Copyright ©2023 | All Rights Reserved
General information
The following information will provide
you with an easy to navigate overview of what will happen with your
personal data when you visit this website. The term “personal data”
comprises all data that can be used to personally identify you. For
detailed information about the subject matter of data protection,
please consult our Data Protection Declaration, which we have
included beneath this copy.
Data recording on this website
Who is the responsible party for the recording of data
on this website (i.e., the “controller”)?
The data on this
website is processed by the operator of the website, whose contact
information is available under section “Information about the
responsible party (referred to as the “controller” in the GDPR)” in
this Privacy Policy.
How do we record your data?
We collect your data as a result of your sharing of your data
with us. This may, for instance be information you enter into our
contact form. Other data shall be recorded by our IT systems
automatically or after you consent to its recording during your
website visit. This data comprises primarily technical information
(e.g., web browser, operating system, or time the site was
accessed). This information is recorded automatically when you
access this website.
What are the purposes we use your
data for?
A portion of the information is generated to
guarantee the error free provision of the website. Other data may be
used to analyze your user patterns.
What rights do you
have as far as your information is concerned?
You have the
right to receive information about the source, recipients, and
purposes of your archived personal data at any time without having
to pay a fee for such disclosures. You also have the right to demand
that your data are rectified or eradicated. If you have consented to
data processing, you have the option to revoke this consent at any
time, which shall affect all future data processing. Moreover, you
have the right to demand that the processing of your data be
restricted under certain circumstances. Furthermore, you have the
right to log a complaint with the competent supervising agency.
Please do not hesitate to contact us at any time if you have
questions about this or any other data protection related issues.
Analysis
tools and tools provided by third parties
There is a
possibility that your browsing patterns will be statistically
analyzed when your visit this website. Such analyses are performed
primarily with what we refer to as analysis programs. For detailed
information about these analysis programs please consult our Data
Protection Declaration below.
We are hosting the content of our website at the following
providers:
Amazon Web Services (AWS)
The provider is
the Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, 1855
Luxembourg (hereinafter referred to as “AWS”). When you visit our
website, your personal data will be processed on AWS servers. This may
also result in the transfer of personal data to the parent company of
AWS in the United States. The transfer of data to the US is based on
the EU’s standard contractual clauses. For details please consult:
https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/.
For more information, please see the AWS Data Privacy Policy:
https://aws.amazon.com/de/privacy/?nc1=f_pr. AWS is used on the basis
of Art. 6(1)(f) GDPR. We have a legitimate interest in a depiction of
our website that is as reliable as possible. If appropriate consent
has been obtained, the processing is carried out exclusively on the
basis of Art. 6(1)(a) GDPR and § 25 (1) TTDSG, insofar the consent
includes the storage of cookies or the access to information in the
user’s end device (e.g., device fingerprinting) within the meaning of
the TTDSG. This consent can be revoked at any time.
Data
processing
We have concluded a data processing agreement (DPA)
for the use of the above-mentioned service. This is a contract
mandated by data privacy laws that guarantees that they process
personal data of our website visitors only based on our instructions
and in compliance with the GDPR.
Strato
The provider
is Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin (hereinafter
referred to as “Strato”). When you visit our website, Strato records
various logfiles, including your IP addresses. For more information,
please consult the Strato Data Privacy Policy:
https://www.strato.de/datenschutz/. Strato is used on the basis of
Art. 6(1)(f) GDPR. We have a legitimate interest in a depiction of our
website that is as reliable as possible. If appropriate consent has
been obtained, the processing is carried out exclusively on the basis
of Art. 6(1)(a) GDPR and § 25 (1) TTDSG, insofar the consent includes
the storage of cookies or the access to information in the user’s end
device (e.g., device fingerprinting) within the meaning of the TTDSG.
This consent can be revoked at any time.
Data processing
We
have concluded a data processing agreement (DPA) for the use of the
above-mentioned service. This is a contract mandated by data privacy
laws that guarantees that they process personal data of our website
visitors only based on our instructions and in compliance with the
GDPR.
Webflow
The provider is the Webflow, Inc., 398
11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter
referred to as “Webflow”). When you visit our website, Webflow records
various logfiles, including your IP address. Webflow is a tool for the
creation and hosting of websites. Webflow stores cookies or other
recognition technologies that are required for the depiction of the
site, for the provision of certain website functions and to guarantee
its security (necessary cookies). For details, please consult the data
privacy policy of Webflow:
https://webflow.com/legal/eu-privacy-policy. We use Webflow on the
basis of Art.6(1)(f) GDPR. We have a legitimate interest in ensuring
that our website is depicted as reliable as possible. If appropriate
consent has been obtained, the processing is carried out exclusively
on the basis of Art. 6(1)(a) GDPR and § 25 (1) TTDSG, insofar the
consent includes the storage of cookies or the access to information
in the user’s end device (e.g., device fingerprinting) within the
meaning of the TTDSG. This consent can be revoked at any time. The
transfer of data to the United States is based on the standard
contract clauses of the EU Commission. For details, please go to:
https://webflow.com/legal/eu-privacy-policy.
Data processing
We have concluded a data processing agreement (DPA) for the use
of the above-mentioned service. This is a contract mandated by data
privacy laws that guarantees that they process personal data of our
website visitors only based on our instructions and in compliance with
the GDPR.
Cloudflare
We use the “Cloudflare” service
provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA
94107, USA. (hereinafter referred to as “Cloudflare”). Cloudflare
offers a content delivery network with DNS that is available
worldwide. As a result, the information transfer that occurs between
your browser and our website is technically routed via Cloudflare’s
network. This enables Cloudflare to analyze data transactions between
your browser and our website and to work as a filter between our
servers and potentially malicious data traffic from the Internet. In
this context, Cloudflare may also use cookies or other technologies
deployed to recognize Internet users, which shall, however, only be
used for the herein described purpose. The use of Cloudflare is based
on our legitimate interest in a provision of our website offerings
that is as error free and secure as possible (Art. 6(1)(f) GDPR). Data
transmission to the US is based on the Standard Contractual Clauses
(SCC) of the European Commission. Details can be found here:
https://www.cloudflare.com/privacypolicy/. For more information on
Cloudflare’s security precautions and data privacy policies, please
follow this link: https://www.cloudflare.com/privacypolicy/.
Data
processing
We have concluded a data processing agreement (DPA)
for the use of the above-mentioned service. This is a contract
mandated by data privacy laws that guarantees that they process
personal data of our website visitors only based on our instructions
and in compliance with the GDPR.
Amazon CloudFront CDN
We use the Content Delivery Network Amazon CloudFront CDN. The
provider is Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy,
L-1855, Luxembourg (hereinafter referred to as “Amazon”). Amazon
CloudFront CDN is a globally distributed Content Delivery Network.
During these transactions, the information transfer between your
browser and our website is technically routed via the Content Delivery
Network. This enables us to boost the global availability and
performance capabilities of our website. The use of Amazon CloudFront
CDN is based on our legitimate interest in keeping the presentation of
our web services as error free and secure as possible (Art. 6(1)(f)
GDPR). The data transfer to the United States is based on the Standard
Contract Clauses of the EU Commission. You can find the details here:
https://aws.amazon.com/de/blogs/security/aws-gdpr-data-processing-addendum/.
For more information on Amazon CloudFront CDN please follow this link:
https://d1.awsstatic.com/legal/privacypolicy/AWS_Privacy_Notice__German_Translation.pdf.
Data protection
The operators of this website and its pages take
the protection of your personal data very seriously. Hence, we handle
your personal data as confidential information and in compliance with
the statutory data protection regulations and this Data Protection
Declaration. Whenever you use this website, a variety of personal
information will be collected. Personal data comprises data that can
be used to personally identify you. This Data Protection Declaration
explains which data we collect as well as the purposes we use this
data for. It also explains how, and for which purpose the information
is collected. We herewith advise you that the transmission of data via
the Internet (i.e., through e-mail communications) may be prone to
security gaps. It is not possible to completely protect data against
third-party access.
Information about the responsible party
(referred to as the “controller” in the GDPR)
The data
processing controller on this website is:
CO2OPT GmbH
Am
Sandtorkai 32
20457 HamburgPhone: +49 (0) 40 6077998 96
E-mail:
info@co2opt.com
The controller is the natural person or
legal entity that single-handedly or jointly with others makes
decisions as to the purposes of and resources for the processing of
personal data (e.g., names, e-mail addresses, etc.).
Storage
duration
Unless a more specific storage period has been
specified in this privacy policy, your personal data will remain with
us until the purpose for which it was collected no longer applies. If
you assert a justified request for deletion or revoke your consent to
data processing, your data will be deleted, unless we have other
legally permissible reasons for storing your personal data (e.g., tax
or commercial law retention periods); in the latter case, the deletion
will take place after these reasons cease to apply.
General
information on the legal basis for the data processing on this website
If you have consented to data processing, we process your
personal data on the basis of Art. 6(1)(a) GDPR or Art. 9 (2)(a) GDPR,
if special categories of data are processed according to Art. 9 (1)
DSGVO. In the case of explicit consent to the transfer of personal
data to third countries, the data processing is also based on Art. 49
(1)(a) GDPR. If you have consented to the storage of cookies or to the
access to information in your end device (e.g., via device
fingerprinting), the data processing is additionally based on § 25 (1)
TTDSG. The consent can be revoked at any time. If your data is
required for the fulfillment of a contract or for the implementation
of pre-contractual measures, we process your data on the basis of Art.
6(1)(b) GDPR. Furthermore, if your data is required for the
fulfillment of a legal obligation, we process it on the basis of Art.
6(1)(c) GDPR. Furthermore, the data processing may be carried out on
the basis of our legitimate interest according to Art. 6(1)(f) GDPR.
Information on the relevant legal basis in each individual case is
provided in the following paragraphs of this privacy policy.
Information
on data transfer to the USA and other non-EU countries
Among
other things, we use tools of companies domiciled in the United States
or other from a data protection perspective non-secure non-EU
countries. If these tools are active, your personal data may
potentially be transferred to these non-EU countries and may be
processed there. We must point out that in these countries, a data
protection level that is comparable to that in the EU cannot be
guaranteed. For instance, U.S. enterprises are under a mandate to
release personal data to the security agencies and you as the data
subject do not have any litigation options to defend yourself in
court. Hence, it cannot be ruled out that U.S. agencies (e.g., the
Secret Service) may process, analyze, and permanently archive your
personal data for surveillance purposes. We have no control over these
processing activities.Revocation of your consent to the processing of
data
A wide range of data processing transactions are possible
only subject to your express consent. You can also revoke at any time
any consent you have already given us. This shall be without prejudice
to the lawfulness of any data collection that occurred prior to your
revocation.
Right to object to the collection of data in special
cases; right to object to direct advertising (Art. 21 GDPR)
IN
THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F)
GDPR, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF
YOUR PERSONAL DATA BASED ON GROUNDS ARISING FROM YOUR UNIQUE
SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE
PROVISIONS. TO DETERMINE THE LEGAL BASIS, ON WHICH ANY PROCESSING OF
DATA IS BASED, PLEASE CONSULT THIS DATA PROTECTION DECLARATION. IF YOU
LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL
DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION
WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA, THAT OUTWEIGH YOUR
INTERESTS, RIGHTS AND FREEDOMS OR IF THE PURPOSE OF THE PROCESSING IS
THE CLAIMING, EXERCISING OR DEFENCE OF LEGAL ENTITLEMENTS (OBJECTION
PURSUANT TO ART. 21(1) GDPR). IF YOUR PERSONAL DATA IS BEING PROCESSED
IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT
TO THE PROCESSING OF YOUR AFFECTED PERSONAL DATA FOR THE PURPOSES OF
SUCH ADVERTISING AT ANY TIME. THIS ALSO APPLIES TO PROFILING TO THE
EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT ADVERTISING. IF YOU
OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR
DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21(2)
GDPR).
Right to log a complaint with the competent
supervisory agency
In the event of violations of the GDPR, data
subjects are entitled to log a complaint with a supervisory agency, in
particular in the member state where they usually maintain their
domicile, place of work or at the place where the alleged violation
occurred. The right to log a complaint is in effect regardless of any
other administrative or court proceedings available as legal
recourses.
Right to data portability
You have the
right to have data that we process automatically on the basis of your
consent or in fulfillment of a contract handed over to you or to a
third party in a common, machine-readable format. If you should demand
the direct transfer of the data to another controller, this will be
done only if it is technically feasible.
Information
about, rectification and eradication of data
Within the scope of
the applicable statutory provisions, you have the right to demand
information about your archived personal data, their source and
recipients as well as the purpose of the processing of your data at
any time. You may also have a right to have your data rectified or
eradicated. If you have questions about this subject matter or any
other questions about personal data, please do not hesitate to contact
us at any time.
Right to demand processing restrictions
You have the right to demand the imposition of restrictions as
far as the processing of your personal data is concerned. To do so,
you may contact us at any time. The right to demand restriction of
processing applies in the following cases: In the event that you
should dispute the correctness of your data archived by us, we will
usually need some time to verify this claim. During the time that this
investigation is ongoing, you have the right to demand that we
restrict the processing of your personal data. If the processing of
your personal data was/is conducted in an unlawful manner, you have
the option to demand the restriction of the processing of your data
instead of demanding the eradication of this data. If we do not need
your personal data any longer and you need it to exercise, defend or
claim legal entitlements, you have the right to demand the restriction
of the processing of your personal data instead of its eradication. If
you have raised an objection pursuant to Art. 21(1) GDPR, your rights
and our rights will have to be weighed against each other. As long as
it has not been determined whose interests prevail, you have the right
to demand a restriction of the processing of your personal data. If
you have restricted the processing of your personal data, these data –
with the exception of their archiving – may be processed only subject
to your consent or to claim, exercise or defend legal entitlements or
to protect the rights of other natural persons or legal entities or
for important public interest reasons cited by the European Union or a
member state of the EU.
SSL and/or TLS encryption
For security reasons and to protect the transmission of
confidential content, such as purchase orders or inquiries you submit
to us as the website operator, this website uses either an SSL or a
TLS encryption program. You can recognize an encrypted connection by
checking whether the address line of the browser switches from
“http://” to “https://” and also by the appearance of the lock icon in
the browser line. If the SSL or TLS encryption is activated, data you
transmit to us cannot be read by third parties.
Rejection of
unsolicited e-mails
We herewith object to the use of contact
information published in conjunction with the mandatory information to
be provided in our Site Notice to send us promotional and information
material that we have not expressly requested. The operators of this
website and its pages reserve the express right to take legal action
in the event of the unsolicited sending of promotional information,
for instance via SPAM messages.
Cookies
Our websites and pages use what the industry refers to
as “cookies.” Cookies are small data packages that do not cause any
damage to your device. They are either stored temporarily for the
duration of a session (session cookies) or they are permanently
archived on your device (permanent cookies). Session cookies are
automatically deleted once you terminate your visit. Permanent cookies
remain archived on your device until you actively delete them, or they
are automatically eradicated by your web browser. Cookies can be
issued by us (first-party cookies) or by third-party companies
(so-called third-party cookies). Third-party cookies enable the
integration of certain services of third-party companies into websites
(e.g., cookies for handling payment services). Cookies have a variety
of functions. Many cookies are technically essential since certain
website functions would not work in the absence of these cookies
(e.g., the shopping cart function or the display of videos). Other
cookies may be used to analyze user behavior or for promotional
purposes. Cookies, which are required for the performance of
electronic communication transactions, for the provision of certain
functions you want to use (e.g., for the shopping cart function) or
those that are necessary for the optimization (required cookies) of
the website (e.g., cookies that provide measurable insights into the
web audience), shall be stored on the basis of Art. 6(1)(f) GDPR,
unless a different legal basis is cited. The operator of the website
has a legitimate interest in the storage of required cookies to ensure
the technically error-free and optimized provision of the operator’s
services. If your consent to the storage of the cookies and similar
recognition technologies has been requested, the processing occurs
exclusively on the basis of the consent obtained (Art. 6(1)(a) GDPR
and § 25 (1) TTDSG); this consent may be revoked at any time. You have
the option to set up your browser in such a manner that you will be
notified any time cookies are placed and to permit the acceptance of
cookies only in specific cases. You may also exclude the acceptance of
cookies in certain cases or in general or activate the delete-function
for the automatic eradication of cookies when the browser closes. If
cookies are deactivated, the functions of this website may be limited.
Which cookies and services are used on this website can be found in
this privacy policy.
Contact form
If you submit
inquiries to us via our contact form, the information provided in the
contact form as well as any contact information provided therein will
be stored by us in order to handle your inquiry and in the event that
we have further questions. We will not share this information without
your consent. The processing of these data is based on Art. 6(1)(b)
GDPR, if your request is related to the execution of a contract or if
it is necessary to carry out pre-contractual measures. In all other
cases the processing is based on our legitimate interest in the
effective processing of the requests addressed to us (Art. 6(1)(f)
GDPR) or on your agreement (Art. 6(1)(a) GDPR) if this has been
requested; the consent can be revoked at any time. The information you
have entered into the contact form shall remain with us until you ask
us to eradicate the data, revoke your consent to the archiving of data
or if the purpose for which the information is being archived no
longer exists (e.g., after we have concluded our response to your
inquiry). This shall be without prejudice to any mandatory legal
provisions, in particular retention periods.
Request by e-mail,
telephone, or fax
If you contact us by e-mail, telephone or fax,
your request, including all resulting personal data (name, request)
will be stored and processed by us for the purpose of processing your
request. We do not pass these data on without your consent. These data
are processed on the basis of Art. 6(1)(b) GDPR if your inquiry is
related to the fulfillment of a contract or is required for the
performance of pre-contractual measures. In all other cases, the data
are processed on the basis of our legitimate interest in the effective
handling of inquiries submitted to us (Art. 6(1)(f) GDPR) or on the
basis of your consent (Art. 6(1)(a) GDPR) if it has been obtained; the
consent can be revoked at any time. The data sent by you to us via
contact requests remain with us until you request us to delete, revoke
your consent to the storage or the purpose for the data storage lapses
(e.g. after completion of your request). Mandatory statutory
provisions - in particular statutory retention periods - remain
unaffected.
Calendly
You can make appointments with us on
our website. We use the “Calendly” tool for booking appointments. The
provider is Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia
30363, USA (hereinafter “Calendly”). To book an appointment, enter the
requested data and the desired date in the screen provided. The data
entered will be used for planning, executing and, if necessary, for
the follow-up of the appointment. The appointment data is stored for
us on the servers of Calendly, whose privacy policy can be viewed
here: https://calendly.com/de/pages/privacy. The data you have entered
will remain with us until you ask us to delete it, revoke your consent
for storage or the purpose for which the data was stored ceases to
apply. Mandatory legal provisions, in particular retention periods,
remain unaffected. The legal basis for data processing is Art. 6(1)(f)
GDPR. The website operator has a justified interest in making
appointments with interested parties and customers in as uncomplicated
a manner as possible. If appropriate consent has been obtained, the
processing is carried out exclusively on the basis of Art. 6(1)(a)
GDPR and § 25 (1) TTDSG, insofar the consent includes the storage of
cookies or the access to information in the user’s end device (e.g.,
device fingerprinting) within the meaning of the TTDSG. This consent
can be revoked at any time. The data transfer to the USA is based on
the standard contractual clauses of the European Commission. Details
can be found here: https://calendly.com/pages/dpa.
Data
processing
We have concluded a data processing agreement (DPA)
for the use of the above-mentioned service. This is a contract
mandated by data privacy laws that guarantees that they process
personal data of our website visitors only based on our instructions
and in compliance with the GDPR.
Hubspot CRM
We use
Hubspot CRM on this website. The provider is Hubspot Inc. 25 Street,
Cambridge, MA 02141 USA (hereafter Hubspot CRM). Hubspot CRM enables
us, among other things, to manage existing and potential customers and
customer contacts, to communicate with you and to plan and execute
marketing activities in line with your interests. Hubspot CRM enables
us to capture, sort and analyze customer interactions via email,
social media, or phone across multiple channels. The personal data
collected in this way can be evaluated and used for communication with
the potential customer or marketing measures (e.g., newsletter
mailings). Hubspot CRM also enables us to collect and analyze the user
behavior of our contacts on our website. The use of Hubspot CRM is
based on Art. 6(1)(f) GDPR. The website operator has a legitimate
interest in the most efficient customer management and customer
communication. If appropriate consent has been obtained, the
processing is carried out exclusively on the basis of Art. 6(1)(a)
GDPR and § 25 (1) TTDSG, insofar the consent includes the storage of
cookies or the access to information in the user’s end device (e.g.,
device fingerprinting) within the meaning of the TTDSG. This consent
can be revoked at any time. For details, please refer to Hubspot’s
privacy policy: https://legal.hubspot.com/de/privacy-policy. Data
transmission to the US is based on the standard contractual clauses of
the EU Commission. Details can be found here:
https://www.hubspot.de/data-privacy/privacy-shield.
Data
processing
We have concluded a data processing agreement (DPA)
for the use of the above-mentioned service. This is a contract
mandated by data privacy laws that guarantees that they process
personal data of our website visitors only based on our instructions
and in compliance with the GDPR.
LinkedIn
This website uses elements of the LinkedIn network. The
provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton
Place, Dublin 2, Ireland. Any time you access a page of this website
that contains elements of LinkedIn, a connection to LinkedIn’s servers
is established. LinkedIn is notified that you have visited this
website with your IP address. If you click on LinkedIn’s “Recommend”
button and are logged into your LinkedIn account at the time, LinkedIn
will be in a position to allocate your visit to this website to your
user account. We have to point out that we as the provider of the
websites do not have any knowledge of the content of the transferred
data and its use by LinkedIn. If your approval (consent) has been
obtained the use of the abovementioned service shall occur on the
basis of Art. 6 (1)(a) GDPR and § 25 TTDSG (German Telecommunications
Act). Such consent may be revoked at any time. If your consent was not
obtained, the use of the service will occur on the basis of our
legitimate interest in making our information as comprehensively
visible as possible on social media. Data transmission to the US is
based on the Standard Contractual Clauses (SCC) of the European
Commission. Details can be found here:
https://www.linkedin.com/help/linkedin/answer/62538/datenubertragung-aus-der-eu-dem-ewr-und-der-schweiz?lang=en.
For further information on this subject, please consult LinkedIn’s
Data Privacy Declaration at:
https://www.linkedin.com/legal/privacy-policy.
Google Analytics
This website uses functions of the web analysis
service Google Analytics. The provider of this service is Google
Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4,
Ireland. Google Analytics enables the website operator to analyze the
behavior patterns of website visitors. To that end, the website
operator receives a variety of user data, such as pages accessed, time
spent on the page, the utilized operating system and the user’s
origin. This data is summarized in a user-ID and assigned to the
respective end device of the website visitor. Furthermore, Google
Analytics allows us to record your mouse and scroll movements and
clicks, among other things. Google Analytics uses various modeling
approaches to augment the collected data sets and uses machine
learning technologies in data analysis.
Google Analytics uses
technologies that make the recognition of the user for the purpose of
analyzing the user behavior patterns (e.g., cookies or device
fingerprinting). The website use information recorded by Google is, as
a rule transferred to a Google server in the United States, where it
is stored. The use of these services occurs on the basis of your
consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG. You may
revoke your consent at any time. Data transmission to the US is based
on the Standard Contractual Clauses (SCC) of the European Commission.
Details can be found here:
https://privacy.google.com/businesses/controllerterms/mccs/. Browser
plug-in
You can prevent the recording and processing of your
data by Google by downloading and installing the browser plugin
available under the following link:
https://tools.google.com/dlpage/gaoptout?hl=en. For more information
about the handling of user data by Google Analytics, please consult
Google’s Data Privacy Declaration at:
https://support.google.com/analytics/answer/6004245?hl=en.Contract
data processing
We have executed a contract data processing
agreement with Google and are implementing the stringent provisions of
the German data protection agencies to the fullest when using Google
Analytics.
Newsletter data
If you would like to subscribe to the newsletter
offered on this website, we will need from you an e-mail address as
well as information that allow us to verify that you are the owner of
the e-mail address provided and consent to the receipt of the
newsletter. No further data shall be collected or shall be collected
only on a voluntary basis. We shall use such data only for the sending
of the requested information and shall not share such data with any
third parties. The processing of the information entered into the
newsletter subscription form shall occur exclusively on the basis of
your consent (Art. 6(1)(a) GDPR). You may revoke the consent you have
given to the archiving of data, the e-mail address, and the use of
this information for the sending of the newsletter at any time, for
instance by clicking on the “Unsubscribe” link in the newsletter. This
shall be without prejudice to the lawfulness of any data processing
transactions that have taken place to date. The data deposited with us
for the purpose of subscribing to the newsletter will be stored by us
until you unsubscribe from the newsletter or the newsletter service
provider and deleted from the newsletter distribution list after you
unsubscribe from the newsletter or after the purpose has ceased to
apply. We reserve the right to delete or block e-mail addresses from
our newsletter distribution list at our own discretion within the
scope of our legitimate interest in accordance with Art. 6(1)(f) GDPR.
Data stored for other purposes with us remain unaffected. After you
unsubscribe from the newsletter distribution list, your e-mail address
may be stored by us or the newsletter service provider in a blacklist,
if such action is necessary to prevent future mailings. The data from
the blacklist is used only for this purpose and not merged with other
data. This serves both your interest and our interest in complying
with the legal requirements when sending newsletters (legitimate
interest within the meaning of Art. 6(1)(f) GDPR). The storage in the
blacklist is indefinite. You may object to the storage if your
interests outweigh our legitimate interest.
YouTube with expanded data protection integration
Our website
embeds videos of the website YouTube. The website operator is Google
Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4,
Ireland. We use YouTube in the expanded data protection mode.
According to YouTube, this mode ensures that YouTube does not store
any information about visitors to this website before they watch the
video. Nevertheless, this does not necessarily mean that the sharing
of data with YouTube partners can be ruled out as a result of the
expanded data protection mode. For instance, regardless of whether you
are watching a video, YouTube will always establish a connection with
the Google DoubleClick network. As soon as you start to play a YouTube
video on this website, a connection to YouTube’s servers will be
established. As a result, the YouTube server will be notified, which
of our pages you have visited. If you are logged into your YouTube
account while you visit our site, you enable YouTube to directly
allocate your browsing patterns to your personal profile. You have the
option to prevent this by logging out of your YouTube account.
Furthermore, after you have started to play a video, YouTube will be
able to place various cookies on your device or comparable
technologies for recognition (e.g. device fingerprinting). In this way
YouTube will be able to obtain information about this website’s
visitors. Among other things, this information will be used to
generate video statistics with the aim of improving the user
friendliness of the site and to prevent attempts to commit fraud.
Under certain circumstances, additional data processing transactions
may be triggered after you have started to play a YouTube video, which
are beyond our control. The use of YouTube is based on our interest in
presenting our online content in an appealing manner. Pursuant to Art.
6(1)(f) GDPR, this is a legitimate interest. If appropriate consent
has been obtained, the processing is carried out exclusively on the
basis of Art. 6(1)(a) GDPR and § 25 (1) TTDSG, insofar the consent
includes the storage of cookies or the access to information in the
user’s end device (e.g., device fingerprinting) within the meaning of
the TTDSG. This consent can be revoked at any time. For more
information on how YouTube handles user data, please consult the
YouTube Data Privacy Policy under:
https://policies.google.com/privacy?hl=en.
Google Fonts
(local embedding)
This website uses so-called Google Fonts
provided by Google to ensure the uniform use of fonts on this site.
These Google fonts are locally installed so that a connection to
Google’s servers will not be established in conjunction with this
application. For more information on Google Fonts, please follow this
link: https://developers.google.com/fonts/faq and consult Google’s
Data Privacy Declaration under:
https://policies.google.com/privacy?hl=en.
Data processing
We use online conference tools, among other
things, for communication with our customers. The tools we use are
listed in detail below. If you communicate with us by video or audio
conference using the Internet, your personal data will be collected
and processed by the provider of the respective conference tool and by
us. The conferencing tools collect all information that you
provide/access to use the tools (email address and/or your phone
number). Furthermore, the conference tools process the duration of the
conference, start and end (time) of participation in the conference,
number of participants and other “context information” related to the
communication process (metadata). Furthermore, the provider of the
tool processes all the technical data required for the processing of
the online communication. This includes, in particular, IP addresses,
MAC addresses, device IDs, device type, operating system type and
version, client version, camera type, microphone or loudspeaker and
the type of connection. Should content be exchanged, uploaded, or
otherwise made available within the tool, it is also stored on the
servers of the tool provider. Such content includes, but is not
limited to, cloud recordings, chat/ instant messages, voicemail
uploaded photos and videos, files, whiteboards, and other information
shared while using the service. Please note that we do not have
complete influence on the data processing procedures of the tools
used. Our possibilities are largely determined by the corporate policy
of the respective provider. Further information on data processing by
the conference tools can be found in the data protection declarations
of the tools used, and which we have listed below this text.
Purpose and legal bases
The conference tools are
used to communicate with prospective or existing contractual partners
or to offer certain services to our customers (Art. 6(1)(b) GDPR).
Furthermore, the use of the tools serves to generally simplify and
accelerate communication with us or our company (legitimate interest
in the meaning of Art. 6(1)(f) GDPR). Insofar as consent has been
requested, the tools in question will be used on the basis of this
consent; the consent may be revoked at any time with effect from that
date.
Duration of storage
Data collected directly
by us via the video and conference tools will be deleted from our
systems immediately after you request us to delete it, revoke your
consent to storage, or the reason for storing the data no longer
applies. Stored cookies remain on your end device until you delete
them. Mandatory legal retention periods remain unaffected. We have no
influence on the duration of storage of your data that is stored by
the operators of the conference tools for their own purposes. For
details, please directly contact the operators of the conference
tools.
Conference tools used
We employ the
following conference tools:
Zoom
We use Zoom. The provider
of this service is Zoom Communications Inc, San Jose, 55 Almaden
Boulevard, 6th Floor, San Jose, CA 95113, USA. For details on data
processing, please refer to Zoom’s privacy policy:
https://zoom.us/en-us/privacy.html. Data transmission to the US is
based on the Standard Contractual Clauses (SCC) of the European
Commission. Details can be found here:
https://zoom.us/de-de/privacy.html.
Data processing
We have
concluded a data processing agreement (DPA) for the use of the
above-mentioned service. This is a contract mandated by data privacy
laws that guarantees that they process personal data of our website
visitors only based on our instructions and in compliance with the
GDPR.
Microsoft Teams
We use Microsoft Teams. The
provider is the Microsoft Ireland Operations Limited, One Microsoft
Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
For details on data processing, please refer to the Microsoft Teams
privacy policy:
https://privacy.microsoft.com/en-us/privacystatement.
Data
processing
We have concluded a data processing agreement (DPA)
for the use of the above-mentioned service. This is a contract
mandated by data privacy laws that guarantees that they process
personal data of our website visitors only based on our instructions
and in compliance with the GDPR.
Google Meet
We use
Google Meet. The provider is Google Ireland Limited, Gordon House,
Barrow Street, Dublin 4, Ireland. For details on data processing,
please see the Google privacy policy:
https://policies.google.com/privacy?hl=en.
Data processing
We have concluded a data processing agreement (DPA) for the use
of the above-mentioned service. This is a contract mandated by data
privacy laws that guarantees that they process personal data of our
website visitors only based on our instructions and in compliance with
the GDPR.
Handling applicant data
We offer website visitors the
opportunity to submit job applications to us (e.g., via e-mail, via
postal services on by submitting the online job application form).
Below, we will brief you on the scope, purpose and use of the personal
data collected from you in conjunction with the application process.
We assure you that the collection, processing, and use of your data
will occur in compliance with the applicable data privacy rights and
all other statutory provisions and that your data will always be
treated as strictly confidential.
Scope and purpose of
the collection of data
If you submit a job application to us, we
will process any affiliated personal data (e.g., contact and
communications data, application documents, notes taken during job
interviews, etc.), if they are required to make a decision concerning
the establishment or an employment relationship. The legal grounds for
the aforementioned are § 26 BDSG according to German Law (Negotiation
of an Employment Relationship), Art. 6(1)(b) GDPR (General Contract
Negotiations) and – provided you have given us your consent – Art.
6(1)(a) GDPR. You may revoke any consent given at any time. Within our
company, your personal data will only be shared with individuals who
are involved in the processing of your job application. If your job
application should result in your recruitment, the data you have
submitted will be archived on the grounds of § 26 BDSG and Art.
6(1)(b) GDPR for the purpose of implementing the employment
relationship in our data processing system.
Data
Archiving Period
If we are unable to make you a job offer or you
reject a job offer or withdraw your application, we reserve the right
to retain the data you have submitted on the basis of our legitimate
interests (Art. 6(1)(f) GDPR) for up to 6 months from the end of the
application procedure (rejection or withdrawal of the application).
Afterwards the data will be deleted, and the physical application
documents will be destroyed. The storage serves in particular as
evidence in the event of a legal dispute. If it is evident that the
data will be required after the expiry of the 6-month period (e.g.,
due to an impending or pending legal dispute), deletion will only take
place when the purpose for further storage no longer applies. Longer
storage may also take place if you have given your agreement (Article
6(1)(a) GDPR) or if statutory data retention requirements preclude the
deletion.
Admission to the applicant pool
If we do
not make you a job offer, you may be able to join our applicant pool.
In case of admission, all documents and information from the
application will be transferred to the applicant pool in order to
contact you in case of suitable vacancies. Admission to the applicant
pool is based exclusively on your express agreement (Art. 6(1)(a)
GDPR). The submission agreement is voluntary and has no relation to
the ongoing application procedure. The affected person can revoke his
agreement at any time. In this case, the data from the applicant pool
will be irrevocably deleted, provided there are no legal reasons for
storage. The data from the applicant pool will be irrevocably deleted
no later than two years after consent has been granted.
OneDrive
We have integrated OneDrive on this website. The provider is the
Microsoft Ireland Operations Limited, One Microsoft Place, South
County Business Park, Leopardstown, Dublin 18, Ireland (hereinafter
“OneDrive”). OneDrive enables us to include an upload area on our
website where you can upload content. When you upload content, it is
stored on the OneDrive servers. When you access our website, a
connection to OneDrive is also established so that OneDrive can
determine that you have visited our website. The use of OneDrive is
based on Art. 6(1)(f) GDPR. The website operator has a legitimate
interest in a reliable upload area on its website. If the relevant
consent has been requested, processing is carried out exclusively on
the basis of Art. 6(1)(a) GDPR; consent may be revoked at any time.
Data
processing
We have concluded a data processing agreement (DPA)
for the use of the above-mentioned service. This is a contract
mandated by data privacy laws that guarantees that they process
personal data of our website visitors only based on our instructions
and in compliance with the GDPR.