Privacy policy

As at: November 2026

The protection of your data matters to us – on deployment as on our website. Here you can find out which personal data we process, for what purpose, on what legal basis, and what rights you have.

1. Controller

Pandemedics UG (haftungsbeschränkt)
Raiffeisenstraße 6-8, 63225 Langen
Berlin location: Fürstenwalder Damm 479, 12587 Berlin
Represented by the managing director Thomas Staude
Phone: 030 23 59 890 50 · E-mail: info@pandemedics.de

2. Data protection officer

Our data protection officer is Thomas Staude, Raiffeisenstraße 6-8, 63225 Langen. You can reach him by e-mail at tstaude@pandemedics.de or by post at the address given, marked “Datenschutzbeauftragter” (data protection officer).

3. Visiting the website and server log files

When you visit our website, our hosting provider automatically processes technical data transmitted by your browser: IP address, date and time, page visited, referrer URL, browser type and operating system. This is necessary to deliver the website, to ensure its stability and security and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). The log files are deleted after 14 days at the latest, unless they are needed to investigate a security incident.

Hosting: Host Europe GmbH, Hansestraße 111, 51149 Köln (dedicated virtual server). A data processing agreement under Art. 28 GDPR is in place with the provider; the servers are located in the European Union.

Encryption: Our website is transmitted exclusively in encrypted form via TLS (HTTPS).

4. Cookies, audience measurement and advertising success measurement

Without your consent, our website sets no cookies and loads no content from third parties. Fonts, images and scripts come from our own server. The only thing stored in your browser is your choice in the consent window (the entry “pm-einwilligung” in local storage), so that we do not have to ask you again on every page view.

Google Analytics: If you choose “Accept” in the consent window, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies (e.g. “_ga”) and processes information about your visit: pages viewed, time spent, approximate origin, device used, and events such as submitting a form, using the requirements calculator or clicking a phone number. We do not transmit the content of your form entries to Google. IP addresses are not stored by Google Analytics 4. We have switched off Google signals and personalised advertising. The data is deleted after 2 months.

Google Ads success measurement: If we run ads on Google, then, with your consent, we measure whether a click on an ad led to an enquiry (conversion measurement). For this, Google sets a cookie and receives the information that an enquiry was submitted – not its content.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG, German Telecommunications Digital Services Data Protection Act). In this context, data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. A data processing agreement is in place with Google.

Withdrawal: You can withdraw your consent at any time with effect for the future – via the “Cookie settings” link at the bottom of every page. If you choose “Decline” there, Google Analytics is no longer loaded.

5. Enquiries via forms, e-mail and phone

If you contact us via the quick enquiry, the detailed enquiry, the contact form, by e-mail or by phone, we process your details (e.g. name, contact details, company, details of the event, message) in order to answer your enquiry and prepare a quote. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR for general enquiries. Mandatory fields are marked; without them we cannot process the enquiry.

If no order results, we delete the enquiry after 12 months. If an order is placed, the statutory retention periods apply (up to 10 years under § 147 AO and § 257 HGB).

Enquiries from our forms are stored on our server and automatically deleted there after 90 days. They are also delivered to us by e-mail; our mailboxes are operated at Microsoft 365 (Microsoft Ireland Operations Ltd.). If you provide an e-mail address, you will receive an automatic confirmation of receipt. To protect against abusive mass enquiries, we store a short value derived from your IP address, from which the address cannot be recovered, for one hour at most.

The forms contain an invisible spam protection (a so-called honeypot field). No data is transmitted to third parties for this purpose and no captcha service is used.

Requirements calculator: The calculation takes place exclusively in your browser. Your entries are not transmitted to us unless you yourself submit the result as an enquiry.

6. Course booking and first aid training

To register for courses, we process your name, contact details, the course and date booked, payment details or billing address and – for first aiders in the workplace – employer, statutory accident insurer (BG) or accident insurance fund and membership number. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligations).

As an authorised training provider, we are obliged to keep records of attendance and to bill the accident insurance providers. For this purpose, we transmit the necessary data to the competent statutory accident insurer (BG) or accident insurance fund. We keep attendance lists for at least 5 years; after that they are deleted, unless further retention obligations apply.

Course portal (HiOrg-Server): Our courses are booked online via the course portal of HiOrg Server GmbH, Germany. When you select a date there, you leave our website; your registration data is processed on the servers of HiOrg Server GmbH on our behalf (data processing under Art. 28 GDPR). The list of dates on our website is taken over when the pages are generated – no data is transmitted to HiOrg when you visit our website.

Payment: You pay the course fee by invoice or via PayPal. If you choose PayPal, the data required for the payment is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; their privacy notices apply. Payment in cash is not possible.

7. Applications

If you apply to us, we process your application documents to carry out the application procedure (Art. 6(1)(b) GDPR). We process details of qualifications and vaccination status only to the extent that they are necessary for work in the medical services. If no employment relationship results, we delete the documents no later than 6 months after the end of the procedure, unless you have consented to longer storage.

8. Health data on deployment

This privacy policy concerns our website. Data of patients whom we treat in the medical services is processed separately from this, under Art. 9(2)(c) and (h) GDPR, for treatment and documentation. Organisers receive only summarised information without personal reference in the deployment report. Information on patient documentation is available on site and on request.

9. Links to social networks

On our website we link to our profiles on Instagram, Facebook and LinkedIn. These are simple links, not embedded plugins: only when you click a link are you forwarded to the respective network, which then processes its own data. For our company pages on Facebook and Instagram we are jointly responsible with Meta (Art. 26 GDPR); Meta provides the agreement.

10. Recipients and transfers to third countries

We pass on your data only if this is necessary for the performance of a contract (e.g. to statutory accident insurers, accident insurance funds, tax advisers), if we are legally obliged to do so, or if you have consented. We use technical service providers (hosting, e-mail) as processors under Art. 28 GDPR. Data is transferred to countries outside the EU only if an adequacy decision or appropriate safeguards (e.g. standard contractual clauses) are in place.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to withdraw consent you have given at any time with effect for the future (Art. 7(3)). An informal message to info@pandemedics.de is enough.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the federal state where you live or work. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Wiesbaden. For Berlin, the Berlin Commissioner for Data Protection and Freedom of Information is responsible.

12. Automated decisions

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Changes

We will amend this privacy policy if our website or the legal situation changes. The version published here at the relevant time applies.