Privacy Policy
1. Overview of Data Protection
General Information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data refers to any data by which you can be personally identified. Detailed information on the subject of data protection can be found in the privacy policy outlined below.
Data Collection on This Website
Who is responsible for data collection on this website?
The data processing on this website is carried out by the website operator. Their contact details can be found in the section "Information about the Responsible Party" in this privacy policy.
How do we collect your data?
Your data is collected in two ways:
- Data you provide: This could include information you enter into a contact form.
- Data collected automatically or with your consent: This occurs through our IT systems when you visit the website, including technical data (e.g., your internet browser, operating system, or the time of page access). This data is collected automatically as soon as you access the website.
What do we use your data for?
Some data is collected to ensure the error-free functioning of the website. Other data may be used to analyze your user behavior. If contracts are initiated or concluded through the website, the data provided will also be processed for contract offers, orders, or other inquiries.
What rights do you have regarding your data?
You have the right to request information about the origin, recipients, and purpose of your stored personal data at any time, free of charge. You also have the right to request the correction or deletion of this data. If you have given consent for data processing, you can withdraw this consent at any time with effect for the future. Additionally, under certain circumstances, you have the right to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.
For these and any other questions on the subject of data protection, you can contact us at any time.
Analytics Tools and Third-Party Tools
When you visit this website, your browsing behavior may be analyzed. This is primarily done using analytics programs.
For detailed information on these analytics programs, please refer to the privacy policy below.
2. Hosting and Content Delivery Networks (CDN)
IONOS
Our website content is hosted by the following provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (hereinafter referred to as "IONOS"). When you visit our website, IONOS collects various log files, including your IP address.
Details can be found in IONOS's privacy policy: https://www.ionos.de/terms-gtc/terms-privacy.
The use of IONOS is based on Art. 6(1)(f) GDPR. We have a legitimate interest in ensuring the most reliable presentation of our website. If consent is requested, data processing will be carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TTDPA, provided that consent includes the storage of cookies or access to user device information (e.g., device fingerprinting). Consent can be revoked at any time.
Webflow
Provider: Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. When you visit our website, Webflow collects various log files, including your IP address.
Webflow is a tool for creating and hosting websites. Webflow stores cookies or similar recognition technologies required for the display, functionality, and security of the website (necessary cookies).
Details can be found in Webflow's privacy policy: https://webflow.com/legal/eu-privacy-policy.
The use of Webflow is based on Art. 6(1)(f) GDPR. We have a legitimate interest in ensuring the most reliable presentation of our website. If consent is requested, data processing will be carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TTDPA, provided that consent includes the storage of cookies or access to user device information (e.g., device fingerprinting). Consent can be revoked at any time.
Data transfers to the USA are based on the EU Commission's Standard Contractual Clauses.
Details can be found here: https://webflow.com/legal/eu-privacy-policy.
The company is certified under the "EU-US Data Privacy Framework" (DPF). The DPF ensures compliance with European data protection standards for data processing in the USA. Each DPF-certified company commits to adhering to these standards. Further information is available here: https://www.dataprivacyframework.gov/participant/6365.
Amazon CloudFront CDN
We use the Amazon CloudFront CDN, a service provided by Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg (hereinafter "Amazon").
Amazon CloudFront CDN is a globally distributed Content Delivery Network (CDN) that ensures the efficient transfer of data between your browser and our website. This improves global accessibility and the performance of our website.
The use of Amazon CloudFront CDN is based on our legitimate interest in providing a secure and error-free web service (Art. 6(1)(f) GDPR).
Data transfers to the USA are based on the EU Commission's Standard Contractual Clauses.
Details can be found here:
The company is certified under the "EU-US Data Privacy Framework" (DPF). Further information is available here: https://www.dataprivacyframework.gov/participant/5776.
3. General Information and Mandatory Disclosures
Data Protection
The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.
When you use this website, various pieces of personal data are collected. Personal data is information by which you can be personally identified. This privacy policy explains what data we collect, how we collect it, and for what purposes it is used.
Please note that data transmission over the internet (e.g., communication by email) may have security vulnerabilities. It is not possible to fully protect data from third-party access.
Notice Regarding the Responsible Party
The responsible party for data processing on this website is:
Spotlight Marketing GmbH
Konsul-Smidt-Str. 8v
28217 Bremen
Phone: +49 176 60933085
Email: kontakt@spotlight-marketing.eu
The responsible party is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).
Storage Period
Unless a specific storage period is mentioned in this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you make a legitimate request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the data will be deleted once these reasons no longer apply.
General Information on the Legal Basis for Data Processing on This Website
If you have given consent for data processing, we process your personal data based on Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR if special categories of data under Art. 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, data processing is also based on Art. 49(1)(a) GDPR. If consent is given for the storage of cookies or access to information on your device (e.g., device fingerprinting), data processing is additionally based on § 25(1) TTDPA. Consent can be revoked at any time.
If your data is required for contract fulfillment or pre-contractual measures, we process your data based on Art. 6(1)(b) GDPR. Additionally, we process your data if required to fulfill a legal obligation, based on Art. 6(1)(c) GDPR. Data processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR. Specific legal bases for processing are explained in the relevant sections of this privacy policy.
Recipients of Personal Data
In the course of our business activities, we work with various external parties. This may require the transfer of personal data to these parties. We only share personal data with external parties if it is necessary for contract fulfillment, if we are legally obligated (e.g., sharing data with tax authorities), if we have a legitimate interest under Art. 6(1)(f) GDPR, or if another legal basis permits the sharing of data.
When using data processors, personal data is only shared based on a valid data processing agreement. For joint processing activities, a joint processing agreement will be established.
Withdrawal of Your Consent to Data Processing
Many data processing activities are only possible with your explicit consent. You can withdraw consent you have already given at any time. The legality of the data processing carried out before the withdrawal remains unaffected by the withdrawal.
Right to Object to Data Collection in Special Cases and Direct Advertising (Art. 21 GDPR)
IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE SPECIFIC LEGAL BASIS FOR PROCESSING CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR IF THE PROCESSING IS FOR THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).
IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT ADVERTISING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH ADVERTISING, INCLUDING PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION UNDER ART. 21(2) GDPR).
Right to File Complaints with Regulatory Authorities
In the case of violations of the GDPR, data subjects have the right to file a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work, or the location of the alleged violation. The right to file a complaint is without prejudice to any other administrative or judicial remedies.
Right to Data Portability
You have the right to request that data we process based on your consent or in fulfillment of a contract be handed over to you or a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another responsible party, this will only be done if it is technically feasible.
Access, Correction, and Deletion
You have the right, within the framework of applicable legal provisions, to request information free of charge at any time about your stored personal data, its origin, recipients, and the purpose of data processing. You also have the right to request correction or deletion of this data. For this and any other questions regarding personal data, you can contact us at any time.
Right to Restrict Processing
You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this purpose. The right to restrict processing applies in the following cases:
- If you dispute the accuracy of your personal data stored with us, we usually need time to verify this. During the verification period, you have the right to request the restriction of the processing of your personal data.
- If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of deletion.
- If we no longer need your personal data, but you need it to establish, exercise, or defend legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
- If you have objected to processing under Art. 21(1) GDPR, a balance must be struck between your interests and ours. Until it is clear whose interests prevail, you have the right to request the restriction of the processing of your personal data.
If you have restricted the processing of your personal data, such data may—apart from being stored—only be processed with your consent or for the establishment, exercise, or defense of legal claims, or for protecting the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.
SSL and TLS Encryption
This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator. You can recognize an encrypted connection by the change in the address bar of the browser from "http://" to "https://" and by the lock icon in your browser bar.
When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Objection to Advertising Emails
The use of contact information published as part of the legal notice obligation for sending unsolicited advertising and informational materials is hereby prohibited. The operators of the site expressly reserve the right to take legal action in the event of unsolicited advertising being sent, such as spam emails.
4. Data Collection on This Website
Cookies
Our website uses "cookies." Cookies are small data packets that do no harm to your device. They are stored either temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Session cookies are automatically deleted after your visit. Persistent cookies remain on your device until you delete them or they are automatically deleted by your browser.
Cookies can originate from us (first-party cookies) or third parties (third-party cookies). Third-party cookies enable certain services from third-party companies to be integrated into websites (e.g., cookies for processing payment services).
Cookies serve various functions. Many cookies are technically necessary because certain website functions would not work without them (e.g., the shopping cart function or video display). Other cookies are used to analyze user behavior or display advertising.
Cookies required for electronic communication, providing certain functions requested by you (e.g., shopping cart function), or optimizing the website (e.g., audience measurement cookies) are stored based on Art. 6(1)(f) GDPR unless another legal basis is specified. The website operator has a legitimate interest in storing cookies for the technically error-free and optimized delivery of its services.
If consent for storing cookies and similar recognition technologies has been requested, processing occurs exclusively based on this consent (Art. 6(1)(a) GDPR and § 25(1) TTDPA); consent can be revoked at any time.
You can configure your browser to inform you about the setting of cookies and allow cookies only in specific cases, exclude the acceptance of cookies for certain cases or generally, and enable the automatic deletion of cookies when closing the browser. The functionality of this website may be limited if cookies are disabled.
The cookies and services used on this website are described in this privacy policy.
Contact Form
When you send us inquiries via the contact form, the information you provide in the form, including your contact details, will be stored by us for the purpose of processing your inquiry and in case of follow-up questions. This data will not be shared without your consent.
The processing of this data is based on Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or required for pre-contractual measures. In all other cases, the processing is based on our legitimate interest in effectively handling inquiries (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if it was requested. Consent can be withdrawn at any time.
The data you enter in the contact form will remain with us until you request its deletion, withdraw your consent to storage, or the purpose for data storage no longer applies (e.g., after completing your request). Mandatory legal provisions—particularly retention periods—remain unaffected.
Inquiry via Email, Phone, or Fax
If you contact us by email, phone, or fax, your inquiry, including all personal data resulting from it (name, inquiry), will be stored and processed for the purpose of handling your request. This data will not be shared without your consent.
The processing of this data is based on Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or required for pre-contractual measures. In all other cases, the processing is based on our legitimate interest in effectively handling inquiries (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if it was requested. Consent can be withdrawn at any time.
The data you send to us via contact inquiries will remain with us until you request its deletion, withdraw your consent to storage, or the purpose for data storage no longer applies (e.g., after completing your request). Mandatory legal provisions—particularly retention periods—remain unaffected.
Calendly
On our website, you can schedule appointments with us using the tool "Calendly." The provider is Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA (hereinafter "Calendly").
For scheduling appointments, you will provide the requested data and your preferred date through a dedicated form. This data will be used for planning, conducting, and potentially following up on the appointment. The appointment data is stored on Calendly's servers, and their privacy policy can be accessed here: https://calendly.com/privacy.
The data you provide will remain with us until you request its deletion, withdraw your consent to storage, or the purpose for data storage no longer applies. Mandatory legal provisions—particularly retention periods—remain unaffected.
The legal basis for data processing is Art. 6(1)(f) GDPR. The website operator has a legitimate interest in providing a simple appointment scheduling process for customers and prospects. If consent is requested, data processing is exclusively based on Art. 6(1)(a) GDPR and § 25(1) TTDPA if the consent includes the storage of cookies or access to user device information (e.g., device fingerprinting). Consent can be withdrawn at any time.
Data transfers to the USA are based on the EU Commission's Standard Contractual Clauses. Details can be found here: https://calendly.com/pages/dpa.
Calendly is certified under the "EU-US Data Privacy Framework" (DPF). This agreement ensures compliance with European data protection standards when processing data in the USA. Further information is available here: https://www.dataprivacyframework.gov/participant/6050.
5. Analytics Tools and Advertising
Google Analytics
This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics allows the website operator to analyze website visitor behavior. The website operator receives various usage data, such as page views, time spent on the site, operating systems used, and the user's origin. This data is assigned to the respective end device of the user. There is no assignment to a user ID.
Additionally, Google Analytics may track mouse and scroll movements and clicks. It also uses modeling approaches to augment collected datasets and employs machine learning technologies in data analysis.
Google Analytics uses technologies that enable user recognition for behavior analysis (e.g., cookies or device fingerprinting). The information collected by Google about the use of this website is generally transmitted to and stored on a Google server in the USA.
The use of this service is based on your consent under Art. 6(1)(a) GDPR and § 25(1) TTDPA. Consent can be withdrawn at any time.
Data transfers to the USA are based on the EU Commission's Standard Contractual Clauses. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/.
Google is certified under the "EU-US Data Privacy Framework" (DPF). Further information is available here: https://www.dataprivacyframework.gov/participant/5780.
IP Anonymization
Google Analytics IP anonymization is enabled on this website. This ensures that your IP address is truncated by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area before transmission to the USA. Only in exceptional cases is the full IP address sent to a Google server in the USA and truncated there. On behalf of the website operator, Google uses this information to analyze your use of the website, compile reports on website activities, and provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.
Browser Plugin
You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.
For more information on how Google Analytics handles user data, please see Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=en.
Clarity
This website uses Clarity, a tool provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (https://docs.microsoft.com/en-us/clarity/).
Clarity is used to analyze user behavior on this website. It tracks mouse movements, creates graphical representations (heatmaps) of areas frequently visited by users, and may record sessions for video playback to observe website usage. Additionally, Clarity provides insights into general user behavior on the website.
Clarity uses technologies like cookies or device fingerprinting to enable user recognition for behavior analysis. Your personal data is stored on Microsoft servers (Microsoft Azure Cloud Service) in the USA.
Where consent is obtained, the service is used exclusively based on Art. 6(1)(a) GDPR and § 25 TTDPA. Consent can be withdrawn at any time. If no consent is obtained, the use of this service is based on Art. 6(1)(f) GDPR, as the website operator has a legitimate interest in effective user analysis.
More details about Clarity's data protection can be found here: https://docs.microsoft.com/en-us/clarity/faq.
Clarity is certified under the "EU-US Data Privacy Framework" (DPF). Further information can be found here: https://www.dataprivacyframework.gov/participant/6474.
Plugins und Tools
Vimeo
This website uses plugins from the video platform Vimeo, provided by Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA.
When you visit a page featuring a Vimeo video, a connection to Vimeo servers is established. Vimeo is informed about which pages you visit, and it also captures your IP address—even if you are not logged into Vimeo or do not have a Vimeo account. The data collected by Vimeo is transferred to Vimeo's servers in the USA.
If you are logged into your Vimeo account, Vimeo can associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your Vimeo account.
Vimeo uses cookies and similar recognition technologies (e.g., device fingerprinting) to identify visitors to the website.
The use of Vimeo is in the interest of providing an appealing presentation of our online services, which constitutes a legitimate interest under Art. 6(1)(f) GDPR. If consent is requested, processing is based exclusively on Art. 6(1)(a) GDPR and § 25(1) TTDPA. Consent can be withdrawn at any time.
Data transfers to the USA are based on the EU Commission's Standard Contractual Clauses and Vimeo's "legitimate business interests." Details can be found here: https://vimeo.com/privacy.
More information about how Vimeo handles user data can be found in Vimeo's privacy policy: https://vimeo.com/privacy.
Vimeo is certified under the "EU-US Data Privacy Framework" (DPF). Further information can be found here: https://www.dataprivacyframework.gov/participant/5711.
7. Internal Services
Handling Applicant Data
We provide you with the opportunity to apply to us (e.g., by email, postal mail, or via an online application form). The following information explains the scope, purpose, and use of your personal data collected during the application process. We assure you that your data will be collected, processed, and used in compliance with applicable data protection laws and treated confidentially.
Scope and Purpose of Data Collection
If you send us an application, we process your related personal data (e.g., contact details, communication data, application documents, notes from interviews) to the extent necessary to decide on establishing an employment relationship. The legal basis for this is § 26 BDSG under German law (initiation of an employment relationship), Art. 6(1)(b) GDPR (general contract initiation), and—if you have given consent—Art. 6(1)(a) GDPR. Consent can be withdrawn at any time. Your personal data will only be shared within our company with individuals involved in processing your application.
If your application is successful, the data you have submitted will be stored in our data processing systems based on § 26 BDSG and Art. 6(1)(b) GDPR for the purpose of carrying out the employment relationship.
Retention Period
If we are unable to offer you a position, you decline an offer, or withdraw your application, we reserve the right to retain the data you submitted based on our legitimate interests (Art. 6(1)(f) GDPR) for up to 6 months after the end of the application process (rejection or withdrawal). The data is then deleted, and physical application documents are destroyed. This retention period serves as evidence in case of legal disputes. If it becomes clear that the data will be required beyond the 6-month period (e.g., due to pending or anticipated legal disputes), deletion will occur only after the reason for extended retention ceases to apply.
Longer retention may occur if you have given your consent (Art. 6(1)(a) GDPR) or if statutory retention obligations prevent deletion.
Handling of Applicant Data via Our Funnel System
Provision of Online Services
To provide our online services, we use an external service provider:
Perspective Software GmbH, Mailbox 659770, D-96035 Bamberg (hereinafter referred to as "Perspective").
Perspective stores your data exclusively on European servers. However, it is possible that your data may be accessible to entities in the United States of America, as Perspective uses subcontractors based in the USA. Since the European Commission has determined that the data protection laws of the United States do not provide an adequate level of protection for personal data collected from individuals within the European Union, Perspective implements additional measures and guarantees for data transfers to the United States in accordance with GDPR requirements to ensure an adequate level of protection, such as the conclusion of standard contractual clauses between Perspective and its subcontractors.
I. Description and scope of data processing
Perspective processes your data on our behalf so that we can provide you with our online services. For this purpose, Perspective automatically transmits your IP address to deliver the content and features of our online services to your browser or device.
The following data may be collected:
- Information about the browser type and version used
- The operating system of your computer
- The internet service provider you use
- The IP address of your device
- Date and time of your access to the funnel
- Websites from which you accessed our website ("referrer")
II. Legal basis for data processing
Perspective stores the data mentioned in section I in log files. This is done to ensure:
• The establishment of a smooth connection to the website,
• The provision of a comfortable user experience on our website,
• The analysis of system security and stability, and
• Other administrative purposes.
The temporary storage of the IP address by the system is also necessary to enable the delivery of the website to your computer. For this purpose, the IP address of your computer must remain stored for the duration of the session.
These purposes also constitute our legitimate interest in data processing. Therefore, the legal basis for data processing is Article 6(1) sentence 1 point (f) GDPR.
III. Duration of processing
The personal data processed by Perspective will be deleted as soon as it is no longer necessary to achieve the purpose for which it was collected:
• In the case of data collection for the provision of the website, this is when the respective session ends.
• In the case of IP address storage in log files, this is after a maximum of 7 days.
IV. Rights of data subjects
You have the right to request information about the origin, recipients, and purpose of your stored personal data at any time, free of charge. You also have the right to request the correction, blocking, or deletion of this data. For this and any further questions regarding data protection, you can contact us at any time via the address provided in the legal notice. In addition, you have the right to lodge a complaint with the relevant supervisory authority in case of violations of the GDPR.
Since data processing is based on Article 6(1) sentence 1 point (f) GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms or the processing is necessary for the establishment, exercise, or defense of legal claims (objection under Article 21(1) GDPR). Since the collection of data for the provision of the website and the storage of data in log files are essential for the operation of our website, you may generally not have a right to object.
Additionally, you have the right to request the restriction of the processing of your personal data under certain circumstances. This right applies in the following cases:
• If you contest the accuracy of the personal data we have stored about you, we will generally need time to verify this. During the verification period, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of deletion.
• If we no longer need your personal data but you need it to establish, exercise, or defend legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.
• If you have objected to processing under Article 21(1) GDPR, a balance must be struck between your interests and ours. As long as it is not yet determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.
If you have restricted the processing of your personal data, this data may only be processed – apart from storage – with your consent or for the establishment, exercise, or defense of legal claims or to protect the rights of another natural or legal person or for reasons of important public interest of the European Union or a member state.
