Privacy policy
General part.
Personal names.
This data protection declaration is directed at all persons who visit our website. All personal designations refer to both male and female and diverse persons and language forms and are always to be understood with the addition "(m/f/d)".
Data protection at a glance.
According to Article 12 of the General Data Protection Regulation (henceforth DSGVO), website operators are obliged to inform visitors in a precise, transparent and comprehensible manner how personal data is processed. To this end, we want to make a sincere contribution and summarize our privacy policy as follows. The details are located under the summary:
In the following cases, we process personal data to establish, execute and/or terminate contracts: Contact form, recruiting tool of rexx Systems.
In the following cases, we process personal data based on your consent:
Google Analytics, Google Tag Manager, Facebook, Instagram, LinkedIn, YouTube, Pardot, Google maps.
In the following cases, we process personal data based on our legitimate interest: transient cookies, marketing, rights management, reviews via kununu.
Person responsible.
The person responsible within the meaning of Article 4 number 7 DSGVO for processing the personal data of visitors to this website is: Choice AG, Thomas-Mann-Strasse 16-20, 90471 Nuremberg, T: +49 911 480 499 27, E: info@choice.de, Our data protection officer is Dr. Stephan Gärtner, who can be contacted either at the above data with the address suffix "Data Protection Officer" or by e-mail to request@thenextstanhope.de.
Rights.
(1) The data subjects have several rights with regard to the personal data processed about them in accordance with the GDPR, in particular the right to
- information about the stored personal data,
- correction of incorrectly stored personal data,
- deletion of personal data for whose further storage there is no basis for permission,
- restriction of the processing of stored personal data,
- data portability,
- a complaint to the competent supervisory authority for data protection.
Automated decision-making, incl. profiling.
If under "General Part / Data Protection at a Glance" after the line "In the following cases, we process personal data with the aid of automated decision-making (including profiling, if applicable): ..." no processing operations are described, these do not take place. Otherwise, please refer to our separate data protection declaration.
Data transfer to bodies outside the European Union
(1) It is possible that we transfer personal data to bodies that are located outside the European Union or at least cannot exclude this (henceforth: third country body). In these cases, we must guarantee in accordance with Article 44 of the GDPR that this does not result in a level of protection below that of the GDPR. As a precaution, we would like to point out that the third country agency can be both a controller and a processor.
(2) Insofar as we refer to a so-called adequacy decision in the following statement, this means that the third country agency is located in a country, territory or specific sector for which the Commission has decided that it offers an adequate level of protection. This guarantee then follows from Article 45 GDPR.
(3) Insofar as we refer to the so-called standard contractual clauses in the following declaration, this means that the third country agency accepts the so-called EU standard contractual clauses and has thus contractually committed itself to respecting the level of protection of the General Data Protection Regulation. This guarantee then follows from Article 46(1) and (5) of the GDPR.
(4) Insofar as we refer in the following statement to the fact that you have consented to the transfer to the third country agency, this means that you have been informed of all existing possible risks of such transfers for which there is no adequacy decision or other guarantees and have nevertheless consented to the data transfer. This guarantee then follows from Article 49(1)(a) of the GDPR. For reasons of transparency, we describe the corresponding risks in a separate section.
(5) We provide this notice only as a precautionary measure. It only applies if we refer to it in the following declaration. There is also the possibility that we do not make use of this.
Special constellation: EU standard contractual clauses and third-country entities based in the U.S.
(1) In addition to the explanations under "Data transfer to bodies outside the European Union" - paragraph 3, we would like to draw your attention to a special constellation. In the case of transfers to third-country entities based in the USA, the possibility of invoking the EU standard contractual clauses is restricted. Therefore, if we intend to invoke the EU standard contractual clauses in this context (or are already doing so), please note the following:
(2) We will only rely on the EU Standard Contractual Clauses to transfer personal data to U.S. third country entities if we have first conducted a thorough review of the facts involved. In doing so, we first determine a risk level (type and, in particular, sensitivity of the data concerned, scope of data processing, purpose of data processing, susceptibility to misuse). We then check whether the contractual commitments of the U.S. third-country entity and the technical and organizational measures taken there (e.g. processing of data exclusively in EU-based data centers, encryption technology) sufficiently minimize the risks identified in advance. Only if we come to the conclusion in this regard that the EU standard contractual clauses are a sufficient guarantee in exceptional cases, even in the case of a U.S. third country site, will we invoke them.
(3) This notice is given only as a precautionary measure. It shall only apply if we refer to it in the following declaration. There is also the possibility that we do not make use of this.
Special constellation: Consent to transfer to third-party entities located in the U.S., including risk disclosures
(1) In addition to the explanations under "Data transfer to bodies outside the European Union" - paragraph 4, we would like to draw your attention to another special constellation. In the case of transfers to third-country bodies based in the USA, the possibility of invoking the EU standard contractual clauses is restricted. Therefore, in some cases, the only option is to ask you for your consent to this transfer. However, before you give this consent, we ask you to take note of the following risks and consider them when deciding whether to consent:
(2) We urge you to note that data transfers to the U.S. without the protection of an adequacy decision may involve significant risks. In particular, please note the following risks:
(3) We make this declaration merely as a precautionary measure. It shall only apply if we refer to it in the subsequent declaration. There is also the possibility that we do not make use of this.
Note on the legal obligation to process.
Only insofar as we refer to Article 6 (1) sentence 1 lit. c DSGVO in the following data protection statement, there is a legal obligation to process.
Processing operations necessary for the performance of contracts (primary legal basis: Article 6 (1) sentence 1 lit. b DSGVO)
General information on the purpose and legal basis of the processing operations described below.
(1) The purpose of the processing operations described below is the establishment, performance, termination of contracts as well as the defense against claims on your part, which are directly or indirectly related to the respective contract.
(2) Insofar as the purpose of the processing is the establishment, performance, termination of contracts, Article 6 (1) sentence 1 lit. b DSGVO is the legal basis for the processing of your personal data. According to this provision, the processing of your personal data is also permissible without your consent if it is necessary for the performance of a contract to which you are a party or for the performance of pre-contractual measures which are carried out at your request.
(3) Insofar as the purpose of the processing is the defense against claims on your part which are directly or indirectly related to the respective contract, Article 6 (1) sentence 1 lit. b DSGVO shall also be the legal basis in addition to Article 6 (1) sentence 1 lit. f DSGVO. Our legitimate interest in this respect follows from our right to defend ourselves against claims on your part.
(4) Only insofar as we process your data in your function as an applicant or current or former employee is Article 88 DSGVO in conjunction with. § Section 26 (1) BDSG2018 is the legal basis. According to this provision, the processing of your personal employee data (including your applicant data) is also permitted without your consent if it is necessary for the performance of an employment contract to which you are a party or for the implementation of pre-contractual measures.
(5) Insofar as we refer to Article 6(1) sentence 1 lit. f DSGVO, you have the right to object to the processing, which will result in an end to the processing based on this in cases of justified objection. And insofar as we do not expressly refer to Article 6(1) sentence 1 lit. c DSGVO, there is no obligation to process.
General information on the storage period regarding the data within the scope of the processing operations described below.
(1) We store the data as long as this is necessary in order to establish, execute and, if necessary, terminate the contract and/or to defend ourselves against claims by you that are directly or indirectly related to the respective contract.
(2) If a contractual relationship is established between us, we shall store the data additionally until the expiry of our statutory retention periods. The legal basis for this is Article 6 (1) sentence 1 lit. c DSGVO in conjunction with. § 147 AO, § 257 HGB. According to these regulations, some of the above-mentioned data must also be retained beyond the time when the purpose has been achieved. Thus, we may be obliged to,
- to retain personal data relating to you that is derived from books and records, inventories, annual financial statements, individual financial statements pursuant to § 325 para. 2a HGB (German Commercial Code), consolidated financial statements, management reports and group management reports, opening balances, accounting vouchers, documents pursuant to Article 15 (1) and Article 163 of the Union Customs Code, commercial books, as well as the work instructions and other organizational documents required for their comprehension, for ten years, whereby the retention period generally begins at the end of the calendar year in which the relevant document was created (Article 6 (1) sentence 1 lit. c DSGVO in conjunction with. § 147 AO or in conjunction with. § 257 HGB)
- to retain data concerning your person resulting from received commercial or business letters, from the reproduction of the received commercial or business letters as well as from other documents which are of importance for taxation for six years, whereby the retention period generally begins with the end of the calendar year in which the relevant document arose (Article 6 (1) sentence 1 lit. c DSGVO in conjunction with § 147 AO or i.V.m. § 257 HGB). § 147 AO or in conjunction with. § 257 HGB).
- in the event of rejection, for a further six months after rejection, whereby the legal basis for the six-month storage is Article 6 (1) sentence 1 lit. f DSGVO and our legitimate interest follows from the right to defend ourselves against complaints under the AGG (cf. Section 15 (4) AGG),
- in the event that we ask you whether you wish to be included in our applicant pool and you say yes, until the time of revocation of your consent, whereby the legal basis for this storage is your consent in accordance with Article 88 DSGVO in conjunction with. § 26 paragraph 2 BDSG2018. In the cases of paragraph 3 clauses 1 and 2, we only reserve the right to store, but a storage obligation is not established by this privacy policy.
Contact form.
In a nutshell: We have a form available on our website.
Processing in detail: We provide you with a contact form on this website. We will receive, check and use the data processed via this to respond to you if necessary.
Data that is processed: Here, we generally process the following data from you: (1) the contact data you entered and (2) the communication data.
Recruiting-Tool from rexx systems.
In a nutshell: You may apply for employment with us online, and we will process all data necessary to complete the application process.
Processing and third-party providers in detail: We have included an online recruiting tool on this website. We are happy to briefly describe this processing operation: you have the option of applying to us online. To do this, you can apply to us online after selecting a position that is suitable for you or, if applicable, on your own initiative. The provider of the tool is rexx systems GmbH, Süderstraße 75-79, 20097 Hamburg. We have commissioned the provider used for this purpose in accordance with Article 28 DSGVO.
Data processed: In this context, we usually, but not in every individual case, process the following data from you: the contact data you entered, the data from your application, the data about actions taken to make inquiries and assert rights and data about any consent to be included in the applicant pool, information from the job interview, information about the trial work day.
Greenhouse gas reduction quota trading (GHG quota trading) procedures.
In a nutshell: You can deposit data from the registration certificate Part I (ZLB I) of an electric vehicle with us online so that we can carry out the GHG quota registration with the Federal Environment Agency on your behalf and - if the requirements are met - pass on corresponding quotas.
Processing and third-party providers in detail: We have included an online tool on this website. We would like to briefly describe this processing procedure: You have the possibility to enter your contact and bank data as well as the data from the ZLB I . The provider of the tool is eQuota GmbH, Harzer Str. 39, 12059 Berlin, Germany. We have commissioned the provider used for this purpose in accordance with Article 28 DSGVO. We keep further details for you in the separate privacy policy on (THG quota trading). for you.
Data processed: Here, we process the following data from you: the contact data you entered, the data from the ZLB I and your bank details.
Processing operations for which your consent is required (primary legal basis: Article 6(1) sentence 1 lit. a DSGVO).
General information on the purpose and legal basis of the processing operations described below.
(1) The purpose of the processing operations described below is described separately for each tool.
(2) The legal basis for the respective data processing is your consent pursuant to Article 6 (1) sentence 1 a DSGVO. According to this provision, the processing of your personal data is permitted if you have given your consent to the processing of the personal data relating to you for one or more specific purposes.
General information on the retention period regarding the data within the scope of the processing operations described below.
(1) We generally store the data until you have revoked your consent. You can declare your revocation at any time, for example by sending an informal message to one of the above-mentioned contact channels.
(2) This does not apply to all data for which a reason for storage other than your consent applies. In particular, we store the information that and how you have consented for three years, whereby the period begins to run on December 31 of the calendar year in which you revoke your consent. The legal basis for this is Article 6 (1) sentence 1 lit. c DSGVO in conjunction with. Article 7 (1) DSGVO, as we are obliged to document the granting of consent. Furthermore, this longer storage is also justified by Article 6 (1) sentence 1 lit. f DSGVO, as it is in our legitimate interest to defend ourselves against claims for damages based on the fact that no consent was given at all. This storage interest exists at least until the expiry of the statutory limitation period (§§ 195, 199 BGB).
Notes on the legal basis „Consent“
(1) Insofar as we obtain consent from you for processing, you have the right to revoke this consent at any time with effect for the future. As a rule, this is possible by sending an informal message to us (see "Responsible party." above).
Furthermore, we point out that we process further of your personal data in the context of obtaining consent. These are, on the one hand, identity features (such as your name, your e-mail address, your IP address) and, on the other hand, log data on consent (time of consent, status of consent, scope of consent). We base this data processing on Article 6 (1) sentence 1 lit. c DSGVO in conjunction with. Article 7 (1) DSGVO. The purpose is the need to prove that you have given your consent.
Supplementary note on obtaining consent via a cookie consent tool
In a nutshell: To obtain your consent for the use of certain cookies, we use a cookie consent tool. With this, we collect and store all consent processes that you trigger in this context.
Processing: we use this tool to document your consent to cookie-based data processing on our website.
Data processed: In this context, we would like to point out that we process personal data from you when obtaining consent. These are on the one hand identity characteristics and on the other hand log data for consent.
Google Analytics.
In a nutshell: We use cookies to evaluate your usage behavior on and interaction with our website. We then evaluate this information in order to be able to design our website in an even more targeted manner. For this purpose, we use the "Google Analytics" tool. The US data transfer, which cannot be ruled out, is justified because the processing only takes place if you consent to it.
Processing and third-party providers in detail: To analyze your user behavior on our website, we use the following service provider with its tool described in more detail in the heading: Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043. If you are based within the European Economic Area, your data is additionally processed by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. We are happy to briefly describe this processing procedure: The tool uses so-called "cookies". These are text files that are stored on your computer and enable an analysis of your use of the website. The provider will use this information on our behalf for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The privacy policy of this provider can be found here: https://policies.google.com/privacy?fg=1 The purpose can be described as follows: We use this tool to be able to analyze and regularly improve the use of our website. The statistics obtained allow us to improve our offer and make it more interesting for you as a user. You can find more details about the way of processing via this provider here: https://marketingplatform.google.com/intl/de/about/analytics/.
Data that is processed: This tool uses so-called „cookies“. These are text files that are stored on your computer and enable an analysis of your use of the website. The information generated by this about your use of this website is usually transmitted to a server of the provider in the USA and stored there. However, your IP address will be truncated beforehand by the provider within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a server of the provider in the USA and shortened there. The IP address transmitted by your browser when using this tool is not merged with other data by the provider. We also use this tool for a cross-device analysis of visitor flows, which is carried out via a user ID. You can deactivate the cross-device analysis of your usage in your customer account under "My data", "Personal data". For your information, we would like to point out that we use this tool with the extension "_anonymizeIp()". This means that IP addresses are processed in abbreviated form, which means that it is not possible to relate them to a specific person. If the data collected about you is related to a person, this is therefore immediately excluded and the personal data is deleted immediately.
Third country status: The processing is not prevented by the fact that the data is transferred to the USA, possibly in cooperation with Google LLC. This is because we only use this tool if you consent to the associated transfer of data to the USA (see Article 49(1)(a) DSGVO). Please be sure to read our risk notices beforehand (cf. General Part/Special Constellation: Consent to Transfer to Third-Party Entities Located in the USA, including the risk notices).
Google Tag Manager.
In a nutshell: To coordinate various measures that serve to analyze your usage behavior, we use a central control tool, namely the „Google Tag Manager“. The US data transfer, which cannot be excluded, is justified because the processing only takes place if you consent to it.
Processing and third-party providers in detail: To coordinate and execute our analysis of your user behavior on our website as well as our advertising targeting, we use the following service provider with its tool described in more detail in the heading: Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043. If you are based within the European Economic Area, your data is additionally processed by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. We would like to briefly describe this processing procedure: Through this tool, we can integrate various codes and services in an orderly and simplified manner on our website. This tool implements the tags or triggers the embedded tags. When a tag is triggered, the provider may also process personal data. It cannot be ruled out that the provider also transmits the data to a server in a third country. The privacy policy of this provider can be found here: https://policies.google.com/privacy?fg=1 The purpose can be described as follows: We use the tool to integrate various codes and services in an orderly and simplified manner on our website; this is for the purposes of analyzing user behavior and, if necessary, for advertising purposes. You can find more details about the manner of processing via this provider here: https://marketingplatform.google.com/intl/de/about/tag-manager/.
Data that is processed: Here, we generally process those data from you that we process in connection with Google analytics tools and Google advertising. We refer to the other explanations in connection with processing operations in which the provider assists us.
Third country status: the processing is not prevented by the fact that the data is transferred to the USA, possibly in cooperation with Google LLC. This is because we only use this tool if you consent to the associated transfer of data to the USA (see Article 49(1)(a) DSGVO). Please be sure to read our risk notices beforehand (cf. General Part/Special Constellation: Consent to Transfer to Third-Party Entities Located in the USA, including the risk notices).
Facebook.
In a nutshell: We use the social network „Facebook“. In doing so, we process data about your interaction with this social network and with us via this social network. We receive detailed information about this, which we use specifically; for example, for the purposes of improved communication, promotional approaches and the determination of potential customers. The US data transfer, which cannot be ruled out, is justified as the processing only takes place if you consent to it.
Joint responsibility: If and insofar as we analyze visitor interactions with our company site, we are in this respect jointly responsible with the provider of the social network under data protection law; this in accordance with Article 26 DSGVO. Our agreement with the provider can be found here: https://www.facebook.com/legal/terms/page_controller_addendum. You can find out when the provider and when we process your personal data on our own responsibility under „Processing and third-party providers“.
Processing and Third-Party Providers: We use the above-mentioned social media. Its provider is: Facebook Inc, 1601 S. California Avenue, Palo Alto, CA 94304, USA. If you are located outside the USA and/or Canada, Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland is responsible. We have no influence on the data collected and data processing operations, nor are we aware of the full extent of the data collection, the purposes of the processing, the storage periods. We also have no information on the deletion of the collected data by this provider. If you select our company pages, it is possible that the provider stores the data collected about you as usage profiles and uses these for purposes of advertising, market research and/or demand-oriented design of its website. You have the right to object to the creation of these user profiles, whereby you must contact the provider to exercise this right. A privacy policy of the provider can be found here: https://www.facebook.com/policy.php. Insofar as we can influence the data processing, its purpose is to present our company, to analyze your usage behavior with regard to interaction with our company page maintained there, and to communicate with you via this social network (possibly in an advertising manner). If and insofar as we commission Facebook to process data for us beyond this, we are a client within the meaning of Article 28 DSGVO.
Data that is processed: We maintain a company page on this social network and may analyze whether and how you have visited our company page there; whether and how you react to our posts on social networks; whether and how you communicate with us via the channels there. In this respect, the consent that you have given to this provider is decisive.
Supplementary information on the legal basis: In addition to our general statements on the legal basis, we also inform you here: If you yourself maintain a profile on this social medium, the legal basis is your consent within the meaning of Article 6 (1) sentence 1 lit. a DSGVO, which you have given to the provider of the social network. In all other cases, the legal basis is Article 6(1) sentence 1 lit. f DSGVO, according to which your data may be processed if it is necessary to protect our legitimate interests or the interests of a third party, unless your interests or fundamental rights and freedoms requiring the protection of personal data override these, in particular if the data subject is a child. We have the economic interest to link our company pages, whereby you click on the links independently and voluntarily. In all other respects, the provider is responsible.
Third country status: the US data transfer, which cannot be ruled out, does not prevent us from commissioning or sharing responsibility with the provider of this social network. This is because the processing of your personal data via this tool only takes place if you consent to the associated data transfer to the USA (cf. Article 49 (1) lit. a DSGVO). This is done towards us, as far as we control the data processing. Please be sure to read our risk notices before doing so (cf. General Section/Special Constellation: Consent to Transfer to Third-Party Entities Located in the USA, including the risk notices). Insofar as the provider controls the processing (for example, if you visit the social network independently of an action on our website), there is already no transmission by us to the USA, so that we also do not have to provide any further guarantee within the meaning of Article 44ff. of the GDPR. In this case, there is at most a relationship between us and the provider of the social network within the meaning of Article 26 of the GDPR.
Addition „company page“: We have linked our company page with this provider on our website. If you click on this link (meaning the link to our company page), you will be taken to our profile. With regard to this processing, we refer to our previous statements on visiting our company page with this provider.
Supplement „Facebook Pixel“: We use the Facebook pixel. This is an analysis tool that can be used to measure the effectiveness of advertising. It is generally used to understand and track peoples actions on a website. You implement the Facebook pixel on a website by placing the pixel code in the header of the website. When someone then visits the webpage and performs an action (for example, completes a purchase), the Facebook pixel is triggered and the action is reported. In this way, one learns when a customer takes an action and can evaluate this. There is also the option of extended matching, which we also use and which is also covered by your consent. The Facebook pixel makes it possible to transmit customer data such as first name, last name, email address, etc. to Facebook and enrich it with existing tracking data. In this way, it is also possible to collect data from non-Facebook users or to track users who are not logged into Facebook while visiting a website. This tracks website visitors via Facebook who deliberately prevent the storage of third-party cookies. We have instructed the provider in this respect in accordance with Article 28 DSGVO. More information on how this works and the associated data processing can be found here: https://de-de.facebook.com/business/help/742478679120153?id=1205376682832142.
Instagram.
In a nutshell: We use the social network „Instagram“. In doing so, we process data about your interaction with this social network and with us via this social network. We receive detailed information about this, which we use specifically; for example, for the purposes of improved communication, promotional approaches and the determination of potential customers. The US data transfer, which cannot be ruled out, is justified as the processing only takes place if you consent to it.
Joint responsibility: If and to the extent that we analyze visitor interactions with our company website, we are in this respect jointly responsible with the provider of the social network under data protection law; this in accordance with Article 26 DSGVO. You can find out when the provider and when we process your personal data on our own responsibility under „Processing and third-party providers“.
Processing and third-party providers in detail and joint responsibility: We use the above-mentioned social medium. Its provider is Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland, impressum@support.instagram.com. We have no influence on the data collected and data processing operations, nor are we aware of the full scope of data collection, the purposes of processing, the storage periods. We also have no information on the deletion of the collected data by this provider. If you select our company pages, it is possible that the provider stores the data collected about you as usage profiles and uses these for purposes of advertising, market research and/or demand-oriented design of its website. You have the right to object to the creation of these user profiles, whereby you must contact the provider to exercise this right. A privacy policy of the provider can be found here: https://help.instagram.com/519522125107875. Insofar as we can influence the data processing, its purpose is to present our company, to analyze your usage behavior in relation to the interaction with our company page maintained there, as well as to communicate with you via this social network (possibly in an advertising manner). If and insofar as we commission this provider to process data for us beyond this, we are a client within the meaning of Article 28 DSGVO.
commissioned pursuant to Article 28 DSGVO. More information on how this works and the associated data processing can be found here: https://de-de.facebook.com/business/help/742478679120153?id=1205376682832142.
Data that is processed: We maintain a company page on this social network and may analyze whether and how you have visited our company page there; whether and how you react to our posts on social networks; whether and how you communicate with us via the channels there. In this respect, the consent that you have given to this provider is decisive.
Supplementary information on the legal basis: In addition to our general statements on the legal basis, we also inform you here: If you yourself maintain a profile on this social medium, the legal basis is your consent within the meaning of Article 6 (1) sentence 1 lit. a DSGVO, which you have given to the provider of the social network. In all other cases, the legal basis is Article 6(1) sentence 1 lit. f DSGVO, according to which your data may be processed if it is necessary to protect our legitimate interests or the interests of a third party, unless your interests or fundamental rights and freedoms requiring the protection of personal data override these, in particular if the data subject is a child. We have the economic interest to link our company pages, whereby you click on the links independently and voluntarily. In all other respects, the provider is responsible.
Third country status: the US data transfer, which cannot be ruled out, does not prevent us from commissioning or sharing responsibility with the provider of this social network. This is because the processing of your personal data via this tool only takes place if you consent to the associated data transfer to the USA (cf. Article 49 (1) lit. a DSGVO). This is done towards us, as far as we control the data processing. Please be sure to read our risk notices before doing so (cf. General Section/Special Constellation: Consent to Transfer to Third-Party Entities Located in the USA, including the risk notices). Insofar as the provider controls the processing (for example, if you visit the social network independently of an action on our website), there is already no transmission by us to the USA, so that we also do not have to provide any further guarantee within the meaning of Article 44ff. of the GDPR. In this case, there is at most a relationship between us and the provider of the social network within the meaning of Article 26 of the GDPR.
Addition „company page“: We have linked our company page with this provider on our website. If you click on this link (meaning the link to our company page), you will be taken to our profile. With regard to this processing, we refer to our previous statements on visiting our company page with this provider.
LinkedIn.
In a nutshell: We use the social network „LinkedIn“. In doing so, we process data about your interaction with this social network and with us via this social network. This provides us with detailed information, which we use in a targeted manner; for example, for the purposes of improved communication, promotional approaches and the determination of potential customers. The US data transfer, which cannot be excluded, is justified because the processing only takes place if you consent to it.
Joint responsibility: If and to the extent that we analyze visitor interactions with our company website, we are in this respect jointly responsible with the provider of the social network under data protection law; this in accordance with Article 26 DSGVO. You can find out when the provider and when we process your personal data on our own responsibility under „Processing and third-party providers“.
Processing and third-party providers in detail and joint responsibility: We use the above-mentioned social medium. Its provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. We have no influence on the data collected and data processing operations, nor are we aware of the full scope of data collection, the purposes of processing, the storage periods. We also have no information on the deletion of the collected data by this provider. If you select our company pages, it is possible that the provider stores the data collected about you as usage profiles and uses these for purposes of advertising, market research and/or demand-oriented design of its website. You have the right to object to the creation of these user profiles, whereby you must contact the provider to exercise this right. A privacy policy of the provider can be found here: https://www.linkedin.com/legal/privacy-policy?trk=hb_ft_priv. Insofar as we can influence the data processing, its purpose is to present our company, to analyze your usage behavior in relation to the interaction with our company page maintained there, as well as to communicate with you via this social network (possibly in an advertising manner). If and to the extent that we commission this provider to process data for us beyond this, we are the client within the meaning of Article 28 of the GDPR.
Data that is processed: We maintain a company page on this social network and may analyze whether and how you have visited our company page there; whether and how you react to our posts on social networks; whether and how you communicate with us via the channels there. In this respect, the consent that you have given to this provider is decisive.
Supplementary information on the legal basis: In addition to our general statements on the legal basis, we also inform you here: If you yourself maintain a profile on this social medium, the legal basis is your consent within the meaning of Article 6 (1) sentence 1 lit. a DSGVO, which you have given to the provider of the social network. In all other cases, the legal basis is Article 6(1) sentence 1 lit. f DSGVO, according to which your data may be processed if it is necessary to protect our legitimate interests or the interests of a third party, unless your interests or fundamental rights and freedoms requiring the protection of personal data override these, in particular if the data subject is a child. We have the economic interest to link our company pages, whereby you click on the links independently and voluntarily. In all other respects, the provider is responsible.
Third country status: The data processing operations are also not prevented by the fact that the data may be processed outside the European Union by the provider, possibly in cooperation with LinkedIn Corporation, 2029 Stierlin Court, Mountain View, California 94043, USA. This is because the processing of your personal data via this tool only takes place if you consent to the associated data transfer to the USA (cf. Article 49 (1) lit. a DSGVO). This is done vis-à-vis us, insofar as we control the data processing. Please be sure to read our risk notices before doing so (cf. General Section/Special Constellation: Consent to Transfer to Third-Party Entities Located in the USA, including the risk notices). Insofar as the provider controls the processing (for example, if you visit the social network independently of an action on our website), there is already no transmission by us to the USA, so that we also do not have to provide any further guarantee within the meaning of Article 44ff. of the GDPR. In this case, there is at most a relationship between us and the provider of the social network within the meaning of Article 26 of the GDPR.
Denn die Verarbeitung Ihrer personenbezogenen Daten über dieses Tool erfolgt nur, wenn Sie der damit verbundenen Datenübermittlung in die USA zustimmen (vgl. Artikel 49 Absatz 1 lit. a DSGVO). Dies geschieht uns gegenüber, soweit wir die Datenverarbeitung steuern. Bitte lesen Sie vorher unbedingt unsere Risikohinweise (vgl. Allgemeiner Teil/ Sonderkonstellation: Einwilligung in die Übermittlung an Drittlandstellen mit Sitz in den USA, einschließlich der Risikohinweise). Sofern der Anbieter die Verarbeitung steuert (beispielsweise, wenn Sie das soziale Netzwerk unabhängig von einer Aktion auf unserer Internetseite besuchen), liegt bereits keine Übermittlung durch uns an die USA vor, sodass wir auch keine weitere Garantie i.S.d. Artikel 44ff. DSGVO vorweisen müssen. Hier besteht zwischen uns und dem Anbieter des sozialen Netzwerks allenfalls ein Verhältnis i.S.v. Artikel 26 DSGVO.
Addition „company page“: We have linked our company page with this provider on our website. If you click on this link (meaning the link to our company page), you will be taken to our profile. With regard to this processing, we refer to our previous statements on visiting our company page with this provider.
YouTube (with its own channel).
In a nutshell: We use a video playback solution to present our and/or third-party videos to you as part of our Internet presence, but also on our channel. When you start these videos, both the provider of the video platform and we document this in order to subsequently be able to show you interest-based information and ads. In this respect, we use the portal "YouTube". The US data transfer, which cannot be ruled out, is justified because the processing only takes place if you consent to it.
Processing and third-party providers in detail: We use the above-mentioned video platform or portal on our website. Its provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043. If you are based within the European Economic Area, your data is additionally processed by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. A privacy policy of the provider can be found here: https://policies.google.com/privacy?fg=1 We are happy to describe this processing procedure specifically: Plugins of the video portal YouTube are integrated on our website. Each time you call up a page that offers one or more YouTube video clips, a direct connection is established between your browser and a YouTube server. These videos are all embedded in "extended data protection mode" No data about you as a user will be transmitted to YouTube if you do not play the videos. Only when you play the videos, the data mentioned in paragraph 3 will be transmitted. We have no influence on this data transmission. If you use a Google account and do not want the assignment with your profile on YouTube, you must log out before activating the button.
Data processed: By visiting the website, YouTube receives the information that you have accessed the corresponding subpage of our website. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether there is no user account. If you are logged in to Google, your data will be directly assigned to your account. YouTube stores your data as usage profiles and uses them for purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) for the provision of needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right. Further information on the purpose and scope of data collection and its processing by YouTube can be found in the privacy policy. There you will also find further information about your rights and setting options to protect your privacy: https://www.google.de/intl/de/policies/privacy.
Third country status: The processing is not prevented by the fact that the data is transmitted to the USA, possibly in cooperation with Google LLC. This is because we only use this tool if you consent to the associated transfer of data to the USA (see Article 49(1)(a) DSGVO). Please be sure to read our risk notices beforehand (cf. General Part/Special Constellation: Consent to Transfer to Third-Party Entities Located in the USA, including the risk notices).
Addition „Company page“: We have linked our company page with this provider on our website. If you click on this link (meaning the link to our company page), you will be taken to our profile. With regard to this processing, we refer to our previous statements on visiting our company page with this provider.
Marketing automation with Pardot (Salesforce).
In a nutshell: In order to communicate with you in an automated manner, such as sending you useful information, we use marketing automation to send automated message (e.g., emails, text messages) to you, evaluate your interactions, and in turn respond to you in an automated manner.
Processing and Third Party Providers in Detail: We use a marketing automation solution. We are happy to describe this processing operation in specific terms: we use the marketing automation solution to apply marketing measures to you, which we have identified and described as such in this Privacy Policy. The provider is Salesforce, Inc. which is represented in Germany by Salesforce.com Germany GmbH, Erika-Mann-Str. 63, 80636 Munich, Germany. You can find more information on data protection at this company at: https://www.salesforce.com/gdpr/overview/. We have entrusted the provider with the processing of your personal data required in this respect in accordance with Article 28(3) DSGVO.
Data processed: We process all data that we use to address you in advertising, as already described in this privacy policy. Furthermore, we use the so-called „tags“ in our communication with you (for example, to process the contract or follow-up emails) and in the delivery of newsletters and webinars. A tag is a labeling of information with additional information, specifications or categories. When tagging, information is associated with appropriate keywords, categories or other parameters that we define in advance. It is important that we use and define these tags in such a way that the provider follows our instructions here.
Third country status: the processing is not prevented by the fact that Salesforce, Inc. has its registered office outside the European Union. This is because in the event that your data is processed outside the USA, we invoke Article 47 DSGVO in conjunction with. Salesforces Processor Binding Corporate Rules for the Processing of Personal Data, cf. https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/Salesforce-Processor-BCR.pdf.
Google Maps.
In a nutshell: In order to show you directions or to display a map for other reasons, we use a map service. We use the tool „Google Maps“ here. The third country data transfer, which cannot be excluded, is justified because the processing only takes place if you consent to it in advance.
Processing and third-party providers in detail: We use the tool described in more detail in the heading from the provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. We are happy to describe the processing procedure in concrete terms: This tool is intended to enable you to determine our location on the basis of an interactive map within the scope of our website and to determine the most favorable route to us for you using the route planner function of this tool. You can find out more about this tool here: https://support.google.com/maps/answer/7576020?hl=de#null.
Data processed: Here, data about the use of our website, your IP address and the address entered for route planning, are transmitted to Google, whereby this takes place directly via the browser you use, so that we have no further influence on this processing. Which data is transferred in detail also depends on whether you use our site as a logged-in user of a Google account. Details on data transfer and use can be found at: https://policies.google.com/privacy?hl=de.
Third country status: The processing is not prevented by the fact that the provider is located outside the European Union. This is because the processing of your personal data via this tool only takes place if you consent to the associated data transfer to the USA (see Article 49(1)(a) DSGVO). Please be sure to read our risk notices beforehand (cf. General Part/Special Constellation: Consent to Transfer to Third-Party Providers Located in the USA, including the risk notices).
Processing operations for which your consent is required (primary legal basis: Article 6 (1) sentence 1 lit. f DSGVO)
General information on the purpose and legal basis of the processing operations described below.
(1) The purpose of the processing operations described below is described separately for each tool. It is the decisive justification for our legitimate interest in the processing.
(2) The legal basis for the respective data processing is Article 6 (1) sentence 1 lit. f DSGVO. According to this provision, the processing of your personal data is also permitted without your consent if it is necessary for the protection of our legitimate interests or those of a third party, unless your interests or fundamental rights and freedoms requiring the protection of personal data are overridden.
General information on the retention period regarding the data within the scope of the processing operations described below.
(1) ) We store the data until our purpose has ceased to apply, which is always the case if you have raised a justified objection (cf. „Note on the right to object“).
(2) This does not include all data for which a reason for storage other than a legitimate interest applies. In particular, we store the information from which our legitimate interest arises for three years, beginning on December 31 of the calendar year in which you declared your objection or the interest ceased to exist. This longer storage is on the one hand regulated by Article 6 (1) sentence 1 lit. c DSGVO in conjunction with. Article 5(2) DSGVO, as we are accountable with regard to the lawfulness of the data processing. This is additionally justified by Article 6(1) sentence 1 lit. f DSGVO, as it is in our legitimate interest to defend ourselves against claims for damages based on the fact that no legitimate interest would have existed. This interest in storage exists at least until the expiry of the statutory limitation period (§§ 195, 199 BGB).
Notes on the right of objection
(1) Insofar as we base data processing in the following privacy policy on Article 6 (1) sentence 1 lit. f DSGVO, i.e. on a legitimate interest in the processing, you always have the right to object to the processing. As a rule, this is possible by sending an informal message to us (see „Responsible party“ above). If the objection is justified, we will stop the processing.
(2) If the legitimate interest is based on the interest in direct advertising or promotional targeting, your objection is always justified, provided you are identified.
Soliciting contractors.
Very briefly: Provided that you conclude a contract with us, be it a paid or free contract, there is the possibility that we will provide you with useful information by e-mail. You can object to this at any time, by informal message to us.
Processing and Third Party Providers in Detail: We process your email address and name to send you useful information by email at regular or irregular intervals. Furthermore, we store the information that a contractual relationship exists or existed between us in order to be able to prove our legitimate interest.
Data processed: We store and use your e-mail address, your name and the status data regarding the contractual relationship.
Special note on the right to object: You can object to the use of your data for this purpose at any time; for example, by sending us an informal message (contact channels can be found at the beginning of the privacy policy and in our imprint). In particular, you can object without incurring any costs other than the transmission costs according to the prime rates.
Informational use of the website.
In a nutshell: When you visit our website, so-called transient cookies briefly process data from you in order to display the website to you.
Processing in detail: We use so-called transient cookies on our website. These include, in particular, session cookies. These store a so-called session ID, with which various requests of the visitors browser can be assigned to the common session. This allows the visitor computer to be recognized when the visitor returns to your website.
Data processed: IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred in each case, website from which the request comes, browser, operating system and its interface, language and version of the browser software. We receive this data via cookies and directly from your browser.
Rights Management.
In a nutshell: When you assert rights against us (e.g., request for information), we process the related communication data to be able to prove later how we handled your claims.
Processing in detail: You have a number of rights vis-à-vis us (see General section, Rights of visitors to the website). If you assert rights against us, we process the related contact, communication and transaction data. We process your data as follows:
- we receive your request.
- we examine your request.
- if justified, we comply with your request.
- we store the related data.
Addition to the legal basis: While the processing in the sense of the intention paragraphs 1 to 3 is justified by Article 6(1) sentence 1 lit. c DSGVO (we are obliged to process your concerns as a rule from the DSGVO), the purpose of the storage (paragraph 2 clause 4) is that we store the data in order to be able to defend ourselves later against claims from your side. This is also our legitimate interest. We store your data until the end of the third calendar year following your request/input (cf. Article 6(1) sentence 1 lit. f DSGVO in conjunction with Sections 193, 195 BGB).
Data processed: Name, contact details and communication content.
Reviews via Kununu.
In a nutshell: In certain cases, you have the option to rate us online. For this purpose, we and a rating provider process the necessary data from you.
Processing in detail: We have integrated a rating tool at this website to enable you to rate us and our services. Insofar as we use this tool, three processing operations are to be distinguished:
- First, we graphically display a plugin on our website along with ratings. As soon as you click on the plugin, the information that you have visited our website and that you have clicked on the plugin from there is transmitted to the provider of the rating tool, i.e. the web server automatically saves a so-called server log file, which contains your IP address, date and time of the retrieval, transferred data volume and the requesting provider (access data) and documents the retrieval. This access data is not evaluated and is automatically overwritten at the latest seven days after the end of your visit to the site.
- As soon as you submit a rating about us and our services in the event of a purchase on the site, the provider of the rating tool processes your data for the purpose of displaying the rating and, if necessary, for other purposes about which this provider must inform you.
- In the case of your rating, if shared by you, your name and email address as well as the customer ID of the order process will be transmitted to the rating tool provider, who will check the transmitted rating and publish it on our website.
Addition to the legal basis: The relevant legal basis in each case for processing operations (see previous paragraph) is lit.
- Article 6(1) sentence 1 lit. f DSGVO, whereby our legitimate interest follows from the fact that we grant you the voluntary opportunity, irrelevant for the contract design, to evaluate us and our performance independently of our sphere of influence, for details on this legal basis see above.
- . that legal basis which the provider of the evaluation tool designates to you, because in this respect he is the responsible party and no longer us,
- whichever legal basis the rating tool provider designates to you, because it is the responsible party in this respect and no longer us.
Data that will be processed: : Name, rating content.