[ 1.0 ]
Legal
Privacy Policy
Status
August 01, 2026
Responsible party
Marble Imaging GmbH, Bremen
Data protection officer
heyData GmbH, Berlin
[ 2.0 ]
Sections
01
With the following privacy policy, we would like to inform you about what types of your personal data (hereinafter also referred to as “data”) we process, for what purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both as part of the provision of our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as “online offer”). Our data protection officer: heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, datenschutz@heydata.eu.
The terms used are not gender-specific.
02
Marble Imaging GmbH
Konsul-Smidt-Straße 8H
28217 Bremen
Email: contact@marble-imaging.de
Our data protection officer: heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, datenschutz@heydata.eu.
03
The following overview summarizes the types of processed data, the purposes of their processing, and refers to the affected individuals.
Types of Processed Data
Inventory data
Location data
Contact data
Content data
Usage data
Meta, communication, and procedural data
Log data
Categories of Affected Individuals
Communication partners
Users
Purposes of Processing
Communication
Security measures
Reach measurement
Organizational and administrative procedures
Feedback
Profiles with user-related information
Provision of our online offer and user-friendliness
IT infrastructure
Public relations
| Types of Processed Data | ||||||
|---|---|---|---|---|---|---|
| Inventory data | Processed | Processed | ||||
| Location data | Processed | |||||
| Contact data | Processed | Processed | Processed | |||
| Content data | Processed | Processed | Processed | Processed | ||
| Usage data | Processed | Processed | Processed | Processed | Processed | |
| Meta, communication, and procedural data | Processed | Processed | Processed | Processed | Processed | |
| Log data | Processed | |||||
| Legal Bases | ||||||
| ConsentArt. 6(1)(a) GDPR | Applies | Applies | Applies | |||
| Contract performance and pre-contractual inquiriesArt. 6(1)(b) GDPR | Applies | |||||
| Legitimate interestsArt. 6(1)(f) GDPR | Applies | Applies | Applies | Applies | Applies | Applies |
04
Relevant legal bases under the GDPR: Below you will find an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations in your or our country of residence may apply. If specific legal bases are relevant in individual cases, we will inform you of them in the privacy policy.
Consent (Art. 6(1)(a) GDPR)
Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR)
Legitimate interests (Art. 6(1)(f) GDPR)
National Data Protection Regulations in Germany
In addition to the GDPR’s data protection regulations, national data protection regulations apply in Germany. This includes, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG). The BDSG contains specific regulations, especially regarding the right to information, the right to deletion, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission, as well as automated decision-making in individual cases, including profiling. Additionally, data protection laws of the individual federal states may apply.
Note on the Applicability of GDPR and Swiss Data Protection Act (DSG)
These data protection notices serve both to provide information under the Swiss DSG and under the GDPR. Therefore, please note that, due to the broader geographical application and comprehensibility, the terms of the GDPR are used. Specifically, instead of the terms “processing” of “personal data,” “overriding interest,” and “sensitive personal data” used in the Swiss DSG, the terms used in the GDPR are “processing” of “personal data” and “legitimate interest” and “special categories of data.” However, the legal meaning of the terms will still be determined under the Swiss DSG within the scope of its applicability.
05
We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of the processing, as well as the different probabilities of occurrence and severity of the risk to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.
These measures include, in particular, securing the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, input, transmission, securing of availability, and separation of the data. Furthermore, we take into account the protection of personal data in the development or selection of hardware, software, and procedures in accordance with the principle of data protection through technology design and data protection-friendly default settings.
Securing Online Connections through TLS/SSL Encryption Technology (HTTPS)
To protect users’ data transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transfers meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by the display of HTTPS in the URL. This serves as an indicator to users that their data is transmitted securely and encrypted.
06
Data Processing in Third Countries
If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if the processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, offices, or companies, this is done only in accordance with legal requirements. If the level of data protection in the third country has been recognized by an adequacy decision (Art. 45 GDPR), this serves as the basis for the data transfer.
07
We delete personal data that we process in accordance with legal requirements as soon as the underlying consents are revoked or no further legal grounds for processing exist. This applies to cases where the original purpose of processing ceases to exist, or the data is no longer needed. Exceptions to this rule apply if legal obligations or special interests require longer retention or archiving of the data.
Data that is no longer needed for the originally intended purpose but is retained due to legal requirements or other reasons is processed exclusively for the reasons justifying its retention.
08
We process users’ data to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to deliver the content and functions of our online services to the user’s browser or device.
Types of Processed Data
Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions)
Meta, communication, and procedural data (e.g., IP addresses, time data, identification numbers, involved persons)
Log data (e.g., log files concerning logins or data retrieval or access times)
Content data (e.g., textual or visual messages and contributions and the information relating to them, such as authorship or time of creation)
Affected Individuals
Users (e.g., website visitors, users of online services)
Purposes of Processing
Provision of our online offer and user-friendliness
IT infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.))
Security measures
Retention and Deletion
Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”
Legal Bases
Legitimate interests (Art. 6(1)(f) GDPR)
Further Notes on Processing Procedures, Procedures, and Services
Provision of the online offer on rented storage space: We use storage space, computing power, and software that we rent or otherwise obtain from a server provider (also called a “web hoster”) to provide our online offer.
Legal bases: Legitimate interests (Art. 6(1)(f) GDPR)
Collection of Access Data and Log Files
Access to our online offer is logged in the form of so-called “server log files” on the servers our web hosting services provides. Server log files can include the address and name of the accessed websites and files, date and time of access, transmitted data volumes, report of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), and typically IP addresses and the requesting provider. The server log files can be used for security purposes, e.g., to prevent server overload (especially in the case of abusive attacks such as DDoS attacks), and to ensure the server’s stability.
Legal Bases
Legitimate interests (Art. 6(1)(f) GDPR)
Email Sending and Hosting
The web hosting services we use also include sending, receiving, and storing emails. For these purposes, the addresses of recipients and senders as well as other information regarding email transmission (e.g., involved providers) and the content of the respective emails are processed. The aforementioned data may also be processed for spam detection purposes.
09
Cookies are small text files or other storage notes that store information on end devices and can read them out. For example, to store the login status in a user account, the contents of a shopping cart in an online shop, the accessed content, or the used functions of an online offer. Cookies can also be used for various purposes, such as to ensure the functionality, security, and comfort of online offers, as well as to create analyses of visitor flows.
Notes on Consent
We use cookies in accordance with legal regulations. Therefore, we obtain prior consent from users unless it is not required by law. Consent is particularly unnecessary if storing and reading the information (including cookies) is strictly necessary to provide a service explicitly requested by the user.
Notes on Data Protection Legal Bases
The legal basis on which we process personal data of users with the help of cookies depends on whether we ask for their consent. If users agree, the legal basis for the processing of their data is the declared consent. Otherwise, the data processed with the help of cookies is based on our legitimate interests (e.g., in a business operation of our online offer and the improvement of its usability) or if this is necessary for fulfilling our contractual obligations.
General Notes on Revocation and Objection (Opt-out)
Users can revoke the consent they have given at any time and also object to the processing in accordance with legal requirements, e.g., via the privacy settings of their browser.
Processed Data Types
Meta, communication, and procedural data (e.g., IP addresses, time data, identification numbers, involved persons)
Affected Individuals
Users (e.g., website visitors, users of online services)
Legal Bases
Legitimate interests (Art. 6(1)(f) GDPR)
Consent (Art. 6(1)(a) GDPR)
10
When contacting us (e.g., by post, contact form, email, telephone, or via social media) and in the context of existing user and business relationships, the information provided by the inquiring persons is processed insofar as this is necessary to respond to the contact inquiries and any requested measures.
Processed Data Types
Inventory data (e.g., full name, residential address, contact information, customer number, etc.)
Contact data (e.g., postal and email addresses or telephone numbers)
Content data (e.g., textual or visual messages and contributions and the information relating to them, such as authorship or time of creation)
Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions)
Meta, communication, and procedural data (e.g., IP addresses, time data, identification numbers, involved persons)
Affected Individuals
Communication partners
Purposes of Processing
Communication
Organizational and administrative procedures
Feedback (e.g., collecting feedback via online form)
Provision of our online offer and user-friendliness
Retention and Deletion
Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”
Legal Bases
Legitimate interests (Art. 6(1)(f) GDPR)
Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR)
Further Notes on Processing Procedures, Procedures, and Services
Contact form: When contacting us via our contact form, email, or other communication channels, we process the personal data provided to us to respond to and process the respective request. This usually includes information such as name, contact information, and possibly other information provided to us and necessary for appropriate processing. We use this data exclusively for the specified purpose of contact and communication.
Legal Bases
Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR)
Legitimate interests (Art. 6(1)(f) GDPR)
11
Web analytics (also referred to as “reach measurement”) serves to evaluate the visitor flows of our online offer and can include behavior, interests, or demographic information about visitors, such as age or gender as pseudonymous values. With the help of reach measurement, we can, for example, recognize at what time our online offer or its functions or contents are most frequently used or invite reuse. Likewise, we can track which areas need optimization.
In addition to web analytics, we may also use testing procedures to test and optimize different versions of our online offer or its components.
Notes on Legal Bases
If we ask users for their consent to use third-party services, the legal basis for data processing is the consent. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economic, and recipient-friendly services).
Processed Data Types
Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions)
Meta, communication, and procedural data (e.g., IP addresses, time data, identification numbers, involved persons)
Affected Individuals
Users (e.g., website visitors, users of online services)
Purposes of Processing
Reach measurement (e.g., access statistics, recognition of returning visitors)
Profiles with user-related information (creating user profiles)
Legal Bases
Consent (Art. 6(1)(a) GDPR)
Legitimate interests (Art. 6(1)(f) GDPR)
12
We maintain online presences within social networks and process user data within this context to communicate with the active users there or to offer information about us.
Please note that user data may be processed outside the European Union.
Furthermore, user data within social networks is typically processed for market research and advertising purposes. For example, user profiles can be created based on user behavior and resulting interests. These profiles may, in turn, be used to place advertisements within and outside the networks that presumably correspond to users’ interests. Therefore, cookies are typically stored on users’ computers, in which the usage behavior and interests of the users are stored. In addition, data may also be stored in the user profiles, regardless of the devices used by the users (especially if they are members of the respective platforms and logged in).
For a detailed presentation of the respective processing and objection options (opt-out), we refer to the privacy policies and information of the operators of the respective networks.
Even in the case of information requests and the assertion of affected rights, we point out that these can be most effectively asserted with the providers. Only they have access to the user data and can take appropriate measures and provide information directly. However, if you still need help, you can contact us.
Processed Data Types
Contact data (e.g., postal and email addresses or telephone numbers)
Content data (e.g., textual or visual messages and contributions and the information relating to them, such as authorship or time of creation)
Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions)
Affected Individuals
Users (e.g., website visitors, users of online services)
Purposes of Processing
Communication
Feedback (e.g., collecting feedback via online form)
Public relations
Retention and Deletion
Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”
Legal Bases
Legitimate interests (Art. 6(1)(f) GDPR)
Further Notes on Processing Procedures, Procedures, and Services
X: Social network; Service provider: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://x.com; Privacy Policy: https://x.com/de/privacy.
13
We integrate function and content elements into our online offer that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos, or maps (hereinafter uniformly referred to as “content”).
The integration always requires that the third-party providers of these contents process the IP address of the users, as they could not send the content to their browser without the IP address. The IP address is therefore required for the display of these contents or functions. We strive to use only those contents whose respective providers use the IP address only for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. The “pixel tags” can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the user’s device and may include technical information about the browser and operating system, referring websites, visit time, and other information about the use of our online offer, but may also be linked to such information from other sources.
Notes on Legal Bases
If we ask users for their consent to use third-party providers, the legal basis for data processing is the consent. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economic, and recipient-friendly services).
Processed Data Types
Usage data (e.g., page views and dwell time, click paths, usage intensity and frequency, device types and operating systems used, interactions with content and functions)
Meta, communication, and procedural data (e.g., IP addresses, time data, identification numbers, involved persons)
Inventory data (e.g., full name, residential address, contact information, customer number, etc.)
Contact data (e.g., postal and email addresses or telephone numbers)
Content data (e.g., textual or visual messages and contributions and the information relating to them, such as authorship or time of creation)
Location data (information on the geographical position of a device or person)
Affected Individuals
Users (e.g., website visitors, users of online services)
Purposes of Processing
Provision of our online offer and user-friendliness
Retention and Deletion
Deletion in accordance with the information in the section “General Information on Data Storage and Deletion”
Storage of cookies for up to 2 years (unless otherwise specified, cookies and similar storage methods can be stored on users’ devices for up to two years)
Legal Bases
Consent (Art. 6(1)(a) GDPR)
Legitimate interests (Art. 6(1)(f) GDPR)
Further Notes on Processing Procedures, Procedures, and Services
Google Maps: We integrate the maps of the “Google Maps” service provided by Google. The processed data may include, in particular, IP addresses and location data of the users; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://mapsplatform.google.com/; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF).
YouTube Videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://www.youtube.com; Privacy Policy: https://policies.google.com/privacy; Basis for third-country transfers: Data Privacy Framework (DPF). Objection option (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=en; Settings for displaying ads: https://myadcenter.google.com/personalizationoff.
Contact
If you have any questions or concerns regarding this Privacy Policy, please contact our data protection officer via: heyData GmbH, Schützenstraße 5, 10117 Berlin, www.heydata.eu, datenschutz@heydata.eu.