Legal Notice &Datenschutz.

Types of data processed

• Master data (e.g. personal master data, names or addresses).
• Contact data (e.g. email, telephone numbers).
• Content data (e.g. text entries, photographs, videos).
• Usage data (e.g. pages visited, interest in content, access times).
• Meta and communication data (e.g. device information, IP addresses).

Categories of data subjects

Visitors and users of the online offering (hereinafter we also refer to the data subjects collectively as “users”).

Purpose of processing

• Provision of the online offering, its functions and content.
• Responding to contact enquiries and communicating with users.
• Security measures.
• Reach measurement and marketing.

Terms used

“Personal data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier.

“Processing” means any operation performed on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data.

“Controller” means the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data. A “processor” processes personal data on behalf of the controller.

Relevant legal bases

In accordance with Art. 13 GDPR we inform you of the legal bases of our data processing. For users within the scope of the GDPR, i.e. the EU and the EEA, the following applies unless the legal basis is stated separately in this privacy policy:

• Consent: Art. 6(1)(a) and Art. 7 GDPR.
• Performance of our services, contractual measures and responses to enquiries: Art. 6(1)(b) GDPR.
• Compliance with our legal obligations: Art. 6(1)(c) GDPR.
• Protection of vital interests: Art. 6(1)(d) GDPR.
• Safeguarding our legitimate interests: Art. 6(1)(f) GDPR.
• Processing for other purposes: Art. 6(4) GDPR; special categories of data: Art. 9(2) GDPR.

Security measures

Taking into account the state of the art, the costs of implementation and the nature, scope and purposes of the processing as well as the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access, input, disclosure and separation of the data. We have also established procedures for exercising data subject rights, erasing data and responding to threats, and we take data protection into account as early as the selection of hardware, software and procedures.

Cooperation with processors, joint controllers and third parties

Where we disclose data to other persons and companies, transmit data to them or otherwise grant them access, this is done only on the basis of a legal permission, with the consent of users, where a legal obligation provides for it, or on the basis of our legitimate interests (e.g. when using agents or web hosts).

Where we disclose or transmit data to other companies within our group, this is done in particular for administrative purposes as a legitimate interest and, beyond that, on a basis that complies with the legal requirements.

Transfers to third countries

Where we process data in a third country, i.e. outside the EU, the EEA or Switzerland, or where this occurs in the context of using third-party services, this is done only in order to fulfil our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. Processing in a third country takes place only where the legal requirements are met, for example on the basis of an adequacy decision or recognised contractual guarantees.

Rights of data subjects

• You have the right to request confirmation as to whether data concerning you are being processed, to obtain information about such data and to receive a copy of the data.
• You have the right to request the completion or rectification of data concerning you.
• You have the right to request that data concerning you be erased without delay or that the processing be restricted.
• You have the right to receive the data you have provided to us and to request its transmission to other controllers.
• You have the right to lodge a complaint with the competent supervisory authority.

Right of withdrawal and right to object

You have the right to withdraw consent you have given with effect for the future. You may object to the future processing of data concerning you at any time, in particular to processing for the purposes of direct marketing.

Cookies

“Cookies” are small files stored on users’ devices in which various information can be saved. Cookies are primarily used to store information about a user during or after a visit to an online offering. Temporary cookies are deleted when the user closes the browser; permanent cookies remain stored beyond that.

Users can object to the use of cookies for reach measurement and advertising purposes via the opt-out pages of the Network Advertising Initiative, the US website aboutads.info/choices or the European website youronlinechoices.com. Cookies can also be deactivated in the browser settings, which may restrict the functions of this online offering.

Erasure of data

The data processed by us are erased in accordance with the legal requirements as soon as the consent permitting the processing is withdrawn or other permissions cease to apply. Where data are not erased because they are required for other, legally permissible purposes, their processing is restricted. This applies in particular to data that must be retained for commercial or tax law reasons.

Contacting us

When you contact us, for example via the contact form, by email, telephone or social media, your details are processed in order to handle the enquiry pursuant to Art. 6(1)(b) GDPR within contractual or pre-contractual relationships and Art. 6(1)(f) GDPR for other enquiries. Your details may be stored in a customer relationship management system. We erase enquiries once they are no longer required and review the necessity every two years; statutory retention obligations remain unaffected.

Administration, accounting and office organisation

We process data within the scope of administrative tasks, the organisation of our business, financial accounting and compliance with legal obligations such as archiving, on the basis of Art. 6(1)(c) and Art. 6(1)(f) GDPR. In this context we disclose data to tax authorities, advisers such as tax consultants and auditors as well as payment service providers, where this is necessary.

Hosting and access data

The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services as well as security and technical maintenance services. In doing so, we or our hosting provider process master data, contact data, content data, contract data, usage data, meta and communication data of users of this online offering on the basis of our legitimate interests in an efficient and secure provision of this online offering pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR.

We collect data on every access to the server on which this service is located (server log files). Access data include the name of the page or file retrieved, the date and time of retrieval, the volume of data transferred, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL, IP address and the requesting provider. Log file information is stored for a maximum of seven days for security reasons and then deleted, unless it must be retained for evidentiary purposes.

Newsletter

We send newsletters and electronic notifications containing promotional information only with the consent of the recipients or on the basis of a legal permission. Subscription takes place by means of a double opt-in procedure, i.e. you receive an email asking you to confirm your subscription. Subscriptions are logged in order to be able to prove the process. You can cancel the receipt of our newsletter at any time; a corresponding link is contained in every newsletter.

Reach measurement and advertising services

On the basis of our legitimate interests in the analysis, optimisation and economic operation of our online offering pursuant to Art. 6(1)(f) GDPR, or on the basis of your consent, we may use services such as Google Analytics, Google Ads and the Facebook pixel. These services use cookies and process usage data, in particular the shortened IP address, in pseudonymised form in order to measure the use of our online offering and to display advertising that matches the interests of users. Further information and objection options can be found in the privacy policies of the respective providers at policies.google.com/privacy and facebook.com/policy.

Applications

We process applicant data only for the purposes of the application process pursuant to Art. 6(1)(b) and Art. 6(1)(f) GDPR. The necessary applicant data follow from the respective job description and generally include personal details, contact details and the documents belonging to the application. Please note that emails are generally not sent in encrypted form. If an application is unsuccessful, the data are erased after six months, unless there are grounds for longer retention.