Privacy Policy
Preamble
With the following Privacy Policy, we would like to inform you about the types of personal data (hereinafter also referred to as “data”) we process, the purposes for which we process it, and the scope of such processing. This Privacy Policy applies to all processing of personal data carried out by us, both in connection with the provision of our services and, in particular, on our websites, in mobile applications, and on external online platforms, such as our social media profiles (hereinafter collectively referred to as the “online offerings”).
The terms used are not gender-specific.
Effective: January 19, 2024
Table of Contents
- Preamble
- Data Controller
- Contact the Data Protection Officer
- Overview of Data Processing
- Applicable Legal Bases
- Security Measures
- Transfer of Personal Data
- Deletion of Data
- Rights of Data Subjects
- Use of Cookies
- Business Services
- Contact and Inquiry Management
- Communication via Messenger
- Video Conferences, Online Meetings, Webinars, and Screen Sharing
- Job application process
- Cloud services
- Social media presence
- Plugins, embedded features, and content
- Changes and Updates to the Privacy Policy
Person in Charge
Ex-Pack GmbH
von-Gimborn-Straße 4
46446 Emmerich am Rhein
Contact the Data Protection Officer
dataudit privacy policy
Seyhun Savas
www.dataudit.de
Overview of Processing Steps
The following overview summarizes the types of data processed and the purposes of such processing, and identifies the data subjects.
Professional Liability Insurance
Gossler, Gobert & Wolters
Assekuranz Makler GmbH & Co. KG
Fischertwiete 1, Chilehaus B,
20095 Hamburg
Geographical Scope: Germany
Types of Data Processed
- Inventory data.
- Payment data.
- Location data.
- Contact data.
- Content data.
- Contract data.
- Usage data.
- Meta, communication, and process data.
- Applicant data.
Categories of Data Subjects
- Customers.
- Employees.
- Prospective customers.
- Communication partners.
- Users.
- Job applicants.
- Business and contractual partners.
- People depicted in images.
Purposes of Processing
- Provision of contractual services and fulfillment of contractual obligations.
- Contact requests and communication.
- Direct marketing.
- Office and organizational procedures.
- Management and response to inquiries.
- Job application processes.
- Feedback.
- Marketing.
- Profiles containing user-related information.
- Provision of our online services and user-friendliness.
- IT infrastructure.
Relevant Legal Bases
Relevant Legal Bases Under the GDPR: The following provides an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country or ours, depending on where you or we are located. If, in individual cases, more specific legal bases apply, we will inform you of these in the Privacy Policy.
- Consent (Art. 6(1), first sentence, lit. a) GDPR) – The data subject has given consent to the processing of personal data concerning him or her for a specific purpose or for several specific purposes.
- Performance of a Contract and Pre-Contractual Inquiries (Art. 6(1), first sentence, lit. b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the data subject’s request.
- Legal obligation (Art. 6(1), first sentence, (c) GDPR) – Processing is necessary to comply with a legal obligation to which the controller is subject.
- Legitimate Interests (Art. 6(1), first sentence, subparagraph (f) of the GDPR) – Processing is necessary to protect the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, take precedence.
- Job Application Process as a Pre-Contractual or Contractual Relationship (Art. 6(1), sentence 1, letter b) GDPR) – To the extent that, as part of the application process, special categories of personal data within the meaning of Article 9(1) of the GDPR (e.g., health data, such as severe disability status or ethnic origin) are requested from applicants, so that the controller or the data subject can exercise the rights and fulfill the obligations arising from labor law and the law on social security and social protection, such processing is carried out in accordance with Article 9(2)(b) GDPR; in the case of the protection of the vital interests of applicants or other individuals pursuant to Article 9(2)(c) of the GDPR; or for the purposes of preventive healthcare or occupational medicine, for assessing an employee’s fitness for work, for medical diagnosis, care or treatment in the health or social sector, or for the administration of systems and services in the health or social sector pursuant to Article 9(2)(h) of the GDPR. In the case of the disclosure of special categories of data based on voluntary consent, their processing is carried out pursuant to Article 9(2)(a) of the GDPR.
National Data Protection Regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Act on the Protection against the Misuse of Personal Data in Data Processing (Federal Data Protection Act—BDSG). The BDSG contains, in particular, special provisions regarding the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and the transfer of data, as well as automated decision-making in individual cases, including profiling. Furthermore, state data protection laws of the individual federal states may apply.
Note on the Applicability of the GDPR and the Swiss Data Protection Act (DSG): This privacy notice serves to provide information in accordance with both the Swiss Federal Act on Data Protection (Swiss DSG) and the General Data Protection Regulation (GDPR). For this reason, please note that, due to their broader geographical scope and clarity, the terms used in the GDPR are employed. In particular, instead of the terms “processing” of “personal data,” “overriding interest,” and “personal data requiring special protection,” the terms used in the GDPR—“processing” of “personal data,” as well as “legitimate interest” and “special categories of data”—are used. However, the legal meaning of these terms continues to be determined in accordance with the Swiss Data Protection Act (DSG) within the scope of its application.
Safety Measures
We implement technical and organizational measures appropriate to the circumstances and purposes of the processing, as well as the varying likelihoods and severity of threats to the rights and freedoms of natural persons, in accordance with legal requirements and taking into account the state of the art, the costs of implementation, and the nature, scope, circumstances, and purposes of the processing, as well as the varying likelihood and severity of threats to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk.
These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, input of, and disclosure of the data, ensuring its availability, and maintaining its separation. Furthermore, we have established procedures that ensure the exercise of data subjects’ rights, the erasure of data, and responses to data breaches. Furthermore, we take the protection of personal data into account from the very beginning of the development or selection of hardware, software, and procedures in accordance with the principle of data protection through technical design and privacy-friendly default settings.
IP Address Truncation: If IP addresses are processed by us or by the service providers and technologies we use, and the processing of a full IP address is not necessary, the IP address is truncated (also referred to as “IP masking”). In this process, the last two digits or the last part of the IP address after a period are removed or replaced with placeholders. The purpose of truncating the IP address is to prevent or significantly hinder the identification of an individual based on their IP address.
TLS/SSL Encryption (https): To protect user data transmitted via our online services, we use TLS/SSL encryption. Secure Sockets Layer (SSL) is the standard technology for securing Internet connections by encrypting the data transmitted between a website or app and a browser (or between two servers). Transport Layer Security (TLS) is an updated and more secure version of SSL. Hyper Text Transfer Protocol Secure (HTTPS) appears in the URL when a website is secured by an SSL/TLS certificate.
Transfer of Personal Data
As part of our processing of personal data, the data may be transferred to or disclosed to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, service providers tasked with IT-related duties or providers of services and content that are integrated into a website. In such cases, we comply with legal requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to ensure the protection of your data.
Data Transfer Within the Corporate Group: We may transfer personal data to other companies within our corporate group or grant them access to this data. If this transfer is for administrative purposes, it is based on our legitimate business and operational interests; or it occurs if it is necessary to fulfill our contractual obligations, or if consent has been obtained from the data subjects or a legal basis exists.
Data Transfer Within the Organization: We may transfer personal data to other departments within our organization or grant them access to this data. If this disclosure is made for administrative purposes, it is based on our legitimate business and operational interests, or occurs when necessary to fulfill our contractual obligations, or when consent from the data subjects or a legal authorization is available.
Deletion of Data
The data we process is deleted in accordance with legal requirements as soon as the consent authorizing its processing is revoked or other legal grounds for processing no longer apply (e.g., if the purpose for which the data was processed no longer exists or the data is no longer necessary for that purpose). If the data is not deleted because it is necessary for other legally permissible purposes, its processing will be limited to those purposes. This means that the data will be blocked and will not be processed for any other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons, or whose storage is necessary to assert, exercise, or defend legal claims, or to protect the rights of another natural or legal person. As part of our privacy policy, we may provide users with additional information regarding the deletion and retention of data that applies specifically to the respective processing operations.
Rights of Data Subjects
Rights of Data Subjects Under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 through 21 of the GDPR:
- Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. If personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
- Right to Withdraw Consent: You have the right to withdraw any consent you have given at any time.
- Right of Access: You have the right to request confirmation as to whether data concerning you is being processed, as well as access to this data, further information, and a copy of the data in accordance with legal requirements.
- Right to Rectification: In accordance with legal requirements, you have the right to request that data concerning you be completed or that inaccurate data concerning you be corrected.
- Right to Erasure and Restriction of Processing: In accordance with legal requirements, you have the right to request that data concerning you be erased without delay, or, alternatively, to request a restriction on the processing of such data in accordance with legal requirements.
- Right to Data Portability: You have the right, in accordance with legal requirements, to receive the data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another data controller.
- Complaint to a Supervisory Authority: In accordance with applicable law and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority—in particular, a supervisory authority in the Member State where you habitually reside— the supervisory authority of your place of work or the location of the alleged infringement, should you believe that the processing of personal data concerning you violates the GDPR.
Use of Cookies
Cookies are small text files or other storage mechanisms that store information on end devices and retrieve information from them. For example, to save the login status in a user account, the contents of a shopping cart in an online store, the content accessed, or the features used on a website. Cookies can also be used for various purposes, such as ensuring the functionality, security, and convenience of online services, as well as analyzing visitor traffic.
Information on Consent: We use cookies in accordance with legal requirements. Therefore, we obtain prior consent from users unless such consent is not required by law. In particular, consent is not required if the storage and retrieval of information—including cookies—are strictly necessary to provide users with a telemedia service (i.e., our online service) that they have expressly requested. Strictly necessary cookies generally include cookies with functions that serve the display and operation of the online service, load balancing, security, the storage of users’ preferences and selections, or similar purposes related to the provision of the primary and secondary functions of the online service requested by users. The revocable consent is clearly communicated to users and includes information regarding the respective use of cookies.
Notes on the legal basis for data protection: The legal basis under data protection law on which we process users’ personal data using cookies depends on whether we ask users for their consent. If users give their consent, the legal basis for processing their data is the consent they have provided. Otherwise, the data processed using cookies is processed on the basis of our legitimate interests (e.g., the business operation of our online service and improving its usability) or, if this occurs in the context of fulfilling our contractual obligations, when the use of cookies is necessary to fulfill our contractual obligations. We explain the purposes for which we process cookies in this Privacy Policy or as part of our consent and processing procedures.
Retention Period: With regard to the retention period, the following types of cookies are distinguished:
- Temporary cookies (also known as session cookies): Temporary cookies are deleted at the latest after a user leaves an online service and closes their device (e.g., browser or mobile application).
- Persistent cookies: Persistent cookies remain stored even after the device is closed. For example, this allows the login status to be saved or preferred content to be displayed directly when the user visits a website again. Similarly, user data collected via cookies may be used for audience measurement. Unless we provide users with explicit information regarding the type and storage duration of cookies (e.g., when obtaining consent), users should assume that cookies are permanent and may be stored for up to two years.
General Information on Withdrawal and Objection (so-called “opt-out”): Users may withdraw the consent they have provided at any time and object to processing in accordance with legal requirements. To do so, users may, among other things, restrict the use of cookies in their browser settings (although this may also limit the functionality of our online service). An objection to the use of cookies for online marketing purposes can also be submitted via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.
- Legal bases: Legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR). Consent (Art. 6(1), first sentence, lit. a) of the GDPR).
Further information on processing operations, procedures, and services:
- Processing of cookie data based on consent: We use a cookie consent management system through which users’ consent to the use of cookies—as well as to the processing activities and providers specified within the cookie consent management system—is obtained, managed, and revoked by the users. In this context, the declaration of consent is stored so that the request for consent does not need to be repeated and so that consent can be demonstrated in accordance with legal obligations. Storage may occur on the server and/or in a cookie (a so-called “opt-in” cookie, or using comparable technologies) to enable the consent to be associated with a user or their device. Subject to specific information provided by cookie management service providers, the following applies: Consent may be stored for up to two years. In this process, a pseudonymous user identifier is generated and stored along with the time of consent, details regarding the scope of consent (e.g., which categories of cookies and/or service providers), as well as the browser, operating system, and device used;
- Legal basis: Consent (Art. 6(1), sentence 1, letter a) of the GDPR).
- BorlabsCookie: Cookie consent management; Service provider: Processed on servers and/or computers under the provider’s own data protection responsibility; Website: https://de.borlabs.io/borlabs-cookie/. Additional information: An individual user ID, language, types of consent, and the time at which consent was given are stored on the server and in a cookie on the user’s device.
Business Services
We process data from our contractual and business partners, such as customers and prospective customers (collectively referred to as “contractual partners”) in the context of contractual and similar legal relationships, as well as related measures and in the context of communication with contractual partners (or on a pre-contractual basis), e.g., to respond to inquiries.
We process this data to fulfill our contractual obligations. These include, in particular, the obligations to provide the agreed-upon services, any obligations to update such services, and to remedy warranty claims and other service disruptions. In addition, we process the data to safeguard our rights and for the purposes of administrative tasks associated with these obligations, as well as for corporate organization. Furthermore, we process the data based on our legitimate interests in proper and sound business management, as well as in security measures to protect our contractual partners and our business operations from misuse, and threats to their data, confidential information, and rights (e.g., involving telecommunications, transportation, and other support services, as well as subcontractors, banks, tax and legal advisors, payment service providers, or tax authorities). Within the framework of applicable law, we disclose the data of contractual partners to third parties only to the extent necessary for the aforementioned purposes or to fulfill legal obligations. Contractual partners are informed about other forms of processing, e.g., for marketing purposes, within the scope of this Privacy Policy.
We inform contractual partners of which data is required for the aforementioned purposes either before or during data collection—for example, in online forms, through special markings (e.g., colors) or symbols (e.g., asterisks or similar), or in person.
We delete the data after the expiration of statutory warranty and comparable obligations, i.e., generally after 4 years, unless the data is stored in a customer account, for example, as long as it must be retained for legal archiving purposes. The statutory retention period for documents relevant under tax law, as well as for ledgers, inventories, opening balance sheets, annual financial statements, the work instructions necessary for understanding these documents, and other organizational documents and accounting vouchers, ten years; and for received commercial and business letters and copies of sent commercial and business letters, six years. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance sheet, the annual financial statements, or the management report was prepared, the commercial or business letter was received or sent, or the accounting voucher was created, or the record was made, or the other documents were created.
To the extent that we use third-party providers or platforms to provide our services, the terms and conditions and privacy policies of the respective third-party providers or platforms apply to the relationship between users and the providers.
- Types of data processed: Master data (e.g., names, addresses); payment data (e.g., bank account information, invoices, payment history); contact data (e.g., email, phone numbers); contract data (e.g., subject matter of the contract, term, customer category).
- Data subjects: Prospective customers. Business and contractual partners.
- Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; contact inquiries and communication; office and organizational procedures; management and response to inquiries.
- Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR); Legal obligation (Art. 6(1), sentence 1, lit. c) GDPR). Legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR).
Contact and Inquiry Management
When you contact us (e.g., by mail, contact form, email, phone, or social media), as well as in the context of existing user and business relationships, the information provided by the individuals making the inquiry is processed to the extent necessary to respond to the contact requests and any requested actions.
- Types of data processed: Contact information (e.g., email, phone numbers); content data (e.g., entries in online forms); Usage data (e.g., websites visited, interest in content, access times); meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Data subjects: Communication partners.
- Purposes of processing: Contact inquiries and communication; managing and responding to inquiries; feedback (e.g., collecting feedback via online forms); providing our online services and ensuring user-friendliness.
- Legal bases: Legitimate interests (Art. 6(1), sentence 1, lit. f) GDPR). Performance of a contract and pre-contractual inquiries (Art. 6(1), sentence 1, lit. b) GDPR).
Additional information on processing activities, procedures, and services:
- Contact form: When users contact us via our contact form, email, or other communication channels, we process the data provided to us in this context to handle the matter raised; Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1), first sentence, letter b) of the GDPR), legitimate interests (Art. 6(1), first sentence, letter f) of the GDPR).
Communication via Messenger
We use messaging apps for communication purposes and therefore ask that you review the following information provided by the messaging apps regarding encryption, the use of communication metadata, and your options for objecting.
You can also contact us through alternative channels, such as by phone or email. Please use the contact information provided to you or the contact information listed on our website.
In the case of end-to-end encryption of content (i.e., the content of your message and attachments), please note that the communication content (i.e., the message content and attached images) is encrypted from end to end. This means that the content of the messages cannot be viewed, not even by the messenger providers themselves. You should always use an up-to-date version of the messenger with encryption enabled to ensure that the message content is encrypted.
However, we also inform our communication partners that while the messenger providers cannot view the content, they can determine whether and when communication partners are communicating with us, as well as process technical information about the communication partners’ devices and, depending on their device settings, location information (so-called metadata).
Notes on Legal Bases: If we ask communication partners for permission before communicating with them via messenger, the legal basis for our processing of their data is their consent. Furthermore, if we do not ask for consent and they, for example, contact us on their own initiative, we use Messenger in our relationship with our contractual partners and in the context of contract initiation as a contractual measure; and in the case of other interested parties and communication partners, we process data based on our legitimate interests in fast and efficient communication and in meeting our communication partners’ needs for communication via Messenger. Furthermore, we would like to point out that we do not initially transmit the contact information provided to us to the messaging services without your consent.
Withdrawal, Objection, and Deletion: You may withdraw any consent you have given at any time and object to communication with us via Messenger at any time. In the case of communication via Messenger, we delete the messages in accordance with our general deletion policies (i.e., for example, as described above, upon the termination of contractual relationships, in the context of archiving requirements, etc.) and otherwise, as soon as we can reasonably assume that we have responded to any inquiries from the communication partner, provided that no reference back to a previous conversation is to be expected and no legal retention obligations prevent the deletion.
Reservation regarding other communication channels: Finally, for your security, we reserve the right not to respond to inquiries via Messenger. This is the case, for example, when internal contractual matters require special confidentiality or a response via messenger does not meet formal requirements. In such cases, we will direct you to more appropriate communication channels.
- Types of Data Processed: Contact information (e.g., email, phone numbers); Usage data (e.g., websites visited, interest in content, access times); meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Data subjects: Communication partners.
- Purposes of processing: Contact inquiries and communication; direct marketing (e.g., via email or mail).
- Legal bases: Consent (Art. 6(1), sentence 1, lit. a). Legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR).
Additional information on processing operations, procedures, and services:
- Instagram: Sending messages via the Instagram social network; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR); Website: https://www.instagram.com. Privacy Policy: https://instagram.com/about/legal/privacy.
- Facebook Messenger: Facebook Messenger with end-to-end encryption (end-to-end encryption for Facebook Messenger requires activation unless it is enabled by default); Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Data Processing Agreement: https://www.facebook.com/legal/terms/dataprocessing. Basis for third-country transfers: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
- LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Basis for transfers to third countries: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa); Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out; Additional Information: Together with LinkedIn Ireland Unlimited Company, we are responsible for the collection (but not the further processing) of visitor data for the purpose of generating “Page Insights” (statistics) for our LinkedIn profiles.
- This data includes information about the types of content users view or interact with, or the actions they take, as well as interactions via the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data), and details from users’ profiles, such as job title, country, industry, organizational level, company size, and employment status. Privacy information regarding LinkedIn’s processing of user data can be found in LinkedIn’s Privacy Policy: https://www.linkedin.com/legal/privacy-policy
- We have entered into a specific agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum” (the “Addendum”), https://legal.linkedin.com/pages-joint-controller-addendum), which specifically sets forth the security measures LinkedIn must observe and in which LinkedIn has agreed to fulfill the rights of data subjects (i.e., users can, for example, submit requests for information or deletion directly to LinkedIn). Users’ rights (in particular the rights to access, erasure, objection, and filing a complaint with the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint responsibility is limited to the collection of data by and its transfer to Ireland Unlimited Company, a company based in the EU. Further processing of the data is the sole responsibility of Ireland Unlimited Company, particularly with regard to the transfer of data to the parent company, LinkedIn Corporation, in the United States.
Video conferences, online meetings, webinars, and screen sharing
We use platforms and applications from other providers (hereinafter collectively referred to as “conference platforms”) for the purpose of conducting video and audio conferences, webinars, and other types of video and audio meetings (hereinafter collectively referred to as “conferences”). When selecting conference platforms and their services, we comply with legal requirements.
Data processed by conference platforms: When participants join a conference, the conference platforms process the participants’ personal data listed below. The scope of the processing depends, on the one hand, on what data is required for a specific conference (e.g., login credentials or real names) and, on the other hand, on what optional information participants provide. In addition to processing for the purpose of conducting the conference, participants’ data may also be processed by the conference platforms for security purposes or to optimize service. The data processed includes personal information (first name, last name), contact information (email address, phone number), login credentials (access codes or passwords), profile pictures, details regarding professional position/role, the IP address of the internet connection, information about users’ devices, their operating systems, browsers, and the technical and language settings thereof, information regarding the content of communications—i.e., chat entries as well as audio and video data—and the use of other available features (e.g., polls). Communication content is encrypted to the extent technically provided by the conference providers. If participants are registered as users on the conference platforms, additional data may be processed in accordance with the agreement with the respective conference provider.
Logging and Recordings: If text entries, participation results (e.g., from polls), or video and audio recordings are logged, participants will be informed of this transparently in advance and—where necessary—asked for their consent.
Participants’ Data Protection Measures: Please refer to the conference platforms’ privacy policies for details regarding the processing of your data, and select the security and privacy settings that best suit your needs within the conference platforms’ settings. Please also ensure the protection of data and privacy in the background of your recording for the duration of a video conference (e.g., by informing roommates, locking doors, and, where technically possible, using the background blurring feature). Links to conference rooms and access credentials must not be shared with unauthorized third parties.
Notes on Legal Bases: If, in addition to the conference platforms, we also process user data and request consent for the use of the conference platforms or certain features (e.g., consent to record conferences), the legal basis for the processing is this consent. Furthermore, our processing may be necessary to fulfill our contractual obligations (e.g., in participant lists, when compiling meeting results, etc.). In all other cases, user data is processed based on our legitimate interests in efficient and secure communication with our communication partners.
- Types of data processed: Master data (e.g., names, addresses); contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); usage data (e.g., websites visited, interest in content, access times); metadata, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Data subjects: Communication partners; users (e.g., website visitors, users of online services). Individuals depicted in images.
- Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; contact requests and communication; office and organizational procedures.
- Legal bases: Legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR).
Additional information on processing procedures, processes, and services:
- Microsoft Teams: Conference and communication software; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR); Website: https://www.microsoft.com/de-de/microsoft-365; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement, Security Information: https://www.microsoft.com/de-de/trustcenter. Basis for transfers to third countries: EU-U.S. Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
- TeamViewer: Conference and communication software; Service provider: TeamViewer GmbH, Jahnstr. 30, 73037 Göppingen, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.teamviewer.com/de/. Privacy Policy: https://www.teamviewer.com/de/legal/privacy-and-cookies/.
Application Process
The application process requires applicants to provide us with the information necessary for their evaluation and selection. The specific information required is outlined in the job description or, in the case of online forms, in the instructions provided there.
Generally, the required information includes personal details such as name, address, contact information, and proof of the qualifications necessary for the position. Upon request, we are also happy to provide additional details regarding what information is needed.
If available, applicants may submit their applications to us via an online form. The data is transmitted to us in encrypted form using state-of-the-art technology. Applicants may also submit their applications to us via email. However, please note that emails are generally not sent in encrypted form over the Internet. As a rule, emails are encrypted during transmission but not on the servers from which they are sent and received. We therefore cannot assume any responsibility for the transmission of the application between the sender and our server.
For the purposes of candidate sourcing, application submission, and candidate selection, we may use applicant tracking systems, recruitment software, and platforms and services provided by third-party vendors, in compliance with legal requirements.
Applicants are welcome to contact us regarding the method of submitting their application or to send their application to us by mail.
Processing of Special Categories of Data: To the extent that, as part of the application process, special categories of personal data (Art. 9(1) GDPR, e.g., health data such as severe disability status or ethnic origin) are requested from applicants or provided by them, such data is processed to enable the data controller or the data subject to exercise their rights and fulfill their obligations under labor law and the law on social security and social protection, in the case of protecting the vital interests of applicants or other individuals, or for purposes of preventive health care or occupational medicine, for assessing an employee’s fitness for work, for medical diagnosis, for care or treatment in the health or social sector, or for the administration of systems and services in the health or social sector.
Deletion of Data: The data provided by applicants may be further processed by us for the purposes of the employment relationship in the event of a successful application. Otherwise, if the application for a job opening is unsuccessful, the applicants’ data will be deleted. Applicants’ data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Subject to a valid revocation by the applicant, the data will be deleted no later than six months after the application is submitted, so that we can answer any follow-up questions regarding the application and fulfill our obligations to provide evidence under regulations governing the equal treatment of applicants. Invoices for any travel expense reimbursements are archived in accordance with tax regulations.
Inclusion in a Candidate Pool: Inclusion in a candidate pool, if offered, is based on consent. Applicants are informed that their consent to be included in the talent pool is voluntary, has no impact on the ongoing application process, and that they may revoke their consent at any time with future effect.
Duration of data retention in the applicant pool in months: Applications are retained for 6 months. Longer retention is possible if requested by applicants. Applicants must provide their consent for this.
- Types of data processed: Master data (e.g., names, addresses); contact information (e.g., email, phone numbers); content data (e.g., entries in online forms); applicant data (e.g., personal details, mailing and contact addresses, documents accompanying the application and the information they contain, such as cover letters, resumes, and certificates, as well as other information regarding a specific position or voluntarily provided by applicants about themselves or their qualifications).
- Data subjects: Job applicants.
- Purposes of processing: Job application process (establishment and any subsequent implementation, as well as possible subsequent termination of the employment relationship).
- Legal bases: Recruitment process as a pre-contractual or contractual relationship (Art. 6(1), sentence 1, lit. b) of the GDPR). Legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR).
Additional information on processing activities, procedures, and services:
- Facebook Jobs: Job search and application-related services within the Facebook platform; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, (f) of the GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Data Processing Agreement: https://www.facebook.com/legal/terms/dataprocessing. Basis for third-country transfer: EU-U.S. Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum).
- LinkedIn Recruiter: Job search and application-related services within the LinkedIn platform; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.linkedin.com; Terms of Service: https://www.linkedin.com/legal/user-agreement; Privacy Policy: https://legal.linkedin.com/dpa; Data Processing Agreement: https://legal.linkedin.com/dpa. Basis for transfers to third countries: EU-US Data Privacy Framework (DPF).
- Stepstone: Services related to employee recruitment (search for employees, communication, application process, contract negotiations); Service provider: StepStone Deutschland GmbH, Völklinger Straße 1, 40219 Düsseldorf, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.stepstone.de. Privacy Policy: https://www.stepstone.de/Ueber-StepStone/Rechtliche-Hinweise/datenschutzerklaerung/.
- Federal Employment Agency: We process personal data exchanged in cooperation with the Federal Employment Agency; Website: https://www.arbeitsagentur.de. Privacy Policy: https://www.arbeitsagentur.de/datenschutz.
Cloud Services
We use software services accessible via the Internet and run on their providers’ servers (so-called “cloud services,” also referred to as “Software as a Service”) for the storage and management of content (e.g., document storage and management, the exchange of documents, content, and information with specific recipients, or the publication of content and information).
In this context, personal data may be processed and stored on the providers’ servers to the extent that such data is part of communications with us or is otherwise processed by us as described in this Privacy Policy. This data may include, in particular, users’ master data and contact information, as well as data relating to transactions, contracts, other processes, and their contents. The cloud service providers also process usage data and metadata, which they use for security purposes and to optimize their services.
If we use the cloud services to provide forms or similar documents and content for other users or on publicly accessible websites, the providers may store cookies on users’ devices for web analytics purposes or to remember users’ settings (e.g., in the case of media usage).
- Types of data processed: Master data (e.g., names, addresses); contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); Usage data (e.g., websites visited, interest in content, access times); meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Data Subjects: Customers; Employees (e.g., staff members, job applicants, former employees); Prospective clients; Communication partners.
- Purposes of processing: Office and organizational procedures. IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)).
- Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
Additional information on processing operations, procedures, and services:
- Microsoft Cloud Services: Cloud storage, cloud infrastructure services, and cloud-based application software; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal basis: Legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR); Website: https://microsoft.com/de-de; Privacy Policy: https://privacy.microsoft.com/de-de/privacystatement; Security information: https://www.microsoft.com/de-de/trustcenter. Data Processing Agreement: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. Basis for transfers to third countries: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
- Telekom Magentacloud: Cloud storage service; Service provider: Telekom Deutschland GmbH, Landgrabenweg 151, 53227 Bonn, Germany; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR); Website: https://cloud.telekom-dienste.de/. Privacy Policy: https://www.telekom.de/ueber-das-unternehmen/datenschutz.
Social Media Presence
We maintain online presences on social media platforms and, in this context, process user data in order to communicate with users active on those platforms or to provide information about us.
Please note that this may involve the processing of user data outside the European Union. This may pose risks to users, as it could, for example, make it more difficult to enforce users’ rights.
Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created based on users’ behavior and the resulting interests. These user profiles can, in turn, be used, for example, to display advertisements—both within and outside the networks—that are presumed to correspond to the users’ interests. For these purposes, cookies are typically stored on users’ computers, in which their usage behavior and interests are recorded. Furthermore, data may also be stored in the usage profiles regardless of the devices used by users (particularly if users are members of the respective platforms and are logged in to them).
For a detailed description of the respective forms of processing and the options for opting out, please refer to the privacy policies and information provided by the operators of the respective networks.
We also note that requests for information and the exercise of data subject rights are most effectively addressed directly with the providers. Only the providers have access to users’ data and can directly take appropriate measures and provide information. If you still need assistance, however, you can contact us.
- Types of data processed: Contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); Usage data (e.g., websites visited, interest in content, access times); meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).
- Data subjects: Users (e.g., website visitors, users of online services).
- Purposes of processing: Contact requests and communication; feedback (e.g., collecting feedback via online forms); marketing.
- Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR).
Additional information on processing operations, procedures, and services:
- Instagram: Social network; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.instagram.com. Privacy Policy: https://instagram.com/about/legal/privacy.
- Facebook Pages: Profiles within the Facebook social network; Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, (f) of the GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy; Basis for transfers to third countries: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum); Additional Information: We are jointly responsible with Facebook Ireland Limited for the collection (but not the further processing) of data from visitors to our Facebook page (so-called “Fan Page”). This data includes information about the types of content users view or interact with, or the actions they take (see “Things You and Others Do and Share” in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g., IP addresses, operating system, browser type, language settings, cookie data; see “Device Information” in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under “How do we use this information?” , Facebook also collects and uses information to provide analytics services, known as “Page Insights,” to page administrators so they can gain insights into how people interact with their pages and the content associated with them. We have entered into a special agreement with Facebook (“Information About Page Insights,” https://www.facebook.com/legal/terms/page_controller_addendum), which specifically outlines the security measures Facebook must adhere to and in which Facebook has agreed to uphold the rights of data subjects (i.e., users can, for example, submit requests for information or deletion directly to Facebook). Users’ rights (in particular the rights to access, erasure, objection, and filing a complaint with the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Page Insights Information” (https://www.facebook.com/legal/terms/information_about_page_insights_data). Joint responsibility is limited to the collection of data by Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, particularly with regard to the transfer of data to the parent company, Meta Platforms, Inc., in the United States.
- LinkedIn: Social network; Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) GDPR); Website: https://www.linkedin.com; Privacy Policy: https://www.linkedin.com/legal/privacy-policy; Basis for third-country transfer: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://legal.linkedin.com/dpa); Opt-out option: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out; Additional Information: Together with LinkedIn Ireland Unlimited Company, we are responsible for the collection (but not the further processing) of visitor data for the purpose of generating “Page Insights” (statistics) for our LinkedIn profiles.
- This data includes information about the types of content users view or interact with, or the actions they take, as well as information about the devices users employ (e.g., IP addresses, operating system, browser type, language settings, cookie data), and details from users’ profiles, such as job title, country, industry, hierarchical level, company size, and employment status. Privacy information regarding LinkedIn’s processing of user data can be found in LinkedIn’s Privacy Policy: https://www.linkedin.com/legal/privacy-policy
- We have entered into a special agreement with LinkedIn Ireland (“Page Insights Joint Controller Addendum” (the “Addendum”), https://legal.linkedin.com/pages-joint-controller-addendum), which specifically sets forth the security measures LinkedIn must adhere to and in which LinkedIn has agreed to fulfill the rights of data subjects (i.e., users may, for example, submit requests for information or deletion directly to LinkedIn). Users’ rights (in particular the rights to access, erasure, objection, and filing a complaint with the competent supervisory authority) are not restricted by the agreements with LinkedIn. Joint responsibility is limited to the collection of data by and its transfer to Ireland Unlimited Company, a company based in the EU. Further processing of the data is the sole responsibility of Ireland Unlimited Company, particularly with regard to the transfer of data to the parent company, LinkedIn Corporation, in the United States.
- YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, lit. f) of the GDPR); Privacy Policy: https://policies.google.com/privacy; Basis for transfers to third countries: EU-U.S. Data Privacy Framework (DPF). Option to object (opt-out): https://myadcenter.google.com/personalizationoff.
- Smashballoon: Smash Balloon is a WordPress plugin that allows website operators to easily and securely integrate social media feeds into their websites. It offers a range of features, such as a feed creation wizard, an efficient customizer, caching, GDPR compliance, SEO optimization, and more; Service provider: Smash Balloon LLC
- Minnesota City, Minnesota, USA; Website: https://smashballoon.com/. Privacy Policy: https://smashballoon.com/app-
Plugins, Embedded Functions, and Content
We incorporate functional and content elements into our online offerings that are obtained from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos, or city maps (hereinafter collectively referred to as “content”).
This integration always requires that the third-party providers of this content process the users’ IP addresses, as they would be unable to send the content to the users’ browsers without the IP address. The IP address is therefore necessary for the display of this content or these features. We make every effort to use only content whose respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. These “pixel tags” allow information such as visitor traffic on the pages of this website to be analyzed. This pseudonymous information may also be stored in cookies on the user’s device and may include, among other things, technical information about the browser and operating system, referring websites, time of visit, and other details regarding the use of our online services, as well as be linked to such information from other sources.
- Types of data processed: Usage data (e.g., web pages visited, interest in content, access times); meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status); Location data (information regarding the geographic position of a device or a person).
- Data subjects: Users (e.g., website visitors, users of online services).
- Purposes of processing: Provision of our online offerings and user-friendliness; marketing. Profiles containing user-related information (creation of user profiles).
- Legal bases: Consent (Art. 6(1)(a) GDPR). Legitimate interests (Art. 6(1)(f) GDPR).
Additional information on processing procedures, methods, and services:
- Google Fonts (hosted on our own server): Provision of font files to ensure a user-friendly display of our online offering; Service provider: Google Fonts are hosted on our server; no data is transmitted to Google; Legal basis: Legitimate interests (Art. 6(1), first sentence, (f) of the GDPR).
- Google Maps: We integrate maps from the “Google Maps” service provided by Google. The data processed may include, in particular, users’ IP addresses and location data; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Consent (Art. 6(1), first sentence, (a) of the GDPR); Website: https://mapsplatform.google.com/; Privacy Policy: https://policies.google.com/privacy. Basis for transfers to third countries: EU-US Data Privacy Framework (DPF).
- Instagram Plugins and Content: Instagram plugins and content—this may include, for example, images, videos, text, and buttons that allow users to share content from this online service on Instagram. We are jointly responsible with Meta Platforms Ireland Limited for the collection or receipt, as part of a transfer (but not the further processing), of “event data,” which Facebook collects via Instagram features (e.g., content embedding features) executed on our online service or receives as part of a transfer for the following purposes: a) Displaying content and advertising information that corresponds to users’ presumed interests; b) Delivery of commercial and transaction-related messages (e.g., contacting users via Facebook Messenger); c) Improving ad delivery and personalizing features and content (e.g., improving the ability to identify which content or advertising information is likely to match users’ interests). We have entered into a special agreement with Facebook (“Addendum for Controllers,” https://www.facebook.com/legal/controller_addendum), in which Facebook is specifically required to comply with certain security measures (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has agreed to fulfill the rights of data subjects (i.e., users can, for example, submit requests for information or deletion directly to Facebook). Note: When Facebook provides us with metrics, analyses, and reports (which are aggregated—i.e., do not contain information about individual users and are anonymous to us), this processing does not take place under joint controllership but rather on the basis of a data processing agreement (“Data Processing Terms,” https://www.facebook.com/legal/terms/dataprocessing), the “Data Security Terms” (https://www.facebook.com/legal/terms/data_security_terms) and, with regard to processing in the U.S., on the basis of standard contractual clauses (“Facebook-EU Data Transfer Addendum, https://www.facebook.com/legal/EU_data_transfer_addendum”). Users’ rights (in particular the right to access, erasure, objection, and the right to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with Facebook; Service Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.instagram.com. Privacy Policy: https://instagram.com/about/legal/privacy.
- Polylang: Polylang is a WordPress plugin that allows you to publish your website in multiple languages.
The key features of Polylang are:
- Multilingual support: Polylang allows you to publish your website in multiple languages.
- Automatic detection of the user’s language: The plugin can automatically detect which language a visitor is using and display the corresponding content; Service provider: WP SYNTEX, 28 rue Jean Sébastien Bach, 38090 Villefontaine, France; Website: https://polylang.pro/; Privacy Policy: https://polylang.pro/privacy-policy/.
Changes and Updates to the Privacy Policy
We ask that you review the content of our Privacy Policy on a regular basis. We will update the Privacy Policy as soon as changes to our data processing activities make this necessary. We will notify you as soon as the changes require action on your part (e.g., consent) or any other individual notification.
If we provide addresses and contact information for companies and organizations in this Privacy Policy, please note that these addresses may change over time, and we ask that you verify the information before contacting them.
The supervisory authority responsible for us:
LDI NRW
Kavalleriestr. 2-4
40213 Düsseldorf