Privacy policy

Status: 01.09.2026

1. General Information

With the following information, we would like to give you, as a "data subject", an overview of how we process your personal data and of your rights under data protection law.

The processing of personal data — such as your name, address or email address — is always carried out in accordance with data protection law, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). With this privacy policy, we would like to inform you about the scope and purpose of the personal data we collect, use and process.

2. Controller

Carl Hanser Verlag GmbH & Co. KG

Vilshofener Straße 10
81679 Munich, Germany
Phone: +49 89 99830-0
Email: info@hanser.de

Registered at the Munich Register Court under HRA 49621, hereinafter referred to as "we" or "us".

3. Data Protection Officer

Carl Hanser Verlag GmbH & Co. KG

Data Protection Officer

Vilshofener Straße 10
81679 Munich, Germany
Phone: +49 89 99830-0
Email: datenschutz@hanser.de

You may contact our Data Protection Officer directly at any time with any questions or suggestions regarding data protection.

4. Transfer of Data to Third Parties

As explained in this privacy policy, we use various service providers who help us deliver our services and keep your data secure. When we use these service providers, it is necessary for us to disclose your personal data to them.

We have entered into agreements with all service providers to whom we disclose your data, obliging them to protect your data.

Where your personal data is transferred outside the EU, we ensure that your personal data receives an equivalent level of protection, either because the country to which your data is transferred has an "adequate" data protection standard as recognised by the European Commission, or by applying another safeguard, such as an enhanced contractual arrangement, i.e. the Standard Contractual Clauses (SCCs) adopted by the European Commission.

5. Operation of the Website

5.1 Hosting

We host our website with Amazon Web Services (AWS). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855 Luxembourg. In addition, further service providers may support us in the design and operation of the website.

When you visit our website, your personal data is processed on the servers of AWS. In this context, personal data may also be transferred to AWS’s parent company in the USA.

The processing of your data in connection with the hosting of the website is carried out on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in presenting our website as reliably as possible.

You can find further information on the data protection provisions of AWS at: https://aws.amazon.com/de/privacy/?nc1=f_pr

5.2 SSL/TLS Encryption

To ensure the security of data processing and to protect the transmission of confidential content — such as orders, login data or contact enquiries that you send to us as the operator — this website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser shows "https://" instead of "http://", and by the padlock symbol in your browser bar.

We use this technology to protect the data you transmit.

6. Cookies

6.1 General Information on Cookies

Cookies are small files that your browser automatically creates and that are stored on your IT system (laptop, tablet, smartphone, etc.) when you visit our site. Information is stored in the cookie that results in each case from the specific context of the device used. However, this does not mean that we thereby directly obtain knowledge of your identity.

The use of cookies serves to make the use of our services more pleasant for you. For example, we use so-called session cookies to recognise that you have already visited individual pages of our website. These are automatically deleted after you leave our site.

In addition, we also use temporary cookies to optimise user-friendliness; these are stored on your device for a certain defined period. If you visit our site again in order to use our services, it is automatically recognised that you have already been with us before, as well as which entries and settings you have made, so that you do not have to enter them again.

Furthermore, we use cookies to record the use of our website statistically and to evaluate our services for the purpose of optimisation. These cookies enable us to automatically recognise, when you visit our website again, that you have already visited it. The cookies set in this way are automatically deleted after a defined period in each case. The respective storage period of the cookies can be found in the settings of the consent tool used.

6.2 Legal Basis for the Use of Cookies

The data processed by the cookies that is required for the proper functioning of the website is therefore necessary to safeguard our legitimate interests and those of third parties pursuant to Art. 6(1)(f) GDPR.

For all other cookies, you have given your consent via our opt-in cookie banner within the meaning of Art. 6(1)(a) GDPR.

6.3 Consentmanager (Consent Management Tool)

We use the consent management platform "Consentmanager" provided by consentmanager AB, Haltegelvägen 1b, 72348 Västerås, Sweden. This service enables us to obtain and manage website users’ consent to data processing.

Consentmanager collects data generated by end users who use our website. When an end user gives consent, the following data is automatically logged by Consentmanager:

• Browser information
• Date and time of access
• Device information
• The URL of the page visited
• Banner language
• Consent ID
• The end user’s consent status, which serves as proof of consent

The consent status is also stored in the end user’s browser, so that the website can automatically read and comply with the end user’s consent for all subsequent page requests and future end user sessions for up to 12 months. The consent data (consent and withdrawal of consent) is stored for three years. The retention period corresponds to the regular limitation period pursuant to Section 195 of the German Civil Code (BGB). The data is then deleted immediately.

The functionality of the website cannot be guaranteed without the processing described. The user has no right to object as long as there is a legal obligation to obtain the user’s consent to certain data processing operations.

You can find detailed information on the use of Consentmanager at: https://www.consentmanager.net/en/privacy/

7. Use of Our Products and Services

7.1 Enquiries by Email, Fax or Telephone

If you contact us by email, fax or telephone, we store and process personal data for the purpose of handling your enquiry. The legal basis for this data processing is your consent pursuant to Art. 6(1)(a) GDPR, our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR, or, if your enquiry relates to a contract or is necessary for pre-contractual measures, Art. 6(1)(b) GDPR.

We store your data until you ask us to delete it, until you withdraw your consent to the processing, or until the purpose for storing it no longer applies. Mandatory statutory provisions (e.g. statutory retention obligations) remain unaffected.

7.2 Use of Our AI Assistant

You can access our AI assistant via our website, an MCP server or an API interface. Operating with the help of artificial intelligence, the assistant offers professionals from various industries the ability to retrieve specialist information easily and quickly in the form of a chat dialogue. For this purpose, we use the trusted sources of our specialist publishing house.

Depending on the product variant, the use of the AI assistant requires registration, during which we collect the following data:

• First name and surname
• Email address
• Password
• IP address and time of registration
• Scope of licence and authorisation
• Assignment of the user to a customer or company account

When you use the AI assistant, we process further data such as:

• Chat history and content of prompts
• Technical data required for operation, such as server logs

The legal basis for the processing of the data is the performance of a contract or pre-contractual measures pursuant to Art. 6(1)(b) GDPR. The analysis of chat content is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest, exclusively for the general improvement of our products as well as for troubleshooting and to ensure IT security. The chat content is not used to train AI models.

To provide the AI assistant, we use various service providers who act as processors on our behalf. We have concluded contractual agreements with all service providers that ensure an adequate level of data protection. Insofar as the data transfer is not based on an adequacy decision of the EU Commission, we have agreed on the applicability of the EU Commission’s Standard Contractual Clauses for the transfer to third countries.

To provide the AI assistant, we use an LLM cloud provider as well as Amazon Web Services (hosting).

We store your data until we are asked to delete it or until the purpose for storing it no longer applies. Mandatory statutory provisions — in particular statutory retention periods — remain unaffected.

We store the chat content and chat histories for as long as the user keeps them in their chat history. You can delete this data yourself at any time by using the delete function in the application. For technical reasons, it may take up to 30 days for your deletion to be fully implemented in the production systems.

Deletion of your customer account and the associated data is possible within the notice periods of your contract and can be carried out, among other things, by sending a message to the email address datenschutz@hanser.de.

The technically required operational data and log files are deleted as soon as they are no longer required for the purpose for which they were collected.

7.3 Sending Information by Email

As a registered customer, you receive information from us at irregular intervals by email on how to make optimal use of the product or service you use. This includes, among other things, welcome emails, tips on the product, examples of optimal use, or references to webinars relating to the product or service you use. The legal basis for this processing is the performance of a contract or a pre-contractual measure pursuant to Art. 6(1)(b) GDPR.

In addition, we reserve the right to send you, at irregular intervals, information about goods or services from our range similar to those you have already purchased, by email. Pursuant to Section 7(3) of the German Act Against Unfair Competition (UWG), we do not need to obtain your separate consent for this. In this respect, the data processing is carried out solely on the basis of our legitimate interest in personalised direct marketing pursuant to Art. 6(1)(f) GDPR.

If you have objected to the use of your email address for advertising purposes, no such emails will be sent by us. Insofar as they are not emails that are necessary for the performance of the contract, you can unsubscribe from receiving them at any time by using the unsubscribe link in the email.

We use the service provider SAP Engagement Cloud for sending emails. The provider is SAP Deutschland SE & Co. KG, Hasso-Plattner-Ring 7, 69190 Walldorf, Germany.

You can find detailed information on the functions of SAP Engagement Cloud at: https://www.sap.com/germany/products/crm/engagement-cloud/features.html

7.4 Newsletter Distribution for Marketing Purposes

We may offer a newsletter subscription on our website. In the newsletter, we inform our prospective and existing customers about our offers at irregular intervals.

Which personal data is transmitted to us when you subscribe to the newsletter is determined by the input form used for this purpose.

The legal basis for the data processing is Art. 6(1)(a) GDPR. A corresponding link for withdrawing consent can be found in every newsletter.

For legal reasons, a confirmation email is sent using the double opt-in procedure to the email address you first entered for the newsletter distribution. This confirmation email serves to verify whether you, as the owner of the email address, have authorised receipt of the newsletter.

When you register for the newsletter, we also store the IP address of the IT system you used at the time of registration, as assigned by your internet service provider (ISP), as well as the date and time of registration. The collection of this data is necessary in order to be able to trace any (possible) misuse of your email address at a later point in time, and therefore serves our legal protection.

We use the service provider SAP Engagement Cloud for sending emails. The provider is SAP Deutschland SE & Co. KG, Hasso-Plattner-Ring 7, 69190 Walldorf, Germany.

You can find detailed information on the functions of SAP Engagement Cloud at: https://www.sap.com/germany/products/crm/engagement-cloud/features.html

8. Web Analytics, Plugins and Other Services

8.1 Google Analytics 4 (GA4)

On our websites, we use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

In this context, pseudonymised usage profiles are created and cookies (see the "Cookies" section) are used. The information generated by the cookie about your use of this website may include, among other things:

• a short-term recording of the IP address without permanent storage
• location data
• browser type/version
• operating system used
• referrer URL (previously visited page)
• time of the server request

The pseudonymised data may be transferred by Google to a server in the USA and stored there.

The information is used to evaluate the use of the website, to compile reports on website activity, and to provide further services associated with website use and internet use for the purposes of market research and the needs-based design of these internet pages. This information may also be transferred to third parties where this is required by law, or insofar as third parties process this data on our behalf.

These processing operations are only carried out if you have given your express consent pursuant to Art. 6(1)(a) GDPR.

The data storage period preset by Google is 14 months. Otherwise, the personal data is retained for as long as it is required to fulfil the purpose of processing. The data is deleted as soon as it is no longer required to achieve the purpose.

You can find further information on data protection when using GA4 at: https://support.google.com/analytics/answer/12017362?hl=en

8.2 Google Tag Manager

On this website, we use the Google Tag Manager service. The operating company of Google Tag Manager is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland Limited is part of the Google group of companies with its head office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

This tool allows "website tags" (i.e. keywords that are integrated into HTML elements) to be implemented and managed via an interface. Through the use of Google Tag Manager, we can automatically track which button, link or personalised image you actively clicked on, and can then record which content on our website is of particular interest to you.

These processing operations are only carried out if you have given express consent pursuant to Art. 6(1)(a) GDPR.

You can view further information on Google Tag Manager as well as Google’s privacy policy at: https://policies.google.com/privacy?hl=en

8.3 Leadinfo (Lead-Generation-Service)

On our website, we use the lead generation service provided by Leadinfo B.V., Rivium Quadrant 141, Capelle aan den IJssel, South Holland 2909, Netherlands.

The service recognises visits by companies to our website on the basis of IP addresses and shows us publicly available information about them, such as company names or addresses. The IP addresses are neither displayed nor stored in this process.

In addition, Leadinfo sets two first-party cookies to analyse user behaviour on our website and processes domains from form entries (e.g. "http://leadinfo.com ") in order to correlate IP addresses with companies and to improve the services.

As a rule, the following data is collected and processed:

• IP address without permanent storage
• location based on the IP address
• domain from form field entries

These processing operations are only carried out if you have given your express consent pursuant to Art. 6(1)(a) GDPR. Your data is stored until the purpose has been achieved or until you withdraw your consent.

You can find further information on the data protection provisions of Leadinfo at: https://www.leadinfo.com/en/legal/privacy/

8.4 Microsoft Bookings

On our website, we use the appointment scheduling tool Microsoft Bookings ("Bookings"), a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

When you click the corresponding booking button, you are automatically connected to our appointment account with Bookings. After choosing your appointment, confirming it and entering your contact details and your request, you will receive an email from Bookings confirming your appointment.

When using the service, the following data may be processed, among other things:

• surname, first name
• telephone number
• email address
• preferred form of communication (telephone, video conferencing system)
• reason for your enquiry
• time of the appointment request and of the agreed appointment
• free text added by you

These processing operations are only carried out if you have given your express consent pursuant to Art. 6(1)(a) GDPR by clicking the booking button. As an alternative, appointments can also be arranged by email or by telephone.

Microsoft generally processes the data within the European Union under the so-called EU Data Boundary. In order to provide and safeguard the services and to comply with legal obligations, Microsoft Ireland may transfer personal data to affiliated companies of the Microsoft Corporation (Redmond, Washington, USA). The intra-group data transfer is carried out on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR as well as supplementary technical and organisational measures, as set out in the Microsoft Data Protection Addendum.

You can view Microsoft’s privacy policy at: https://www.microsoft.com/en-us/privacy/privacystatement

9. Stripe Payment Provider

We have integrated components of Stripe on this website. The operating company of Stripe is Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA. For customers within the EU, Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland is responsible. Stripe makes it possible to accept credit and debit card payments in our web shop. In doing so, Stripe handles the entire payment process.

The personal data exchanged with Stripe consists of the payment method (i.e. credit card, debit card or account number), bank sort code, currency, and the amount and date of the payment. In the case of a transaction, your name, email address, billing or shipping address and sometimes also your transaction history may be transmitted. This data is necessary for payment processing and fraud prevention. We will also transmit other personal data to Stripe where there is a legitimate interest in the transmission. The personal data exchanged between Stripe and us may be transmitted by Stripe to credit reference agencies. The purpose of this transmission is identity and creditworthiness checks.

Where appropriate, Stripe passes on the personal data to affiliated companies and service providers or subcontractors, insofar as this is necessary to fulfil contractual obligations or the data is to be processed on our behalf.

You have the option to withdraw your consent to the handling of personal data vis-à-vis Stripe at any time. A withdrawal does not affect personal data that must necessarily be processed, used or transmitted for the (contractual) processing of payments.

Stripe is used in the interest of proper and smooth payment processing. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. The transmission of your personal data is only carried out if you have given your express consent pursuant to Art. 6(1)(a) GDPR. In addition, we have concluded a data processing agreement (DPA) with Stripe pursuant to Art. 28 GDPR.

You can view Stripe’s privacy policy at: https://stripe.com/de/privacy

10. Your Rights as a Data Subject

10.1 Right of Access — Art. 15 GDPR

You have the right to obtain from us, free of charge and at any time, information about the personal data stored about you, as well as a copy of this data, in accordance with the statutory provisions.

10.2 Right to Rectification — Art. 16 GDPR

You have the right to request the rectification of inaccurate personal data concerning you. Furthermore, taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data.

10.3 Erasure — Art. 17 GDPR

You have the right to request that we erase the personal data concerning you without undue delay, provided that one of the reasons set out in law applies and insofar as the processing or storage is not necessary.

10.4 Restriction of Processing — Art. 18 GDPR

You have the right to request that we restrict processing if one of the legal conditions is met.

10.5 Data Portability — Art. 20 GDPR

You have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, to whom the personal data was provided, provided that the processing is based on consent pursuant to Art. 6(1)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and that the processing is carried out by automated means.

Furthermore, when exercising your right to data portability pursuant to Art. 20(1) GDPR, you have the right to have the personal data transmitted directly from one controller to another controller, insofar as this is technically feasible and provided that the rights and freedoms of other persons are not adversely affected as a result.

10.6 Right to Object — Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6(1)(f) GDPR (data processing on the basis of a balancing of interests).

This also applies to profiling based on these provisions within the meaning of Art. 4(4) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

In individual cases, we process personal data in order to carry out direct marketing. You can object at any time to the processing of personal data for the purposes of such advertising. This also applies to profiling insofar as it is connected with such direct marketing. If you object to us regarding processing for direct marketing purposes, we will no longer process the personal data for these purposes.

10.7 Withdrawal of Consent Under Data Protection Law

You have the right to withdraw consent to the processing of personal data at any time with effect for the future.

10.8 Complaint to a Supervisory Authority

You have the right to lodge a complaint with a supervisory authority responsible for data protection about our processing of personal data. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Postfach 1349, 91504 Ansbach, Germany.