measure which ad brought you here. Only if you agree do we store the ad's click ID (gclid, gbraid or wbraid), the campaign details from the web address, the first page you visited and the website you came from for 90 days in the cookie ea_attr.

In that case we also load the Google tag (gtag.js) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It sets cookies whose names begin with _gcl_ (stored for up to 90 days) and reports to Google when you book an appointment, send an inquiry or tap one of our phone numbers. Google receives your IP address, information about your browser and device, the page visited and the click ID, but not your name or contact details. We use Google's consent mode in basic mode: without your consent, the tag does not load at all. We do not use it for personalised advertising; that setting is permanently switched off. Google may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).

If you then book an appointment or submit an inquiry, we store these details with your request. If the branch confirms your appointment or you later buy a hearing aid from us, we transmit the click ID with the time and, for a purchase, the value to Google Ireland Limited so that we can see which ads are effective. We do not transmit your name or contact details. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). If you decline, we set none of these cookies and do not load the Google tag. You can withdraw your consent at any time via “Cookie settings” at the bottom of every page; the cookies are then deleted.

Reviews widget (ProvenExpert)

A reviews widget from our partner ProvenExpert GmbH can appear in the bottom-left corner of every page. It loads customer reviews and Google star ratings directly from ProvenExpert's servers; the widget only runs once you consent.

If you consent, your browser sends its IP address to ProvenExpert, and ProvenExpert may set a cookie. The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). If you decline, we do not load the widget and show only a link to our ProvenExpert profile instead. You can withdraw your consent at any time under “Cookie settings” at the bottom of every page.

Fonts and social networks

The fonts used on this website are hosted on our own server; your browser does not load them from Google or other providers.

We only link to Facebook and Instagram. Data is only sent to these platforms when you click a link.