The German version is legally binding.
With the following privacy policy we would like to inform you about which types of your personal data (hereinafter also briefly referred to as "data") we process for which purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications as well as within external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”).
The terms used are not gender-specific.
Status: 21 June 2022
Johannes Wotzka
Scrambl AG
Grosshofstrasse 9
c/o LUREVO Treuhand AG
6010 Kriens
Email address: datenschutz@scrambl.org
Legal notice: https://www.scrambl.org/impressum
Scrambl is not required to appoint a data protection officer pursuant to Art. 37 GDPR.
The following overview summarizes the types of data processed and the purposes of their processing and refers to the affected persons.
Types of data processed
Master data (e.g., names, addresses).
Applicant data (e.g., personal details, postal and contact addresses, application documents and the information contained therein, such as cover letters, CVs, references as well as further information provided by applicants concerning their person or qualifications with regard to a specific position or voluntarily).
Content data (e.g., text entries, photographs, videos).
Contact data (e.g., email, telephone numbers).
Meta/communication data (e.g., device information, IP addresses).
Usage data (e.g., visited websites, interest in content, access times).
Payment data (e.g., bank details, invoices, payment history).
Categories of data subjects
Employees (e.g., employees, applicants, former employees).
Applicants.
Business and contractual partners.
Interested parties.
Communication partners.
Customers.
Users (e.g., website visitors, users of online services).
Purposes of processing
Registration procedures.
Provision of our online offering and user-friendliness.
Analysis of visitor activity.
Application procedures (initiation and any subsequent conduct as well as possible later termination of the employment relationship.).
Office and organizational procedures.
Click tracking.
Content Delivery Network (CDN).
Feedback (e.g., collecting feedback via online forms).
Contact requests and communication.
Reach measurement (e.g., access statistics, recognition of returning visitors).
Security measures.
Surveys and questionnaires (e.g., surveys with input options, multiple-choice questions).
Contractual services and service.
Administration and response to inquiries.
Below we inform you of the legal bases of the General Data Protection Regulation (DSGVO) on which we process personal data. Please note that in addition to the provisions of the DSGVO, national data protection regulations in your or our country of residence and domicile may apply. If more specific legal bases are applicable in individual cases, we will inform you of these in the privacy policy.
Consent (Art. 6 para. 1 sentence 1 lit. a DSGVO) - The data subject has given consent to the processing of personal data relating to them for a specific purpose or purposes.
Performance of a contract and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b DSGVO) - The processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract.
Legal obligation (Art. 6 para. 1 sentence 1 lit. c DSGVO) - The processing is necessary for compliance with a legal obligation to which the controller is subject.
Protection of vital interests (Art. 6 para. 1 sentence 1 lit. d DSGVO) - The processing is necessary in order to protect the vital interests of the data subject or of another natural person.
Legitimate interests (Art. 6 para. 1 sentence 1 lit. f DSGVO) - The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the interests or fundamental rights and freedoms of the data subject which require protection of personal data override those interests.
Art. 9 para. 1 sentence 1 lit. b DSGVO (Application procedure as a pre-contractual or contractual relationship) (Insofar as special categories of personal data within the meaning of Art. 9 para. 1 DSGVO (e.g., health data such as severe disability status or ethnic origin) are requested from applicants in the context of the application procedure so that the controller or the data subject can exercise their rights and fulfill their obligations arising from employment law and the law on social security and social protection, their processing is carried out pursuant to Art. 9 para. 2 lit. b DSGVO; in the case of protection of the vital interests of the applicants or other persons pursuant to Art. 9 para. 2 lit. c DSGVO; or for the purposes of preventive or occupational medicine, assessing the working capacity of the employee, medical diagnosis, provision or treatment in the health or social care sector, or the management of systems and services in the health or social care sector pursuant to Art. 9 para. 2 lit. h DSGVO. In the event of a voluntary disclosure of special categories of data based on consent, their processing is carried out on the basis of Art. 9 para. 2 lit. a DSGVO.)
National data protection regulations in Switzerland: In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection in Switzerland apply. This includes in particular the Federal Act on Data Protection (DSG). The DSG applies in particular when no EU/EEA citizens are affected and, for example, only data of Swiss citizens are processed.
We implement, in accordance with statutory requirements and taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of processing as well as the varying likelihoods of occurrence and the severity of the risk to the rights and freedoms of natural persons, appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.
The measures include in particular securing the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to it, input, disclosure, ensuring availability and its separation. Furthermore, we have established procedures that ensure the exercise of data subject rights, the deletion of data and responses to hazards to the data. In addition, we take into account the protection of personal data already when developing or selecting hardware, software and procedures in accordance with the principle of data protection by design and by privacy-friendly default settings.IP address truncation: Where possible, or when storing the IP address is not required, we truncate or have your IP address truncated. In the case of IP address truncation, also referred to as "IP-Masking", the last octet, i.e., the last two numbers of an IP address, is deleted (in this context the IP address is an identifier individually assigned to an internet connection by the online access provider). Truncating the IP address is intended to prevent or make it substantially more difficult to identify a person based on their IP address.
SSL encryption (https): In order to protect the data you transmit via our online offering, we use SSL encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.
In the course of our processing of personal data, it may occur that the data is transmitted to or disclosed to other offices, companies, legally independent organizational units or persons. Recipients of these data can include, for example, payment institutions in the context of payment transactions, service providers commissioned with IT tasks, or providers of services and content that are embedded in a website. In such cases we comply with the statutory requirements and in particular conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.
Data transfers within the corporate group: We may transfer personal data to other companies within our corporate group or grant them access to this data. If this transfer takes place for administrative purposes, the transfer of the data is based on our legitimate entrepreneurial and business interests or takes place if it is necessary to fulfill our contractual obligations or when the consent of the data subjects or a legal permission exists.
Data transfers within the organization: We may transfer personal data to other offices within our organization or grant them access to this data. If this transfer takes place for administrative purposes, the transfer of the data is based on our legitimate entrepreneurial and business interests or takes place if it is necessary to fulfill our contractual obligations or when the consent of the data subjects or a legal permission exists.
If we process data in a third country (i.e., outside the European Union (EU), the European Economic Area (EEA)) or if processing takes place in the context of the use of third-party services or the disclosure or transfer of data to other persons, offices or companies, this will only be done in accordance with the statutory requirements.
Subject to explicit consent or contractually or legally required transfers, we process or have the data processed only in third countries with a recognized level of data protection, which includes the US processors certified under the "Privacy-Shield", or on the basis of special safeguards, such as contractual commitment through so-called standard contractual clauses of the EU Commission, the existence of certifications or binding internal data protection rules (Art. 44 bis 49 DSGVO, information page of the EU Commission:
Cookies are text files that contain data from visited websites or domains and are stored by a browser on the user's computer. A cookie primarily serves to store information about a user during or after their visit within an online offering. The stored information can include, for example, language settings on a website, login status, a shopping cart, or the point at which a video was watched. We also include under the term cookies other technologies that perform the same functions as cookies (e.g., when user information is stored based on pseudonymous online identifiers, also referred to as "user IDs").
The following cookie types and functions are distinguished:
Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user leaves an online offering and closes their browser.
Persistent cookies: Persistent cookies remain stored even after the browser is closed. For example, the login status can be stored or preferred content can be displayed directly when the user visits a website again. Likewise, users' interests, which are used for reach measurement or marketing purposes, can be stored in such a cookie.
First-party cookies: First-party cookies are set by us.
Third-party cookies: Third-party cookies are mainly used by advertisers (so-called third parties) to process user information.
Necessary (also: essential or strictly necessary) cookies: Cookies can, on the one hand, be strictly necessary for the operation of a website (e.g., to store logins or other user inputs or for security reasons).
Statistics, marketing and personalization cookies: Furthermore, cookies are generally used for reach measurement and when a user's interests or behavior (e.g., viewing certain content, using functions, etc.) on individual websites are stored in a user profile. Such profiles serve to display content to users, for example, that corresponds to their potential interests. This procedure is also referred to as "tracking", i.e., tracking the users' potential interests. Insofar as we use cookies or "tracking" technologies, we inform you separately in our privacy policy or in the context of obtaining consent.
Notes on legal bases: The legal basis on which we process your personal data with the help of cookies depends on whether we ask you for consent. If this is the case and you consent to the use of cookies, the legal basis for processing your data is the given consent. Otherwise, the data processed with the help of cookies is processed on the basis of our legitimate interests (e.g., in the economic operation of our online offering and its improvement) or, if the use of cookies is necessary, to fulfill our contractual obligations.
General information on withdrawal and objection (opt-out): Depending on whether the processing is carried out on the basis of consent or a legal permission, you have the right at any time to withdraw a given consent or to object to the processing of your data by cookie technologies (collectively referred to as "opt-out"). You can initially express your objection using the settings of your browser, e.g., by disabling the use of cookies (which may also limit the functionality of our online offering). An objection to the use of cookies for online marketing purposes can also be made via a variety of services, especially in the case of tracking, via the websites
https://optout.aboutads.info and
https://www.youronlinechoices.com/. In addition, you may receive further objection information in the context of the details on the service providers used and the cookies.
Processing of cookie data on the basis of consent: Before we process data in the context of the use of cookies or have it processed, we ask users for consent which can be revoked at any time. Before consent is given, only cookies that are necessary for the operation of our online offering may be used. Their use is based on our interest and the users' interest in the expected functionality of our online offering.
Categories of data processed: Usage data (e.g., visited web pages, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
Data subjects: Users (e.g., website visitors, users of online services).
Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a DSGVO), legitimate interests (Art. 6 para. 1 sentence 1 lit. f. DSGVO).
We process data of our contractual and business partners, e.g., users and prospects (collectively referred to as "contractual partners"), in the context of contractual and comparable legal relationships as well as associated measures and in the context of communication with the contractual partners (or pre-contractually), e.g., to answer inquiries.
We process these data to fulfill our contractual obligations, to safeguard our rights and for purposes related to the administrative tasks associated with these details as well as corporate organization. We disclose contractual partners' data to third parties under applicable law only insofar as this is necessary for the aforementioned purposes or for the fulfillment of legal obligations or is done with the consent of the contractual partners (e.g., to involved telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Contractual partners are informed about further forms of processing, e.g., for marketing purposes, within the scope of this privacy notice.
Which data are required for the aforementioned purposes will be communicated to contractual partners before or at the time of data collection, e.g., in online forms, by special designation (e.g., colors) or symbols (e.g., asterisks or similar), or personally.
We delete the data after the expiry of statutory warranty and comparable obligations, i.e., generally after 4 years, unless the data are stored in a customer account, e.g., as long as they must be retained for legal archival reasons (e.g., for tax purposes generally 10 years). Data disclosed to us by the contractual partner in the context of an assignment will be deleted in accordance with the provisions of the assignment, generally after the end of the assignment.
If we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply in the relationship between the users and the providers.
User account: Contractual partners can create an account within our online offering (e.g., customer or user account, hereinafter "user account"). If registration of a user account is required, contractual partners will be informed accordingly, as well as about the information required for registration. The user accounts are public and can be indexed by search engines.
If users have cancelled their user account, the data relating to the user account will be deleted, subject to their retention being required for legal reasons or for the completion of an already incurred contractual obligation. It is the users' responsibility to back up their data upon termination of the user account.
Business analyses and market research: For business reasons and to be able to identify market trends and the wishes of contractual partners and users, we analyze the data available to us on business transactions, contracts, inquiries, etc., whereby the group of affected persons may include contractual partners, prospects, customers, visitors and users of our online offering.
The analyses are carried out for the purposes of business evaluations, marketing and market research (e.g., to identify customer groups with different characteristics). In doing so, we may, if available, take into account the profiles of registered users along with their details, e.g., regarding services used. The analyses serve only us and are not disclosed externally unless they are anonymous analyses with aggregated, i.e., anonymized values. Furthermore, we respect users' privacy and process the data for analysis purposes as pseudonymously as possible and, where feasible, anonymously (e.g., as aggregated data).
Shop and e-commerce: We process our customers' data to enable them to select, purchase, or order the chosen products, goods and related services, as well as their payment and delivery or execution.
The required information is identified as such during the ordering or comparable purchase process and includes the details necessary for delivery, provision and billing as well as contact information to be able to make any necessary inquiries.
Educational and training services: We process the data of participants in our educational and training offerings (collectively referred to as "trainees and continuing-education participants") in order to provide them with our training services. The data processed, the nature, scope, purpose and necessity of their processing are determined by the underlying contractual and training relationship. Forms of processing also include performance assessment and the evaluation of our services as well as those of the instructors.
In the course of our activities we may furthermore process special categories of data, in particular information on the health of the trainees and continuing-education participants as well as data from which ethnic origin, political opinions, religious or philosophical beliefs may be derived. For this purpose we obtain an explicit consent of the trainees and continuing-education participants where required and otherwise process the special categories of data only if it is necessary for the provision of the training services, for purposes of health care, social protection or the protection of the trainees' vital interests.
Where it is necessary for the performance of our contract, to protect vital interests or is legally required, or if consent of the trainees and continuing-education participants is given, we disclose or transmit the trainees' data to third parties or contractors, in compliance with professional regulatory requirements, such as authorities or service providers in the area of IT, office or comparable services.
Coaching: We process the data of our clients as well as prospects and other principals or contractual partners (collectively referred to as "clients") in order to provide them with our services. The data processed, the nature, scope, purpose and necessity of their processing are determined by the underlying contractual and client relationship.
In the course of our activities we may furthermore process special categories of data, in particular information on clients' health, possibly with reference to their sexual life or sexual orientation, as well as data from which racial and ethnic origin, political opinions, religious or philosophical beliefs or trade union membership may be derived. For this purpose we obtain an explicit consent of the clients where required and otherwise process the special categories of data insofar as this serves the clients' health, the data are public, or other legal permissions exist.
Where it is necessary for the performance of our contract, to protect vital interests or is legally required, or if consent of the clients is given, we disclose or transmit the clients' data in compliance with professional regulatory requirements to third parties or contractors, such as authorities, billing agencies as well as service providers in the area of IT, office or comparable services.
Consulting: We process the data of our clients, mandate holders as well as prospects and other principals or contractual partners (collectively referred to as "clients") in order to provide them with our consulting services. The data processed, the nature, scope, purpose and necessity of their processing are determined by the underlying contractual and client relationship.
Where it is necessary for the performance of our contract, to protect vital interests or is legally required, or if consent of the clients is given, we disclose or transmit the clients' data in compliance with professional regulatory requirements to third parties or contractors, such as authorities, subcontractors or service providers in the area of IT, office or comparable services.
Brokerage and mediation services: We process the data of our customers, clients and prospects (collectively referred to as "customers") in accordance with the customers' underlying mandate. We may furthermore process information on the characteristics and circumstances of persons or items belonging to them if this is part of our mandate. These may, for example, be information about personal life circumstances, movable or immovable property and the financial situation.If required for the fulfillment of the contract or by law, or consented to by the customers, or based on our legitimate interests, we disclose or transfer customers' data in the context of coverage inquiries, contract conclusions and the processing of contracts to providers of the mediated services/objects, insurers, reinsurers, broker pools, technical service providers, other service providers such as cooperating associations, as well as financial service providers, credit institutions and investment management companies, and social insurance institutions, tax authorities, tax advisors, trustees, legal advisers, auditors, insurance ombudsmen, Eidgenössische Finanzmarktaufsicht (Finma) of Switzerland and the Federal Financial Supervisory Authority (BaFin) in Germany. Furthermore, unless otherwise agreed, we may engage subcontractors, such as sub-intermediaries.
Project and development services: We process the data of our customers as well as principals (hereinafter collectively referred to as "customers") in order to enable them to select, purchase or commission the chosen services or works and associated activities, as well as their payment and provision or performance or delivery.
The required information is designated as such in the context of the order, purchase or comparable contract conclusion and includes the information necessary for the provision of services and billing as well as contact information to allow any necessary clarifications. To the extent that we obtain access to information about end customers, employees or other persons, we process these in accordance with statutory and contractual requirements.
Publication activities: We process the data of our contacts, interview partners and other persons who are the subject of our publishing, editorial and journalistic and related activities. In this context, we refer to the applicability of the protective provisions of freedom of expression and the press pursuant to Art. 85 DSGVO in conjunction with the respective national laws. The processing serves the fulfillment of our commissioned activities and otherwise takes place in particular on the basis of the public interest in information and media offerings.
Recruiting services: In the course of our services, which include in particular the search for potential job candidates, contacting them and their placement, we process the data of job candidates and the personal data of potential employers or their employees.
We process the information and contact details provided by job candidates for the purposes of establishing, performing and, if applicable, terminating a contract for job placement. In addition, we may, in accordance with legal provisions, contact interested parties at a later date with follow-up questions regarding the success of our placement service.
We process the data of job candidates as well as of employers to fulfill our contractual obligations, in order to handle the placement requests submitted to us to the satisfaction of the parties involved.
We may log placement processes in order to be able to demonstrate the existence of the contractual relationship and the consents of the interested parties in accordance with the statutory accountability obligations (Art. 5 Abs. 2 DSGVO). These details are stored for a period of three to four years should we need to prove the original request (e.g., to demonstrate the entitlement to contact the job candidates).
Offering of software and platform services: We process the data of our users, registered and any test users (hereinafter collectively referred to as "users") in order to provide our contractual services to them and on the basis of legitimate interests to ensure the security of our offering and to further develop it. The required information is designated as such in the context of the order, purchase or comparable contract conclusion and includes the information necessary for the provision of services and billing as well as contact information to allow any necessary clarifications.
Brokerage services: We process the information provided by interested parties in the course of an intermediation request for the purposes of establishing, performing and, if applicable, terminating a contract for the brokerage of offers from providers of the products or services requested by them.
We use the contact details of interested parties to specify their request via the agreed or otherwise permitted communication channel (e.g., telephone or e-mail) and to suggest suitable providers or offers on the basis of the specified request. In addition, in accordance with legal provisions, we may contact interested parties at a later date with follow-up questions regarding the success of our brokerage services.
We process the data of interested parties as well as of providers to fulfill our contractual obligations, in order to match the incoming requests of interested parties with the offers of providers that suit them and to forward them to the relevant providers or to propose the providers.
We may log the entries submitted in the online form by interested parties in order to be able to demonstrate the existence of the contractual relationship and the consents of the interested parties in accordance with the statutory accountability obligations (Art. 5 Abs. 2 DSGVO). These details are stored for a period of up to four years should we need to prove the original request (e.g., to demonstrate the entitlement to contact the interested parties).
Types of data processed: Account data (e.g., names, addresses), payment data (e.g., bank details, invoices, payment history), contact data (e.g., e-mail addresses, telephone numbers), contract data (e.g., subject matter of the contract, term, customer category), usage data (e.g., visited web pages, interest in content, access times), meta-/communication data (e.g., device information, IP addresses), applicant data (e.g., personal details, postal and contact addresses, application documents and the information contained therein, such as cover letters, CVs, references, as well as further information voluntarily provided by applicants regarding a specific position or their person or qualifications).
Special categories of personal data: Health data (Art. 9 Abs. 1 DGSVO), data concerning sex life or sexual orientation (Art. 9 Abs. 1 DGSVO), religious or philosophical beliefs (Art. 9 Abs. 1 DGSVO), data revealing racial and ethnic origin.
Data subjects: Interested parties, business and contractual partners, customers, applicants.
Purposes of processing: Contractual services and service, contact inquiries and communication, office and organizational procedures, administration and response to inquiries, security measures, analysis of visits and actions, interest-based and behavioral marketing, profiling (creation of user profiles), conversion measurement (measurement of the effectiveness of marketing measures).
Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b. DSGVO), legal obligation (Art. 6 Abs. 1 S. 1 lit. c. DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO), consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO).
https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de
Within the scope of contractual and other legal relationships, due to statutory obligations or otherwise on the basis of our legitimate interests, we offer the data subjects efficient and secure payment options and, in addition to banks and credit institutions, use further payment service providers for this purpose (collectively "payment service providers").The data processed by the payment service providers include basic/registration data, such as name and address, banking data, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract-, amount- and recipient-related information. The information is required to carry out the transactions. However, the data entered are processed and stored only by the payment service providers. That is, we do not receive any account- or credit card-related information, but only information confirming or denying the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit reporting agencies. This transmission serves the purpose of identity and creditworthiness checks. For this we refer to the AGB and the privacy notices of the payment service providers.
The payment transactions are subject to the terms and conditions and the privacy notices of the respective payment service providers, which are available on their respective websites or within the transaction applications. We likewise refer to these for further information and for asserting rights of withdrawal, access and other data subject rights.
Processed categories of data: account/registration data (e.g., names, addresses), payment data (e.g., bank details, invoices, payment history), contract data (e.g., subject matter of the contract, term, customer category), usage data (e.g., visited web pages, interest in content, access times), meta-/communication data (e.g., device information, IP addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., text entries, photographs, videos).
Data subjects: customers, prospective customers, users (e.g., website visitors, users of online services).
Purposes of processing: contractual services and service, tracking (e.g., interest-/behavior-based profiling, use of cookies), feedback (e.g., collecting feedback via online form), contact inquiries and communication, affiliate tracking.
Legal bases: performance of a contract and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b. DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO), consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO).
Services used and service providers:
PayPal: payment services and solutions (e.g., PayPal, PayPal Plus, Braintree); service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Website: https://www.paypal.com/de; Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
If we advance payment or assume comparable economic risks (e.g., for purchase on account), we reserve the right, in order to protect our legitimate interests, to obtain identity and creditworthiness information for the purpose of assessing the credit risk on the basis of mathematical-statistical procedures from service companies specialized in this field (credit reporting agencies).
We process the information received from the credit reporting agencies regarding the statistical probability of a payment default as part of an appropriate discretionary decision concerning the establishment, performance and termination of the contractual relationship. We reserve the right, in the event of a negative result of the credit check, to refuse payment on account or any other advance service.
The decision as to whether we advance payment is made, in accordance with Art. 22 DSGVO, solely on the basis of an automated individual decision taken by our software on the basis of the report from the credit reporting agency.
If we obtain an explicit consent from contracting parties, the legal basis for the credit report and the transmission of the customer's data to the reporting agencies is consent. If no consent is obtained, the credit report is carried out on the basis of our legitimate interests in the security of our payment claims.
Processed categories of data: account/registration data (e.g., names, addresses), payment data (e.g., bank details, invoices, payment history), contact data (e.g., e-mail, telephone numbers), contract data (e.g., subject matter of the contract, term, customer category).
Data subjects: customers, prospective customers.
Purposes of processing: assessment of creditworthiness and solvency.
Legal bases: consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
Automated individual decisions: credit report (decision based on a credit check).
Services used and service providers:
CRIF AG (Switzerland): credit reporting agency; service provider: CRIF AG, Hagenholzstrasse 81, 8050 Zurich, Switzerland; Website: https://www.crif.ch/; Privacy Policy: https://www.crif.ch/datenschutz/.
SCHUFA: credit reporting agency; service provider: SCHUFA Holding AG, Privatkunden ServiceCenter, Postfach 10 34 41, 50474 Cologne, Germany; Website: https://www.schufa.de/de/; Privacy Policy: https://www.schufa.de/de/datenschutz/.
In order to be able to provide our online offering securely and efficiently, we use the services of one or more web hosting providers from whose servers (or servers managed by them) the online offering can be retrieved. For these purposes we may use infrastructure and platform services, computing capacity, storage space and database services as well as security services and technical maintenance services.
The data processed in the context of providing the hosting offering may include all information relating to the users of our online offering that is generated in the context of use and communication. These regularly include the IP address, which is necessary to deliver the content of online offerings to browsers, and all inputs made within our online offering or on web pages.
E-mail sending and hosting: The web hosting services we use also include the sending, receiving and storage of e-mails. For these purposes the addresses of recipients and senders as well as further information concerning the sending of e-mails (e.g., the providers involved) and the contents of the respective e-mails are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that e-mails are generally not sent encrypted over the Internet. As a rule, e-mails are encrypted during transport, but (unless an end-to-end encryption method is used) not on the servers from which they are sent and received. We therefore cannot accept responsibility for the transmission path of e-mails between the sender and the reception on our server.
Collection of access data and log files: We ourselves (or our web hosting provider) collect data on every access to the server (so-called server log files). The server log files may include the address and name of the retrieved web pages and files, date and time of access, amount of data transferred, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider.
The server log files can be used, on the one hand, for security purposes, e.g., to prevent overloading of the servers (especially in the case of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure server load and stability.
We process the data of the users of our application to the extent necessary to provide the application and its functionalities to the users, to monitor their security and to further develop them. We may also contact users in compliance with the statutory provisions if communication is necessary for the administration or use of the application. Otherwise, with regard to the processing of the users' data we refer to the privacy notices in this privacy policy.Legal bases: The processing of data that is necessary for providing the application's functionalities serves to fulfill contractual obligations. This also applies when the provision of the functions requires authorization by the users (e.g., enabling device functions). If the processing of data for providing the application's functionalities is not necessary, but serves the security of the application or our business interests (e.g., collection of data for the purpose of optimizing the application or for security purposes), it is carried out on the basis of our legitimate interests. If users are expressly asked for their consent to the processing of their data, the processing of the data covered by the consent is carried out on the basis of the consent.
Commercial use: We process the data of users of our application, registered and any test users (hereinafter collectively referred to as "users"), in order to be able to provide our contractual services to them and on the basis of legitimate interests in order to ensure the security of our application and to further develop it. The required information is marked as such in the context of usage, order, purchase or comparable contract conclusion and may include the information necessary for service provision and any billing as well as contact information to enable any necessary follow-up communications.
Storage of a universal and unique identifier (UUID): The application stores for purposes of analyzing the usage and functionality of the application as well as storing users' settings a so-called universal and unique identifier ("Universally Unique Identifier", UUID). This identifier is generated upon installation of this application, remains stored between the application launches and its updates, and is deleted when users remove the application from their device.
Device permissions for access to functions and data: The use of our application or its functionalities may require permissions from users for access to certain functions of the devices used or to data stored on or accessible via the devices. By default, these permissions must be granted by the users and can be revoked at any time in the settings of the respective devices. The exact procedure for controlling app permissions may depend on the user's device and software. If clarification is needed, users may contact us. We point out that refusal or revocation of the respective permissions may affect the functionality of our application.
Access to the camera and stored recordings: In the course of using our application, image and/or video recordings (which also include audio recordings) of the users (and of other persons captured by the recordings) are processed by accessing the camera functions or stored recordings. Access to the camera functions or stored recordings requires a permission from the users that can be revoked at any time. The processing of the image and/or video recordings serves solely to provide the respective functionality of our application, in accordance with its description to the users, or its typical and expected operation.
Use of microphone functions: In the course of using our application, the microphone functions and the audio recordings captured thereby are processed. The use of the microphone functions requires a permission from the users which can be revoked at any time. The use of the microphone functions and audio data serves solely to provide the respective functionality of our application, in accordance with its description to the users, or its typical and expected operation.
Processing of stored contacts: In the course of using our application, the contact information of persons stored in the device's contact directory (name, e-mail address, telephone number) is processed. The use of the contact information requires a permission from the users which can be revoked at any time. The use of the contact information serves solely to provide the respective functionality of our application, in accordance with its description to the users, or its typical and expected operation. Users are informed that the authorization for processing the contact information must be lawful and in particular, for natural persons, requires their consent or a statutory permission.
Use of contact data for the purpose of contact matching: The data of contacts stored in the device's contact directory may be used to check whether these contacts also use our application. For this purpose, the contact data of the respective contacts (including the telephone number and e-mail address as well as the names) are uploaded to our server and used only for the purpose of matching.
Processing of location data: In the course of using our application, location data collected by the device used or otherwise entered by users are processed. The use of location data requires a permission from the users which can be revoked at any time. The use of location data serves solely to provide the respective functionality of our application, in accordance with its description to the users, or its typical and expected operation.
Location history and movement profiles: Based on the location data collected in the course of using our application, a location history is created from which the geographic movements of the devices used over a period of time can be inferred (and which may permit conclusions to be drawn about the users' movement profiles). The location history serves only to provide the respective functionality of our application, in accordance with its description to the users, or its typical and expected operation.
Types of data processed: Inventory data (e.g., names, addresses), meta/communication data (e.g., device information, IP addresses), payment data (e.g., bank details, invoices, payment history), contract data (e.g., subject matter of the contract, duration, customer category), image and/or video recordings (e.g., photographs or video recordings of a person), audio recordings, location data (data that indicate the location of an end user's device), location history and movement profiles (collection of location data and changes of position over a certain period).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Contractual services and service.
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), performance of a contract and pre-contractual enquiries (Art. 6 Abs. 1 S. 1 lit. b. DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
Procedures referred to as "Single-Sign-On" or "Single-Sign-On login / authentication" are processes that allow users to sign in to our online offering by means of a user account with a Single-Sign-On provider (e.g., a social network). A prerequisite for Single-Sign-On authentication is that users are registered with the respective Single-Sign-On provider and enter the required access data into the designated online form, or are already logged in with the Single-Sign-On provider and confirm the Single-Sign-On login via a button.Authentication takes place directly with the respective single sign-on provider. As part of such authentication we receive a user ID with the information that the user is logged in under this user ID at the respective single sign-on provider and an ID that cannot be used by us for other purposes (so-called "User Handle"). Whether additional data is transmitted to us depends solely on the single sign-on method used, on the data-sharing choices made as part of the authentication and also on which data users have released in the privacy or other settings of their user account with the single sign-on provider. Depending on the single sign-on provider and the choices of the users, various data may be provided; as a rule these are the e-mail address and the username. The password entered with the single sign-on provider as part of the single sign-on procedure is neither visible to us nor is it stored by us.
Users are asked to note that the information they have stored with us may be automatically synchronized with their user account at the single sign-on provider, but this is not always possible or does not necessarily occur. If, for example, users' e-mail addresses change, they must change them manually in their user account with us.
We can use the single sign-on login, if agreed with the users, in the course of or prior to the performance of the contract; if the users have been asked for this, we process [their data] on the basis of consent and otherwise use it on the basis of our legitimate interests and the users' interests in an effective and secure login system.
If users decide that they no longer want to use the linking of their user account at the single sign-on provider for the single sign-on procedure, they must remove this connection within their user account at the single sign-on provider. If users want their data deleted with us, they must cancel their registration with us.
Processed data categories: Registration data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Contractual services and support, login procedures.
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), performance of a contract and pre-contractual enquiries (Art. 6 Abs. 1 S. 1 lit. b. DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
Services and service providers used:
LinkedIn Single-Sign-On: Authentication service; Service provider: LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA USA; Website:
https://www.linkedin.com; Privacy policy:
https://www.linkedin.com/legal/privacy-policy; Privacy Shield (Gewährleistung Datenschutzniveau bei Verarbeitung von Daten in den USA):
https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&;status=Active
We use blogs or comparable means of online communication and publication (hereinafter "publication medium"). Readers' data are processed for the purposes of the publication medium only to the extent necessary for its presentation and for communication between authors and readers or for reasons of security. Otherwise, we refer to the information on the processing of visitors to our publication medium within these privacy notes.
Comments and contributions: When users leave comments or other contributions, their IP addresses may be stored on the basis of our legitimate interests. This is done for our security in case someone posts unlawful content in comments and contributions (insults, prohibited political propaganda etc.). In such a case we ourselves may be held liable for the comment or contribution and are therefore interested in the identity of the author.
Furthermore, we reserve the right to process users' information for the purpose of spam detection on the basis of our legitimate interests.
On the same legal basis we reserve the right to store users' IP addresses for the duration of surveys and to use cookies to prevent multiple votes.
The personal information provided in connection with comments and contributions, any contact and website information as well as the substantive information will be stored by us permanently until the users object.
Processed data categories: Registration data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., text entries, photographs, videos), usage data (e.g., visited websites, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Contractual services and support, feedback (e.g., collecting feedback via online form), security measures, administration and answering of enquiries.
Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6 Abs. 1 S. 1 lit. b. DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO), consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), protection of vital interests (Art. 6 Abs. 1 S. 1 lit. d. DSGVO).
When contacting us (e.g., via contact form, e-mail, telephone or via social media), the details of the persons making enquiries are processed insofar as this is necessary to answer the enquiries and any requested measures.
The answering of contact enquiries within the framework of contractual or pre-contractual relationships is carried out to fulfil our contractual obligations or to answer (pre-)contractual enquiries and otherwise on the basis of legitimate interests in responding to the enquiries.
Processed data categories: Registration data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers), content data (e.g., text entries, photographs, videos), usage data (e.g., visited websites, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
Data subjects: Communication partners.
Purposes of processing: Contact enquiries and communication, administration and answering of enquiries.
Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6 Abs. 1 S. 1 lit. b. DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
We use messengers for purposes of communication and therefore ask you to note the following information regarding the functionality of the messengers, encryption, the use of communication metadata and your options to object.
You can also contact us by alternative means, e.g., by telephone or e-mail. Please use the contact options provided to you or those stated within our online offering.
In the case of end-to-end encryption of contents (i.e., the content of your message and attachments) we point out that the communication contents (i.e., the content of the message and attached images) are encrypted end-to-end. This means that the content of the messages is not accessible, not even by the messenger providers themselves. You should always use an up-to-date version of the messenger with encryption enabled so that the encryption of the message contents is ensured.
We additionally point out to our communication partners that while the messenger providers cannot view the content, they can determine that and when communication partners communicate with us and process technical information about the device used by the communication partners and, depending on the settings of their device, also location information (so-called metadata).
Notes on legal bases: If we ask communication partners for permission before communicating with them via messenger, the legal basis for our processing of their data is their consent. Otherwise, if we do not ask for consent and they, for example, contact us of their own accord, we use messengers in relation to our contractual partners and in the context of contract initiation as a contractual measure and, in the case of other interested parties and communication partners, on the basis of our legitimate interests in quick and efficient communication and in meeting our communication partners' needs to communicate via messenger. Furthermore, please note that we do not transmit contact details provided to us to the messengers for the first time without your consent.Revocation, objection and deletion: You may revoke any consent you have given at any time and object to communication with us via messenger at any time. In the case of communication via messenger, we delete the messages in accordance with our general deletion policies (i.e., e.g., as described above, after the end of contractual relationships, in the context of archiving requirements, etc.) and otherwise as soon as we can assume that any information requested from the communication partners has been answered, when no reference to a previous conversation is to be expected and deletion is not prevented by statutory retention obligations.
Reservation of reference to other communication channels: Finally, we wish to point out that, for your security, we reserve the right not to answer inquiries via messenger. This is the case, for example, when contractual matters require special confidentiality or when a reply via messenger does not meet formal requirements. In such cases we will refer you to more appropriate communication channels.
Skype: Skype’s end-to-end encryption requires its activation (unless it is activated by default).
Types of data processed: Contact data (e.g., e-mail, telephone numbers), usage data (e.g., visited web pages, interest in content, access times), meta/communication data (e.g., device information, IP addresses), content data (e.g., text entries, photographs, videos).
Data subjects: Communication partners.
Purposes of processing: Contact requests and communication, direct marketing (e.g., by e-mail or post).
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
Services used and service providers:
Microsoft Teams: Microsoft Teams - messenger; service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; website:
https://products.office.com; Privacy statement:
https://privacy.microsoft.com/de-de/privacystatement, Security information:
https://www.microsoft.com/de-de/trustcenter; Privacy Shield (guarantee of data protection level when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt0000000KzNaAAK&;status=Active.
We offer online chats and chatbot functions as a means of communication (together referred to as "chat services"). A chat is an online conversation conducted with a certain degree of immediacy. A chatbot is software that answers users’ questions or informs them via messages. If you use our chat functions, we may process your personal data.
If you use our chat services within an online platform, your identification number within the respective platform will also be stored. We may also collect information about which users interact with our chat services and when. Furthermore, we store the content of your conversations via the chat services and log registration and consent processes in order to be able to demonstrate them in accordance with legal requirements.
We point out to users that the respective platform provider may ascertain that and when users communicate with our chat services, as well as technical information about the device used by the users and, depending on their device settings, also location information (so‑called metadata) for the purposes of optimizing the respective services and for security purposes. The metadata of communication via chat services (i.e., e.g., the information about who communicated with whom) could also be used by the respective platform providers, in accordance with their provisions, to which we refer for further information, for marketing purposes or to display personalized advertising to users.
If users agree with a chatbot to activate information by regular messages, they have the option at any time to unsubscribe from the information for the future. The chatbot informs users how and with which terms they can unsubscribe from the messages. When unsubscribing from the chatbot messages, users’ data are deleted from the directory of message recipients.
We use the aforementioned information to operate our chat services, e.g., to address users personally, to answer their inquiries, to transmit any requested content and also to improve our chat services (e.g., to “teach” chatbots answers to frequently asked questions or to identify unanswered inquiries).
Notes on legal bases: We use the chat services on the basis of consent when we have previously obtained the users’ permission to process their data in the context of our chat services (this applies in cases where users are asked for consent, e.g., so that a chatbot can send them regular messages). If we use chat services to answer users’ inquiries about our services or our company, this is carried out for contractual and pre-contractual communication. Otherwise, we use chat services on the basis of our legitimate interests in optimizing the chat services, their economic viability and increasing the positive user experience.
Revocation, objection and deletion: You may revoke any consent you have given at any time or object to the processing of your data within the scope of our chat services.
Types of data processed: Contact data (e.g., e-mail, telephone numbers), content data (e.g., text entries, photographs, videos), usage data (e.g., visited web pages, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
Data subjects: Communication partners.
Purposes of processing: Contact requests and communication, direct marketing (e.g., by e-mail or post).
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
With the users’ consent, we can send so-called "push notifications" to users. These are messages that are displayed on users’ screens, devices or in browsers, even when our online service is not currently being actively used.
To subscribe to push notifications, users must confirm their browser’s or device’s query to receive push notifications. This consent process is documented and stored. The storage is necessary in order to determine whether users have consented to receive push notifications and to be able to demonstrate the consent. For these purposes, a pseudonymous identifier of the browser (so‑called "push token") or the device ID of an end device is stored.
Push notifications can, on the one hand, be necessary for the fulfillment of contractual obligations (e.g., technical and organizational information relevant to the use of our online offering) and otherwise, unless otherwise specified below, are sent on the basis of the users’ consent. Users can change the reception of push notifications at any time using the notification settings of their respective browsers or devices.
Location-based delivery of push notifications: The push notifications we send can be displayed depending on the users’ location based on the location data transmitted by the device used.
Analysis and performance measurement: We evaluate push notifications statistically and can thus determine whether and when push notifications were displayed and clicked. This information is used to technically improve our push notifications based on the technical data or the target groups and their retrieval behavior or retrieval times. This analysis also includes determining whether the push notifications are opened, when they are opened and whether users interact with their content or buttons. For technical reasons, this information can be assigned to individual push notification recipients. However, neither our aim nor, where used, that of the push notification service provider is to monitor individual users. The evaluations serve instead to recognize our users’ usage habits and to adapt our push notifications to them or to send different push notifications according to our users’ interests.The evaluation of push notifications and the measurement of success are carried out on the basis of an explicit consent of the users, which is given by agreeing to receive the push notifications. Users can object to the analysis and success measurement by unsubscribing from the push notifications. A separate revocation of the analysis and success measurement is unfortunately not possible.
Contents:
- Information about us, our services, promotions and offers.
- References to the latest posts and comments."
- Technical notes and changes to our application and its functions."
Types of data processed: Location data (data that indicate the location of an end user’s device), Usage data (e.g., visited web pages, interest in content, access times).
Purposes of processing: Contractual services and service, reach measurement (e.g., access statistics, detection of returning visitors).
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), performance of a contract and pre-contractual enquiries (Art. 6 Abs. 1 S. 1 lit. b. DSGVO).
We use platforms and applications of other providers (hereinafter referred to as “third parties”) for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings. When selecting the third parties and their services, we take the legal requirements into account.
In this context, data of the communication participants are processed and stored on the servers of the third parties to the extent that these are part of communication procedures with us. These data can in particular include registration and contact data, visual as well as vocal contributions, entries in chats and shared screen contents.
If users are referred to the third parties, or to their software or platforms, in the context of communication, business or other relationships with us, the third parties may process usage data and metadata for security purposes, service optimization or marketing purposes. We therefore ask that you please observe the privacy notices of the respective third parties.
Notes on legal bases: If we ask users for their consent to the use of the third parties or certain functions (e.g., consent to a recording of conversations), the legal basis for processing is consent. Furthermore, their use may be part of our (pre-)contractual services, insofar as the use of the third parties has been agreed in that context.
Otherwise, users’ data are processed on the basis of our legitimate interests in efficient and secure communication with our communication partners. In this context, we would also like to refer you to the information on the use of cookies in this privacy notice.
Types of data processed: Master data (e.g., names, addresses), Contact data (e.g., email addresses, telephone numbers), Content data (e.g., text entries, photographs, videos), Usage data (e.g., visited web pages, interest in content, access times), Meta-/communication data (e.g., device information, IP addresses).
Data subjects: Communication partners, users (e.g., website visitors, users of online services).
Purposes of processing: Contractual services and service, contact enquiries and communication, office and organizational procedures, direct marketing (e.g., by email or post).
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), performance of a contract and pre-contractual enquiries (Art. 6 Abs. 1 S. 1 lit. b. DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
Services used and service providers:
Microsoft Teams: Messaging and conferencing software; Service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Website: https://products.office.com; Datenschutzerklärung: https://privacy.microsoft.com/de-de/privacystatement, Sicherheitshinweise: https://www.microsoft.com/de-de/trustcenter; Privacy Shield (assurance of the level of data protection when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000KzNaAAK&;status=Active.
The application procedure requires applicants to provide the data necessary for their assessment and selection. Which information is required is set out in the job description or, in the case of online forms, in the information provided there.
In principle, the required details include personal information such as name, address, a contact option, and evidence of the qualifications necessary for a position. Upon request, we will be happy to inform which details are required.
If made available, applicants can submit their applications to us by means of an online form. The data are transmitted to us encrypted in accordance with the state of the art. Applicants can also submit their applications to us by email. Please note, however, that emails are generally not sent encrypted over the Internet. As a rule, emails are encrypted in transit, but not on the servers from which they are sent and received. We therefore cannot assume responsibility for the transmission route of the application between the sender and its receipt on our server.
For the purposes of applicant search, submission of applications and selection of applicants, we may, in compliance with the legal requirements, use applicant management and recruitment software and platforms and services of third-party providers.
Applicants are welcome to contact us regarding the manner of submitting their application or to send their application to us by postal mail.
Processing of special categories of data: Insofar as, in the context of the application procedure, special categories of personal data within the meaning of Art. 9 Abs. 1 DSGVO (e.g., health data, such as severe disability status or ethnic origin) are requested from applicants so that the controller or the data subject can exercise rights arising from employment law and the law on social security and social protection and can comply with their related obligations, their processing shall take place pursuant to Art. 9 Abs. 2 lit. b. DSGVO, in the case of protecting the vital interests of the applicants or other persons pursuant to Art. 9 Abs. 2 lit. c. DSGVO, or for purposes of preventive or occupational medicine, for the assessment of the employee’s working capacity, for medical diagnosis, for the provision or treatment in the health or social care sector or for the management of systems and services in the health or social care sector pursuant to Art. 9 Abs. 2 lit. h. DSGVO. In the case of voluntary disclosure of special categories of data based on consent, their processing is carried out on the basis of Art. 9 Abs. 2 lit. a. DSGVO.
Deletion of data: The data provided by applicants may, in the event of a successful application, be further processed by us for the purposes of the employment relationship. Otherwise, if the application for a job vacancy is unsuccessful, the applicant’s data will be deleted. Applicant data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Deletion will take place, subject to a justified obligation to retain by the applicants, at the latest after the expiry of a period of six months so that we can respond to any follow-up questions regarding the application and fulfil our documentation obligations arising from provisions on equal treatment of applicants. Invoices for any travel expense reimbursement will be archived in accordance with tax law requirements.
Inclusion in an applicant pool: Inclusion in an applicant pool, if offered, is based on consent. Applicants are informed that their consent to inclusion in the talent pool is voluntary, has no influence on the ongoing application procedure and that they may withdraw their consent at any time for the future.
Retention period of data in the applicant pool in months: 12
Types of data processed: Applicant data (e.g., personal details, postal and contact addresses, the documents belonging to the application and the information contained therein, such as cover letter, curriculum vitae, certificates as well as further information provided by applicants regarding a specific position or voluntarily about their person or qualifications).
Data subjects: Applicants.Purposes of processing: application procedure (establishment and any subsequent implementation as well as possible later termination of the employment relationship.).
Legal bases: Art. 9 Abs. 1 S. 1 lit. b DSGVO (application procedure as a pre-contractual or contractual relationship) (To the extent that special categories of personal data within the meaning of Art. 9 Abs. 1 DSGVO (e.g. health data, such as severe disability status or ethnic origin) are requested from applicants as part of the application procedure so that the controller or the data subject can exercise the rights arising for them from employment law and the law of social security and social protection and can fulfil their related obligations, their processing takes place pursuant to Art. 9 Abs. 2 lit. b. DSGVO, in the event of the protection of the vital interests of the applicants or other persons pursuant to Art. 9 Abs. 2 lit. c. DSGVO or for purposes of preventive or occupational medicine, for the assessment of the employee’s capacity to work, for medical diagnosis, care or treatment in the health or social sector or for the management of systems and services in the health or social sector pursuant to Art. 9 Abs. 2 lit. h. DSGVO. In the event of disclosure of special categories of data on the basis of a voluntary consent, their processing is based on Art. 9 Abs. 2 lit. a. DSGVO.).
Services and service providers used:
Xing: Service provider: XING AG, Dammtorstrasse 29-32, 20354 Hamburg, Germany; Website: https://www.xing.com; Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung.
LinkedIn: Service provider: LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA USA; Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Privacy Shield (guarantee of data protection level when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&;status=Active
We use software services accessible via the Internet and executed on the servers of their providers (so-called "cloud services", also referred to as "software as a service") for the following purposes: document storage and management, calendar management, email dispatch, spreadsheets and presentations, sharing documents, content and information with specific recipients or publishing web pages, forms or other content and information as well as chats and participation in audio and video conferences.
In this context, personal data may be processed and stored on the providers' servers insofar as these are part of communications with us or otherwise processed by us as set out in this privacy policy. These data may in particular include master data and contact data of users, data about transactions, contracts, other processes and their contents. The providers of the cloud services also process usage data and metadata, which they use for security purposes and to optimize the service.
If we provide forms or similar documents and content via the cloud services for other users or publicly accessible websites, the providers may store cookies on the users' devices for the purpose of web analysis or to remember users' settings (e.g., in the case of media controls).
Notes on legal bases: If we ask for consent to the use of the cloud services, the legal basis for processing is the consent. Furthermore, their use may be part of our (pre-)contractual services, provided that the use of the cloud services has been agreed in this context. Otherwise, users' data are processed on the basis of our legitimate interests (i.e., interest in efficient and secure administrative and collaboration processes).
Types of data processed: Master data (e.g., names, addresses), contact data (e.g., email, telephone numbers), content data (e.g., text entries, photographs, videos), usage data (e.g., visited web pages, interest in content, access times), meta-/communication data (e.g., device information, IP addresses).
Data subjects: Customers, employees (e.g., staff, applicants, former employees), prospects, communication partners.
Purposes of processing: office and organizational procedures.
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), performance of a contract and pre-contractual enquiries (Art. 6 Abs. 1 S. 1 lit. b. DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
Services and service providers used:
Microsoft cloud services: cloud storage services; Service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Website: https://microsoft.com/de-de; Privacy statement: https://privacy.microsoft.com/de-de/privacystatement, Security information: https://www.microsoft.com/de-de/trustcenter; Privacy Shield (guarantee of data protection level when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000KzNaAAK&;status=Active.
Typeform Service provider: TYPEFORM S.L., Passatge de la Pau 10 Bis, 1–2, Spain. Website: https://www.typeform.com/ Privacy policy: https://admin.typeform.com/to/dwk6gt .
We send newsletters, emails and other electronic notifications (hereinafter "newsletters") only with the consent of the recipients or a legal permission. If, in the context of registering for the newsletter, its contents are specifically described, they are decisive for the users' consent. Otherwise our newsletters contain information about our services and about us.
To register for our newsletters it is generally sufficient to provide your email address. We may, however, ask you for a name for the purpose of personal addressing in the newsletter, or for further information if this is required for the purposes of the newsletter.
Double opt-in procedure: Registration for our newsletter is generally carried out using a so-called double opt-in procedure. That is, after registration you will receive an email in which you are asked to confirm your registration. This confirmation is necessary so that no one can register with someone else's email address. Newsletter registrations are logged in order to be able to demonstrate the registration process in accordance with legal requirements. This includes the storage of the registration and confirmation times as well as the IP address. Changes to your data stored with the sending service provider are also logged.
Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them, in order to be able to prove a formerly given consent. The processing of these data is restricted to the purpose of possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of a consent is simultaneously confirmed. In the case of obligations to observe objections permanently, we reserve the right to store the email address solely for this purpose in a suppression list (so-called «Blacklist»).
The logging of the registration procedure is carried out on the basis of our legitimate interests for the purposes of proving that it was carried out properly. If we engage a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure dispatch system.
Notes on legal bases: The sending of the newsletters is based on the consent of the recipients or, if consent is not required, on our legitimate interests in direct marketing, insofar as and to the extent that this is legally permitted, e.g. in the case of advertising to existing customers. If we commission a service provider with the sending of emails, this is done on the basis of our legitimate interests. The registration procedure is recorded on the basis of our legitimate interests in order to prove that it was carried out in accordance with the law.
Contents: Information about us, our services, promotions and offers.Analysis and performance measurement: The newsletters contain a so-called "web-beacon", i.e., a pixel-sized file that is retrieved from our server when the newsletter is opened, or, if we use a mailing service provider, from that provider's server. As part of this retrieval, technical information is initially collected, such as information about the browser and your system, as well as your IP address and the time of retrieval.
This information is used to technically improve our newsletter based on the technical data, or to determine target groups and their reading behavior based on their retrieval locations (which can be determined with the help of the IP address) or access times. This analysis also includes determining whether the newsletters are opened, when they are opened, and which links are clicked. For technical reasons, these pieces of information can be assigned to individual newsletter recipients. However, it is neither our intention nor, if used, that of the mailing service provider to monitor individual users. Rather, the evaluations serve to recognize our users' reading habits and to adapt our content to them or to send different content according to our users' interests.
The evaluation of the newsletter and the performance measurement are carried out, subject to the users' express consent, on the basis of our legitimate interests for the purpose of using a user-friendly and secure newsletter system that serves both our business interests and the expectations of the users.
A separate revocation of the performance measurement is unfortunately not possible; in that case the entire newsletter subscription must be cancelled or the subscription must be unsubscribed.
Types of data processed: Registration data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers), meta/communication data (e.g., device information, IP addresses), usage data (e.g., visited websites, interest in content, access times).
Data subjects: Communication partners.
Purposes of processing: Direct marketing (e.g., by e-mail or by post).
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
Right to object (Opt-Out): You can cancel receipt of our newsletter at any time, i.e., withdraw your consents or object to further receipt. A link to cancel the newsletter can be found either at the end of each newsletter or you can otherwise use one of the contact options given above, preferably e-mail, for this purpose.
Services used and service providers:
Mailchimp: E-mail marketing platform; service provider: "Mailchimp" - Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA; Website: https://mailchimp.com; Privacy Policy: https://mailchimp.com/legal/privacy/; Privacy Shield (assurance of data protection level when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&;status=Active.
We process personal data for the purposes of promotional communication, which can be carried out via various channels, such as e-mail, telephone, post or fax, in accordance with legal requirements.
Recipients have the right to withdraw consents given at any time or to object to promotional communication at any time.
After withdrawal or objection, we may, on the basis of our legitimate interests, store the data required to prove the consent for up to three years before deleting them. The processing of these data is limited to the purpose of possible defense against claims. An individual deletion request is possible at any time, provided that the former existence of a consent is simultaneously confirmed.
Types of data processed: Registration data (e.g., names, addresses), contact data (e.g., e-mail, telephone numbers).
Data subjects: Communication partners.
Purposes of processing: Direct marketing (e.g., by e-mail or by post).
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
We process personal data of participants in contests and competitions only in compliance with the applicable data protection provisions, insofar as the processing is contractually necessary for the provision, implementation and settlement of the contest, the participants have consented to the processing, or the processing serves our legitimate interests (e.g., in the security of the contest or in protecting our interests against abuse by, for example, recording IP addresses when contest entries are submitted).
If participants' entries are published as part of the contests (e.g., as part of a vote or presentation of contest entries or winners or in reporting on the contest), we point out that the names of the participants may also be published in this context. Participants may object to this at any time.
If the contest takes place within an online platform or a social network (e.g., Facebook or Instagram, hereinafter referred to as "online platform"), the terms of use and privacy policies of the respective platforms also apply. In such cases, we point out that we are responsible for the information provided by the participants in the context of the contest and that enquiries regarding the contest should be addressed to us.
Participants' data are deleted as soon as the contest or competition has ended and the data are no longer necessary to inform the winners or because follow-up questions regarding the contest are to be expected. As a rule, participants' data are deleted no later than 6 months after the end of the contest. Winners' data may be retained longer in order, for example, to answer queries about the prizes or to fulfill the prizes; in such cases the retention period depends on the nature of the prize and is, for example, up to three years for goods or services in order to be able to process warranty cases. Furthermore, participants' data may be stored for a longer period, e.g., in the form of reporting on the contest in online and offline media.
If data were also collected for other purposes in connection with the contest, their processing and retention period are governed by the privacy notices for that use (e.g., in the case of signing up for the newsletter as part of a contest).
Types of data processed: Registration data (e.g., names, addresses), content data (e.g., text entries, photographs, videos).
Data subjects: Contest and competition participants.
Purposes of processing: Conducting contests and competitions.
Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6 Abs. 1 S. 1 lit. b. DSGVO).
The surveys and questionnaires conducted by us (hereinafter "surveys") are evaluated anonymously. Personal data are processed only to the extent necessary for the provision and technical execution of the surveys (e.g., processing the IP address in order to display the survey in the user's browser or using a temporary cookie (session cookie) to allow the survey to be resumed) or users have given consent.
Notes on legal bases: If we ask participants for consent to the processing of their data, this is the legal basis for the processing; otherwise the processing of participants' data is carried out on the basis of our legitimate interests in conducting an objective survey.
Types of data processed: Contact data (e.g., e-mail, telephone numbers), content data (e.g., text entries, photographs, videos), usage data (e.g., visited websites, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
Data subjects: Communication partners, users (e.g., website visitors, users of online services).
Purposes of processing: Contact enquiries and communication, direct marketing (e.g., by e-mail or by post), feedback (e.g., collecting feedback via online form), tracking (e.g., interest-/behavior-based profiling, use of cookies).
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
Services used and service providers:
Typeform Service provider: TYPEFORM S.L., Passatge de la Pau 10 Bis, 1–2, Spain. Website: https://www.typeform.com/ Privacy Policy:https://admin.typeform.com/to/dwk6gt .
Web analysis (also referred to as "reach measurement") is used to evaluate the visitor flows of our online offering and may include behavior, interests or demographic information about the visitors, such as age or gender, as pseudonymous values. With the help of reach analysis, for example, we can determine at what times our online offering or its functions or content are used most frequently or invite reuse. We can also trace which areas require optimization.
In addition to web analysis, we may also use testing procedures to, for example, test and optimize different versions of our online offering or its components.
For these purposes, so-called user profiles may be created and stored in a file (so-called "Cookie") or similar procedures with the same purpose may be used. Such information may include, for example, viewed content, visited web pages and elements used there, and technical information such as the browser used, the computer system used, as well as information about usage times. If users have consented to the collection of their location data, these may also be processed depending on the provider.
Users' IP addresses are also stored. However, we use an IP-masking procedure (i.e., pseudonymization by truncating the IP address) to protect users. In general, no clear identifying data of users (such as e-mail addresses or names) are stored in the context of web analysis, A/B testing and optimization, but pseudonyms. That means we as well as the providers of the software used do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.
Notes on legal bases: If we ask users for their consent to the use of third parties, the legal basis for the processing of data is consent. Otherwise, users' data are processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.
Types of data processed: Usage data (e.g., visited web pages, interest in content, access times), meta-/communication data (e.g., device information, IP addresses).
Data subjects: Users (e.g., website visitors, users of online services).
Purposes of processing: Reach measurement (e.g., access statistics, recognition of returning visitors), tracking (e.g., interest-/behavior-based profiling, use of cookies), visit action analysis, profiling (creation of user profiles), click tracking, A/B tests, interest-based and behavior-based marketing, audience building (determination of audiences relevant for marketing purposes or other delivery of content).
Security measures: IP masking (pseudonymization of the IP address).
Legal bases: Consent (Art. 6 para. 1 sentence 1 lit. a DSGVO), Legitimate interests (Art. 6 para. 1 sentence 1 lit. f. DSGVO).
Services and service providers used:
Google Analytics: Online marketing and web analysis; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy:
https://policies.google.com/privacy; Privacy Shield (guarantee of data protection level when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&;status=Active.
Hotjar: Web analysis; Service provider: Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta, Europe; Website:
https://hotjar.com; Privacy policy:
https://www.hotjar.com/legal/policies/privacy/;
We process personal data for the purposes of online marketing, which in particular may include the marketing of advertising space or the display of advertising and other content (collectively referred to as "content") based on potential interests of users, as well as the measurement of their effectiveness.
For these purposes, so-called user profiles are created and stored in a file (so-called "Cookie") or similar procedures are used, by means of which the information relevant for the display of the aforementioned content about the user is stored. Such information may include, for example, viewed content, visited web pages, online networks used, but also communication partners and technical information such as the browser used, the computer system used, as well as information about usage times. If users have consented to the collection of their location data, these may also be processed.
Users' IP addresses are also stored. However, we use available IP-masking procedures (i.e., pseudonymization by truncating the IP address) to protect users. In general, no clear identifying data of users (such as e-mail addresses or names) are stored in the context of online marketing procedures, but pseudonyms. That means we as well as the providers of the online marketing procedures do not know the actual identity of the users, but only the information stored in their profiles.
The information in the profiles is usually stored in the cookies or by similar procedures. These cookies can later generally also be read on other websites that use the same online marketing procedure, and analyzed for the purpose of displaying content as well as supplemented with further data and stored on the server of the online marketing service provider.
In exceptional cases, clear identifying data may be assigned to the profiles. This is the case when users are, for example, members of a social network whose online marketing procedure we use and the network links the users' profiles with the aforementioned information. Please note that users may enter into additional agreements with the providers, e.g., by consent during registration.
We generally only receive access to aggregated information about the success of our advertisements. However, as part of so-called conversion measurements, we can check which of our online marketing procedures have led to a so-called conversion, i.e., for example, to the conclusion of a contract with us. Conversion measurement is used solely for the analysis of the success of our marketing measures.
Unless otherwise stated, please assume that cookies used are stored for a period of two years.
Notes on legal bases: If we ask users for their consent to the use of third parties, the legal basis for the processing of data is consent. Otherwise, users' data are processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.
Facebook Pixel: With the help of the Facebook Pixel, Facebook is able, on the one hand, to determine the visitors to our online offering as a target group for the display of advertisements (so-called "Facebook Ads"). Accordingly, we use the Facebook Pixel to show the Facebook Ads we place only to those users on Facebook and within the services of partners cooperating with Facebook (so-called "Audience Network"
https://www.facebook.com/audiencenetwork/ ) who have also shown an interest in our online offering or who exhibit certain characteristics (e.g., interest in certain topics or products that become apparent from the visited websites) that we transmit to Facebook (so-called "Custom Audiences"). With the help of the Facebook Pixel, we also want to ensure that our Facebook Ads correspond to users' potential interests and are not perceived as annoying. With the help of the Facebook Pixel, we can furthermore track the effectiveness of the Facebook advertisements for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook advertisement (so-called "conversion measurement").
Types of data processed: Usage data (e.g., visited web pages, interest in content, access times), meta-/communication data (e.g., device information, IP addresses), location data (data that indicate the location of an end user’s device).Data subjects: Users (e.g. website visitors, users of online services), prospective customers.
Purposes of processing: Tracking (e.g. interest-/behavior-based profiling, use of cookies), remarketing, analysis of visit actions, interest-based and behavior-based marketing, profiling (creation of user profiles), conversion measurement (measuring the effectiveness of marketing measures), reach measurement (e.g. access statistics, recognition of returning visitors), audience formation (determination of target groups relevant for marketing purposes or other delivery of content), cross-device tracking (cross-device processing of user data for marketing purposes).
Security measures: IP masking (pseudonymization of the IP address).
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
Right to object (opt-out): We refer to the privacy notices of the respective providers and to the objection options provided by the providers (so-called "opt-out"). If no explicit opt-out option has been specified, there is, on the one hand, the option to disable cookies in your browser settings. However, this may restrict functions of our online offering. We therefore additionally recommend the following opt-out options, which are offered collectively for the respective regions: a) Europe:
https://www.youronlinechoices.eu. b) Canada:
https://www.youradchoices.ca/choices. c) USA:
https://www.aboutads.info/choices. d) Cross-region:
Services used and service providers:
Google Analytics: Online marketing and web analytics; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://marketingplatform.google.com/intl/de/about/analytics/; Privacy Policy:
https://policies.google.com/privacy; Privacy Shield (assurance of a level of data protection when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&;status=Active; Option to object (opt-out): Opt-out plugin:
https://tools.google.com/dlpage/gaoptout?hl=de, settings for the display of advertisements:
https://adssettings.google.com/authenticated.
Google Ads and conversion measurement: We use the online marketing service "Google Ads" to place advertisements in the Google advertising network (e.g., in search results, in videos, on websites, etc.) so that they are shown to users who are likely to be interested in the advertisements. Furthermore, we measure the conversion of the ads. However, we only learn the anonymous total number of users who clicked on our ad and were forwarded to a page provided with a so-called "Conversion-Tracking-Tag". We ourselves do not receive any information that would allow users to be identified. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://marketingplatform.google.com; Privacy Policy:
https://policies.google.com/privacy; Privacy Shield (assurance of a level of data protection when processing data in the
USA):
https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&;status=Active.
Facebook Pixel: Service provider:
https://www.facebook.com, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; Website:
https://www.facebook.com; Privacy Policy:
https://www.facebook.com/about/privacy; Privacy Shield (assurance of a level of data protection when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&;status=Active; Option to object (Opt-Out):
https://www.facebook.com/settings?tab=ads.
TikTok Pixel, TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland)
We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to provide information about us.
We point out that user data may be processed outside the territory of the European Union in the process. This may result in risks for users because, for example, enforcement of users' rights could be made more difficult. With regard to US providers that are certified under the Privacy Shield or offer comparable guarantees of a secure level of data protection, we point out that they thereby commit to complying with EU data protection standards.
Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created on the basis of users' usage behavior and the resulting interests. The usage profiles can, in turn, be used to display advertisements within and outside the networks that are likely to correspond to users' interests. For these purposes, cookies are generally stored on users' computers in which users' usage behavior and interests are recorded. In addition, data in the usage profiles can also be stored independently of the devices used by the users (in particular, when users are members of the respective platforms and are logged in).
For a detailed description of the respective processing activities and the objection options (opt-out), we refer to the privacy policies and notices of the operators of the respective networks.
Also in the case of requests for information and the assertion of data subject rights, we point out that these can be most effectively asserted with the providers. Only the providers each have access to the users' data and can directly take appropriate measures and provide information. If you still need assistance, you can contact us.
Types of data processed: Identity data (e.g. names, addresses), contact data (e.g. email addresses, telephone numbers), content data (e.g. text entries, photographs, videos), usage data (e.g. visited web pages, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Data subjects: Users (e.g. website visitors, users of online services).
Purposes of processing: Contact inquiries and communication, tracking (e.g. interest-/behavior-based profiling, use of cookies), remarketing, reach measurement (e.g. access statistics, recognition of returning visitors), affiliate tracking.
Legal bases: Legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
Services used and service providers:
Instagram: Social network; service provider: Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; Website:
https://www.instagram.com; Privacy Policy:
https://instagram.com/about/legal/privacy.
Facebook: Social network; service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA; Website:
https://www.facebook.com; Privacy Policy:
https://www.facebook.com/about/privacy; Privacy Shield (assurance of a level of data protection when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&;status=Active; Option to object (Opt-Out): Ad settings:
https://www.facebook.com/settings?tab=ads; Additional notes on data protection: Agreement on joint processing of personal data on Facebook pages:
https://www.facebook.com/legal/terms/page_controller_addendum, privacy information for Facebook pages:
https://www.facebook.com/legal/terms/information_about_page_insights_data.
LinkedIn: Social network; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Website:
https://www.linkedin.com; Privacy Policy:
https://www.linkedin.com/legal/privacy-policy; Privacy Shield (assurance of a level of data protection when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&;status=Active; Option to object (Opt-Out):
https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
SlideShare: Platform for presentations; service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Website:
https://www.linkedin.com; Privacy Policy:https://www.linkedin.com/legal/privacy-policy; Privacy Shield (assurance of data protection level when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&;status=Active.
Twitter: Social network; service provider: Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA; Privacy Policy:
https://twitter.com/de/privacy, (Settings)
https://twitter.com/personalization; Privacy Shield (assurance of data protection level when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&;status=Active.
Xing: Social network; service provider: XING AG, Dammtorstrasse 29-32, 20354 Hamburg, Germany; Website:
https://www.xing.de; Privacy Policy:
https://privacy.xing.com/de/datenschutzerklaerung.
We include functional and content elements in our online offering that are retrieved from the servers of their respective providers (hereinafter referred to as "third parties"). These can, for example, be graphics, videos or social media buttons as well as posts (hereinafter uniformly referred to as "content").
Embedding always requires that the third-party providers of this content process users' IP addresses, because without the IP address they could not send the content to their browsers. The IP address is therefore required for the display of this content or functions. We strive to use only such content whose respective providers use the IP address solely for delivering the content. Third parties may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic to the pages of this website. The pseudonymous information can furthermore be stored in cookies on users' devices and contain, among other things, technical information about the browser and operating system, referring websites, the time of visit as well as further information on the use of our online offering and can be linked with such information from other sources.
Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is consent. Otherwise, users' data are processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to draw your attention to the information on the use of cookies in this privacy policy.
Types of data processed: Usage data (e.g., visited web pages, interest in content, access times), meta-/communication data (e.g., device information, IP addresses), location data (data indicating the location of an end user's device), contact data (e.g., e-mail, telephone numbers), content data (e.g., text entries, photographs, videos), account data (e.g., names, addresses).
Data subjects: Users (e.g., website visitors, users of online services), communication partners.
Purposes of processing: Provision of our online offering and user-friendliness, contractual services and service, contact inquiries and communication, direct marketing (e.g., by e-mail or postal mail), tracking (e.g., interest-/behavior-related profiling, use of cookies), interest-based and behavior-related marketing, profiling (creation of user profiles), security measures, administration and response to inquiries.
Legal bases: Legitimate interests (Art. 6(1) sentence 1 lit. f GDPR), consent (Art. 6(1) sentence 1 lit. a GDPR), performance of a contract and pre-contractual inquiries (Art. 6(1) sentence 1 lit. b GDPR).
Services used and service providers:
Font Awesome: Display of fonts and icons; service provider: Fonticons, Inc., 6 Porter Road Apartment 3R, Cambridge, MA 02140, USA; Website:
https://fontawesome.com/; Privacy Policy:
https://fontawesome.com/privacy.
Google Fonts: We integrate the fonts ("Google Fonts") of the provider Google, whereby users' data are used solely for the purpose of displaying the fonts in users' browsers. The integration is carried out on the basis of our legitimate interests in a technically secure, maintenance-free and efficient use of fonts, their uniform display and taking into account possible licensing restrictions for their integration. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://fonts.google.com/; Privacy Policy:
https://policies.google.com/privacy; Privacy Shield (assurance of data protection level when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&;status=Active.
Google Maps: We embed the maps of the service "Google Maps" provided by Google. The processed data may in particular include IP addresses and location data of users, which, however, are not collected without their consent (as a rule given via the settings of their mobile devices); service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://cloud.google.com/maps-platform; Privacy Policy:
https://policies.google.com/privacy; Privacy Shield (assurance of data protection level when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt0000000TRkEAAW&;status=Active; Objection option (Opt-Out): Opt-Out plugin:
https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of ad impressions:
https://adssettings.google.com/authenticated.
ReCaptcha: We integrate the function "ReCaptcha" to detect bots, e.g., when entering data in online forms. Users' behavior information (e.g., mouse movements or challenges) is evaluated in order to distinguish humans from bots. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://www.google.com/recaptcha/; Privacy Policy:
https://policies.google.com/privacy; Privacy Shield (assurance of data protection level when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt0000000TRkEAAW&;status=Active; Objection option (Opt-Out): Opt-Out plugin:
https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of ad impressions:
https://adssettings.google.com/authenticated.
YouTube videos: Video content; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; Website:
https://www.youtube.com; Privacy Policy:
https://policies.google.com/privacy; Privacy Shield (assurance of data protection level when processing data in the USA):
https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&;status=Active; Objection option (Opt-Out): Opt-Out plugin:
https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of ad impressions:
https://adssettings.google.com/authenticated.
We use services, platforms and software of other providers (hereinafter referred to as "third parties") for the purposes of organization, administration, planning and the provision of our services. When selecting the third parties and their services, we observe the statutory requirements.
In this context, personal data may be processed and stored on the servers of the third parties. Various data may be affected by this, which we process in accordance with this privacy policy. Such data may in particular include master data and contact data of users, data on transactions, contracts, other processes and their contents.
If users are referred to third parties or their software or platforms in the context of communication, business or other relationships with us, the third parties may process usage data and metadata for security purposes, for service optimization or for marketing purposes. We therefore ask you to pay attention to the data protection notices of the respective third parties.Notes on legal bases: If we ask users for their consent to the use of third-party providers, the legal basis for the processing of data is consent. Furthermore, their use may be part of our (pre-)contractual services, provided the use of the third-party providers has been agreed upon in this context. Otherwise, users’ data are processed on the basis of our legitimate interests (i.e., interest in efficient, economical and recipient-friendly services). In this context, we would also like to point out the information on the use of cookies in this privacy policy.
Types of data processed: Basic data (e.g., names, addresses), contact data (e.g., email, telephone numbers), content data (e.g., text entries, photographs, videos), usage data (e.g., visited websites, interest in content, access times), meta/communication data (e.g., device information, IP addresses).
Data subjects: Communication partners, users (e.g., website visitors, users of online services), interested parties.
Purposes of processing: Contact inquiries and communication, reach measurement (e.g., access statistics, identification of returning visitors), tracking (e.g., interest-/behavior-based profiling, use of cookies), management and response to inquiries, feedback (e.g., collecting feedback via online form), surveys and questionnaires (e.g., surveys with input options, multiple-choice questions), profiling (creation of user profiles), audience building (determination of target groups relevant for marketing purposes or other presentation of content), remarketing, analysis of visit actions, interest-based and behavior-based marketing, conversion measurement (measurement of the effectiveness of marketing measures).
Legal bases: Consent (Art. 6 Abs. 1 S. 1 lit. a DSGVO), performance of contract and pre-contractual inquiries (Art. 6 Abs. 1 S. 1 lit. b. DSGVO), legitimate interests (Art. 6 Abs. 1 S. 1 lit. f. DSGVO).
Services used and service providers:
Microsoft Planner: Service provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA; Website: https://products.office.com; Privacy statement: https://privacy.microsoft.com/de-de/privacystatement, Security information: https://www.microsoft.com/de-de/trustcenter; Privacy Shield (ensuring data protection level when processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt0000000KzNaAAK&;status=Active.
The data we process are deleted in accordance with legal requirements as soon as the consents permitting the processing are revoked or other permissions lapse (e.g., when the purpose of processing these data has ceased to apply or they are no longer required for the purpose).
If the data are not deleted because they are required for other legally permissible purposes, their processing will be restricted to these purposes. That is, the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for asserting, exercising or defending legal claims or for the protection of the rights of another natural or legal person.
Further information on the deletion of personal data may also be provided within the individual data protection notices of this privacy policy.
We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g., consent) or any other individual notification.
If we provide addresses and contact information of companies and organizations in this privacy policy, please note that addresses may change over time and we ask you to check the details before making contact.
As a data subject, you have various rights under the GDPR, in particular those arising from Art. 15 to 18 and 21 DSGVO:
Right to object: You have the right, on grounds relating to your particular situation, at any time to object to the processing of personal data concerning you which is based on Art. 6 Abs. 1 lit. e or f DSGVO; this also applies to profiling based on these provisions. If personal data concerning you are processed in order to conduct direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purposes of such advertising; this also applies to profiling insofar as it is related to such direct marketing.
Right to withdraw consent: You have the right to withdraw consents given at any time.
Right of access: You have the right to request confirmation as to whether data concerning you are being processed and to obtain access to those data as well as further information and a copy of the data in accordance with statutory provisions.
Right to rectification: In accordance with legal requirements, you have the right to request completion of data concerning you or the correction of inaccurate data concerning you.
Right to erasure and restriction of processing: In accordance with legal requirements, you have the right to request that data concerning you be deleted without undue delay, or alternatively, in accordance with legal requirements, to request a restriction of processing of the data.
Right to data portability: You have the right to receive the personal data concerning you that you have provided to us in accordance with legal requirements in a structured, commonly used and machine-readable format, or to request transmission of those data to another controller.
Complaint to supervisory authority: In accordance with legal requirements, you also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you violates the GDPR.
In this section you will receive an overview of the terminology used in this privacy policy. Many of the terms are taken from the law and are primarily defined in Art. 4 DSGVO. The legal definitions are binding. The following explanations are intended primarily to aid understanding. The terms are sorted alphabetically.
A/B tests: A/B tests are used to improve the user-friendliness and performance of online offerings. Different versions of a website or its elements, such as input forms, may be shown to users, in which the placement of content or the labeling of navigation elements may differ. Subsequently, based on the behavior of users, e.g., longer dwell time on the website or more frequent interaction with the elements, it can be determined which of these pages or elements better meet users’ needs.
Affiliate tracking: In the context of affiliate tracking, links by which the linking websites refer users to websites with product or other offers are logged. The operators of the respective referring websites may receive a commission if users follow these so-called affiliate links and subsequently take up the offers (e.g., purchase goods or use services). For this it is necessary that providers can track whether users who are interested in certain offers subsequently take them up as a result of the affiliate links. Therefore, for the functionality of affiliate links it is necessary that they are supplemented with certain values that become part of the link or are otherwise stored, e.g., in a cookie. The values include in particular the originating website (Referrer), the time, an online identifier of the operator of the website on which the affiliate link was located, an online identifier of the respective offer, an online identifier of the user, as well as tracking-specific values such as, for example, ad creative ID, partner ID and categorizations.Conversion tracking: "Conversion tracking" denotes a procedure by which the effectiveness of marketing measures can be determined. For this purpose, as a rule a cookie is stored on users' devices within the websites where the marketing measures take place and is then retrieved again on the target website. For example, we can track whether the ads we placed on other websites were successful).
Creditworthiness information: Automated decisions are based on automatic data processing without human intervention (e.g., in the case of an automatic rejection of a purchase on account, an online loan application or an online application procedure without any human involvement). Such automated decisions are only permissible under Art. 22 DSGVO if the data subjects consent, if they are necessary for the performance of a contract, or if national laws permit these decisions.
Content Delivery Network (CDN): A "Content Delivery Network" (CDN) is a service by means of which the contents of an online offering, in particular large media files such as graphics or program scripts, can be delivered faster and more securely using regionally distributed and Internet-connected servers.
Cross-Device Tracking: Cross-Device Tracking is a form of tracking in which users' behavioral and interest information is collected across devices in so-called profiles by assigning an online identifier to the users. This allows user information to be analyzed for marketing purposes regardless of the browsers or devices used (e.g., mobile phones or desktop computers). For most providers, the online identifier is not linked to clear data such as names, postal addresses, or e-mail addresses.
IP masking: "IP masking" refers to a method in which the last octet, i.e., the last two numbers of an IP address, are deleted so that the IP address can no longer serve to uniquely identify a person. Therefore, IP masking is a means of pseudonymization of processing procedures, particularly in online marketing.
Interest-based and behavioral marketing: Interest-based and/or behavioral marketing refers to the practice of predicting potential interests of users in advertisements and other content as accurately as possible. This is done based on information about their prior behavior (e.g., visiting certain websites and dwelling on them, purchasing behavior, or interaction with other users), which is stored in a so-called profile. Cookies are typically used for these purposes.
Click tracking: Click tracking allows an overview of users' movements within an entire online offering. Because the results of these tests are more accurate if users' interactions can be tracked over a certain period (e.g., so that we can find out whether a user tends to return), cookies are typically stored on users' computers for these testing purposes.
Conversion measurement: Conversion measurement is a procedure by which the effectiveness of marketing measures can be determined. For this purpose, as a rule a cookie is stored on users' devices within the websites where the marketing measures take place and is then retrieved again on the target website. For example, we can track whether the ads we placed on other websites were successful.
Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g., cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Profiling: "Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person (depending on the type of profiling, this includes information regarding age, gender, location data and movement data, interaction with websites and their content, purchasing behavior, social interactions with other people), to analyze, assess or predict them (e.g., interests in certain content or products, click behavior on a website or place of residence). Cookies and web beacons are often used for profiling purposes.
Reach measurement: Reach measurement (also referred to as web analytics) is used to evaluate the visitor flows of an online offering and may include the behavior or interests of visitors in certain information, such as website content. With the help of reach analysis, website owners can, for example, determine what time visitors visit their website and which content they are interested in. This allows them, for example, to better tailor the content of the website to the needs of their visitors. Pseudonymous cookies and web beacons are often used for reach analysis purposes in order to recognize returning visitors and thus obtain more accurate analyses of the use of an online offering.
Remarketing: "Remarketing" or "retargeting" refers to, for example, noting for advertising purposes which products a user showed interest in on a website in order to remind the user of these products on other websites, e.g., in advertisements.
Location history and movement profiles: "Location history" (also referred to as "movement profile") denotes the collection of location data over a certain period. Location history allows conclusions to be drawn about the geographical movements (i.e., changes of position) of devices or their users.
Tracking: "Tracking" refers to the ability to trace users' behavior across multiple online offerings. As a rule, behavioral and interest information relating to the online offerings used is stored in cookies or on the servers of the providers of the tracking technologies (so-called profiling). These data can then be used, for example, to show users advertisements that are likely to match their interests.
Controller: The "controller" is the natural or legal person, authority, institution or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processing: "Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, whether collecting, evaluating, storing, transmitting or deleting.
Audience creation: "Audience creation" (or "Custom Audiences") refers to determining audiences for advertising purposes, e.g., displaying advertisements. For example, based on a user's interest in certain products or topics on the internet, it can be inferred that this user is interested in advertisements for similar products or the online shop in which they viewed the products. "Lookalike Audiences" (or similar audiences) are, in turn, when content deemed suitable is shown to users whose profiles or interests are presumed to correspond to the users for whom the profiles were created. Cookies and web beacons are typically used for the purposes of creating Custom Audiences and Lookalike Audiences.